@night 1803 access accessdata active directory admissibility ads aduc aim aix ajax alissa torres amcache analysis anjp anssi answer key antiforensics apfs appcompat appcompatflags applocker april fools argparse arman gungor arsenal artifact extractor attachments attacker tools austin automating automation awards aws azure azuread back to basics backstage base16 best finds beta bias bitcoin bitlocker blackbag blackberry enterprise server blackhat blacklight blade blanche lagny book book review brute force bsides bulk extractor c2 carved carving case ccdc cd burning ceic cfp challenge champlain chat logs Christmas Christmas eve chrome cit client info cloud forensics command line computer forensics computername conference schedule consulting contest cool tools. tips copy and paste coreanalytics cortana court approved credentials cryptocurrency ctf cti summit cut and paste cyberbox Daily Blog dbir deep freeze defcon defender ata deviceclasses dfa dfir dfir automation dfir exposed dfir in 120 seconds dfir indepth dfir review dfir summit dfir wizard dfrws dfvfs dingo stole my baby directories directory dirty file system disablelastaccess discount download dropbox dvd burning e01 elastic search elcomsoft elevated email recovery email searching emdmgmt Encyclopedia Forensica enfuse eric huber es eshandler esxi evalexperience event log event logs evidence execution exfat ext3 ext4 extended mapi external drives f-response factory access mode false positive fat fde firefox for408 for498 for500 for526 for668 forenisc toolkit forensic 4cast forensic lunch forensic soundness forensic tips fraud free fsutil ftk ftk 2 full disk encryption future gcfe gcp github go bag golden ticket google gsuite guardduty gui hackthebox hal pomeranz hashlib hfs honeypot honeypots how does it work how i use it how to howto IE10 imaging incident response indepth information theft infosec pro guide intern internetusername Interview ios ip theft iphone ir itunes encrypted backups jailbreak jeddah jessica hyde joe sylve journals json jump lists kali kape kevin stokes kibana knowledgec korman labs lance mueller last access last logon leanpub libtsk libvshadow linux linux-3g live systems lnk files log analysis log2timeline login logs london love notes lznt1 mac mac_apt macmini magnet magnet user summit mathias fuchs md viewer memorial day memory forensics metaspike mft mftecmd mhn microsoft milestones mimikatz missing features mlocate mobile devices mojave mount mtp multiboot usb mus mus 2019 mus2019 nccdc netanalysis netbios netflow new book new years eve new years resolutions nominations nosql notifications ntfs ntfsdisablelastaccessupdate nuc nw3c objectid offensive forensics office office 2016 office 365 oleg skilkin osx outlook outlook web access owa packetsled paladin path specification pdf perl persistence pfic plists posix powerforensics powerpoint powershell prefetch psexec py2exe pyewf pyinstaller python pytsk rallysecurity raw images rdp re-c re-creation testing reader project recipes recon recursive hashing recycle bin redteam regipy registry registry explorer registry recon regripper remote research reverse engineering rhel rootless runas sample images san diego SANS sans dfir summit saturday Saturday reading sbe sccm scrap files search server 2008 server 2008 r2 server 2012 server 2019 setmace setupapi sha1 shadowkit shadows shell items shellbags shimcache silv3rhorn skull canyon skype slow down smb solution solution saturday sop speed sponsors sqlite srum ssd stage 1 stories storport sunday funday swgde syscache system t2 takeout telemetry temporary files test kitchen thanksgiving threat intel timeline times timestamps timestomp timezone tool tool testing training transaction logs triage triforce truecrypt tsk tun naung tutorial typed paths typedpaths uac unc understanding unicorn unified logs unread usb usb detective usbstor user assist userassist usnjrnl validation vhd video video blog videopost vlive vmug vmware volatility vote vss web2.0 webcast webinar webmail weekend reading what are you missing what did they take what don't we know What I wish I knew whitfield windows windows 10 windows 2008 windows 7 windows forensics windows server winfe winfe lite wmi write head xboot xfs xways yarp yogesh zimmerman zone.identifier

Daily Blog #316: Sunday Funday 5/4/14 Winner!

Hello Reader,
      One of the best things about Sunday Funday is when I pick a topic that someone I never knew before has a serious passion for. In this weeks contest one such anonymous submitter has obviously been tracking this topic and has come back with a great list of cases that apply. There is nothing better for me than a Sunday Funday I walk away from learning something as well.

The Challenge:
One of our viewers, Jason Alvarado, pointed out a case study on USA v Jerrett in which a mans conviction was overturned when it was revealed how the anonymous tipster and the government interacted. What other case studies can you find for other cases like this in the USA or in any other country.

The Winning Answer

Raymond v. Superior Court9 a 12-year old boy told an officer that he had found marijuana in his father’s bedroom. The officer responded by asking him to try to get “a sample.” He succeeded but, not surprisingly, the court suppressed it, saying, “Although the [boy] was the immediate actor, police participation in planning and implementation subjected the expedition and its product to [suppression].”

Stapleton v. Superior Court,11 LAPD officers, accompanied by special agents from three credit card companies, went to Stapleton’s home to arrest him on an outstanding warrant for credit card fraud. Some of the agents covered the back while the officers and one of the agents entered through the front. After Stapleton was arrested, one of the agents searched the trunk of his car and found several illegal tear gas canisters.

The California Supreme Court ruled the search was illegal and, although it was conducted by a civilian, it also ruled it was a police search because the officers, “by allowing [the agent] to join in the search and arrest operation, put [him] in a position which gave him access to the car keys and thus to the trunk of [Stapleton’s] car.”

People v. De Juan, “Suppression will be ordered when with the knowledge that a private citizen is violating or is about to unlawfully violate the privacy rights of another, the police sit idly by and do nothing.”

 U.S. v. Reed14 the manager of a Best Western motel in Alaska notified officers that he suspected Reed was using his motel room for “drug activities.” He also asked the officers to stand by while he “checked the room.” According to the court, the officers “stood guard” in the doorway as the manager went through Reed’s dresser drawers and examined the contents of his briefcase. As it turned out, the search netted a gun and some drugs, but the court suppressed everything because the officers had failed to stop him. Said the court:

[The officers] definitely knew and acquiesced in [the manager’s] search. They were personally present during the search, knew exactly what [the manager] was doing as he was doing it, and made no attempt to discourage him from examining Reed’s personal belongings beyond what was required to protect hotel property.

 People v. Minervini17 a motel desk clerk in Santa Barbara suspected that two men who had rented two rooms were part of a gang that had been stealing television sets from motels in the area. When he saw one of the men removing a “large box” from his room, he notified the police and the motel’s manager. When officers arrived, they accompanied the manager as he opened the door to one of the rooms and found the television was gone. The manager and the officers then went to the other room which the manager opened with a key. As he looked around the room, he saw that the television set had been placed in a cardboard box. The men were later arrested.

On appeal, they claimed the motel manager was functioning as a police agent when he opened the doors to their rooms. But the court pointed out that the manager “went to the rooms and opened them on his own initiative.” More important, he had a right to do so and “that right would not be diminished if he sought police assistance in exercising that right or even if he was encouraged by the police to so exercise it.”

 U.S. v. Andrini20 ATF agents were conducting surveillance on a motel room rented by Andrini who was suspected of setting fire to an office building. As the result of a mix-up in room assignments, Andrini’s suitcase was sent to the wrong room, then returned to the front desk. Although an ID tag was not attached to the bag, both the desk clerk and the ATF agent (who happened to be present) suspected that it belonged to Andrini. When the clerk asked the agent what he wanted him to do with the bag, he told him to follow “routine” procedures. So the clerk opened it to try to determine the identity of its owner. Inside, he saw a gun. Continuing to follow routine procedures, he notified local police who arrested Andrini for being a felon in possession of a firearm. During a search incident to the arrest, the officers found a pyrotechnic fuse similar to the one used in the arson.  On appeal from his arson conviction, Andrini contended the search of his suitcase should be deemed a police search but the court disagreed, noting, “[The ATF agent] did not instruct the motel clerk to open the bag. To the contrary, he advised the clerk to follow routine motel procedure.”  

People v. Warren the defendant argued that Alvarez, the owner of a parcel delivery service, was a police agent when he searched a package that Warren had dropped off. His argument was based on Alvarez having been an officer in the past, and having previously notified officers when he found drugs in packages. But this was immaterial, said the court, because “the evidence supports the trial court’s finding that Alvarez was acting as a responsible employee and on behalf of the mail companies, and not as an agent of the government.”

United States v. Jacobsen (1984) 466 U.S. 109, 113 [“[The Fourth Amendment] is wholly inapplicable to a search or seizure, even an unreasonable one, effected by a private individual not acting as an agent of the Government or with the participation or knowledge of any governmental official.”]

Skinner v. Railway Labor Exec. Assn. (1989) 489 U.S. 602, 614. ALSO SEE Coolidge v. New Hampshire (1971) 403 U.S. 443, 487 [“The test [is whether the citizen] must be regarded as having acted as an instrument or agent of the state”]. 

Lugar v. Edmondson Oil Co. (1982) 457 U.S. 922, 937 [private citizen may be a police agent if he “obtained significant aid from state officials”]; United States v. Jacobsen (1984) 466 U.S. 109, 113 [private citizen may be a police agent if he acted “with the participation” of an officer]; Jones v. Kmart Corp. (1998) 17 Cal.4th 329, 333 [private citizen may be a police agent if he “obtained significant aid from state officials”]; People v. McKinnon (1972) 7 Cal.3d 899, 912 [Fourth Amendment applies if officers “hired and paid” the person to conduct warrantless searches,” or if  he were to “open and search a specific package at [their] express direction or request”]; People v. Bennett (1998) 17 Cal.4th 373, 384, fn.3 [civilian was acting at an officer’s request]; Dyas v. Superior Court (1974) 11 Cal.3d 628, 633, fn.2 [exclusionary rule will be applied if officers “requested the illegal search”]; Stapleton v. Superior Court (1968) 70 Cal.2d 97, 102 [“[The civilian] entered petitioner’s house at the request and as an agent of the police.”]; People v. Tarantino (1955) 45 Cal.2d 590 [officer requested a sound engineer to plant a bug in a suspect’s hotel room]; People v. Fierro (1965) 236 Cal.App.2d 344 [officer requested motel manager to search the defendant’s motel room]; People v. North (1981) 29 Cal.3d 509, 514 [search “performed in conjunction with, or cloaked in the authority of the state”]; People v. De Juan (1985) 171 Cal.App.3d 1110, 1120 [search at officers’ “behest or instigation”]; People v. Scott (1974) 43 Cal.App.3d 723, 726 [citizen “hired and paid by the police”]; People v. Leighton (1981) 124 Cal.App.3d 497, 501 [“the police direct[ed] the private citizen to conduct the search”]; U.S. v. Ziegler (9th Cir. 2007) 474 F.3d 1184, 1190 [FBI agent asked company manager to provide him with a copy of an employee’s hard drive]; U.S. v. Ginglen (7th Cir. 2006) 467 F.3d 1071, 1075 [“[T]here is no indication that the government encouraged or acquiesced in the brothers’ decision to enter their parents’ home.”]; U.S. v. Shahid (7th Cir. 1997) 117 F.3d 322, 325 [“Other useful criteria are whether the private actor acted at the request of the government and whether the government offered the private actor a reward.”]. 9 (1971) 19 Cal.App.3d 321, 325. 

Lugar v. Edmondson Oil Co. (1982) 457 U.S. 922, 941 [“[W]e have consistently held that a private party’s joint participation with state officials in the seizure of disputed property is sufficient to characterize that party as a ‘state actor’ for purposes of the Fourteenth Amendment.”]; People v. North (1981) 29 Cal.3d 509, 514 [search “performed in conjunction with” officers]; People v. McKinnon (1972) 7 Cal.3d 899, 912 [civilian would be deemed a police agent if officers were engaged in a “joint operation” with him]; People v. Scott (1974) 43 Cal.App.3d 723, 726 [a search would be a police search if a citizen “participates in planning or implementing a ‘joint operation’ with law enforcement authorities”]. COMPARE People v. Mangiefico (1972) 25 Cal.App.3d 1041, 1048 [“Berdan was not engaged in a joint operation with local authorities, but was conducting an independent investigation.”]. 

People v. Yackee (1984) 161 Cal.App.3d 843, 847 [“[T]he investigating officer knowingly allowed the airline to reopen the suitcase in his presence, for his benefit, without intervening to stop the search. Thus, what had heretofore been a purely private search became a joint operation with the police.”]; Dyas v. Superior Court (1974) 11 Cal.3d 628, 633, fn.2 [exclusionary rule will be applied if officers “knowingly allowed [an illegal search] to take place without protecting the third party’s rights”]; Stapleton v. Superior Court (1968) 70 Cal.2d 97, 103 [“[T]he police stood silently by while [the agent] made the obviously illegal search.”]; People v. McKinnon (1972) 7 Cal.3d 899, 912 [“[A] private citizen may also be deemed to act as an agent of the police when the latter merely ‘stand silently by’”]; People v. North (1981) 29 Cal.3d 509, 516 [“police foreknowledge or simultaneous awareness of a citizen entry, is wholly lacking in the case before us.”]; U.S. v. Walther (9th Cir. 1981) 652 F.2d 788, 793 [“The DEA thus had knowledge of a particular pattern of search activity dealing with a specific category of cargo, and had acquiesced in such activity.”]; U.S. v. Shahid (7th Cir. 1997) 117 F.3d 322, 325 [a “critical” factor is “whether the government knew of and acquiesced in the intrusive conduct”]. 

U.S. v. Cleaveland18 an investigator for the Portland General Electric Company (PGE) received a tip that someone was diverting electricity to a certain residence. So he asked a detective to accompany him while he checked the meter. The detective waited in his car while the investigator searched the meter housing and discovered evidence of illegal diversion. In ruling that the search was not a police search, the court noted: It was PGE, not the police, who initiated the plan to inspect the meter. There was no reason why the detective should have restrained [the investigator] or discouraged him in his search because [the investigator] never exceeded his authority under the Customer Service Agreement to go on the property and inspect the meter. 

U.S. v. Bruce21 the manager of an Extended Stay America hotel in Ohio notified police that employees had detected the odor of burning marijuana coming from one of two rooms that had been rented by Bruce and his friends. So a police sergeant asked the manager to tell the housekeepers to segregate the trash from the two rooms “during their regular cleaning.” While searching the trash, officers found marijuana.  On appeal, Bruce contended the housekeepers were police agents, but the court disagreed, noting:  [T]he cleaning staff were not asked to search for evidence, but merely to preserve any possible evidence they might otherwise have removed from the room and discarded in the course of their ordinary cleaning duties. There is no evidence that the staff were asked to look around the rooms, report any suspicious items, or otherwise deviate from their typical cleaning routine. 

Post a Comment


Author Name

Contact Form


Email *

Message *

Powered by Blogger.