Forensic investigations in cyberspace for civil proceedings

Abstract

This article considers some of the legal issues raised when private entities are seeking forensic data from Internet‐based activities for the purpose of civil proceedings. It focuses on the identification of potential defendants and the obtaining of evidence in the course of its transmission. Existing law, legislative proposals and case law are examined in terms of appropriately balancing the rights of the claimant, defendant and third‐party communication providers.

Notes

Correspondence: Ian Walden, Centre for Commercial Law Studies, Queen Mary, University of London, Roy Goode House, 13 Charterhouse Square, London EC1M 6AX, UK. E‐mail: [email protected].

The author is Reader in Information and Communications Law and Head of the Institute of Computer and Communications Law in the Centre for Commercial Law Studies, and also Consultant to solicitors Baker & McKenzie.

E.g. UK Civil Procedure Rules (CPR), Part 31, ‘Disclosure and inspection of documents’.

E.g. CPR 25.1(1)(h) re: a ‘Search Order’ (formally known as an ‘Anton Piller’ order).

New Yorker cartoon, 5 July 1993.

For a detailed description, see LINX ‘Best current practice—traceability’ (May 1999): www.linx.net. Also see ‘Whois database contributes to fraud and ID theft’, in silicon.com, 7 November 2003.

See http://www.internetcrimeforum.org.uk.

The Regulation of Investigatory Powers (Communications Data) Order 2003 (S.I. No. 3172).

S. 35.

(2001) 4 EMLR 750.

So‐called after the House of Lords decision in Norwich Pharmacal Co. v. Customs & Excise Commissioners [1974] AC 133. Now formalized in the Civil Procedure Rules at 31.18: ‘Rules 31.16 and 31.17 do not limit any power which the court may have to order (a) disclosure before proceedings have started; and (b) disclosure against a person who is not a party to proceedings.’

Norwich Pharmacal at p 175.

[1999] FSR 518.

(2003) 2 All ER 872.

CHC Software Care Ltd. v. Hopkins and Wood [1993] F.S.R. 241.

Ashworth Security Hospital v. MGN Ltd., [2002] 4 All E.R. 193, at para. 57.

Directive 02/58/EC ‘concerning the processing of personal data and the protection of privacy in the electronic communications sector’ (OJ L 201/37, 31.7.2002) at art. 15(1). Transposed into UK law by the Privacy and Electronic Communications (EC Directive) Regulations 2003, (SI No. 2426).

Anti‐Terrorism Crime and Security Act 2001, at s. 102 et seq.

In re Verizon Internet Services, Inc., 240 F.Supp.2d 24 (D.D.C 2003).

17 U.S.C.A. §512(a)–(d).

17 U.S.C.A. §512(h)(1).

17 U.S.C.A. §512(h)(1)(C). See also ALS Scan, Inc. v. RemarQ Communities, Inc., 239 F.3d 619, concerning a subpoena challenge based on non‐compliance.

S. Rep. No. 105–190, at 20.

Fed. R. Civ. P. 45.

TS 10 (1996) Cm 3046; 33 I.L.M. 81 (1994).

See WIPO Copyright Treaty (1996) as implemented in the EU Directive 01/29/EC ‘on the harmonisation of certain aspects of copyright and related rights in the information society’ (OJ L 167/10, 22 June 2001) at articles 2 and 3 respectively.

Ibid, at art. 9.

COM(2003) 46 final, 30 January 2003. The final text was adopted on 19 April 2004 and is available at http://register.consilium.eu.int/pdf/en/04/st03/st03636.en04.pdf

Ibid, at art. 8(2)(a).

Ibid, at art. 8(1)(a).

Ibid, at art. 9(4) and the Explanatory Memorandum at p 21.

Directive 1995/46/EC ‘on the protection of individuals with regard to the processing of personal data and on the free movement of such data’, OJ L 281/31, 23 November 1995.

Ibid, at art. 7(f).

[2003] EWHC 786 (Ch).

At para 238. Paragraph 6 refers to the provision under the UK Data Protection Act 1998, at Schedule II, which implements Article 7(f).

Case C‐369/98 R v. Minister of Agriculture, Fisheries and Food, ex parte Trevor Robert Fisher and Penny Fisher [2000] ECR I‐06751.

Commission Report, ‘Technical analysis of the transposition in the Member States’, May 2003, p 10.

The legal distinction between public and private telecommunication systems may vary between jurisdictions, but for the purpose of this article the distinction is based on whether the system is offered to the public for use, not any concept of legal ownership.

Halford v. United Kingdom (1997) IRLR 471.

RIPA, s. 1(1), (2).

Ibid, s. 1(3).

SI No. 2699. Hereinafter referred to as the ‘Lawful business practice’ regulations.

Directive 97/66/EC ‘concerning the processing of personal data and the protection of privacy in the telecommunications sector’ (OJ L 24/1, 30 January 1998).

Op cit, note 15, at Art. 5(2).

Lawful Business Practice Regulations, op cit, note 40, at para. 3(1)(a)(iii) and (iv).

Ibid, at para. 3(2).

Office of the Information Commissioner, ‘The Employment Practices Data Protection Code, Part 3: Monitoring at work’, available at www.dataprotection.gov.uk.

L Spitzner ‘Honeypots—definitions and value of honeypots’ published at www.enteract.com/∼lspitz/honeypot.html.

See generally, I Walden and A Flanagan ‘Honeypots: a sticky legal landscape’ Rutgers Computer and Technology Law Journal, Vol 29, No 2, 2003, 317–370.

In the USA, entrapment is considered a substantive defence (see Sherman v. United States (1957) 356 US 369). In the UK, entrapment is viewed as a threat to the integrity of the judicial system (R v. Loosely (Attorney General's Reference No. 3 of 2000) (2001) 4 All ER 897).

E.g. Regulation of Investigatory Powers Act 2000, s. 5.

See for example ‘Race to save new victims of child porn’ The Guardian, 4 November 2003, p 1.

A&M Records, Inc & ors v. Napster, Inc, 230 F.3d 1004 (9th Cir. 2001).

See Metro‐Goldwyn‐Mayer Studios, Inc. et al. V. Grokster, LTD. Et al, 259 F. Supp.2d 1029, 1045 (C.D.Cal. 2003).

See ‘Innocent file‐sharers could appear guilty’ NewScientist.com news service, 1 October 2003.

‘Madonna swears at music pirates’ BBC News, 22 April 2003: available at www.bbc.co.uk.

RIPA, at s. 2(2): ‘a person intercepts a communication in the course of its transmission by means of a telecommunication system if, and only if, he: (a) so modifies or interferes with the system, or its operation, (b) so monitors transmissions made by means of the system, or (c) so monitors transmissions made by wireless telegraphy to or from apparatus comprised in the system, as to make some or all of the contents of the communication available, while being transmitted, to a person other than the sender or intended recipient of the communication.’

See eBay v. Bidders Edge, 100 F. Supp. 2d 1058 (N.D.Cal. 2000) and Ticketmaster Corp. v. Tickets.com, Inc., 54 U.S.P.Q.2d 1344 (C.D.Cal. 2000).

E.g. Prince plc v. Prince Sports Group Inc (1998) FSR 21, where a claim in respect of the domain name ‘prince.com’ was held to be a unlawful threat under the Trade Marks Act 1994, s. 21. Potential alternative claims may in the torts of slander of title, malicious falsehood and trade libel.

Additional information

Notes on contributors

Ian Walden *

Correspondence: Ian Walden, Centre for Commercial Law Studies, Queen Mary, University of London, Roy Goode House, 13 Charterhouse Square, London EC1M 6AX, UK. E‐mail: [email protected]. The author is Reader in Information and Communications Law and Head of the Institute of Computer and Communications Law in the Centre for Commercial Law Studies, and also Consultant to solicitors Baker & McKenzie.