Digg this story   Add to del.icio.us   (page 3 of 4 ) previous  next 
Liar, Liar, and Pretexting
Mark Rasch, 2006-09-19

Story continued from Page 2


The recent movie The Black Dahlia relates to a real murder case of Elizabeth Short. In 1949 reporters working on the case called Short’s mother after the murder, not telling the mom that her daughter had been murdered. Instead they used the ruse that she had won a beauty contest in order to get information about the deceased. A deceptive trade practice? What if you don’t affirmatively lie, but merely mislead - allow the recipient of the information to believe that you are someone else, or need the information? Is anything less than the truth, the whole truth and nothing but the truth actionable?

Remember, the deceptive trade practice rules are not designed to be a protection of the privacy of non-public personal information. They are intended to make people in business play nicely and be honest. Thus, the victim of the deception is not you - it’s the phone company, the credit card company, the bank, etc. - the person whose putatively owns the information.

Criminal fraud

In addition to the deceptive trade practice statutes, the actions of the HP officers, their lawyers and investigators may also violate various fraud statutes, like the mail fraud (18 USC 1341), wire fraud (18 USC 1343) and computer fraud (18 USC 1030) statutes, as well as various state criminal fraud and larceny by trick statutes. These statutes generally prohibit the use of false or fraudulent statements, or even material omissions in furtherance of a “scheme or artifice to defraud” someone out of “money or property.”

So is your personal information “property” and if so, whose “property” is it? What about other kinds of information? The law is very weird on this idea of information as property. Some kinds of information, like properly protected trade secrets, patents, copyrights and trademarks, clearly have recognized property interests - some with respect to confidentiality, some with respect to misuse. Other types of information have recognized confidentiality interests, but not necessarily a “property” interest. This would include things like credit information, some criminal history information, information protected by a court order, information classified for national security or foreign relations purposes, and health care information. But confidentiality and property are not the same thing. Clearly, your physical records - the dead trees and ink - are property for someone. If I waltzed into your doctor’s office and stole your records (remember Daniel Ellsberg?) I would be guilty of both burglary and theft. But if I just called the attending nurse and cajoled the info? Invasion of privacy sure, but theft? Not so clear.

Even if your telephone toll records are considered “property,” are they your property? And do you have any expectation of privacy with them? The U.S. Supreme Court appears to suggest that the answer to these questions is no.

In 1999, in Smith v. Maryland, the Court stated that, “... we doubt that people in general entertain any actual expectation of privacy in the numbers they dial. All telephone users realize that they must "convey" phone numbers to the telephone company, since it is through telephone company switching equipment that their calls are completed. All subscribers realize, moreover, that the phone company has facilities for making permanent records of the numbers they dial, for they see a list of their long-distance (toll) calls on their monthly bills.” ... “it is too much to believe that telephone subscribers, under these circumstances, harbor any general expectation that the numbers they dial will remain secret.”

The court went on to say that even if you did think your phone records were private, at least for Fourth Amendment search and seizure purposes, your expectation of privacy is just not reasonable, since they aren't your records. The Court said, “When he used his phone, petitioner voluntarily conveyed numerical information to the telephone company and 'exposed' that information to its equipment in the ordinary course of business. In so doing, petitioner assumed the risk that the company would reveal to police the numbers he dialed.”

While California law generally prohibits telephone companies from disclosing your records without your consent (save subpoenas or other process) it’s not clear that it prohibits others from attempting to induce a phone company from thinking that they do have your consent. Thus, the phone company may take the risk that these records are inadvertently disclosed.

Story continued on Page 4 



Mark D. Rasch is an attorney and technology expert in the areas of intellectual property protection, computer security, privacy and regulatory compliance. He formerly worked at the Department of Justice, where he was responsible for the prosecution of Robert Morris, the Cornell University graduate student responsible for the so-called Morris Worm and the investigations of the Hannover hackers featured in Clifford Stoll’s book, "The Cuckoo’s Egg."
    Digg this story   Add to del.icio.us   (page 3 of 4 ) previous  next 
Comments Mode:
Update 2006-09-20
Mark D. Rasch
Liar, Liar, and pretexting 2006-09-20
Mark D. Rasch
stolen laptop 2006-09-20
Mark D. Rasch
Liar, Liar, and pretexting 2006-09-21
SNARE IT Security
Liar, Liar, and pretexting 2006-09-25
Michael


 

Privacy Statement
Copyright 2010, SecurityFocus