A district court judge ordered Massachusetts and Boston College police to return a BC student's computers, cell phone and other belongings, after finding that investigators did not sufficiently show a link between the man and any crime.
The case pits investigators against Riccardo Calixte, a senior in computer science at Boston College (corrected). After Calixte's roommate complained of "domestic issues" and called Calixte a hacker, campus police opened up an investigation into an e-mail allegedly sent by Calixte to a school mailing list. The e-mail linked to a fake profile of Calixte's roommate on a site for gay men. The roommate also accused Calixte of maintaining a cache of more than 200 illegally copied movies, hacking into the college's grade database, configuring computers so they cannot be scanned for illegal downloads and jailbreaking cell phones.
In an affidavit (pdf) to support his application for a search warrant, Boston College Police Officer Kevin M. Christopher gave evidence that Calixte may have sent the e-mail, citing it as a violation of two computer hacking laws: obtaining computer services by fraud or misrepresentation and unauthorized access to a computer.
In his order to return Calixte's items, the judge noted that, even if Calixte had sent the e-mail, doing so would not violate either law and criticized the prosecutors' attempts to revise their case as an investigation into the allegations that the student hacked into the school's grade database.
"Faced with the reality that the alleged e-mail activity was probably not illegal, the Commonwealth now seeks to justify the search warrant, post hoc, based on an affidavit that fails to indicate the time or the place of the criminal activity its informant (Calixte's roommate) claims to have witnessed, and that reflects no effort or attempt to verify the sketchy information supplied," Judge Margot Botsford of the Supreme Judicial Court of the Suffolk County wrote in the order.
The computer crime violations contained in the search warrant resemble those brought against Lori Drew, a Missouri mother, who was accused of using a fake MySpace profile of a teenage boy to bully a 13-year-old friend of her daughter. The prosecutors charged Drew with violating computer crime statutes, because her use of MySpace was "unauthorized." The jury found her guilty of three misdemeanor charges of violating the Computer Fraud and Abuse Act, although the convictions are under appeal.
In the application to search Calixte's dorm room, the investigator's affidavit shows a stunning lack of technical knowledge, citing — among the reasons that Calixte was under suspicion — that he used two computer operating systems on the same computer, one of which "is a black screen with a white font, which he uses prompt commands on."
The ruling was not a complete victory for Calixte. The judge denied Calixte's attorneys' request that any evidence collected so far be barred from used in future trials. Such a request would best be heard by the judge in any future case, Botsford ruled.
CORRECTION: The original article incorrectly identified Calixte's school. The student attends Boston College.
If you have tips or insights on this topic, please contact SecurityFocus.
Posted by: Robert Lemos