I've been bothered by the item I wrote about yesterday on a data center search that removed data wholesale and impacted an unknown (but probably large) number of individuals and businesses not covered by the search warrant. This is exactly the sort of thing that outraged the colonists and created the fourth amendment in the first place.
So how should a data center search be conducted?
If somebody gets shot on the sidewalk in front of your business, you're not going to be doing much business until they clear the police tape away. That's not an unreasonable accommodation to the needs of law enforcement. An unreasonable accommodation would be to have them haul off the front wall of your store for blood spatter analysis instead of taking samples and photographs.
I think, for the US at least, a reasonable accommodation might be for large data centers to have a requirement to keep law enforcement apprised of what hardware they are using with what storage capacities. The information could be held by a judge and only opened up to the police as part of mandatory prep for a search. Thus the information provided can't be used for competitive business purposes, just in aiding a search to minimize disruption to innocent parties.
The police (local, state, federal) then have an obligation to come on site with high speed data copying gear of requisite capacity, a server set to respond to all relevant IPs and ports with relevant applications that explain the situation and the rights of innocent data holders and how they can monitor the situation for privacy violations. If there is a need to sieze physical drives, leave the data center (if they are not the actual target of the investigation) with some adequate loaners that they need to replace inside a reasonable period.
If you set things up well enough, the service outage shouldn't be anything more than a particularly ill-timed back hoe taking out a fiber optic cluster, something annoying but not particularly business threatening. Knowing what web site to visit, judge to call, and address to letter write or visit, means that people are apprised of their rights and they can address their worries in a timely fashion.
Any data taken should be held by a judge and turned over on the basis of meeting the criteria of the original search warrant and further data of other accounts should only be investigated if a separate search warrant is justified in the traditional way and the person to be searched is notified.
With the original case resolved, all irrelevant data not used in the case should be destroyed or given back to their original owners as if it were the fruit of an illegal search but without the civil suit rights that would attend an actual illegal search.
Posted by TMLutas at February 26, 2004 08:59 AM