Are online accounts and phone numbers frozen when &quot;electronic devices&quot; are seized by law enforcement? The recent seizure of the cellphones and computers of Rudy Giuliani by the FBI led me to wonder about the immediate, extra-legal consequences for such an individual. Would this individual be restricted from transferring their phone number to another phone in order to continue using it, or to access their &quot;contacts&quot; list. Same for &quot;social media&quot; and other accounts (e.g. a password manager) – would the individual be locked out of those as well? As a &quot;non-legal&quot; person, at first glance it seems to me that it would follow that the accounts would be frozen in order to preserve any evidence being sought. However, thinking about it further, if the warrants were only for &quot;electronic devices&quot; exclusive of electronic accounts and services (e.g. cell phone and social media accounts), then the individual should legally still be able to access them. Stated a simpler way: what is the scope of a warrant for &quot;electronic devices&quot;?
Assuming that the police have a warrant to seize your cell phone, the scope of what can be seized is specified in the warrant. It is not automatic that seizing a phone entails seizure of some or all online accounts (e.g. automatic backups, collections of passwords in a Google account) and it does not automatically &quot;freeze&quot; or block a person's access to their accounts including phone accounts. It's not that it is impossible to seize an account, it's that it is not automatic: it has to be in the scope of the warrant. Here is a collection of petition templates, asking the court to allow the seizure of various things for various reasons (mostly electronic), including access to bank accounts. If the police suspect that information might be available online after it has been deleted from a phone, they would need to include online accounts in the scope of the petition(s). There is even a template for &quot;give me everything&quot;, called &quot;Frankenstein&quot;.
It has been investigated, it simply has not been prosecuted. The investigation started when someone reported suspicious activity in Hastert's accounts. The investigation proceeded from a belief that he was being blackmailed. After listening to a wire of a conversation between Hastert and the alleged blackmailer, the officers investigating decided it was not a simple case of him being blackmailed--they or the prosecutors' office used their discretion to go after Hastert for illegally structuring his payments to avoid anti-money-laundering reporting laws, and to my knowledge have not yet pursued any blackmail charge. Police and Prosecutors have very wide discretion regarding what charges they bring. In addition, it is very common to have a civil lawsuit brought that implicates criminal laws, but not have the criminal violations be charged. For example, if you steal a purse you go to jail, but if you steal a building you are rarely charged with a criminal offense. It is rarely to a civil litigant's advantage to bring up criminal matters and there are ethical rules limiting the interaction between the two.
A warrant is required: you cannot just bust into a home because the owner died. Nothing that you describe resembles the kind of emergency situation that allows a warrantless search. In order to get a warrant, you have to have a good enough reason. Suppose that campus police found a suspicious object at the scene which was evidence of a crime and which had an identifiable connection to his home. Campus police might get a warrant to search the home, to find evidence related to the possiblity that this was a murder. That evidence could be evidence that he had uncovered a terrorist plot to bomb Needles CA, and he was killed because of that. His home computer might contain records of contact between him and the terrorists: so the judge might grant a warrant. The FBI might also go to a federal court for a warrant for a different suspected crime, for example a planned bombing of Needles. Since this involves national security, this could be a FISA court, which is a secret court for surveilling foreign spies in the US. The daughter has the (apparent) authority to consent to a search – police are not required to inquire very deeply into a person's authority to consent to a search. If she doesn't consent, the police of the FBI might have probable cause for a warrant – it has to be an articulable reason, not just a mystical intuition (TV cop shows notwithstanding) that there must have been a crime and the house has evidence of the crime.
Massachusetts is a 'two-party' state. So you'd have to have consent from them to record. You could probably travel to a 'one-party' state such as one of the states listed here and call them while recording. In a one-party state, only one of the parties to the conversation needs to know about the recording. In those states you don't even need to inform them. It would be interesting to see if the law applied to where the call center is located. When calling credit card companies these days, the call may be routed to any number of places depending on call loads, and those places might be out of country as well.
This would be illegal in Australia (Criminal Code Act 1995 part 10.7: any unauthorised impairment of electronic communication to or from a computer), the US (Computer Fraud and Abuse Act) and any other jurisdiction that I can think of. There is no exception allowing vigilante action in case a person has a reasonable belief that the material on a website is offensive or illegal. In general, the law does not allow immunization against criminal prosecution in case the victim of an attack is himself a criminal. Only the government has the right to punish criminals.
Yes, this violates the GDPR if the user is in Europe. Data which is tied to a personal device can be tied to the person who owns it. From "What Is Personal Data" by the UK Information Commissioner's Office (ICO) (emphasis added): Personal data is information that relates to an identified or identifiable individual. What identifies an individual could be as simple as a name or a number or could include other identifiers such as an IP address or a cookie identifier, or other factors. If it is possible to identify an individual directly from the information you are processing, then that information may be personal data. If you cannot directly identify an individual from that information, then you need to consider whether the individual is still identifiable. You should take into account the information you are processing together with all the means reasonably likely to be used by either you or any other person to identify that individual. The bit about "all means reasonably likely" in the last bullet includes the kind of de-anonymisation tactics described in the NYT article. There are 6 lawful bases for data processing in the GDPR, and all processing must fall under at least one of them. (a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose. (b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract. (c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations). (d) Vital interests: the processing is necessary to protect someone’s life. (e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. (f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.) Selling data isn't covered by any of the others, so consent must be obtained. Permission must be clear and positive, and you cannot predicate delivery of a service on the processing of data that isn't necessary for that service. So for instance you cannot say "You can use this service as long as we are allowed to collect and sell your data" because selling the data isn't necessary to the provision of the service. From "Consent" by the ICO: Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent. Explicit consent requires a very clear and specific statement of consent. Keep your consent requests separate from other terms and conditions. Be specific and ‘granular’ so that you get separate consent for separate things. Vague or blanket consent is not enough. [...] Avoid making consent to processing a precondition of a service. This applies to any processing of data about individuals within the EU, so just being an American company doesn't get you a free pass to ignore the GDPR if your app gets used by Europeans. The "Legitimate interests" basis is more problematic, in that the company collecting the data has to conduct a vague "balancing test" to determine if this basis applies. For direct marketing the ICO has written this, which says that direct marketing may be a legitimate interest, especially if you can show that the user has expressed interest in such adverts. For instance a location service which promises to tell you about nearby special offers would fall into this category. Against this, the impact on the user's privacy has to be considered, and location data is "special category data" because it can reveal medical information (e.g. hospital attendance) or religious affiliation (e.g. which church you go to). So unless the relationship between the recorded location data and the service is very direct its not going to pass the balancing test. The company would also need to distinguish between knowing the current location and keeping a record of historical locations; the two need separate justification. And of course nothing about this covers the sale of the data; this is considering a company which sells advertising space in it's app, not one that sells the data itself.
The relevant Maryland statute is MD. Criminal Law Code Ann. § 9-307 (2021), subsection (a): A person may not destroy, alter, conceal, or remove physical evidence that the person believes may be used in a pending or future official proceeding with the intent to impair the verity or availability of the physical evidence in the official proceeding. Note &quot;that the person believes&quot; and &quot;with the intent to.&quot; If you have no reason to think it might be necessary in an official proceeding, you aren't violating this section. If you delete the data unintentionally or for some other reason, then you also probably are not violating the section. (I say &quot;probably&quot; because I'm sure there's some sort of provision for negligence or willful disregard for the evidential value of something you should know has evidential value.) As a practical matter, no copyright lawsuit or criminal trial (and criminal trials over copyright infringement are very rare) is going to depend on the browser history of the defendant's friend. What if my computer has major software issues and the only viable solution is delete everything and reinstall from scratch; am I stuck with a worthless broken computer because reinstalling things from scratch would delete evidence of a crime? If you know of evidence on the hard drive that would be destroyed, you can copy it somewhere else before deleting and reinstalling. Federal law is similar: it requires knowledge and intent. 18 USC 1519: Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States or any case filed under title 11, or in relation to or contemplation of any such matter or case, shall be fined under this title, imprisoned not more than 20 years, or both.
The answer is, "No, it will not default to the state where the recording device is located." Whether your recording is legal or not may depend on where the device is located, but it may depend on other things as well. For example, to sue under Florida law, "the persons bringing suit must be Florida residents or the improper "interception" must have occurred in Florida." Thus, if the someone from NY is recorded while in Florida by someone in NJ, Florida law does not apply. The rules used to determine which state's laws apply under which circumstances are explained thoroughly here. The issue of which state's laws apply is what is known as "conflict of laws." The basic idea is simple: Because you and the insurance company are citizens of different states, you have "diversity of citizenship." If the laws in your states differ, the court must decide whose law applies -- is it the state you called from, the state you called to, or federal law? Unfortunately for you, choice of law is hard even for lawyers to get a handle on. There are several different approaches states use to answer questions about conflict of law. Which approach a state uses to settle conflicts of law will determine whose law that state's courts will apply. To get a correct answer, you need to talk to an attorney who understands conflict of law and the admissibility of wiretaps.