Inquisition 21
 |
 |
|
|
| Log In
|
|
|
|
|
| Search Articles
|
|
|
|
|
| Comments
|
|
|
You don't have to,
but if you log in,
you can add comments.
|
| Page Referral
|
|
|
|
|
|
|
Internet security
|
|
|
1 | 2 | 3 | 4 | 5 | 6 | 7 | 8
Staying safe on the Internet
Important information for the defense where computers are seized
An introduction to the US DOJ’s manual on searching and seizing computers
By Timothy W. Hoover
Assistant Federal Defender
I. INTRODUCTION
The Fourth Amendment search and seizure concepts familiar to criminal defense attorneys are generally applicable to searches and seizures of computers and related materials. However, defense attorneys have at their disposal a powerful tool in moving for the return of property and challenging search warrants for computers - the U.S. Department of Justice's ("DOJ") January 2001 publication Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations (2001) (the "Manual").
1. The Manual, published by the Computer Crime and Intellectual Property Section ("CCIPS") of DOJ's Criminal Division, is designed to offer guidance and authority to federal law enforcement agents for searching and seizing computers.
Manual at 1. And while the Manual contains the usual (yet curious) disclaimer that it is intended to "offer assistance, not authority," and it "does not represent the official position of the Department of Justice or any other agency," it is an important resource for the defense lawyer in challenging computer searches.
A review by this office of a recent warrant to search a computer obtained in federal court in Buffalo confirms that federal search warrants to search and seize computers and the affidavits in support of the warrants continue to be broadly drawn and without adequate factual or legal support -- despite the fact that the Manual warns against this practice. Broadly drawn warrants provide agents with license to engage in fishing expeditions that in the more customary search and seizure parlance are known as general searches and are barred by the Fourth Amendment. Whether the inadequate preparation of computer search applications and warrants stems from the complacency that sets in because some applications are "easy" with clearly established probable cause (i.e., a child porn case where there is a confession and retrieval of images from internet web sites) or otherwise, expect to continue to see unsupported applications and warrants.
Armed with the Manual, and despite very little (and generally unfavorable) case authority on computer searches, defense counsel may be able to make serious challenges to warrant affidavits and computer searches. Exposing a case agent's lack of familiarity with the Manual (and its predecessors) on the stand at a suppression hearing will permit strong challenges to the Government's invocation of the good faith exception to save unconstitutional general searches.
The discussion that follows is intended to serve only as introduction to key provisions of the Manual relating to challenging searches of computers pursuant to warrants (as opposed to warrantless searches).
II. THE MANUAL
A. Background
The Manual was designed to replace and supersede the Federal Guidelines for Searching and Seizing Computers (1994) (reprinted at 56 Crim. L. Rep. 2023 (Dec. 21, 1994)) (the "Guidelines"), and the 1997 and 1999 Supplements to the Guidelines. The Manual represents a significant revision, reorganization and expansion of the Guidelines for guidance on computer related searches.
The most significant expansion from the original Guidelines occurs in discussions of federal statutes that impact searches because they provide for possible civil liability (and in the case of Title III, possible suppression of evidence) for failure to comply with their provisions. Chapter Three of the Manual addresses compliance with the Electronic Communications Privacy Act, 18 U.S.C.§§ 2701-11, which protects privacy rights of certain information of subscribers and customers to network service providers (such as Internet Service Providers (ISP's)) providing various computing services. Chapter Four of the Manual addresses issues relating to electronic surveillance statutes in computer investigations, including 18 U.S.C. §§ 2510-22 ("Title III").2
The Preface makes clear that the Manual is not intended to be relied on as authority and is not an official DOJ position.3 Manual at 1. Nevertheless, a theme woven throughout the Manual is that Assistant United States Attorneys and federal agents preparing and executing search warrants should take great care in building probable cause, drafting the affidavit and warrant, and executing the search. To that end, contact information for sections within the Criminal Section is provided for agents and line prosecutors, as well as for the CCIPS.
Within the DOJ, and federal law enforcement agencies generally, there is greater encouragement for at least one technically trained agent to be present in local field offices. Additionally, regional offices will house experts in actually conducting searches of technology systems for evidence. See, e.g., Manual at 35. Within the FBI, for example, some agents are designated as members of the Bureau's Computer Assistance Response Team,4 or CART Team. See, e.g., Statement for the Record of Louis B. Freeh on Cybercrime, before the Senate Committee on Appropriation, Subcommittee for the Department of Commerce, Justice, State, the Judiciary, and Related Agencies (Feb. 16, 2000) ("[c]urrently the FBI has 26 full time CART personnel at FBI Headquarters and 62 full-time and 54 part-time CART personnel in the field, for a total of 142 trained CART personnel").
Notwithstanding the foregoing, and notwithstanding the existence of the Manual, many agents (like many of us) remain technically unsophisticated and are not proficient (or, in some cases, even competent) in respect to the workings or searches and seizures of computers systems. Just one example is the seizure of scanners and printers under the rubric of "memory storage devices," even though most scanners and many printers do not have memory caches that store images of items or data. Accordingly, defense counsel's greater familiarity with the Manual (as well as basic technology issues) may be invaluable in deciding when and how to challenge a warrant, the manner of its execution and how to cross examine the agent at a suppression hearing.
B. Contents
The Manual consists of five chapters, a separate Introduction and Appendix.
Chapter Two deals with searching and seizing computers with a warrant, and a portion of the Appendix provides sample search warrant language. These are addressed in the next section.
Chapter One addresses Searching and Seizing Computers Without a Warrant.
Covered topics include the Fourth Amendment and the expectation of privacy in the computer context, Manual at 8, Exceptions to the Warrant Requirement, Manual at 13, and searches of the workplace of private and government employees.
Manual at 25. Generally, courts have "analogized the Fourth Amendment protection appropriately afforded an individual's computer files and computer hard drive to the protection given an individual's closed containers and closed personal effects." United States v. Roberts, 86 F. Supp.2d 678, 688 (S.D.
Tex. 2000). Therefore, to access the information inside a computer, the government must obtain a warrant, just as if the government were going to open a closed container, if no exception to the warrant requirement applies. United States v. Ross, 456 U.S. 798, 812 (1982).
Chapter Three of the Manual discusses procedures for compliance with the Electronic Communications Privacy Act. Counsel representing an electronic communications provider, such as a network or electronic mail provider, will want to familiarize themselves with both ECPA and its civil remedies and Chapter Three of the Manual. In the context of search warrants, two points should be emphasized. First, the text of the ECPA does not provide a suppression remedy for statutory violations. See, e.g., Manual at 83; United States v. Hambrick, 55 F.
Supp.2d 504, 507 (W.D. Va. 1999), aff'd, 225 F.3d 656 (4th Cir. 2000), cert. denied, 531 U.S. 1099 (2001); but see McVeigh v. Cohen, 983 F. Supp. 215 (D.D.C. 1998) (in highly publicized case involving discharge of gay Navy member, Judge Sporkin arguably suggests suppression remedy for flagrant violations of statute). Second, if counsel is challenging a search warrant where the defendant is a network provider, the failure to comply with the ECPA may provide support for the proposition that the good faith exception should not save the search, considering the extensive tutelage given to agents in the Manual on complying with the ECPA.
Chapter Four of the Manual is directed toward compliance with federal electronic surveillance statutes, including suppression of oral and wire communication intercepted in violation of Title III. Manual at 100.
Chapter Five addresses the corollary concerns in seeking to admit the seized data/information and/or hardware into evidence. From the defense perspective, sloppy or disorganized procedures in packaging, inventorying and/or removing and transporting computer related evidence should, like shoddy procedures for actually searching for files on a computer, be subject to careful scrutiny.
Evidence may be lost, contaminated or corrupted in either the field operation or the data analysis process and, in either case, may give rise to pre-trial motions in limine and close cross examination of the responsible agent at trial.
C. Chapter Two: Searching and Seizing Computers With A Warrant
1. Recommended steps for successful search
In discussing searching and seizing computers with a warrant, the Manual identifies why computer searches are infinitely more complicated than everyday searches for paper documents or evidence:
As a result of these uncertainties, agents cannot simply establish probable cause, describe the files they need, and then "go" and "retrieve" the data. Instead, they must understand the technical limits of different search techniques, plan the search carefully, and then draft the warrant in a manner that authorizes the agents to take necessary steps to obtain the evidence they need.
Manual at 34.
With these complications, the Manual recommends four steps "to maximize the likelihood of a successful search and seizure:
1) Assemble a team consisting of the case agent, the prosecutor, and a technical expert as far in advance of the search as possible.
2) Learn as much as possible about the computer system that will be searched before devising a search strategy or drafting the warrant.
3) Formulate a strategy for conducting the search (including a backup plan) based on the known information about the targeted computer system.
4) Draft the warrant, taking special care to describe the object of the search and the property to be seized accurately and particularly, and explain the search strategy (as well as the practical and legal issues that helped shape it) in the supporting affidavit.
Manual at 34-36.
Thus, the Manual provides fertile ground for agent cross-examination as to issues that precede even the preparation of the affidavit and warrant or the search itself. The Manual correctly suggests that computer searches are more difficult and more technical, and require careful preparation. Thus, the Government's failure to carefully prepare for the search or its sloppy execution are matters that should be relevant to a judge in the context of a motion to suppress and a jury in the context of trial.
2. Various methods of executing searches
The amount of disruption to your client's business (or for an individual, her routine) from a computer search and/or seizure depends not only upon the quantity of computer hardware seized, but also upon the method of seizure - e specially if the hardware is going to be seized for lengthy off-site examination.
The Manual identifies four general methods of executing computer searches and seizures:
1) Search the computer and print out a hard copy of particular files at that time;
2) Search the computer and make an electronic copy of particular files at that time;
3) Create a mirror-image electronic copy of the entire Storage device on-site, and then later recreate a working copy of the storage device off-site for review; and,
4) Seize the equipment, remove it from the premises, and review its contents off-site.
Manual at 36-37. There are huge problems associated with each of these methods although, quite obviously, they are listed by order of oppressiveness to the owner of the property.5 The Manual identifies the "role of the hardware in the offense" as a key factor in determining the search method. If the hardware is contraband, evidence, or an instrumentality of crime, pursuant to Rule 41(b), "agents will usually plan to seize the hardware and search its contents off-site."
Manual at 36. If the hardware is merely a storage device for actual evidence, "government generally should only seize the equipment if a less intrusive alternative that permits the effective recovery of the evidence is infeasible in the particular circumstances of the case." Id.
3. Hardware as contraband, evidence, or an instrumentality of crime versus hardware as a mere storage device for evidence of crime.
In discussing the usual seizure and off-site search of hardware when it is itself contraband or evidence or an instrumentality, the Manual sets forth an exception important to white collar cases:
When the "computer" involved is not a stand-alone PC but rather part of a complicated network, the collateral damage and practical headaches that would arise from seizing the entire network generally counsels against a wholesale seizure. For example, if a system administrator of a computer network stores stolen proprietary information somewhere in the network, the network becomes an instrumentality of the system administrator's crime. Technically, agents could obtain a warrant to seize the entire network. However, carting off the entire network might cripple a functioning business and disrupt the lives of hundreds of people . . . . In such circumstances, agents will want to take a more nuanced approach to obtain the evidence they need.
Manual at 38 (emphasis added).
By contrast, when computer hardware is simply a means of storage for evidence of a crime, the Manual generally recommends seizure and an off-site search "only . . . if a less intrusive alternative that permits the effective recovery of the evidence is infeasible in the particular circumstances of the case."
Manual at 38. Importantly, there is an explicit preference for on-site searches in business settings:
In many cases, the search strategy will depend on the sensitivity of the environment in which the search occurs. For example, agent seeking to obtain information stored on the network of a functioning business will in most circumstances want to make every effort to obtain the information without seizing the business's computers, if possible. In such situations, a tiered search strategy designed to use the least intrusive approach that will recover the information is generally appropriate. Such approaches are discussed in Appendix F.
Whatever search strategy is chosen, it should be explained fully in the affidavit supporting the warrant application.
Manual at 39 (emphasis added).6 Noting the portability of most personal computers, the Manual notes that "agents are particularly likely to seize personal computers absent unusual circumstances."
Manual at 39. While the observation is true, the consequences can be dire for the business if the Government removes "just the PCs." In the client-server environment that has replaced old mainframe-terminal systems, the net result can be that the government removes all the workstations within the business.
4. Multiple warrants when searching networks
Rule 41(a) of the Federal Rules of Criminal Procedure authorizes a federal magistrate judge to issue a search warrant "for a search of property within the federal district . . . ." Recognizing that computer networks may provide access to electronic information that is far outside the judicial district where the warrant is obtained and search executed, the Manual recommends that:
When agents can learn prior to the search that some or all of the data described by the warrant is stored remotely from where the agents will execute the search, the best course of action depends upon where the remotely stored data is located. When the data is stored remotely in two or more different places within the United States and its territories, agents should obtain additional warrants for each location where the data resides to ensure compliance with a strict reading of Rule 41(a).
Manual at 46 (emphasis added). Counsel should move to suppress data obtained from outside the district where the warrant was issued, and may succeed if there is evidence that agents knew the information was outside the district, but proceeded with one warrant anyway.
5. Drafting the warrant and affidavit
Beginning at page 50, the Manual offers extensive advice for drafting the search warrant affidavit and the warrant itself. It is here that an agent's lack of familiarity with the Manual (or the predecessor Guidelines) or deviation from the directions within the Manual or lack of understanding of hardware and or file structures can throw the warrant (or its execution) into jeopardy when a suppression motion is filed. Outlined below are key provisions in the Manual's recommended steps for obtaining a warrant that can be successfully used to challenge the agent on the stand at the suppression hearing.
a. Step 1: Accurately and particularly describe the property to be seized in the warrant and/or attachments to the warrant
The concepts of particularity in the items to be seized and overbreadth are closely related, and both tie the search and seizure of items to the establishment of probable cause to seize such items.
The Fourth Amendment bars general, exploratory searches, and thus requires that "a search warrant describe with particularity the items to be seized."
United States v. Dockter, 58 F.3d 1284, 1288 (8th Cir. 1995) (citing Andresen v. Maryland, 427 U.S. 463, 480 (1976)). "The requirement of particularity is closely tied to the requirement of probable cause to search." Wayne R. LaFave, Criminal Procedure, §3.4(f), at 227 (1984). As the Manual explains, the particularity requirement ensures that the "officers [know] how to separate the items properly subject to seizure from irrelevant items," Manual at 50, so that "nothing is left to the discretion of the officer executing the warrant." Marron v.
United States, 275 U.S. 192, 196 (1927).
The concept of overbreadth ensures that the scope of the warrant is limited to the probable cause established in the affidavit on which the warrant is based. See, e.g., United States v. Leary, 846 F.2d 592, 605 (10th Cir. 1988) ("[A] search warrant is . . . impermissibly overbroad if it authorizes the search and seizure of evidence that is not supported by probable cause."). The overbreadth doctrine ensures that items will be seized only where they are tied with particular illegal activity that support the probable cause determination, specific time periods for which there is probable cause to search for documents, or specific types of documents that support the probable cause to search. See, e.g., United States v. Nagalingam, 166 F.3d 1216, 1998 U.S. App. LEXIS 24980, at *11 (6th Cir. Oct. 6, 1998) (table) (where affidavit did not describe offenses prior to 1993, warrant was overbroad to the extent that it allowed seizure of earlier records); Rickert v. Sweeney, 813 F.2d 907 (8th Cir. 1987) (warrant facially overbroad where it failed to limit the search to records of one particular project for which there was probable cause); United States v. Roche, 614 F.2d 6,
8 (1st Cir. 1980) (warrant for all records of an insurer not justified where affidavit referred only to automobile insurance).
The Manual correctly reflects that "all records" and "all documents" searches should rarely, if ever, survive judicial scrutiny. After discussing whether the focus of the warrant is on the hardware or simply on information stored on the hardware, pursuant to Federal Criminal Rule 41(b), Manual at 51, the Manual instructs agents to carefully limit the language in their application/affidavit and warrant: Agents should be particularly careful when seeking authority to seize a broad class of information. This often occurs when agents plan to search
computers at a business. . . . Agents cannot simply request permission to seize "all records" from an operating business unless agents have probable cause to believe that the criminal activity under investigation pervades the entire business. . . . Instead, the description of the files to be seized should include limiting phrases that can modify and limit the "all records" search . . . .
In light of these cases, agents should narrow "all records" searches with limiting language where necessary and appropriate.
Manual at 52 (citations omitted). The Manual recommends that the agent begin with an "all records" description, add limiting language relating to the crime and time period, describe explicit examples of the records to be seized, and indicate that the records can be seized in electronic and non-electronic form.
Manual at 52.
While the Manual's language stresses limitations, ironically the Manual itself goes on to propose sample search warrant language that is extremely broad and encompasses all sorts of computer hardware and software to which no probable cause has been established. See Manual at 52. The link that government agents (and the Manual) often fail to make is between the data or hardware sought and the illegal activity. Specifically, is there any evidence that the target even owns a Palm Pilot, let alone uses it in his tax preparation business? Thus, neither the Manual nor field practice will significantly limit the scope of the warrants sought by field agents, and those warrants should continue to be challenged as overbroad.
The Manual makes clear that the good faith exception should be invoked whenever necessary to save an overbroad search. Manual at 55.
b. Step 2: Establish probable cause in the affidavit
Step Two in obtaining a search warrant is the preparation of the affidavit and establishment of probable cause "to believe that contraband, evidence, fruits, or instrumentalities of crime exist in the location to be searched." Manual at 55 (citing U.S. Const. Amend. IV). The Manual provides an interesting discussion regarding the forms of evidence that may exist at a place to be
searched:
Importantly, the probable cause requirement does not require agents to be clairvoyant in their knowledge of the precise forms of evidence or contraband that will exist in the location to be searched. For example, agents do not need probable cause to believe that the evidence sought will be found in computerized (as opposed to paper form). . . .
Manual at 55. Although the Manual generally cites authority supporting these propositions, it is suggested that, in specific cases, this advice may be tread too lightly on the particularity requirement, which is inextricably intertwined with the probable cause determination. In document intensive white collar cases (as distinguished from drug or child pornography cases), the agent should be able to specify what particular documents are being sought. And, when computer hardware or data is sought, the agent should be able to tie those items back to the alleged criminal activity. If the agent seeks to seize a litany of computer related items, probable cause to seize those items should be established in the affidavit.
In this vein, consider a major change from the Guidelines to the Manual. In the Guidelines, the "Independent Component" doctrine is described at length under "Seizing Hardware":
To say that the government has probable cause to seize a "computer" does not necessarily mean it has probable cause to seize the entire computer system (i.e., the computer and all connected peripheral devices). Indeed, each component in a computer system should be considered independently.
. . . .
Nonetheless, it is simply unacceptable to suggest that any item connected to the target advice is automatically seizable. In an era of increased networking, this can lead to absurd results. . . . Taken to its logical extreme, the "take it because it's connected" theory means that in any given case, thousands of machines around the world can be seized because the target machine shares the Internet. Obviously, this is not the proper approach. The better view is to seize only those pieces of equipment necessary for basic input/output (i.e., the computer itself, plus the keyboard and monitor) so that the government can successfully execute the warrant. When agents prepare warrants for other devices, they should only list those components for which they can articulate an independent basis for search or seizure (i.e., the component itself is contraband, an instrumentality, or evidence). Certainly, it does not mean that connected devices are exempt; it only requires that agents and prosecutors articulate a reason for taking the item they wish to seize.
Guidelines at 17 (emphasis added). In the Manual, however - as part of the scaling back on specific advice on the establishment of probable cause for seizure of both information and hardware - an explicit discussion of the "Independent Component" doctrine is nowhere to be found. Notwithstanding the absence of specific discussion of the "Independent Component" doctrine, challenges should continue as to broad warrants and massive seizures of hardware, software, disks and CDS. "All hardware" searches are just as repugnant to the Fourth Amendment as "all records" searches.
c. Step 3: In the affidavit supporting the warrant, include an explanation of the search strategy (such as
the need to conduct an off-site search) as well as the practical and legal considerations that will govern
the execution of the search
The Manual recommends that agents "explain both the search strategy and the practical considerations underlying the strategy in the affidavit." Manual at 56. Describing the search strategy, whether an off-site review of hardware will occur, and techniques for searching specific files are all outlined in order to save searches where significant numbers of documents or files or evidence not outlined in the warrant are seized. Defense counsel may move to suppress the entire fruits of a search if the search is executed in "flagrant disregard"
of the warrant:
A search is executed in "flagrant disregard" of its terms when the officers so grossly exceed the scope of the warrant during execution that the authorized search appears to be merely a pretext for a "fishing expedition" through the target's private property.
Manual at 56 (citing United States v. Liu, 239 F.3d 138 (2d Cir. 2000); United States v. Foster, 100 F.3d 846, 851 (10th Cir. 1996); United States v.Young, 877 F.2d 1099, 1105-1106 (1st Cir. 1989)).
Suppression may be a possibility when the agent does not explain the reason for removing the items for off-site examination and the probable cause for the search generally is weak. But, as the Manual recognizes, where items are taken off-site simply because of practical difficulties, the "flagrant disregard"
standard is forgiving to the government.
After a computer is seized, a scattershot examination of every file on the computer may present a search outside the scope of the warrant, or at the least, a lack of good faith. The Manual addresses this concern and recommends that "[w]hen the agents have a factual basis for believing that they can locate the evidence using a specific set of techniques, the affidavit should explain the techniques that the agents plan to use to distinguish incriminating documents from commingled documents." Manual at 59. The Manual essentially recommends a narrow approach where possible, noting that courts have reservations about broad searches stemming from narrow warrants. Manual at 59 (quoting United States v. Carey, 172 F.3d 1268, 1275-76, 1275 n.8 (10th Cir. 1999).
Finally, the Manual recommends that where hardware is seized as evidence or contraband, and the agents plan on searching the hardware itself after the initial search for files that are contraband, "[i]t is a good practice for agents to inform the magistrate of this plan in the supporting affidavit." Manual at 60.
A second warrant may be required to do so. "Whether a second warrant is needed depends on the purpose of the search. If agents plan to search the computer for the information that was the target of the original seizure, no second warrant is required."
Manual at 61 (citing United States v. Simpson, 152 F.3d 1241, 1248 (10th Cir. 1998); United States v. Gray, 78 F. Supp.2d 524, 530-31 (E.D. Va. 1999). "If investigators seize computer equipment for the evidence it contains and later decide to search the equipment for different evidence, however, they should obtain a second warrant." Manual at 61.
On this point, the Manual's advice that a second warrant is required only when a different purpose for the search is present glosses over the "closed container" analogy that is repeated throughout the federal cases on searching computers. Even if the original hardware seizure is proper, a second warrant should be obtained to search the files on the hardware, or at the least, authorization to view those files should appear in the first warrant. Without the second warrant, the first may simply be a pretext for the agents to get files and information they did not have probable cause to seize but were in the computer.
See, e.g., United States v. Barth, 26 F. Supp.2d 929, 936-37 (W.D. Tex. 1998).
6. Sample language for search warrants
Appendix F of the Manual, at 127-138, provides sample language for search warrants and affidavits to search and seize computers.
III. CONCLUSION
Counsel should carefully review the Manual in cases where clients' computers are searched, because in almost every case there will be deviations from the Manual's recommended procedures. Whether those deviations are the result of casual adherence to the Manual or utter ignorance of it, this is a fertile area for suppression practice.
----------------------------------------
1 Available at: http://www.cybercrime.gov./searchmanual.htm.
Page references to the Manual in this article are to the printed html version.
2 With the passage of the USA Patriot Act, we would expect that the Manual's discussion of ECPA and electronic surveillance will be updated in the near future. See http://www.cybercrime.gov/search/html (contains DOJ's field guidance on Patriot Act relating to searching computers and notes that an updated version of the Manual will be released in the near future).
3 This assertion should not stop counsel from using the Manual as necessary in a suppression hearing or at trial.
4 Note that CART team members will often go along on search warrant executions, but not be involved in drafting affidavits.
5 For example, printing out hard copies of particular files can take many hours and agents regularly require that company personnel not be present, thereby essentially shutting down the facility for the duration. Simply making electronic copies of particular files may seem the least oppressive method of seizure until the agents determine that they need to attach peripheral tape drives to the system in order to capture files that are larger than 1.44 MB (the capacity of a floppy disk) and therefore start playing with system configuration files. The parade of horribles is quite extensive.
6 A common problem (and excuse used by the Government) that is articulated to justify the wholesale removal of hardware is that the data being sought is written in a program not in the possession of the Government. Hence, it is argued, the actual machine upon which the program (not only the data) is run is needed by the Government.
From: Midwest Data Group, LLC
398 W. Bagley Road, Suite 206
Berea, Ohio 44017
Office: 440.891.0750
Fax: 440.891.0760
MDG - The Computer Forensic Experts.
Internet security
Checking your PC for invasions
Clearing the hard drive and cache
Operating with a high level of security - encryption
Where to get help, including expert witness
US government warning on Windows
Other general and useful information
Important information for the defense where computers are seized
 |
|
|
