- When the FBI and police tracked down suspected serial
killer Maury Troy Travis, they didn't need bloodhounds, lab tests, fingerprints
or other standard tools of criminal investigations.
-
- Instead, agents simply tapped into the wealth of information
that Microsoft Corp. and other Internet companies keep on people who visit
their Web sites and use their services.
-
- The stunning breakthrough in what had seemed a difficult
case underscored why such information is a valuable resource for police
-- and sometimes a concern for civil libertarians.
-
- Travis' arrest June 7 was set in motion two weeks earlier,
when a Post-Dispatch reporter received an anonymous letter praising a story
profiling a slain prostitute. Accompanying the letter was a map of part
of West Alton, marked with an "X" to show where a body could
be found.
-
- After finding a skeleton there, authorities focused on
the map, which appeared to have a come from an Internet service. Detectives
found an apparent match on Expedia.com, according to affidavit by FBI agent
Melanie Jimenez.
-
- On May 30, Expedia told Jimenez that Microsoft, based
in Redmond, Wash., provides the information for its map site.
-
- So the FBI, using a subpoena, requested records of any
maps of West Alton made between May 18, the date of the newspaper story
that spurred the letter, and May 21, the postmark on the envelope. It took
four days to get an answer.
-
- On June 3, Microsoft reported back that only one computer
had done it. The company said that on May 20, the computer had "zoomed
in on the map of the West Alton, Missouri, area approximately 10 times
in a chronological order to end with an exact match of the map" sent
to the Post-Dispatch, Jimenez said in the affidavit.
-
- But Microsoft could provide no name. Just an address
that is meaningless to most people: It was the Internet Protocol address
of 65.227.106.78.
-
- To translate the IP number, the FBI turned to WorldCom
Inc., which provides local telephone numbers to connect Internet services
to their dial-up customers. WorldCom assigns a temporary IP address to
each customer for each Internet session. The question wasn't just who used
65.227.106.78, but who used it at the time in question.
-
- The next day, on June 4, WorldCom's Internet division,
UUnet, identified the user the evening of May 20 as MSN/maurytravis, Jimenez
said. The MSN stands for Microsoft Network.
-
- The FBI went back to Microsoft Network later the same
day to identify the customer. It was Maury Troy Travis of Ferguson.
-
- That was the groundwork for surveillance and, on June
7, an arrest and search warrant that authorities said helped solidify the
case with DNA and tire tread evidence linking Travis, a 36-year-old waiter,
to some of the killings. He was charged with two counts of kidnapping in
federal court documents that also linked him to seven murders overall.
Police think he may have killed 10 or more.
-
- On June 17, without ever admitting guilt, Travis hanged
himself in jail.
-
- Tracks left on the Web
-
- It appeared that Travis had been unaware of the ease
with which Internet use can be traced. In fact, it is that lack of awareness
- coupled with the easy use of technology by law enforcement and the sheer
abundance of information on the Web - that troubles civil libertarians.
-
- "Many users are not aware of the tracks that are
left behind when they surf the Web and visit various sites," said
David Sobel, general counsel of the Electronic Privacy Information Center
in Washington.
-
- "Most users have an illusion of anonymity when they
use the Internet, which a case like this demonstrates is not well-founded
because there is quite a bit of traceability on the Internet," he
said. Sobel said that is why he supports strengthening the protections
already in federal law.
-
- The Electronic Communications Privacy Act of 1986 requires
federal law enforcement agencies to take various steps to obtain information
from Internet companies. The law requires prosecutors to issue a subpoena
or obtain a court order or a search warrant from a judge for certain types
of information.
-
- It also allows prosecutors to accept information given
voluntarily by an Internet company.
-
- Even the Department of Justice described the law as "unusually
complicated" in a manual for prosecutors published last year. "Navigating
through ECPA requires agents and prosecutors to apply the various classifications
devised by ECPA's drafters to the facts of each case before they can figure
out the proper procedure for obtaining the information sought," the
manual says.
-
- The law left unclear whether a simple subpoena could
obtain an IP address or if a prosecutor needed an order signed by a judge,
said Cindy Cohn, attorney for the Electronic Frontier Foundation. It is
a civil liberties group based in San Francisco.
-
- Cohn said the lack of clarity meant prosecutors did need
a judge's order. But Justice Department spokesman Mark Corallo said the
agency believed only a subpoena was necessary.
-
- The debate was resolved after the Sept. 11 attacks, when
President George W. Bush signed the USA Patriot Act, giving the Justice
Department new powers to fight terrorism. It provides prosecutors clear
authority to obtain temporarily assigned IP addresses and other information
from Internet companies through use of a subpoena.
-
- "No check and balance"
-
- In the Travis case, the FBI and the U.S. attorney's office
in Illinois have not revealed how they obtained the information from Microsoft
and WorldCom - whether by subpoena, search warrant or neither.
-
- But Microsoft said Thursday that federal prosecutors
had issued a subpoena.
-
- Sobel said that given the strong link between the map
sent to the Post-Dispatch and the crimes, there is little doubt that prosecutors
were right to pursue the information and could easily have obtained a search
warrant.
-
- Even so, he said, permitting prosecutors to obtain such
information through use of a subpoena - a unilateral step that does not
require the oversight of a judge - is not sufficient protection for the
public.
-
- "There's no check and balance," he complained.
"If law enforcement says, 'We want this information, and all we need
is a subpoena,' there are not many (Internet service providers) that are
going to say, 'No, you need a warrant.' There's a high level of cooperation."
-
- Corallo, the Justice Department spokesman, declined to
comment on whether a subpoena sufficiently protects privacy. "The
Patriot Act was passed by bipartisan majorities of the House and Senate
and it is now the law of the land," he said.
-
- Few legal precedents
-
- At least part of the confusion comes from the fact that
the Electronic Communications Privacy Act has not been widely tested in
the courts, and there are few legal precedents, Sobel said.
-
- But one high-profile case was that of Timothy McVeigh,
a sailor of no relation to the Oklahoma City bomber with the same name.
McVeigh's sexual orientation was discovered when a Navy investigator asked
America Online Inc. for information from McVeigh's user profile.
-
- The Navy sought to discharge McVeigh on the grounds that
he had identified himself to America Online as gay. But in 1998, a federal
judge in Washington said America Online had violated McVeigh's rights under
the Electronic Communications Privacy Act by releasing the information
without McVeigh's permission.
-
- The judge, Stanley Sporkin, also barred the Navy from
discharging McVeigh, a highly decorated master chief petty officer. America
Online also agreed to pay unspecified damages to settle a lawsuit brought
by McVeigh and agreed to adopt policies aimed at protecting the privacy
rights of customers.
-
- Microsoft, which critics have often accused of failing
to protect customers' privacy, warns that it may have to reveal customer
information to comply with the law. Its privacy policy says, in part, "Microsoft
may disclose personal information if required to do so by law or in the
good faith belief that such action is necessary to: (a) conform to the
edicts of the law or comply with legal process served on Microsoft or the
site."
-
- Tonya Klause, a Microsoft spokeswoman, said the FBI had
a subpoena for the information that identified Travis.
-
- Microsoft does not sell such information or share it
with business partners, Klause said. Asked how long the company retains
data on an individual's use of Expedia's mapping site, Klause said in a
written reply only "a very short time period."
-
- WorldCom spokeswoman Sudie Nolan said, "WorldCom
makes every effort to assist law enforcement agencies, but always subject
to the appropriate legal processes."
-
- Nolan said WorldCom does not reveal how long it retains
information identifying the IP addresses used by computer users. WorldCom
does not sell the IP address information, she said.
-
- Nicolas Terry, a professor at St. Louis University School
of Law, says he is less concerned about prosecutors' access to Internet
data than about what Internet companies are doing with the data they collect.
-
- He said other developed countries had online privacy
laws that were more stringent than those in the United States. For instance,
the European Union passed a law in 1995 that permits Internet companies
to use information given to them only for the purpose intended when a consumer
first gives the information.
-
- "What is to stop a Web site from collecting information
about the maps we access - and anything else we do online - and selling
it to other persons," Terry asked. "That is what is going on
much more than catching serial killers."
-
- = = = =
-
- WHAT IS AN IP ADDRESS?
-
- Sources: FBI, Microsoft Corp., The Computer Glossary
-
- The IP address, written as four numbers separated by
periods, identifies a particular computer's location on the Internet. Computers
linked to a network through a fixed connection typically have a permanent
address, while computers that dial over a telephone line to reach the internet
are assigned an IP address for each session.
-
- THE MATCHING IP ADDRESS
-
- 65 . 227 . 106 . 78
-
- (First set of numbers ex. 65:) Identifies network to
which a computer belongs
-
- (Rest of numbers: ex. 227.106.78) Identifies the actual
computer on that network
-
- A map downloaded from the Internet led the FBI to suspected
serial killer Maury Troy Travis.
-
- 1. THE DOWNLOAD
-
- MAY 20: Someone dials up MSN and downloads a map from
Expedia.com. The map is mailed to the Post-Dispatch.
-
- 2. INVESTIGATION BEGINS
-
- MAY 24: The Post-Dispatch gives the Illinois state police
the map and letter. They identify the map as from Expedia.com.
-
- 3. THE FBI GETS INVOLVED
-
- MAY 30: Expedia.com informs the FBI that records of access
to the map can be obtained through Microsoft Corp.
-
- 4. THE IP ADDRESS
-
- JUNE 3: Microsoft tells the FBI that only one computer
downloaded a map of the area during the time in question. Microsoft provides
the IP address of that computer.
-
- 5. THE USER NAME
-
- JUNE 4: The FBI asks WorldCom Inc. to identify the user
name for the computer assigned the IP address on May 20. WorldCom provides
the user name MSN/maurytravis.
-
- 6. THE INFORMATION
-
- JUNE 4: The FBI asks Microsoft for the account information
on MSN/maurytravis. Microsoft provides the name Maury Travis along with
his address and phone number.
-
- 7. THE ARREST
-
- JUNE 7: After round-the-clock surveillance reveals that
Travis lives at the house, he is arrested.
-
- Reporter Peter Shinkle:
- http://www.stltoday.com/stltoday/news/stories.nsf/News/B
|
