Stories
Slash Boxes
Comments

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Federal Judge: Keystroke Logging Isn't Wiretapping

Posted by timothy on Tue Nov 23, 2004 12:18 AM
from the not-covered-under-existing-law dept.
TospenJ writes "A federal judge in Los Angeles has dismissed wiretapping charges against a California man who used a hardware keystroke logger to spy on his employer, SecurityFocus is reporting. The court ruled that the device doesn't violate the federal Wiretap Act because it only intercepted signals off a keyboard cable, not an interstate network. The government is asking for reconsideration. Ironically, the judge relied in part on the Scarfo precedent, which allowed the FBI to use such a keylogger without a wiretap warrant."
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • Either it's a wiretap or it's not.

    Heads the prosecutors win and the FBI loses.
    Tails the prosecutors lose and the FBI wins.

    Looks like tails.
    • Yes, but surely they'll get him on other charges (hacking, spying, whatever..).

    • Either it's a wiretap or it's not.

      They didn't say it wasn't a wiretap. They said it wasn't a Federal wiretap because the keyboard cable didn't cross a state line. This is a proper and just ruling.

      Why didn't they just charge him under a state stature? I could think of at least two violations of NYS Penal Law for a keyboard logger -- just off the top of my head and IANAL. Why should we want the Feds to have more power then they already do?

  • Ironic? (Score:4, Insightful)

    by forkazoo (138186) <wrosecrans@noSPAm.gmail.com> on Tuesday November 23 2004, @12:20AM (#10895557) Homepage
    How exactly is that ironic? Judge upholds precident. Wow, that's an unexpected turn!
    • Re:Ironic? (Score:4, Informative)

      by tsm_sf (545316) * on Tuesday November 23 2004, @12:29AM (#10895616) Journal
      Yeah, pretty logical too. A key logger isn't a sniffer.

      It's not up to the judge to (in a case like this) rule on the moral guilt of the defendant, but just to determine if they've broken the applicible law. Now is when we'd see the legislative branch of our government swing into action, were it not populated by scum-sucking filth.
    • Re:Ironic? (Score:5, Insightful)

      by identity0 (77976) on Tuesday November 23 2004, @12:32AM (#10895639) Journal
      It's ironic because the feds want to prosecute this guy, but their previous power grab backfired on them.

      They argued in a previous case that a keylogger was not a wiretap and thus did not require a warrent, now they're trying to argue the other way around when it suits them - but the judge used their previous arguments against them.

      Irony and poetic justice at once, really. But does anyone else think it should be the other way? That is, that it should be considered a wiretap when done by either FBI or private citizen, and regulated accordingly? I don't think people should be snooping on other people's computers any more than the FBI...
      • No. Well, maybe. (Score:5, Insightful)

        by raehl (609729) <{moc.oohay} {ta} {113lhear}> on Tuesday November 23 2004, @03:00AM (#10896184) Homepage
        If they use a keylogger to capture what I type into my online journal, it's not a wiretap. If they use a keylogger to capture what I type to my mother, it's boring, and sometimes profane - but probably also a wiretap.

        This is a case where judges are forced to apply old rules for old tech to new tech. The original intent of the wiretap law was to prevent people from eavesdropping on conversations between two parties without appropriate judicial oversight. So is using a keylogger wiretapping? It depends.

        The real answer is an updated law to reflect the updated technology. Relying on Judges to protect our rights is the sign of a lazy legislature.

        • The original intent of the wiretap law was to prevent people from eavesdropping on conversations between two parties without appropriate judicial oversight. So is using a keylogger wiretapping? It depends.

          That's true, but the reason the feds are allowed such a law is because only the federal government is allowed to regulate interstate commerce. That's why the scope of this federal wiretapping law is only within the bounds of interstate communications. In this case the content of the communication is i
        • I don't know why the FBI is even involved.
          Oh, I'm sure it has something to do with the... <reads sig> ...never mind, I can't talk about it.
            • Re:Ironic? (Score:4, Funny)

              by idontgno (624372) on Tuesday November 23 2004, @11:50AM (#10899407) Journal
              Alanis Morissette's Ironic. Ironic, because it's a song about irony, purporting to cite multiple glowing examples of irony, and containing exactly no irony. Except the meta-irony of being un-ironic.

              Kinda Zen, that.

    • Re:Ironic? (Score:4, Funny)

      by knifeyspooney (623953) on Tuesday November 23 2004, @01:41AM (#10895925)
      Ironically, the government is prosecuting a case to protect a citizen's privacy!
  • Payback (Score:4, Funny)

    by Anonymous Coward on Tuesday November 23 2004, @12:20AM (#10895558)
    Hmmm.
    Isn't that ironic?
    Now that there's precident, I can start spying on John Ashcroft!
    Payback Be-och!
  • Sounds fine to me. (Score:3, Insightful)

    by Anonymous Coward on Tuesday November 23 2004, @12:21AM (#10895563)
    But isn't running trojan software to monitor someone illegal by other means anyway? I mean, these overbroad "unauthorized access of a computer system" laws must be good for something.
    • Um, it's a hardware logger, not a software one. Probably one of those things about a cm in diameter and 2cm long that the keyboard plugs in through.

      But yeah, it seems to me that those "unauthorized access of a computer system" laws should be useful in this case. And anyone who's looked at computer-related legislation in the last 15 or so years knows there's a lot of those.
    • The point of this case was the scope of Federal Wiretapping Act applies only to information in transit. A trojan, by sending information over an inter-state network would be subject to federal control. Since, however, the keylogger only recorded information entered at the one terminal, and not communications that traveled over state lines, it is not.
  • Wire (Score:3, Insightful)

    by BlackMagi (605036) on Tuesday November 23 2004, @12:21AM (#10895564) Homepage
    What part of the word wire do I not understand? My keyboard is attached to my PC with a wire. Don't know about yours...
    • Re:Wire (Score:2, Insightful)

      Mine's wireless via RF radio! Would listening on the radio frequency of the wireless keyboard count?
    • Well, in that case, the FBI will be around shortly to install a listening device onto your private Asterisk PBX. Or even a tape recorder onto your 2 tin cans connected by string.

      The point is that your keyboard is not on a public network and therefore is not subject to wiretap regulations, which only cover devices directly connected to public communication networks.

      Is it unethical? Damn right it is. Legal? Apparently so.

    • Re:Wire (Score:4, Informative)

      by bsartist (550317) on Tuesday November 23 2004, @12:27AM (#10895604) Homepage
      You understand the word wire just fine - you do not understand the word federal. Federal law applies if the wire crosses state lines - so if your PC is in California and your keyboard in Nevada, federal wiretap law would apply.

      Note that the judge specifically stated that the federal law does not apply here - if California has any laws regarding wire tapping, those still might apply.
  • by mordors9 (665662) on Tuesday November 23 2004, @12:23AM (#10895570)
    I think one of the main reasons we have these sorts of decisions is the fact that the average judge is so old he has no idea what a computer is or what it is being used for. To say that typing on a keyboard would not possibly be an interstate communication shows a lack of knowledge of what email is, what irc is, what instant messaging is......
    • by Laivincolmo (778355) on Tuesday November 23 2004, @12:26AM (#10895597)
      I don't mean to sound like a flamebait, but the parent has a very good point. Maybe it is time to consider the fact that while with age comes wisdom, with age also comes irrelevance with current day. They might represent the ideals of the people from when they were in their prime, but they certainly do not reflect on today's technological society in general. Maybe voting for justices?
      • That sounds to me like the DA didn't do their job right. It's their responsibility to try to convince the judge/jury that the defendant has committed what he's been charged with. Part of that is educating them about nonobvious yet relevant consequences of the applicable law(s). This means demonstrating how keystroke loggers are capable of intercepting email, instant messaging, IRC, MUDs, etc.

        Any reasonable judge should be able to understand that when it's pointed out to them. That doesn't mean it'll sp
      • by grasshoppa (657393) <skennedy AT tpno-co DOT org> on Tuesday November 23 2004, @12:37AM (#10895670) Homepage
        The subject matter is irrelevant. With age does come wisdom, and the ability to make decisions regarding new technology.

        Youth, on the other hand, lacks wisdom, and is double-wammied by believing they have it.

        Given the choice between the two, guess which I'd choose.
      • Voting for judges is a bad idea. The last thing you want is for judges to have to pander to public opinion in order to secure reelection. It's not good for keeping the judiciary unbiased and focused on the law. (Yes, I know many jurisdictions in the U.S. elect judges. It's a bad idea there too.)
    • by Have Blue (616) on Tuesday November 23 2004, @12:37AM (#10895666) Homepage
      The judge in this case may actually be correct. The keylogger was installed between the keyboard and the computer; it only intercepted signals traveling between the CPU and the keyboard. This signal is not transmitted directly onto the Internet on even the lowest level connections; it just causes the I/O controller to create a record in a buffer somewhere and schedule an interrupt for the CPU to handle it. It would no more be interstate communication than watching someone write down a phone number would be traditional wiretapping.
      • it only intercepted signals traveling between the CPU and the keyboard.

        Well, but if you apply the same reasoning to telephones, you should be able to wiretap any phone as long as the wire is between the actual telephone and the first switch. After all, any information through that wire will only go from the switch to the phone and vise versa. It won't be transmitted directly either - it will be digitized, encoded, stored in packets and embedded in T1 and SDH frames.

    • by trolluscressida (564353) on Tuesday November 23 2004, @12:49AM (#10895720)
      You missed the point of the article entirely.

      The federal law makes wiretapping an interstate transmission illegal. What you type on your keyboard and gets sent to your computer is not going to be an interstate transmission.

      If the wiretapping device had been between say, the computer and router - than the wiretap act may have been properly invoked.

      So you criticize the judge without reading the article or understanding the issue at hand. The judge may be old but he's certainly clever, understands computers, and picked up subtleties which you didn't even know existed.

      Yes there are clueless judges. Doesn't look like this is one of them.

      Score one for the old guys.

      From the article:
      But district court judge Gary Feess disagreed, and last month granted a defense motion to dismiss the indictment. Feess ruled that the interception of keystrokes between the keyboard and the computer's CPU did not meet the "interstate or foreign commerce" clause in the federal Wiretap Act, even if some of those keystrokes were banging out e-mail. "[T]his court finds it difficult to conclude that the acquisition of internal computer signals that constitute part of the process of preparing a message for transmission would violate the Act."

      "The network connection is irrelevant to the transmissions, which could have been made on a stand-alone computer that had no link at all to the internet or any other external network," Feess wrote. "Thus, although defendant engaged in a gross invasion of privacy ... his conduct did not violate the Wiretap Act. While this may be unfortunate, only Congress can cover bases untouched."
      • by plastik55 (218435) on Tuesday November 23 2004, @01:33AM (#10895891) Homepage
        The federal law makes wiretapping an interstate transmission illegal. What you type on your keyboard and gets sent to your computer is not going to be an interstate transmission.

        You know, when I make a phone call, it goes from my phone line to the local switch. Then it goes from the local switch to a regional switch. Maybe it makes its way to an interstate line. Who knows? It depends what number I call. But the signal that goes between my house and the local switch, well, that doesn't cross state lines, right?

        So if you tap the phone line from my house to the local switch, the signal you are tapping never crosses state lines. Therefore a federal agency can tap my phone line with impunity.

        See, the network connection is irrelevant to the transmissions, which could have been made on a stand-alone phone with no link at all the a long-distance network. Therefore no local phone taps violate the Wiretap Act.

        Right?

        After all, as defined in the Act, ''electronic communication'' means any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photooptical system that affects interstate or foreign commerce. It's crystal clear.
        • For 1, it doesn't matter if what is typed is later relayed by the computer out of state. All the key logger is doing is recording the signal from the keyboard to the computer. For 2 my guess would be that technically if the data never left the state, meaning it didn't through any routers outside of the state, on its way to the destination, then it would be legal under the wiretap act.
    • "I think one of the main reasons we have these sorts of decisions is the fact that the average judge is so old he has no idea what a computer is or what it is being used for."

      That may have been the case in the earlier case (where the FBI's claim that a keylogger was not a wiretap was upheld), but in this case, the judge was merely following precedent, which is what a judge is supposed to do. The law is supposed to be consistent. When two judges make conflicting rulings, the result is a mess that usually
  • by Anonymous Coward on Tuesday November 23 2004, @12:23AM (#10895571)
    It was keystroke logging. But there should be a law against that.
  • What good is a cake if you can't eat it too?

    /sarcasm
  • Of course (Score:2, Insightful)

    When the federal government or a company does it, it isn't wiretapping. But if the common man does it especially to a company or the government in return it is.

    If only people would realize that the depth and breadth of the hipocrisy the current powers that be employ, they would be shocked.
    • Re:Of course (Score:5, Insightful)

      by Phosphor3k (542747) on Tuesday November 23 2004, @12:26AM (#10895591)
      What the hell are you talking about?

      The judge ruled the man didn't break any laws. It's not wire-tapping for the FBI, and it's not wire-tapping for civilians.
    • we have a term for this, its called fascism.

      we have a document that is supposed to protect the people of this nation from govt overreaching. its called the constitution.

      However in the current world of neo-con spinmasters, anyone that doesn't go their way is an 'activist judge'. its the typical vilify your antagonist as a method to distract the people from the complex underlying issues.

      For a few dollar more i can install a slippery slope for you.
  • by Justin205 (662116) on Tuesday November 23 2004, @12:26AM (#10895594) Homepage
    1) Check the keyboard connection. Remove any foreign devices and destroy them, if need be.

    2) Check for any odd or suspicious processes running in the background. Kill processes that don't look right (can be very dangerous though, and impossible if it's running as another user...).

    Maybe if someone had a list of known keylogger processes, it'd be fine to kill processes... Google doesn't turn up anything like that easily. If someone feels like going more in-depth into the search and finding a nice list, feel free.

    Or maybe just use a password-protected laptop, that only you can use. And I mean a good, secure password.
    • That won't make you entirely safe. If someone has physical access to the keyboard or computer, it's not difficult to install the keylogger inside either. And keyboards often use common microcontrollers: my Logitech Internet Navigator, for example, uses the 68HC08JB8. It could be possible to replace the microcontroller with one that has altered firmware, to log keystrokes pretty much invisibly. Build in a long passphrase to trigger dumping the logged keystrokes, and you're in business.
  • Wiretaps (Score:2, Insightful)

    Wiretaps should be any recording device attached to any device or cable that sends or recieves data. After all its a "Wire" "Tap".
  • by Sheetrock (152993) on Tuesday November 23 2004, @12:29AM (#10895615) Homepage Journal
    There needs to be a clearcut distinction made between good guys and bad guys in the wiretapping statues.

    If keystroke logging isn't wiretapping, maybe this opens a whole can of worms whereby spyware becomes legal. And if software that sits on my machine without my knowledge relaying my credit card information to a teenager in a foreign country can't be considered wiretapping -- or if the same standard is applied to spyware purveyors as to government agents -- then there's something screwy in the law that needs to be fixed.

    I think spyware needs to be stopped now. And I don't think that the ability to conduct legitimate investigation should be confused in the law with some guy allegedly spying on his employer. Two different things that need to be handled two different ways.

  • it only intercepted signals off a keyboard cable, not an interstate network

    The feds usually argue that just being connected to the internet makes the machine involved in interstate commerce. Or actually they rarely even have to argue this. If they lose this and have to show that interception or fraud involved actual interstate network traffic, a lot of convictions will fall.

  • by yorkpaddy (830859) on Tuesday November 23 2004, @12:32AM (#10895637)
    does it matter if the physical hardware is local, and then transmits the data over interstate lines. Is it legal if the FBI installs a key logger, that they have to physically access? What about a video camera that doesn't transmit pictures but records them to tape. The tape is then accessed without sending the data over comunication lines or radio, is that legal?
  • Correct ruling (Score:5, Insightful)

    by bobhagopian (681765) on Tuesday November 23 2004, @12:33AM (#10895645)
    In Constitutional terms, this is the correct ruling. Federal laws only extend to "interstate commerce," which these days is interpreted to mean "interstate anything."

    I do see the sad humor in the government's hypocrisy, given their arguments in the FBI wiretapping case. However, the real outrage here is that there is no state law which clearly prohibits the interception of electronic signals.

    Remember, folks, the states are supposed to take care of their own business. It's not always convenient, but it's how the Constitution gives primary power to state governments rather than the federal one.
  • This ruling appears pretty straightforward, after all a keyboard cable barely reaches 5 feet much less across state lines. However, when you realize that the standard in question was simply 'affecting interstate or foreign commerce' the result is much more significant. Especially considering the very broad interpratation of this clause in the past.

    If this ruling is upheld it could have some very interesting consequences relating to governmental power. In general the federal government only has the power to legislate things which affect interstate commerce (plus a bunch of other exception...which we won't consider here). For instance if it was determined that a TiVO does not affect interstate/foriegn commerce the FCC would not have the ability to foist broadcast flags or other copyright protection mechanisms. Similar problems would occur with any attempt to federally regulate copyright protection into the PC.

    Surely, one would think that protecting copyright would affect interstate commerce (whether this is effective or not is an entierly seperate matter). However, this misses the true significance of this ruling. Despite the fact that some of the keystrokes were sent in interstate email he still apparently considered the keyboard itself not to be affecting interstate commerce. For this not to be considered interstate commerce suggests a much stricter/direct standard is being applied.

    Perhaps I am misinterpreting the standard involved. The article wasn't very precisce and perhaps the federal wiretap act actually requires the *communication itself* to be interstate. However, I think this is unlikely as I believe it also covers *in state* wire taps. Although, even if I am correct I imagine this will be reversed on appeal. This is simply a far too drastic change in understanding of what it means to affect interstate commerce.
      • Yes, congress is specifically given the right to set up an institution of copyright. If you had cared to read my post I never suggested that copyright law would be thereby overturned. However, nothing in the text of the copyright clause in the constitution appears to give congress any power to regulate devices which might circumvent copyright. Unless you actually have historical precident which suggests the courts have interpreted this clause not only to give congress the power to create copyright but al
  • rawr (Score:4, Insightful)

    by Renraku (518261) on Tuesday November 23 2004, @12:54AM (#10895743) Homepage
    Like an earlier poster said.

    Can of worms.

    So monitoring a phone line is wiretapping. What about monitoring the cord between the handset and the phone?

    Same difference here. 9 times out of 10, a computer is used to communicate with another computer in the workplace, or beyond the workplace. Monitoring the connection between the keyboard and the PC is monitoring interstate communication.
  • by laughingcoyote (762272) <barghesthowl&excite,com> on Tuesday November 23 2004, @02:08AM (#10896013) Journal

    First off, it looks like the FBI, -in this case-, was acting legitimately, with authority from a judge. The fact that they had only a search warrant, rather than a wiretap order, is a technicality, they could have gotten either one with probable cause (which I presume they had, since nothing has been presented to the contrary.)

    However, I am concerned about the broader scope of this precedent. The earlier post and article already mentioned keylogging by everyone from jealous spouses to bosses. Do we not need to draw a line (and demand that our state legislatures do so) by enacting privacy protection for this type of scenario?

    While we decry "activist judges", the fact remains that technology is quickly outpacing the laws made to cover it. Under the current strict interpretations that seem to be in vogue by the courts, laws are obsolete before they get out of their Senate committee. Someone will figure out a new way to do something that flaunts the spirit of a law without -technically- violating its letter.

    Given that, it would seem that judges need to look at the intent of laws as well as their specific, strict letter. It certainly applies that "freedom of speech" applies to email and websites as well as the spoken and written word, even though such things are (obviously) not mentioned, as they didn't exist. Similarly, it would seem to me that the wiretap law is being construed quite narrowly here. The obvious intent of the law is that communication is private and protected from snooping except from legitimate law-enforcement authorities under strict court scrutiny. Bosses and spouses should, quite simply, not be allowed to monitor your communications without your explicit knowledge, consent, and full understanding of what is being snooped and when. Law enforcement agencies should not be allowed to do it except with probable cause and under court scrutiny.

    It seems to me that changing the location or type of monitoring (a hardware or software keylogger rather than a traditional wiretap) still is doing exactly what this law is intended to prevent. I hope, given the judge's very narrow decision, that similar laws will be passed that protect us against similar types of snooping, from law enforcement or anyone else.

  • From thinkgeek.com (Score:3, Informative)

    by mansa (94579) on Tuesday November 23 2004, @09:52AM (#10897959)
    In case you were looking, here's the device [thinkgeek.com].

    Have fun with your self-styled "security experts" at work!
    • Where did we start to hold the assumption that the police are not civilians?

      Not that this has anything to do with whats going on... but the moment they were handed guns and given special powers over civilians. That is the instant they are not civilians... Lets be honest now, our police is no different than the military it might as well be a branch and we should dispense with any notions that the police shouldn't be held to a higher standard than "civilians".
      Again not that this has anything to do with thi