🚀 go-pugleaf

To anyone interested in the recent court-ordered search of two UC
computers:

Those of you who have accounts on the UC computers violet or garnet
will have noticed the recent login message regarding a court ordered
search of files on those computers.  Following is a summary of some
information I've obtained regarding the search.  The two notes are
summaries that I sent to some people who had already expressed an
interest in any information I had about the case.

PLEASE NOTE: This is not in any way an "official" summary.  I do not
represent the University or the plaintiff in this case.  The opinions
and interpretations expressed are entirely my own and should not be
interpreted as representing any one else's point of view.

The most recent bit of information is that the Electronic Frontier
Foundation is actively investigating the case and may choose to take
some action.

As I mention in one of the notes below, if you are interested in any
further information I get about the case, email me and I'll add you to
my mailing list.

-Dean
--
Dean Pentcheff  (Internet: dean2@garnet.berkeley.edu)
Department of Integrative Biology, University of California, Berkeley CA 94720
Work Phone: (510) 643-9048   Home Phone: (510) 839-1790    Fax: (510) 643-6264

===================================
Jan 6, 1991

To those interested in the search of files on UC Berkeley's computers:

Now that I've returned from the holiday, I've made a few inquiries 
regarding this incident.  To recap, the following "news" item appeared
on our mainframes:

   We were recently required by order of the Alameda County Superior Court
   to search files on Garnet and Violet that may contain a particular
   individual's name within the file.  We are complying with that court
   order.

   We think it is important to alert you that files on the shared systems,
   or even on personal workstations or microcomputers, are subject to
   search, and even seizure, by court order.

   Curtis Hardyck, Vice Provost

A number of mail messages arrived in my mailbox suggesting that this
search may not be legal within the bounds of the Electronic
Communications Privacy Act.  Basically, it appears that if there are
"electronic communications" stored on those mainframes (which there
certainly are), a court order to search them in bulk is not
specific enough.  The analogy is that it would not be legal to search
all paper files in a building to find an incriminating document: the
warrant has to specify the specific people whose files are to be
searched, which files to be searched, and show probable cause of a
crime.

The current status of the case appears to be as follows:
1. The family of a student who is undergoing disciplinary action for
   allegedly breaking into some computers is suing the university.
2. The family has requested that all "student records" concerning the
   student which exist on two of our mainframes be turned over to the
   court.  These records have been defined as any record that names him
   (based on his four- or five-letter login ID).
3. The university has complied with the court order to search all
   files on the mainframes.  They have located (surprise, surprise)
   numerous files that include the login's letter sequence.
4. Tomorrow (Tuesday, Jan. 7) the university lawyers are going to go
   to court to try to fight further execution of the order, on the
   grounds that doing so would require printing out all of those files
   (about 11 million lines) and examining them by eye.  Thus they are
   contesting on the grounds of undue burden, not privacy violation.

I have contacted the Vice Provost involved in the case and apprised
him of the interest we have.  He has promised to keep me up to date on
developments.  

Interested though I am in the case (and since I keep files on these
computers, I do suspect that I may have been illegally searched), I'm
not in a position to pursue legal action now.  I'm in the last couple
of months of my Ph.D. here - if I were to get legally involved in
this, my professor would ensure that they were my last couple of
months, period.  

If you're interested in being kept up to date on this "affair", let me
know with some return email (so I don't pester all of you with
updates).

-Dean

P.S. Just got a call from a San Jose paper (seems that they have a
reporter who reads comp.risks!).  They're pursuing the story at the
university.  Remind me to check my appointment calendar for the next
month before I post to comp.risks again...


==================================


Wed Jan  8 15:17:03 PST 1992

To those concerned with the court-ordered search of files on University
	of California computers:

Yesterday (Tuesday, Jan 7) there was a court hearing at which UC's
lawyers tried to convince the judge that UC should not have to do any
further search since that would impose an undue burden on the
university.  The judge ruled that the university does indeed have to
search all files on two mainframes for all university records relevant
to a particular student (the plaintiff in the lawsuit).

At this stage, a grep/awk search of all files has been done.  Computer
Services now has a list of the names of all files which contain the
target string (which is either the login ID or actual name of the
student in question, I'm not sure which [or both?]).  It's unclear what
will happen next.  Computer Services is well aware that they may have
located files which contain the string(s) accidentally, are otherwise
irrelevant to the case, or which contain lots of other irrelevant
information (e.g. mailbox files with dozens of letters, only one of
which may be relevant).  They are waiting for the court to tell them
what to do next.  Presumably this could range anywhere from turning
over copies of all the files to the court, through hand searching the
files for relevance, or further filtering the search on the basis of
file ownership, etc.

The University lawyers took a brief look at the Electronic
Communications Privacy Act, but decided that it wasn't applicable.
[WARNING * WARNING: the following remarks are my non-lawyer's
interpretation of the non-lawer's interpretation in Computing Services
of the lawyer's interpretation.  Don't take what I say here too
seriously!]  Evidently there is a clause in the ECPA which states that
if there are other statutes which could require searching of files,
those statutes take precedence.  In this case, there is the Buckley
amendment to the California Family Education Rights and Privacy Act
which states that any student has the right to access all university
maintained records regarding that student.  The court's interpretation
is that the two mainframes are maintained by the university, hence any
and all files on them constitute "university maintained records" and
are subject to search.

Most of the above information comes from a chat I had with George
Lavender in Computing Services.  Clearly, he is in the position of
having to comply with the court order.  He is, however, aware of what
he's doing and is trying his best to minimize intrusion into files.
From his point of view, he'd really like to see some sort of legal
resolution of this conflict.  This sort of competition between the
right of students/anyone to records on them vs. the right of privacy
of file owners is quite likely to arise again.  Quite apart from legal
qualms, the folks at Compting Services have better things to do with
their time than bulk searches of files, so they'd be quite happy to
see some resolution.

Stay tuned for the next exciting installment of Searchout at the UC
Corral.

-Dean
-- 
Dean Pentcheff  (Internet: dean2@garnet.berkeley.edu)
Department of Integrative Biology, University of California, Berkeley CA 94720
Work Phone: (510) 643-9048   Home Phone: (510) 839-1790    Fax: (510) 643-6264