Privacy: Can your PC be subpoenaed?
It never occurred to him that such personal data could be extracted and shared among strangers. But that's what happened when his computer's hard drive was copied by two investigators retained for his employer, Northwest Airlines (nwac). Working right in his living room with a program called EnCase, they excavated every last bit and byte from his desktop hard drive.
As part of a court-approved search, the man and woman arrived at 11:00 a.m. on Feb. 3, tugging a dolly carrying tool boxes and diagnostic equipment that banged at each step up to the second floor of his duplex. They moved Reeve's PC from its usual place in his bedroom -- near a red, cross-stitched sign that says "Home Sweet Apartment" -- and, with cover unscrewed, spent three hours copying everything on the hard drive.
Northwest suspected that its flight-attendant union had used the Internet to run an illegal call-in-sick campaign to disrupt the airline, the country's fourth largest. So the airline won a court order to search 20 or so hard drives at flight attendants' homes and union offices.
"I didn't know your company could wholeheartedly ransack your computer," said Reeve, who celebrated his 42nd birthday and 10th anniversary as a Northwest flight attendant last week.
Now more federal courts are approving searches of home PCs for evidence in civil cases. But it isn't easy drawing limits around a vast digital pool of data, and even safeguards put in place by a federal judge can fall apart as a legal battle speeds up or heats up.
Swamped by the files unearthed from just the first few computers in its search, Northwest complained to one judge that printing each document found inside the workers' PCs would amass a paper pile five times as tall as the Washington Monument, which stands 555 feet.
In the unresolved dispute, both sides have been caught off-guard by the magnitude of the data haul. And so, apparently, were the two presiding judges and Northwest's investigative consultant, Ernst & Young, whose cutting-edge computer-forensics lab is run by the former chief of computer-crime investigations for the U.S. Air Force.
The latest technology makes it easy to extract most deleted files, fragments of Web searches and a host of other data from a PC. Deep in the recesses of the hard drive (the massive repository sometimes heard groaning as a computer starts up) are untold numbers of documents and records of digital actions that many computer owners believe had long since vanished into the ether: forgotten drafts of notes never sent, deleted e-mail, Web pages visited by the owner or anyone who happened to tap the keys.
Almost everything is kept somewhere on the hard drive. Not until there is no nook or cranny left on it do the deleted files typically get overwritten. And many computers never reach that point. The "C" drive of Reeve's four-year-old computer had 4.36 gigabytes of memory, capable of storing more than a dozen sets of the 32-volume Encyclopaedia Britannica. He believes the drive wasn't full.
The story of Reeve and his disemboweled desktop began as the past century closed. The final weekend of 1999 was brutal for Northwest schedulers. Between Dec. 30 and Jan. 2, anywhere from 932 to 1,042 flight attendants called in sick every day, nearly double the number of the same weekend in 1998, according to the suit Northwest filed in U.S. District Court in St. Paul, Minn., in early January. The airline and its 11,000 flight attendants have been locked in a contract dispute stretching back to 1996. Even by scrambling to shift crews around, and calling on a pool of reserves, Northwest still couldn't get 317 planes in the air.
Northwest was convinced that the sharp increase in absenteeism was an orchestrated protest campaign by the flight attendants' union, the Teamsters Local 2000. For weeks leading up to the weekend, Northwest had been watching anonymous postings on the local's own Web pages and elsewhere. Griffin and Reeve each ran personal Web sites concerned with union matters.
Northwest's suit cited one anonymous message that appeared on Griffin's site Dec. 8. "While not sanctioned by the union," the message said, "a sick-out en masse is one way the company will be convinced that we are serious about an industry-leading contract." Northwest asked the court to grant a restraining order to prevent the union from future disruption of flight operations. Weighing the interests of the flying public, the court complied.
The flight attendants named in the suit denied fomenting any illegal work disruption. "Trust me, I thought about calling in," Reeve said. "I think a lot of people were frustrated and took matters into their own hands."
The airline negotiated an agreement on discovery guidelines with attorneys representing the union officials, but not with Reeve and Griffin, who are rank-and-file members. The parties agreed to allow Ernst & Young to make copies of the hard drives and search for any correspondence related to numerous specific subjects or groups, including Local 2000, "calling in sick" and the Contract Action Team, or CAT. The period involved was limited to April 1, 1999, to Feb. 8, 2000.
Ernst & Young was supposed to comb the drives using unspecified keywords, and hand over to Northwest anything it turned up. At its National Computer Forensics Lab in Vienna, Va., Ernst & Young routinely makes "mirror image" copies of hard drives. The drive itself, a stack of magnetically coated platters spinning at blinding speeds, stores data on a microscopic scale. Using sophisticated software, computer detectives can exhume even data nestled in remote, hard-to-access areas, such as the "slack space" or "unallocated" parts of the thin disks.
David Morrow, who heads the lab, joined Ernst & Young in 1998 from the Air Force Office of Special Investigations, where he directed the operation that processed computer evidence for counter-intelligence, and criminal and fraud cases. Using the court-approved guidelines, Morrow, who led the Northwest project, said his team alone devised the keywords, and wouldn't share them with Northwest or the flight attendants, according to a statement he filed with the court.
Concerned about free-speech issues and the Internet, Paul Levy, an attorney for the Public Citizen Litigation Group in Washington, agreed to represent Messrs. Griffin and Reeve. At a February hearing in St. Paul, he argued that the keywords, to the extent he could learn them, were overly broad. After learning that one was "flu," he argued that the tiny word would also snatch any innocent or irrelevant file in which "the letters 'f' 'l' 'u' happened to appear together in another word, such as 'influential' or 'influx.' "
The search of just Griffin's and Reeve's computers proved formidable. "The responsive data identified would consume 75,200 pages of paper," Morrow said in his court statement, much of it nothing more than "unintelligible computer code." By discarding the documents with gibberish, Ernst & Young cut the number to 22,500. The discovery process was further aggravated because Northwest's attorneys were trying to amass evidence quickly for a Feb. 15 hearing, at which they would seek a more substantial ruling against the union, a preliminary injunction.
Fighting erupted before the drives were even copied. When the parties met in the St. Paul court on Feb. 1, Levy said Griffin and Reeve hadn't been involved in negotiating the search guidelines, and objected to them. Levy said the two had reviewed their own hard drives "and because the computers had been used mostly for private and not work-related purposes, they contained a vast array of personal material that should not be subject to inspection by strangers."
He later argued that Ernst & Young couldn't operate neutrally. Aside from already being Northwest's accounting firm, Ernst & Young also was retained by some of Northwest's lawyers to do the computer analysis. Morrow, in his statement, responded that Ernst & Young acted professionally in complying with the court's orders.
"The Teamsters union negotiated extensively on the procedures, and then agreed to Ernst & Young," said John Gallagher, an attorney for Northwest with Paul, Hastings, Janofsky & Walker. "Everybody was on board except" Griffin and Reeve, he added.
Magistrate Judge Arthur Boylan agreed that the computer-search procedure -- even though agreed to by the other flight attendants -- didn't offer adequate protection. He suggested that Ernst & Young proceed with determining which documents were responsive to the discovery request, but then send them to lawyers for the defendants. They, in turn, could pluck out anything they objected to, noting the specific reasons. Only then would the remainder go to Northwest.
The judge gave Ernst & Young 24 hours to search computers and produce the documents. Defendants' attorneys got 24 hours to review them. The schedule proved impractical immediately.
On Feb. 3, the day Reeve's hard drive was copied in North Hollywood, two Ernst & Young staffers flown in to Honolulu copied Griffin's computer files. Others descended on the Local 2000 office near the airport in Minneapolis.
Days passed before Ernst & Young delivered the first paper documents. The two sides bickered about who was to blame for the delay, but in the end, the attorneys for Griffin and Reeve say they received their first batch on Friday morning Feb. 11, eight days after their computer drives were copied. Over the weekend, boxes of documents arrived day and night.
"I got through the Friday morning delivery -- extremely rushed examination -- and basically what I did was anything that might be discoverable I tried to turn over," Levy said at a hearing. "Where a privilege wasn't involved, I just gave. They got much more because of the rushed schedule they put me under." (At least one file related to Reeve's bid for his apartment building, for instance, was apparently cleared for release to Northwest.)
At the same hearing, noting that the airline's attorneys had just been hit with an avalanche of more than 6,000 documents from Ernst & Young, Northwest attorney Timothy Thornton pleaded for more time to review them. "I think everybody was a little naive when we felt we could just dive into these computers and make it simple," he said.
Anyway, he told the judge, rather than pursue the injunction immediately, the airline wanted to devote its energy to new contract negotiations with the flight attendants.
Levy suspects something else. Noting that Northwest's legal team had been given several thousand pages mined from the two flight attendant's computers to comb through, he concludes, "The problem was there was no smoking gun."
Emboldened, lawyers for Griffin and Reeve asked the court in March to reverse the computer-search order, arguing a fresh angle: It had erred by not allowing the defendants to search their own files and turn over relevant documents to the other side. That's normal discovery procedure, and penalties are high if it is later proved that evidence was withheld.
The only exception, they said, was when a court was presented with evidence that documents had been destroyed or the computer owner couldn't otherwise be trusted to do the search himself. In one case they cited, a federal judge in Illinois last year allowed a computer expert hired by a machinery company to inspect the PC of an ex-employee it was suing -- but only after he sought to excuse the disappearance of certain electronic files by claiming his computer had "fallen off my desktop on at least four to five occasions."
In their appeal, the two Northwest flight attendants argued that "because deleted materials can be retrieved from computer storage, unlike conventional paper files, the material stored on personal computers may be uniquely private, including thoughts never communicated to another soul."
For instance, among the documents Levy objected to was one called "rebuttal for court.doc," dated Jan. 8, 2000. His reason: "Griffin prepared it shortly after the lawsuit was filed ... to assemble his thoughts; it was intended for eventual communication to his attorneys.
"Although it was never sent to his attorneys, it is withheld because an invasion of his personal computer and seizure of a memorialization of his thoughts about how to mount his legal defense would violate his right of free speech under the First Amendment, his right of privacy under the Fourth Amendment, and the attorney-client privilege."
"Everybody has a private side with a computer," Reeve said. "It's like putting part of your brain in a box."
He said he thinks the airline really wanted to frighten employees, to prevent the Internet from becoming a powerful organizing tool. "They have yet to turn up any evidence of conspiracy," he added.
"Our intention was to stop illegal activity," said Jon Austin, a Northwest spokesman. "We are pleased that that activity did stop."
As for evidence on the drives, Gallagher, the Northwest attorney, notes that the airline agreed to halt searches weeks ago to focus on contract negotiations with the union. Northwest's suit may be dismissed if a vote on the resulting new contract, currently being tallied, is passed. If that happens, he added, "we'll never know what we might have discovered."
While Andrea Todd and Vincent King, the Ernst & Young computer team in Los Angeles, copied his computer hard drives three months ago, Reeve, who earns about $35,000 a year, videotaped them for legal protection. At one point, he cleared his coffee table, removing his white "Ted" mug, to make room for the Ernst & Young equipment. Soon, on the firm's monitor, the EnCase drive-copying software was displaying a series of commands that sound like missile-guidance lingo, including "Locking" and "Acquire."
"I felt pretty damned violated. I couldn't figure out what crime I committed," he said. He added, "What I did is run a Web site, and got a very large company mad at me."
A hearing is set for next month on a request by Griffin and Reeve to reverse the computer-search order and immediately destroy the CD replicas of their hard drives. "Maintenance of such copies perpetuates the potent chilling and intimidating effect of the hard-drive discovery," they said.
When considering that request, the airline's reply said, the court shouldn't be swayed by "defendants' hyperventilated accusations about 'Big Brother' and Northwest's 'intrusion' into their private lives."