Disclosing Website Vulnerabilities with the Threat of Criminal Prosecution

July 26th, 2010

Another website vulnerability with the threat of criminal prosecution has been in the news. It appears that Goatse Security disclosed that AT&T’s website made the email addresses of iPad owners public by displaying the email address associated with a user if anyone correctly guessed and entered a valid username.

The Wall Street Journal reported that AT&T issued a statement saying “…it would cooperate with any efforts to investigate or prosecute the breach [of its website].” Why would someone be prosecuted for disclosing a threat of identity theft, so a vulnerability could be fixed? A look at several of the incidents alleged to have “gone over the line” show similar or shared characteristics.

With the AT&T iPad episode, the Wall Street Journal reported another expert as saying that Goatse Security “…created a program that exploited the hole, harvesting 114,000 emails of iPad owners.” If this is true, Goatse Security may have built a burglar’s tool which could be prosecuted and evidenced by the sheer number of emails taken.

This might have been overlooked and maybe even responded with a “thank you” by AT&T if Goatse Security had only obtained a half a dozen email addresses; took a screen capture; reported it directly to AT&T; and did not disclose it publicly. According to Ryan Naraine at ZDNet, Google and Mozilla will even pay you for finding vulnerabilities, however, Microsoft will just thank you and give you credit which is also valuable.

One of the problems with disclosing vulnerabilities is that often the vulnerability is not accidentally discovered by normal use of the website as intended by the website owner.  Instead, vulnerabilities are often discovered by people searching for them by the same means as an illegal hacker.

Some characteristics which could be evaluated either by a company wondering if they have been victimized or if they have been given useful information by a good doer, or by a prosecutor in determining whether to prosecute are:

  • Was any software created to identify the vulnerability?
  • Were any private areas of the website penetrated in order to identify the vulnerability?
  • How much data was taken?
  • How much data was needed to identify and report the vulnerability?
  • Was the data disclosed to anyone other than the website owner?
  • Was the vulnerability reported to anyone other than the website owner?
  • If the vulnerability was publicly disclosed, was it publicly disclosed only after the website owner had sufficient time to research the vulnerability, an appropriate fix, and incorporate or distribute the fix?
  • Was the vulnerability reported to the website owner without asking for anything in return?
Bookmark and Share

Posted in Computer Crime | No Comments »

Familial DNA Could Be Coming to Your State Soon

July 13th, 2010

Familial DNA may have just cracked the Grim Sleeper serial killer case in Los Angeles, leading to the arrest of Lonnie Franklin alleged to have killed at least 10 women and one male. Currently, familial DNA is only legal in California and Colorado but with a stunning early success in the Grim Sleeper serial killer case, familial DNA could be coming to your state soon.

Familial DNA will revolutionize criminal investigations by allowing police to solve cold cases; current crimes which would have been unsolvable; and to solve crimes much more quickly. As in the Grim Sleeper case, familial DNA can allow police to focus investigations and locate criminals when the police have a DNA sample from a crime scene which without familial DNA analysis, would have been unidentified. Now, DNA can be connected to a close family member if a family member has DNA on file.

Opponents will argue that familial DNA searches infringe upon constitutional guarantees against unwarranted searches; violate the privacy of family members who have relatives with DNA in the database; and unfairly target blacks because there are many more blacks than whites with DNA samples in the database.

I believe that while the use of familial DNA is an additional intrusion into privacy, its use is far more valuable than its cost to privacy. Not only can the use of familial DNA save many lives in countless future criminal cases (how many people will still be alive just because the Grim Sleeper was caught), but use of familial DNA will be of substantial benefit in preventing innocent people from being convicted. While there may be many more blacks in the DMA database, familial DNA has the ability to save the lives of blacks from both criminals and wrongful convictions. Consider the case of Eddie Lloyd who was wrongfully convicted and other people who were exonerated by the Innocence Project.

Familial DNA analysis itself is not racial.  Criminal defense lawyers know how to deal with DNA issues at trial and the exclusion of DNA evidence which should not be admitted into evidence at trial.

Read information about familial DMA at the Colorado D.A.’s office and STR Analysis

Bookmark and Share

Posted in Investigation | No Comments »

Were You Arrested & Filmed on COPS?

March 1st, 2010

I was watching COPS and saw a segment where a girl was stopped for possible DUI. The police pulled her over, approached her vehicle and told her to get out of the car. They did not smell any alcohol on her breath and suspected that she might be on drugs.

The police officer asked her if she had taken any drugs and she said that she did not. The police officer was not willing to accept that answer and told her several times that she had to tell the truth. After denying taking any drugs several more times, she finally admitted that she took one pill. The police officer than began questioning her as to what kind of drug she took. She was then arrested when she could not produce a prescription.

Of course, just because the police officer told her that she had to tell the truth, she did not have to tell the police officer that she took any drugs or what kind of drugs she took. In fact, she did not have to say anything at all, other than her name and address.

What caught my attention is that I did not see that the police officer had probable cause to stop her vehicle and did not appear to have probable cause to search her vehicle. I’m sure that the TV show COPS did not show the entire videotape and there may have been probable cause, but I did not see it. If the police officer did not have probable cause, the criminal charges will be dismissed.

What could constitute probable cause? The police officer may have witnessed the car driving erratically which could indicate that the driver was DUI, on drugs, falling asleep, or suffering from a condition such as a heart attack or stroke. Driving erratically such as weaving in and out of lanes would provide the police officer with probable cause to stop a vehicle to investigate if the driver was DUI.

Videotape of the moments before your arrest and during your arrest may be very valuable to determine whether or not a police officer had probable cause to stop you and arrest you. If the police car or police cars involved had video cameras, your criminal defense lawyer will obtain a copy of the videotape which could show if there was probable cause or not. However, many police cars do not have video cameras. If you have been arrested and your arrest was on the news, your lawyer may know about it and can obtain a copy of videos.

However, if you were filmed for a crime TV show like COPS, it is possible that your criminal lawyer will not know about your new celebrity status unless you tell your lawyer that you were being filmed or saw a TV camera when you were arrested. Be sure to tell your criminal defense lawyer if you saw that you were being filmed for a TV show.

Videotape from a TV show is far more valuable than the dashboard camera from a police car because the dashboard camera is fixed, but the cameraman will always have you in the lens. Of course, that can work both ways. It can make it easy for the prosecution, but it can also make it easy for your criminal defense lawyer. In any event, your criminal lawyer should be told as soon as possible that you were being filmed.

Find DUI lawyers when you need one.

Bookmark and Share

Tags:
Posted in Police Stops & Arrest | No Comments »

Does Fear of Profiling Cause Reverse Profiling?

December 29th, 2009

Good intentions to avoid profiling or fear of being accused of profiling can result in reverse profiling with devastating effects.

Consider this about Nigerian Delta Airlines bombing suspect, Umar Farouk Abdulmutallab:

  • Abdulmutallab was denied a visa by the UK in May 2009.
  • The CIA had intelligence that an unknown Nigerian was in Yemen being prepared for a terrorist assault.
  • Approximately 1 month before his flight, when Alhaji Umar Mutallab, Abdulmutallab’s father, became concerned about his son’s involvement with radical Islam, he contacted the US Embassy, met with the CIA and informed the CIA that his son had been to Yemen.
  • The CIA had Umar Farouk Abdulmutallab placed on the US terrorist database, with information of his possible extremist connections in Yemen.
  • The CIA forwarded information about him to the National Counterterrorism Center.
  • When he purchased a ticket to the US on Delta Airlines, he 1) paid $2,831 cash for a round-trip ticket from Lagos, Nigeria, to Detroit via Amsterdam; 2) traveled alone; and 3) had only a small carry-on bag, without luggage stored below.

While alarm bells should have gone off when he purchased a ticket to travel to the US, there was a deafening silence.  Profiling passengers can be initiated at three possible time intervals, prior to purchasing an airline ticket; after purchasing an airline ticket; and upon arrival at the airport.  Profiling could have consisted of racial, religious, demographic information; other information such as already collected intelligence regarding his activities; and observed behavior at the airport.

Apparently, no profiling of any sort was conducted and the result is that he allegedly carried onboard the Delta Airlines flight as much as 80g of PETN, enough explosive to cause substantial damage and possibly bring down the aircraft causing the deaths of everyone on board.  While no constructive profiling was conducted in this attempted bombing of an airplane, I have personally been subjected to reverse profiling.

What is reverse profiling and why does it waste security resources? Several years ago during the President Bush years, I flew on JetBlue from New York to Los Angeles, drove to San Diego, flew back to New York and then flew to Florida and back. On each segment of my flight, I was selected for extra screening.

I did fit some rudimentary profiling because I was traveling alone and flew back from a different airport. However, after complaining I was told by a JetBlue employee that I was selected for extra screening because I am a law enforcement officer. I remembered that on that first flight to Los Angeles, the JetBlue employee at the ticket counter saw my Auxiliary Police ID when I was asked for my driver’s license and this information ended up in the computer. Apparently there was a policy of profiling law enforcement officers. I’m not sure why, but possibly to make them think that security was up to par.

I was outraged that I was selected for extra screening because of my law enforcement status. After contacting JetBlue administration, I was removed from the extra screening list and have not been selected for extra screening again.

I wonder how many potentially dangerous people are ignored because TSA agents are wasting time screening law enforcement officers and 78-year-old grandmothers because these groups are not protected from profiling. What do you think?

Bookmark and Share

Posted in Profiling | No Comments »

The Real Reason GITMO Shouldn’t Be Closed

May 22nd, 2009

Some people are concerned that transferring terrorists from GITMO to prisons in the US is a security risk because of the possibility of escape.  Terrorists have attempted to escape from prison before.

Just this month, extra security precautions were taken at an English prison, HMP Full Sutton, in East Yorkshire after discovery of an escape attempt by terrorists similar to another escape attempt last month by nine inmates including convicted terrorists who planned to escape by helicopter.

The two plots to escape from an English prison were prevented.  There are very few escapes from prisons and the possibility of terrorists escaping from a US prison is probably not really a concern.

The biggest threat to transferring GITMO detainees to US prisons is the probability that the terrorists will convert even a few prisoners to agree with their radical beliefs.  Prison is a small enclosed community with a captive audience of prisoners many of whom are uneducated, emotionally disturbed, grew up in a broken family and looking for a group to belong to which will accept them.

Undoubtedly, each terrorist released into a prison population will find a couple of prisoners to prey on.  When those prisoners are released, they can become just as dangerous.  Just today, four homegrown terrorists were arrested in Riverdale New York.  The ringleader James Cromitie who was raised as an Episcopalian spent 12 years in state prison and listed his religion as Baptist when he was first jailed and then listed his religion as Muslim.  No information was released as to who indoctrinated him while in prison, but he grew up in a large broken family and his sister described him as “…the dumbest person I ever came in contact with in my life”.

Prisoners with this type of profile can easily be targeted and converted by terrorists to continue their work after being legally released.

Richard Reid a.k.a. Abdel Raheem and Tariq Raja, who attempted to ignite explosives in his shoes and blow up an American Airlines plane at Christmas 2001, became a radical Islamist while incarcerated in a UK prison.

Jose Padilla, arrested in 2002 for planning to explode a dirty bomb is a former Chicago, IL street gang member who also became a radical Islamist while in prison.

The biggest threat is spreading terrorism to other prisoners who will be legally released.

Bookmark and Share

Posted in Prison | No Comments »

Is Blagojevich’s alleged crime an “Other Disability”

December 14th, 2008

Is Governor Rod Blagojevic disabled from performing his duties as Illinois governor?  Illinois Attorney General Lisa Madigan asked the state Supreme Court to declare Blagojevich unfit for office.

The Illinois Constitution permits removal of the governor when the governor is physically disabled, mentally disabled, or for an “other” disability.  The question is what is an “other” disability and does that include an alleged crime?

In an unusual move, during a nationally televised press conference, the United States Attorney’s office and the FBI released detailed information about Governor Blagojevic’s alleged crimes including the devastating contents of conversations obtained from wiretaps of Governor Blagojevic’s phones and possibly body wires.

The information was publicly released in an effort to prevent possible future crimes affecting the people of the state of Illinois.  However, the result of publicly releasing this information is that Governor Blagojevic was tried and convicted during an approximately 30 minute presentation by law enforcement officials.

Ostensibly, the argument that the governor is disabled was made by Illinois Attorney General Lisa Madigan during her appearance today on NBC’s Meet the Press when she stated that Governor Blagojevic could not appoint a senator to replace President-elect Barack Obama because no one would possibly accept an appointment from Governor Blagojevic (after the very public prosecution on national TV).

While it is probably difficult for the governor to fulfill his usual duties at this time, it certainly is possible to appoint a new senator.  In fact, the United States Attorney General’s office publicly stated that they were aware of the fact that Governor Blagojevic would still be governor at the end of the day and could still appoint a senator.  They stated that the purpose of disclosing the information at this time was to prevent Governor Blagojevic from selling the Senate seat.

That was certainly accomplished.  Governor Blagojevic can now appoint a new Illinois senator and the public can be assured that no money or promises were exchanged for the appointment.  The statement that no one would dare accept an appointment seems ludicrous.  I would accept a Senate appointment in a second and I would make every aspect of my life publicly available to ensure that there was no impropriety.  I can’t imagine anyone else turning down a Senate appointment unless that person had prospects for a better position.

While I think it is not only appropriate, but morally required for Governor Blagojevic to immediately step down, is he really disabled from performing his duties as governor?

Bookmark and Share

Tags: , , , , ,
Posted in Political Crimes | No Comments »

Should the Government Regulate Sex Among Friends?

July 31st, 2008

Should the government be permitted to regulate sex in your house?  What if it’s sex among a few friends?  What if your friends contribute money to the party?

A private “swingers” club (sex club) called “The Cherry Pit” has been battling the City of Duncanville, Texas which is trying to close it down.  The swingers club is in a private residence in an upscale neighborhood near Dallas.  Whether the large number of guests or morality is the issue, apparently neighbors have complained about traffic from a large number of club members, crime and “unsavory” elements created by the club.

The City of Duncanville responded by passing a law or ordinance stating, “The operation and maintenance of a sex club to be unlawful and a public nuisance,…”.  Violation of the new ordinance is punishable by a fine of up to $2,000.

It appears to me that the City of Duncanville, The Cherry Pit, and people writing on the topic are all barking up the wrong tree.

The City of Duncanville has tried to make sex among friends, who belong to a club, a violation of law.  Instead, the city should avoid the constitutional issues involved in regulating sex among friends and concentrate its efforts on regulating businesses in a residential neighborhood or regulating activities which become a nuisance or a burden upon law enforcement.  Governments regulate many activities which create a nuisance.  For instance, loud music, noises or construction too early in the morning or late at night.

The issues which The Cherry Pit should be concerned with is whether it is operating a business or creating a nuisance.

Brian Cuban, Esq. (the brother of Mark Cuban) wrote in his blog, The Cuban Revolution, Is There a Constitutional Right to An Orgy?, “What about gambling?  Consenting adult[s] coming together to play poker or even chess for money?  When does the government have the right to regulate such victimless consenting acts that may not be illegal in and of themselves?  When is there a compelling government interest?”

The analogy to gambling is inappropriate.  Gambling is illegal, even in private among friends.  Engaging in sex with multiple partners in one’s home, even in a group at the same time, is not illegal as long as money is not exchanged for sex.

A more proper analogy is where friends come to my home to play chess or poker, not for money (win or lose), but they contribute to the food.  If we agree to meet at my house every week and I order in food from an expensive restaurant, should I always have to pay for the food or should I be allowed to request my friends to split the cost with me?

If The Cherry Pit is conducting a party where adults can come and have sex with each other and it is not a business or a nuisance, the government has no business trying to regulate it.  If these friends are really sharing the cost of the food, there should be no difference.

Philip L. Franckel, Esq.

Bookmark and Share

Tags: , , ,
Posted in Sex Crimes & Pornography | No Comments »

Computer Problems? You and Your Computer Repair Technician Could Be Arrested!

June 30th, 2008

What happens when legislators write a law about a subject which they know nothing about, such as repairing computers? A Texas law enacted in 2007 turns computer technicians and consumers into criminals under certain conditions when a consumer or anyone seeks to have a computer repaired.

The Texas law requires a computer technician to have a private investigator’s license to analyze someone else’s data on a hard drive. The problem is that some repairs require the technician to look at the data.

The law makes it a Class A misdemeanor punishable by up to one year in jail, a $4,000 fine and civil penalties up to $10,000 if the computer technician accesses data in violation of the law. The law even provides the same penalties for the consumer or person who knowingly requested the repair from an unlicensed computer technician.

It must have seemed like a good idea at the time for legislators who don’t consider the consequences of a law that they write, but a computer technician would have to go back to school for three years to earn a degree in Criminal Justice or complete an apprenticeship with a licensed private investigator.

The Institute for Justice filed a lawsuit against the Texas Private Security Board seeking a decision finding the law unconstitutional. Until then, if you have to fix your computer in Texas, ask your computer shop if they have a technician with a private investigator’s license. If you forget to ask and the computer police knock at your door, you can look for a computer crime defense lawyer!

Bookmark and Share

Tags: , , , ,
Posted in Computer Crime | No Comments »

Should a Judge’s Sexually Explicit Website Be Cause for Recusal?

June 27th, 2008

A federal judge, Alex Kozinski, Presiding Judge of the 9th US Circuit Court of Appeals, recently created a furor among legal ethics lawyers. The Los Angeles Times reported the judge admitted that he maintained a sexually explicit website with both sexually artistic photos and apparently, what some people would deem to be, pornographic photos including “images of masturbation, public sex, contortionist sex, defecation and urination”. The judge stated that the website was not for public use and required an access name to view the sexually explicit photographic material.

The ethics problem is that the judge is sitting on a case where prosecutors allege that a criminal defendant, who is a film producer, distributed criminally obscene videos involving extreme fetishes like bestiality and defecation.

According to the National Law Journal, Stephen Gillers, a professor of legal ethics at New York University School of Law, said that Kozinski should recuse himself because the existence of the sexual images has been made public. The National Law Journal quoted Gillers as stating, “Given the present publicity, the public might reasonably question Kozinski’s ability to handle an obscenity prosecution impartially,” he said.

I find it interesting that Professor Gillers said that Justice Kozinski should recuse himself “since [because] the images have been made public”. The question should be whether his hobby will influence his performance on the bench even more than any possible appearance of impropriety. I do not believe that the appearance of impropriety alone should be enough to justify a recusal, particularly in light of the fact that double jeopardy becomes an issue if the judge should recuse himself.

If his interest in maintaining the website could be sufficient to affect any aspect of the trial, the judge should recuse himself regardless of double jeopardy. The correct outcome would be to admonish the judge for his failure to recuse himself, not to punish the defendant.

What is disturbing is the fact that the judge was not forthcoming with the fact that he had a private or even semiprivate interest which could affect his impartiality or create that appearance. At the very least, the judge could have recused himself without disclosing his reasons. The fact that he did not recuse himself creates the appearance that he did in fact have a personal interest in the outcome. It is not fair either to prosecutors, the public, criminal defense lawyers, or defendants when a judge fails to recuse himself or herself when private and even embarrassing issues create a conflict of interest. Everyone loses.

Philip L. Franckel, Esq.
Criminal Defense Lawyer
1888DRUGCRIMES.COM

Bookmark and Share

Tags: , , , ,
Posted in Sex Crimes & Pornography | No Comments »

Handheld Cell Phone Ban While Driving Begins in California & Washington

June 25th, 2008

Drivers in the states of California and Washington will now have to use hands free cell phones while driving. Both California and Washington have enacted new laws banning hand-held cell phone use while driving. The new cell phone ban laws are effective as of July 1, 2008.

California Vehicle Code Section 23123(a) prohibits drivers from using a wireless telephone while driving unless the cell phone is capable of both hands free listening and talking and is used in that manner while driving. The law provides some exemptions which defy belief, such as school bus drivers.

California Vehicle Code Section 23124 prohibits drivers under the age of 18 from using a wireless telephone, even if hands-free.

If you drive in either California or Washington, make sure that you use a headset or speakerphone while talking on your cell phone and driving. Usually, within the first few months of a new law, in order to create awareness of the law, there is increased enforcement by the police resulting in an unusually high amount of traffic tickets being issued.

With just a small fine and no points, you may not need a California traffic ticket lawyer for this one, but other serious consequences may become a reality. Driving without a hands-free cell phone will give a police officer probable cause to pull you over and issue a traffic ticket.

To make a DUI or DWI arrest or an arrest for illegal drugs, firearms or other illegal items, a police officer needs probable cause to pull you over. For instance, driving erratically would provide probable cause to pull you over to determine if you are driving under the influence of alcohol or drugs.

Even without driving erratically, you may be arrested for DUI, DWI, illegal drugs or other offenses if you are stopped while talking on a cell phone which is not hands-free. After you have been stopped by the police for talking on a handheld cell phone, the police officer may be able to obtain additional probable cause to arrest you for DUI or DWI if the police officer determines that you are driving while drunk.

Additionally, once you have been stopped, the police officer may be able to obtain additional probable cause to search your car for illegal drugs, illegal firearms and other illegal substances.

While not necessarily a big deal, a traffic ticket for illegal cell phone use while driving can lead to serious consequences involving possible jail time, serious fines, and requiring you to hire a California DUI lawyer or a California drug lawyer.

Bookmark and Share

Tags: , , ,
Posted in Traffic Tickets | No Comments »

« Older Entries