This preview shows page 1-2-3-4-5-6-7-53-54-55-56-57-58-59-60-106-107-108-109-110-111-112 out of 112 pages.
Computer EvidenceSearch & SeizureManualNew JerseyDepartment of Law & Public SafetyDivision of Criminal JusticeNew JerseyComputer Evidence Search& Seizure ManualDepartment of Law & Public SafetyDivision of Criminal JusticeApril 2000New Jersey Is An Equal Opportunity Employer CHRISTINE TODD WHITMAN Governor6WDWH RI 1HZ -HUVH\DEPARTMENT OF LAW AND PUBLIC SAFETYOFFICE OF THE ATTORNEY GENERALPO BOX 080 TRENTON, NJ 08625-0080(609) 292-4925JOHN J. FARMER, JR. Attorney General April 2000To All Law Enforcement:Re:Computer Evidence Search and Seizure ManualDear Law Enforcement Personnel:I am pleased to provide you with this new manual that provides detailsregarding the search and seizure of computers and computer-related evidence.The proliferation of personal computers and the explosive growth of theInternet have major implications for the law enforcement community. Just astechnology has changed the nature of communications and commerce, it hassimilarly provided new avenues for criminal activity and victimization. Paperrecords of illegal transactions have given way to electronic data files; threats arenow often conveyed by email; personal identities are stolen and used for illicitpurposes; and chat rooms provide would-be-sex offenders with new opportunities tolure minors.Fortunately, law enforcement’s ability to navigate this fast-changing terraincontinues to outpace the expectations of criminals using computers. There is nobetter example of this than the recent, successful investigation of the “Melissa”virus case. Working in cooperation with federal, county and local law enforcementagencies, expert investigators and prosecutors from the Division of CriminalJustice’s Computer Analysis and Technology Unit (CATU) and the Division of StatePolice’s High Technology Crime and Investigations Support Unit (HCTU) identifiedthe creator of the virus and arrested the suspect in less than 72 hours. Duringthose 72 hours, however, the virus caused more than $80 million in damages andshut down e-mail systems around the world. If the law enforcement communityhad not responded as proficiently as it had, the damage from the virus could havebeen catastrophic.Computer Search and Seizure ManualPage 2April 2000The “Melissa” virus case underscores the point that in order for lawenforcement agencies to stay ahead of computer criminals, we must work together. Criminal Justice’s CATU and State Police’s HCTU are integral participants in theAttorney General’s Internet Working Group, a group brought together by my officeto coordinate the high-technology resources of all the divisions of the Department ofLaw and Public Safety and to pursue an integrated approach to Internet andadvanced technology issues. Similarly, the Statewide Computer Crime Task Forcebrings together State, county and local law enforcement agencies to trainprosecutors in the areas of computers, computer forensics, the Internet and thelegal issues associated with the investigation, presentation and admissibility ofdigital and electronic evidence.In the spirit of this cooperative effort, I pledge to you the resources of theDepartment of Law and Public Safety in the fight against the emerging threats ofcomputer and high-technology crime. This Computer Evidence Search and SeizureManual will provide important guidance to you as police and prosecutors involvedin the investigation and prosecution of cases along the new frontiers of hightechnology. Without doubt, however, new technologies are emerging rapidly. The lawthat governs the search and seizure of computers and computer-related evidence arelikely to continue to develop as well. It is important, therefore, that local andcounty law enforcement agencies continue to work closely with the experts in myDepartment so that, collectively, we can bring the best resources together to beardown on those who would use technology to advance their illicit purposes. Respectfully submitted,John J. Farmer, Jr.Attorney GeneralTABLE OF CONTENTSI. SEIZING COMPUTER EVIDENCE 3A. WARRANT-BASED SEARCHES & SEIZURES OF 3COMPUTER EVIDENCE1. Probable Cause Requirements 7a. Probable Cause to Believe That a Crime has been 7Committed and That the Items Described in theWarrant are Connected to Criminal Activityb. Probable Cause to Believe That the Materials to be 8Seized are to be Found at the Place to be Searched2. Particularity Requirement 10a. Generally 10b. Description of the Place to be Searched 11(1) Tangible Objects 11(2) Intangible Objects 11(3) Multiple Locations 12c. Description of the Items to be Seized 14(1) Tangible Objects 15(2) Intangible Objects 15d. Summary 173. Deleted, Encrypted or Password-Protected Data 184. When to Serve the Warrant 215. “No Knock” Authority 226. On-Site/Off-Site Searches 237. Authorization to Take Computer Peripherals and 32Documentation8. Supplemental Warrant Applications 34B. Warrantless Searches & Seizures 351. Plain View 362. Exigent Circumstances 383. Consent 40a. Scope of Consent 40b. Who May Consent 41(1) Family Members and Cohabitant 42(2) Employers 44c. Passwords and Encrypted Documents 45d. Networks 46II. SEARCH EXECUTION 47 A. SEIZING COMPUTER EVIDENCE 47B. SEIZING COMPUTER STORAGE DEVICES WHERE THE 50WARRANT ONLY AUTHORIZES THE SEIZURE OF RECORDSC. THE WARRANT SPECIFICALLY PERMITS THE SEIZURE OF 50COMPUTER RECORDS BUT AN ON-SITE REVIEW IS IMPRACTICALD. DOCUMENTING THE SEARCH AND SEIZURE OF 53COMPUTER EVIDENCEIII. SPECIAL WARRANTS:THE IMPLICATIONS OF THE WIRETAP ACT,THE ELECTRONIC COMMUNICATIONS PRIVACY ACT,AND THE PRIVACY PROTECTION ACT 54A. ELECTRONIC SURVEILLANCE ORDERS 551. Requirements 552. Type of Communication to be intercepted 563. Circumstances Under Which a Wiretap Order Should 57be Sought in Connection With a ComputerB. STORED ELECTRONIC COMMUNICATIONS 57IV. PRIVACY PROTECTION ACT AND NEWSPERSON’S SHIELD 64A. PPA Cases 66B. Conclusion 68V. REVIEW AND ANALYSIS OF COMPUTER EVIDENCE 68VI. ADMISSIBILITY OF COMPUTER EVIDENCE 75A. BEST EVIDENCE RULE 76B. AUTHENTICATION 78C. CHAIN OF CUSTODY 80VII. CONCLUSION 80APPENDIXA. Table of AuthoritiesB. Computer Search ChecklistC. Sample Warrant LanguageD. Sample Search Warrant AffidavitE. Sample Subpoena LanguageF. Communication Information OrdersG. Sample Communications Data Warrant AffidavitACKNOWLEDGMENTThe members of the Computer Crimes Committee include Assistant
View Full Document
Unlocking...