Monday, June 08, 2015

The Law Student, the Encrypted Laptop and the Brute Force Attack


This post examines an opinion a U.S. District Court Judge in Michigan issued recently in a civil suit:  Enjaian v. Schlissel, 2015 WL 3408805 (U.S. District Court for the Eastern District of Michigan 2015).  In the opinion, the judge is ruling on “a Motion for Judgment on the Pleadings and Summary Judgment, filed by Defendants”.  Enjaian v. Schlissel, supra.  According to the document you can find on this site, the defendants are Mark S. Schlissel, Jose A. Dorta, Bernard C. Mundt II and Renee J.S. Schomp.
Essentially, as this site and this site explain, both judgment on the pleadings and summary judgment are tactics a party to a lawsuit can use to try to persuade the judge to enter judgment for that party without actually holding a trial.  The links above will take you to online articles that explain how each device works . . . when they work.
This judge begins his ruling on the defendants’ motion by explaining how, and why, the case arose:
Jesse Enjaian matriculated at the University of Michigan Law School in 2010, joining the Class of 2013. Renée Schomp was Enjaian's classmate, who shared an identical set of classes during their first year. . . . On more than one occasion in early 2011, Enjaian invited Schomp for `coffee or tea’ or `lunch or coffee,’ but on each occasion, Schomp declined. . . .

According to Enjaian, although initially a friend, by their second year of school, something changed; `Schomp began to strongly dislike [him] for unexplained reasons.’ . . . She allegedly began defaming Enjaian to other students, including mutual friends. . . .

On November 17, 2011, Schomp reported to Defendant Bernard Mundt, an Officer with the University of Michigan Police Department, that she had been receiving emails and Facebook Messages from Enjaian over the course of the previous year. . . . The `communications . . . made her increasingly uncomfortable and worried.’

On November 21, 2011, Enjaian exchanged a series of text messages to [sic] Carrie Cushing, a friend of Schomp's, generally insisting that he was entitled to an apology from Schomp. . . . In one of the text messages, he stated that he `h[o]pe[d] [Schomp] likes deep dark pits of depression because [he's] a petty bastard P[sic].’ . . .  After Cushing cautioned him that he shouldn't do anything, Enjaian responded: `Not that serious. Just enough to make her feel crappy-D [sic].’ . . . Cushing shared these text messages with Schomp. . . .

At some point the same evening or early the next morning, Enjaian sent a Facebook message to Schomp expressing that he `fe[lt] entitled to an answer for why [she] behaved so negatively last year.’ . . . In response, Schomp replied: `Jesse, I do not with to have any further contact with you whatsoever. Do not send me any other messages via email, facebook, or text message. Do not call me, speak to me in person, or interact with me in any other way, either directly or indirectly.’ . . .  Cushing also warned Enjaian that Schomp would go to the police if he continued to bother her. . . . Enjaian stated that he would cease communication with Schomp, in order to avoid a harassment claim. . . .
Enjaian v. Schlissel, supra.
The opinion goes on to explain that the “Law School” administered a
listserve called LawOpen, which allows law students to send messages to all other students at the law school. . . . On December 9, 2011, Enjaian created what he calls a `parody of a law school administered student group,’ called `LawClosed.’ . . . Apparently, Enjaian had been restricted from using LawOpen by the school's e-mail account manager for sending inappropriate messages to the student body using LawOpen. . . .

Enjaian configured LawClosed to operate exactly like LawOpen, meaning it was intended to include all Michigan Law students, including Schomp. . . . Enjaian later told Mundt that he chose names by selecting people affiliated with the law school's Facebook account, and that he knowingly included Schomp. . . .

The same day he created it, Enjaian sent two messages using LawClosed. One was to introduce students to LawClosed and the other was to attempt to sell an old casebook. . . . The first email included a hyperlink to a news article reporting the death of a woman that had been employed at Skadden Arps, a large law firm where Schomp had previously been employed. . . . Enjaian knew at the time he sent the messages that Schomp received the emails, and that Schomp had recently requested that he not contact her. . . .

After receiving the emails, Schomp reported back to Mundt, showing him the text messages between Enjaian and Cushing as well the two emails sent to LawClosed. . . . She told Mundt that she thought the article links were directed at her as an act of intimidation and that she felt `frightened and harassed’ by receiving two e-mail messages from Enjaian after she informed him to have no further contact with her. . . . Schomp also initiated a complaint with the University of Michigan Office of Student Conflict Resolution. . . . The next day, on December 10, 2011, at the request of Dean of Students David Baum, the LawClosed list was disabled. . . .
Enjaian v. Schlissel, supra.
The opinion explains that, on “the same day Schomp complained to Mundt,”
Mundt signed an affidavit for a search warrant. . . . The affidavit was reviewed by Blaine Lowesworth from the Washtenaw County Prosecutor's Office and signed the same evening by Magistrate A. Thomas Truesdale of Michigan Judicial District Fourteen–A. . . . The warrant specified `[a]ll computer equipment, information storage devices and cell phones as well as records or documents that are located at the above and there [sic] contents.’ . . . The search warrant also allowed officers to locate and seize passwords or encryption codes necessary to access the data located on the computer. . . .

Mundt, along with two other officers, executed the search warrant that night, and seized Enjaian's laptop computer, cell phone, USB keychain drives, a USB drive, and an iPod Nano. . . . During the search, Enjaian admitted that he sent the messages and that he added Schomp to the list. . . . When Mundt asked Enjaian why he included Schomp despite receiving a `no contact order,’ Enjaian responded that `[i]t didn't cross [his] mind.’ . . .  Enjaian provided his computer login information to Mundt. . . .

Defendant Dorta conducted the search of Enjaian's computer. . . . Dorta discovered that part of Enjaian's computer was encrypted and his cell phone was password protected. . . . Dorta attempted to obtain the passwords from Enjaian, who refused to provide them. . . . Dorta attempted a `simple dictionary brute force attack’ on the encrypted files, which took several months and was ultimately unsuccessful. . . . Dorta was . . . able to circumvent the cell phone password on September 25, 2012. . . .  Dorta was able to extract the Facebook messages and text messages from the cell phone.
Enjaian v. Schlissel, supra.
Dorta then prepared a
warrant request packet seeking the charges of Stalking, Posting, and Malicious Annoyance by Writing against Enjaian. . . . On January 3, 2013, the Washtenaw County Prosecuting Attorney declined to prosecute. . . . In the denial form, Assistant Prosecuting Attorney Susan Longsworth stated that Schomp's `assertion that [the link to the article about the death of the Skadden Associate] was a veiled threat of some sort because [Schomp] once worked for the same large law firm but in a different office cannot be proved beyond a reasonable doubt.’ . . . Shortly thereafter, Enjaian's property was returned to him. . . .
Enjaian v. Schlissel, supra.
After outlining how, and why, the lawsuit arose, the judge began his ruling on the motions filed by the various defendants. Enjaian v. Schlissel, supra.  This post will only examine his rulings on two of Enjaian’s causes of action because they are more directly concerned with the events outlined above. 
The first cause of action this blog post examines was Enjaian’s second cause of action, which as the judge explains, asserted that
Mundt used a valid exercise of Enjaian's 1st Amendment rights, namely the emails sent to LawClosed, as support for probable cause of stalking. Enjaian argues that the search was an element of a conspiracy to shut down LawClosed to silence his views objecting to the `Big Law’ system. 
Enjaian v. Schlissel, supra.  The judge goes on to explain that
[t]o prevail on a claim of 1st Amendment Retaliation, it must be shown that: 1) the conduct was protected, 2) an adverse action was taken against that conduct that would deter a person of ordinary firmness to engage in that conduct, and 3) there is a causal connection between the conduct and the adverse action. Thaddeus–X v. Blatter, 175 F.3d 378 (U.S. Court of Appeals for the 6th Circuit 1999).

Assuming, arguendo, that the emails were protected and that the search constituted an adverse action, Enjaian's claim fails at the third step. As pleaded, Mundt's investigation was causally connected to Schomp's complaint, and there is nothing beyond conclusory speculation that Mundt was acting at the behest of the Law School's desire to restrain Enjaian's dissent regarding the `BigLaw career path.’

The notion that the search warrant was obtained as a pretext to chill Enjaian's speech is not plausible, especially in light of the parallel criminal and academic investigations that followed. Furthermore, the decision to shut down LawClosed was made by the Dean of Students and there is no indication that it had anything to do with the criminal investigation. In fact, there is no allegation that Mundt's affidavit in any way played a part in the independent decision to close down the list or that Mundt was even aware of the University's views on the content of Enjaian's email.

Absent a plausible causal connection between the affidavit and the so-called conspiracy to silence Enjaian, the 1st Amended Complaint fails to state a claim for First Amendment retaliation and the second cause of action must be dismissed pursuant to Rule 12(b)(6). See Bell Atlantic v. Twombly, 550 U.S. 544 (2007).
Enjaian v. Schlissel, supra. 
The judge then went on to address Enjaian’s “fourth cause of action”, which
maintains that Dorta's attempt to break into the encrypted containers on the seized laptop computer was an unreasonable execution of the search warrant. As the court already discussed in Enjaian II, the 6th Circuit has warned that `”hindsight is 20/20’ and that ‘so long as the computer search is limited to a search for evidence explicitly authorized in the warrant, it is reasonable for the executing officers to open the various types of files located in the computer's hard drive in order to determine whether they contain such evidence.”’ Opinion and Order Denying Plaintiff's Motion for Reconsideration, Enjaian v. University of Michigan, No, 13–13907, (U.S. District Court for the Eastern District of Michigan, August 28, 2014) (“Enjaian II”). . . .

The court also pointed out that `the 4th Amendment does not protect against unreasonable delay in returning lawfully seized property to the owner. Enjaian II, No. 13–13907, 2014 WL 3662709 (U.S. District Court for the Eastern District of Michigan, July 14, 2014). . . .  

In essence, Enjaian claims that a brute force attack on the Advanced Encryption Standard used to secure his data was a fool's errand; technically impossible -- statistically improbable without several million years' computing time using modern computers -- and thus `procedural foot dragging.’ Put another way, Enjaian asserts that because he can show that his encryption was unhackable, Dorta acted recklessly by trying to hack it anyway.
Enjaian v. Schlissel, supra. 
(The “Enjaian II” opinion cited in the paragraph above was another lawsuit Enjaian filed that involved the events outlined at the beginning of this post.  You can read about the District Court Judge’s ruling in that related opinion in the blog post you can find here.)
The judge went on to find that Enjaian
fails to identify a clearly established right that was violated by Dorta's search. The court's search revealed no such right exists. In the Federal context,  Federal Rule of Criminal Procedure 41(e)(2)(B) and its associated commentary specifically contemplates an extended search due to the existence of encryption.

The commentary accompanying the 2009 amendments [to the rule] noted that `the practical reality is that there is no basis for a “one size fits all” presumptive period. A substantial amount of time can be involved in the forensic imaging and review of information. This is due to the sheer size of the storage capacity of media, difficulties created by encryption and booby traps, and the workload of the computer labs.’ Federal Rule of Criminal Procedure, comment to Rule 41(b)(5) (2009).

The commentary notes further caution that `[t]he rule does not prevent a judge from imposing a deadline for the return of the storage media or access to the electronically stored information at the time the warrant is issued. However, to arbitrarily set a presumptive time period for the return could result in frequent petitions to the court for additional time.’ Federal Rule of Criminal Procedure, comment to Rule 41(b)(5) (2009).
Enjaian v. Schlissel, supra. 
Next, the judge explained that Enjaian “sought the release of his property in” yet another suit, which he refers to as “Enjaian I.” I do not have a citation for that case, so I cannot outline how the judge ruled in that opinion. 
In his opinion in this case, the judge went on to explain that Enjaian
also would have been entitled to do so by a petition within the state court system. His property was ultimately returned. Without a judicial order to compel that return, Dorta was not required by any law clearly established in this circuit to do so any sooner than he did and was not required to refrain from a brute force attack on the encryption, or otherwise conform his search to any specific protocols. As such, he is entitled to qualified immunity. The fourth cause of action is dismissed with prejudice pursuant to Rule 12(c).
Enjaian v. Schlissel, supra. 

No comments: