Defendant’s Invocation of Fifth Amendment Slows Prosecution in Stolen Data Case
As a West Palm Beach cyber crime criminal defense attorney, I was interested to see a recent item about the difficulties of prosecution in cyber crime cases. SC Magazine, a publication for IT security workers, reported July 12 on the case of Eric Porat, 19, of Brooklyn, who is accused of trying to sell data obtained from Internet data mining company Digital River to the company’s competitors. Investigators wanted to know how Porat came to possess the information on about 200,000 people, but Porat invoked his Fifth Amendment right against self-incrimination. As the article notes, this is perfectly within Porat’s rights and has been upheld in court in other cyber crime cases. And because investigators believe Porat obtained the data through an Indian company or person, they have a limited ability to get the information through subpoenas.
According to the Minneapolis Star-Tribune, Digital River and its subsidiaries sell software to other companies to help them run “affiliated marketing” programs. Data gathered by those programs is stored on Digital River’s servers, and it is some of that data that was breached. Investigators believe that someone using computers from a Digital River customer in India stole the data while the company’s security system was temporarily down for an upgrade. Rather, the SC Magazine article said, the Indian interloper used a “well-crafted search query” while Digital River’s guard was down, suggesting that there was not any illegal activity. From there, it’s not clear how the data got to Porat. He has acknowledged that it came from India but declined to say how or from whom. Once he had it, he is accused of trying to sell it to the highest bidder among Digital River’s competitors. One of them turned him in to the FBI.
Digital River filed a lawsuit and got a court order in late May blocking Porat from selling, distributing, destroying or altering the information. The company’s lawsuit was filed under seal and without notice to the defendants to protect evidence, the Star-Tribune said, but unsealed in early June. The suit seeks to understand how Porat and his company, Affiliads, got the data and what they did with it. Porat reportedly gave a deposition of about six hours, but invoked his Fifth Amendment rights about 26 times during that time.
As the SC Magazine article noted, Digital River has serious legal problems in this case. As a Miami cyber crime criminal defense lawyer, I agree with the author that this is “the single smartest thing a cybercrime defendant can do.” Normally, when someone invokes the Fifth Amendment, investigators can simply look for other sources of the information. But in this case, the other end of the transaction is in another country, which means they cannot subpoena the Indian company or any individuals who may have been involved. In fact, the article notes, Porat may not face criminal theft, hacking or identity theft charges at all, or face only the lesser charges investigators can prove. Meanwhile, it’s also unclear whether the Indian company or any individual there did anything illegal, since the company was a paying customer of Digital River and apparently did not exceed the access allowed to customers. In the end, the article says, Digital River should consider strengthening its security measures.
This is a great example of how the law has yet to catch up with the possibilities offered by technology. Even if the prosecution could reach into other countries, it’s unclear whether the Indian person or people involved actually broke a U.S. law by accessing this information. Selling the information to Porat could be a crime, but it will be difficult to determine whether that is indeed what happened. And of course, it will be hard to make charges stick to Porat without better information. Congress may be able to address part of the problem by passing a law on how information may be exchanged and sold internationally. But as a Fort Lauderdale cyber crime criminal defense attorney, I believe it’s vital for any such law to respect civil rights of individuals and businesses. In the meantime, cyber crime defendants like Porat may be able to count on the Fifth Amendment to protect them and their international compatriots.