Usability of AI-based Evidence I'm a computer forensics graduate student doing research in blockchain currency (e.g. Bitcoin) forensics. I'm wondering if there are any rulings or decisions regarding the usability and admissibility of AI-generated evidence. For example, if I have an algorithm which identifies suspicious wallets likely associated with ransomware activity and another which helps identify the locations of Bitcoin wallets, how much can I do with this? Can I only use this in the context of furthering an ongoing investigation? Would I be able to obtain a search warrant with this information alone or how much further justification would I need. While I'm particularly interested in ransomware attack attribution, some of this applies to blockchain currency forensics as a whole. As a toy example, suppose I'm working with a team in Los Angeles tracking illegal weapon shipments into the United States and blockchain analysis points us to a distributor likely working out of Wyoming. Could we use this I know there are rulings regarding digital software such as EnCase; since this is approved by the IEEE and the digital forensic community as a whole its use is generally admissible in court. It gets a bit more dicey when the basis for your work is not well-known. For example, while the PageRank and DeepWalk algorithms for graph analysis are pretty well-known, the use of them together to identify suspicious Bitcoin wallets is novel and would likely require some justification. Are there any relevant rulings, decisions, etc. that you could point me towards?
In principle, the evidence could be admitted. Federal Rule of Evidence 702 allows an expert to testify if (a) the expert’s scientific, technical, or other specialized knowledge will help the trier of fact to understand the evidence or to determine a fact in issue; (b) the testimony is based on sufficient facts or data; (c) the testimony is the product of reliable principles and methods; and (d) the expert has reliably applied the principles and methods to the facts of the case. A precedent for admitting AI evidence comes from Bertuccelli v. Universal City Studios. The court determined that Dr. Griffor has experience with algorithmic reasoning for artificial intelligence-enabled driving systems, including facial recognition technology and is considered an expert in the field of facial target recognition. The Court finds Dr. Griffor's methodology reliable given that he conducted an artificial intelligence assisted facial recognition analysis of the King Cake Baby and Happy Death Day mask to determine whether the use of mathematics and target facial recognition algorithms comparing the two works would find that human perception would view the works as substantially similar. Accordingly, the Court finds Dr. Griffor is qualified to testify as an expert in this case. Note that some person has to testify: an machine printout can't just be entered as proof of guilt or innocence. It does not automatically follow that a particular AI method is admissible, but it is at least potentially admissible. Then if some evidence is admissible in court, it may also form the basis for searches and seizures requiring reasonable suspicion or probable cause. See also this article on admissibility of machine learning evidence.
Note that what is being bought or sold here is actually information about the exploit. Attempting to criminally penalize the transmission of information in the US often runs into First Amendment issues. If a person has good reason to know that information is going to be used to commit a crime, or is likely to be so used, and there is no plausible legitimate use for the information, that person might be charged with complicity or conspiracy for distributing the information. But where there are legitimate uses, that is much less likely. Here the information could be used to defend against the exploit, or to identify and remove software subject to the exploit, or for research into such exploits generally. There may be other legit uses as well. Some years ago the Federal government attempted to prosecute a person for exporting a book describing how to create an encryption program. The courts eventually ruled that this was protected speech. I suspect a similar ruling would be made in the sort of case described in the question, but the details would matter.
Whether they are admissible as evidence is up to the trier of law The “trier of law” (judge) decides what evidence is admissible according to the rules of evidence. Documents of most kinds are not admissible on their own (exceptions include “business” documents like invoices and receipts). To be admissible, someone (presumably you) has to testify as to what they are, how they were created and maintained and why they are relevant before the judge will decide if they will be accepted as evidence. Whether they prove anything is up to the trier of fact Evidence is not proof The “trier of fact” (jury in a jury trial, judge in a bench trial) decides what weight to give to any and all evidence presented. They may accept the testimony about the documents or they may reject it. If presented with conflicting testimony they have to decide which they prefer. Judges have to give reasons for their decisions which can be appealed. Juries don’t. Files that are readily changeable are likely to be given less weight than files which have a verifiable audit trail. For example, if you kept your .docx files in a GitHub repository they will be stronger evidence than those kept on a local hard drive.
The general rule is, anything is allowed unless it is forbidden (and not that you can only do things that are expressly permitted). The logical structure of law may be a bit more challenging than procedural programming logic, since it may require a global knowledge and evaluation of the entire code (typically but not absolutely, the scope of the search for "unless otherwise" conditions is restricted to "in this chapter"). In other words, the law is a set of propositions which must all be true, and unlike actual execution of instructions in a sequence, law is to be interpreted simultaneously but hierarchically (that is: the order in which clauses are written is not significant). The appearance that the law is self-contradictory is largely illusory, though the resolution of the conflict may require a careful reading of the law and knowledge of jurisdictional hierarchy (federal law is superior to state law, which entails a particular resolution of the apparent conflict). Sometimes there are real conflicts, which usually result from using words in conflicting ways (note the practice of re-defining words "in this chapter/section/title"). The reason why law is not a science is that law is normative, not descriptive: it dictates what is allowed (a determination made through the political process), and does not attempt to discover what independently is. The reason why the legal process cannot be implemented in software is that software does not yet correctly interpret natural language, and law is written in natural language following interpretations based on judgments of what choices a reasonable would make. Perhaps if you propose a piece of law that you think is contradictory, it would be possible to show how the contradiction is illusory.
Although the USA don't like it, there's a department called INTERPOL which is composed by about 150 countries. When a crime is committed and you need to involve another country to solve it, the sovereignty of each County prevents a police officer from one country acting upon another country. That's when the INTERPOL comes in. They usually requests the police from that country to act up. A judge from that country will grant their local police access to the data to be delivered to the country that requested it. Can the police get a search warrant for data 'in the cloud'? Yes. If the servers are located within the boundaries of your own country, it's a normal procedure. But like the above answer states, it's easier to subpoena the records than to execute a search warrant. In a subpoena, the company itself is bound to provide everything the police asks. Can the police get a search warrant for such third party systems? Yes. If there's enough probable cause, the investigation can lead to allow the police to try and discover files that are held by servers that store the cloud data. But if the servers are located outside the country and the company does not have any office opened in the country, a search warrant won't have validity in another jurisdiction and the police can't act without breaking the sovereignty principle. That's where the INTERPOL services are handy. The department is built in the principle of polices from different countries helping each other. The downside is that it's too bureaucratic and it takes a lot of time. For instance if he has a virtual machine hosted by Amazon, would they serve the warrant on Amazon, or on the suspect? Like mentioned by @Viktor, if the company has an office within the bounds of your country, it's easier to subpoena the records because that way the company will filter and provide only the data linked to the suspect being investigated. That is, the subpoena will have both the name of the company (Amazon) and the name of the Suspect, so the company can provide only the necessary files. Update If the police lack sufficient evidence for a search warrant, but an interpol country was, for some reason, willing to work with the police to collect and provide that information would they be able to use it even if they wouldn't have been able to subpoena a US country? Hypothetically speaking, I see your follow-up as a company that do have a local office and the Federal Police was turned down by a judge on a warrant/subpoena. In that case, there's no reason for another's country police to act on their own country. The suspect is a foreign suspect, the crime is a foreign crime and the police has no reason to work on it. But for the sake of argument, let's say that the local police was turned down by a judge for lack of evidence or something and the suspect has been investigated by a foreign country or whatever. If the information that the local police desires to obtain is available through the INTERPOL, it's most likely to be accepted since it's a data stored by an international police department. In your scenario, the foreign police was granted a legal right to search and collected the data for legal purpose. Maybe they can't use it in their own country, but since they followed a safe chain of custody and provided the information to the INTERPOL, that information has legal validity and it is not fruit of the poisonous tree if the chain of custody was maintained.
Yes and no. There are numerous cases where criminals, upon breaking in to somewhere, find evidence of a worse crime and notify authorities. This will provide reasonable suspicion enough for entering the scene. Generally, in testimony, Statements against Interest are more believable because a burgler wouldn't admit to breaking and entering if he had a way to explain why he was there in the first place. (Example: Alice breaks into a Warehouse and sees a mutilated body and blood everywhere. Alice immediately stops her theiving ways and calls 911 to let them know about the scene. Whether or not Alice stays, a dead body is enough probable cause to secure the crime scene without warrant. Its in Alice's interests to stay and help as there is trace of her at the scene and she would be pegged as a suspected murderer. If she's picked up and admits to calling the cops, it's good, but staying and helping out after the call will likely get her off on the charges related to the murder.). It could also work if they are persuing one crime and discover evidence of a second unrelated crime. (i.e. Alice robs the factory and gets away. The Factory Foreman calls the cops to investigate the crime scene, which at this point, does not need a warrant. While investigating, the Cops find security footage that Bob, the night guard, killed Chuck, a late night worker, removed his body, and cleaned the scene, all before Alice broke into the factory. The outcome of the case being made against Alice does not affect their need to prosecute Bob, as they obtained that evidence while looking for Alice in a valid investigation, not Bob, thus it is legal). Under these situations a crime that leads to a separate valid crime involving a different party is admissible. There are two possible reasons that the attorney might think this: Fruit of the Poisonous Tree: This is the obvious element... the kids committed a crime with the hopes that the cops would use the evidence found by them in their commission of a crime to get the real bad guys. The attorney parent thinks this is stupid because the kids broke in specifically to do this and thus any evidence is now tossed out of court. This isn't usually the case in how this scenario will play. Generally the cops are more than happy to look at evidence obtained by criminals that points to another crime. In fact, this is how a lot of gang enforcement units and drug enforcement units operate... pick up a small fish and cut a deal for evidence against a bigger fish (turning state's in the criminal lingo, as the witness is becoming State's Evidence to another crime). As long as it's given to the cops as part of legitament evidence seeking, the cops can follow the leads where ever they... er... lead... Chain of Custody: This is probably, if properly thinking, what the attorney parent is thinking that's a bit more probable. Lets say these kids found a dead body with a sword in it and take the sword to the police... this could get dicey as the kids have contaminated the evidence in possible ways that the killer's lawyer could get thrown out. One thing CSI doesn't always show (though there are a few episodes where it comes up, but not many) is that when something is taken in as evidence, it is carefully documented, sealed, and tagged with a check in/check out list. Every time the seal is broken, the person breaking the seal notes the time, date, and reason and when does, reseals it with a new seal, and signs the time and date of the seal again. This is so at trial, the attorneys know exactly who opened up the evidence, what they did, and what possible contaminants were introduced. You even have to sign into a crime scene before you go up to the yellow tape. A good defense lawyer would call into question any evidence from anything the kids handled to get the evidence tossed (i.e. Your honor, these Meddling Kids handled the sword without following the chain of evidence. They even let their dog handle it. They had already harrassed my client earlier today by insunuating that he was involved with a hoaxed paranormal activity to scare people away from the factory. Since they claim they found the sword, but did document it at the scene, we don't know anything about it prior to the police's chain of custody. I motion that the evidence be dismissed.) If this is successful, anything from the sword is now no longer admissible as if the sword had never been found (including blood of the victim on the blade and finger prints of the suspect on the hilt)... in effect the evidence was prossessed as best the police could but the veracity of the story of it's discovery is too questionable to be considered. The defense does not have to be right, he just has to show there could be another explanation for the sword and the evidence linking his client to the crime committed by it. In short, without specific details, the attorney parent could be right or could be wrong, or more humorously, right, but for the wrong reasons. Edit: U.S. only. See other answers for other jurisdictions.
[I'm not so well-versed on US and Russian law, thus I will limit my answer to EU law.] Your specific use of a user identifier, as I understood from your question, can be classified as personal data, so in your case, the GDPR seems to apply. This means that you need to have a) legitimate purposes to process that personal data (e.g. crash reporting) and b) a legal justification for each purpose of processing: it could be based on consent or another legitimate purpose (inc. your own legitimate interests). Consent might not be the best option for you, but it's up to you to decide. In any case, you need to assess the risks to the data subjects (your users) before you decide. How likely is it that you will get breached, and what potential harm will that cause to your users? These are some guidelines; my recommendation is that you read the law and the guidelines by the Article 29 Working Group and European Data Protection Board, or hire some good experts on this. There is no easy answer, or one size fits all solution. The GDPR isn't so hard to understand or implement, but it does require some change in mindset. With the new law, processing personal data carries a higher risk of penalties, so you should do it only when it's absolutely necessary, and with respect to the rights of your users.
A fundamental requirement of criminal culpability is intent. Based on the description this whole process is happening after a user has already had their phone seized. If a person was not aware of Signal's hidden files to damage the police's data forensics software, they will not have met the criminal intent requirement, either maliciously or under a criminal negligence theory. None of the prongs of CFAA are strict liability statutes (18 U.S. Code § 1030 &quot;Whoever having knowingly accessed a computer...&quot;), so that would not apply here. If we imagine a person that is aware of all the information from Signal about their app intentionally abusing Cellebrite's package and with intention to cause damage downloads Signal's malicious files to their phone, I think it's an open question whether or not they would be liable under the CFAA. Specifically, 18 U.S. Code § 1030(a)(5)(A) (emphasis mine) Whoever knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; An argument on this could go both ways. On the one hand, the owner of the phone could be found to not have substantially caused the information to be transmitted to a protected computer, as the police were the integral cause for that in executing their warrant. On the other hand, this sort of file could be considered a digital &quot;booby trap,&quot; and booby traps are illegal for essentially this reason, that they have a foreseeable effect of causing harm to people who are lawfully inside a building without the owner's permission. In this case, the owner's trap was sprung by law enforcement but still placed by the owner in order to damage them.