Who Tased My File Cabinet?

May 15, 2017
/ Author: Rick

A couple of weeks ago, I wrote a blog article—“The Nerve of Law Enforcement”—about the fact that law enforcement officers in one of the counties where I practice law are uploading juvenile case files to servers owned by a private corporation. Specifically, those juvenile case files include (now) electronically-stored data, such as videos that law enforcement officers either created using their own cameras, or collected as evidence from witnesses to the events recorded. The private corporation is known an Axon, the-law-enforcement-caterer-formerly-known-as Taser International, Inc. And I learned about this because in order to obtain discovery relating to the juvenile I was defending, I was required to go to Evidence.com—owned by Axon—and create an account to gain access to the discovery.

To create the account, Axon required me to digitally “sign” an End User License Agreement, or EULA. Like a lot of other people, I don’t often read these. But since this was a different situation, involving agreeing to something in order to obtain discovery in a criminal case, I figured I needed to read it.

After reading it, I felt for reasons spelled out in my previous article that I could not agree to it. And, therefore, I could not obtain the discovery to defend my client.

Since then, a lot has happened. 

First off, let me say a few things about the District Attorney’s Office handling this case. I never did think that the DA had any kind of nefarious motive here. Matter of fact, they’ve been cooperating with me—to a certain extent—in dealing with the situation.

Arrangements have been made for me to obtain the electronically-stored data / discovery without creating an account on Evidence.com. Most of the discovery has been obtained. A computer glitch delayed getting some of it, but that is not the DA’s fault.

In addition, the DA’s Office, at least initially, agreed with me that what I was telling them was troublesome. I’ve learned from them that their EULA does not look like the EULA I was asked to sign. They, too, were a bit bothered by the one I was given. I have no idea what their EULA looks like; I haven’t seen it. A suggestion I’ve made to reporters who have contacted me, or written about this, is that if I were a reporter, I might try to get a copy of it. But as I’m not a reporter, and I currently don’t have a reason to need their EULA, I haven’t tried to get it. (I have no idea if they’d give it up willingly, or not.)

Now, I said “to a certain extent” above because an Assistant District Attorney to whom the head of the Juvenile Delinquency department, or unit (or whatever they call it) apparently answers has told me that he isn’t sure he agrees with my assessment of the situation here. Although no final decision has been made, they may force me to litigate the issue. Even though I know they aren’t doing this out of malice, I do wish that could be avoided. It’s a side issue to my client’s culpability, or lack thereof, and I’d like to not have to mess with it. But, the fact is that they disagree with me, and that’s why—even though we aren’t as adversarial in the juvenile courts as in the adult courts—we have prosecutors, probation officers, and judges on one side, and a defense attorney looking out for the child on the other.

The nexus of the difference between my position, and the District Attorney’s position, is that—to use the ADA’s words—

It’s like if we rented a storage facility from Derrell’s Mini Storage, and put our archived files in there.

So, as another prosecutor put it,

It’s just storage. It’s like putting the files in a file cabinet in a file room somewhere.

Both of these statements involve flawed analogies. Derrell’s Mini Storage, regardless of which brother owns it, is not going to allow anyone to access the stuff in the storage area. In fact, the renter of the storage space is going to put their own lock on it. And Derrell’s would not cut that lock off, unless perhaps the renter failed to pay their bill. (And wouldn’t that be something? Because, normally, when Derrell’s does that, they auction off what’s inside. But that’s a whole ‘nuther ball of honey badger issues.)

Perhaps uploading juvenile case files to a server could be thought of as just like putting files in a file cabinet in a file room somewhere. The problem is—at least under California law—you don’t get to put those files in just any file cabinet, in just any room.

The crux of the matter here, to unpack their analogy, is that the “file cabinet” here is actually a server in Axon’s “file room.” And the only lock on the door is owned by Axon. Anyone trying to grab the handle on that file cabinet without permission from Axon will be—virtually—tased. In fact, from what I can tell from the EULA I was “asked” to sign, that would seem to include law enforcement, and the District Attorneys’ Offices who contract with Axon.

Moreover, while you could try to view this as a “virtual file cabinet,” instead of a physical thing like computer with a hard drive—well, you can’t really do that. Whatever you want to call it, it exists because of the hardware on which it lives, in an actual real place, or actual real places (in the case of redundant machines instantiating a cloud), and that hardware also lives in an actual real place: a file server room full of computers wired up to other computers.

And not owned by law enforcement, or the District Attorneys. In fact, they probably don’t even know where the file servers are located. [1]“We currently serve our Evidence.com customers from third-party cloud storage providers based in the U.S. and other countries.” See http://investor.axon.com/secfiling.cfm?filingID=1069183-17-42&CIK=1069183 (last visited May 14, 2017 at 4:03 p.m. Pacific Time.

Now, as I discussed in my prior article on this, California’s Welfare & Institutions Code section 827 currently allows only certain individuals to have “juvenile case records.” I also mentioned that “juvenile case records” including the information obtained from investigation of juvenile cases by law enforcement agencies. The people allowed under WIC section 827 include:

(A) Court personnel.
(B) The district attorney, a city attorney, or city prosecutor authorized to prosecute criminal or juvenile cases under state law.
(C) The minor who is the subject of the proceeding.
(D) The minor’s parents or guardian.
(E) The attorneys for the parties, judges, referees, other hearing officers, probation officers, and law enforcement officers who are actively participating in criminal or juvenile proceedings involving the minor.
(F) The county counsel, city attorney, or any other attorney representing the petitioning agency in a dependency action.
(G) The superintendent or designee of the school district where the minor is enrolled or attending school.
(H) Members of the child protective agencies as defined in Section 11165.9 of the Penal Code.
(I) The State Department of Social Services, to carry out its duties pursuant to Division 9 (commencing with Section 10000), and Part 5 (commencing with Section 7900) of Division 12, of the Family Code to oversee and monitor county child welfare agencies, children in foster care or receiving foster care assistance, and out-of-state placements, Section 10850.4, and paragraph (2).
(J) Authorized legal staff or special investigators who are peace officers who are employed by, or who are authorized representatives of, the State Department of Social Services, as necessary to the performance of their duties to inspect, license, and investigate community care facilities, and to ensure that the standards of care and services provided in those facilities are adequate and appropriate and to ascertain compliance with the rules and regulations to which the facilities are subject. The confidential information shall remain confidential except for purposes of inspection, licensing, or investigation pursuant to Chapter 3 (commencing with Section 1500) and Chapter 3.4 (commencing with Section 1596.70) of Division 2 of the Health and Safety Code, or a criminal, civil, or administrative proceeding in relation thereto. The confidential information may be used by the State Department of Social Services in a criminal, civil, or administrative proceeding. The confidential information shall be available only to the judge or hearing officer and to the parties to the case. Names that are confidential shall be listed in attachments separate to the general pleadings. The confidential information shall be sealed after the conclusion of the criminal, civil, or administrative hearings, and may not subsequently be released except in accordance with this subdivision. If the confidential information does not result in a criminal, civil, or administrative proceeding, it shall be sealed after the State Department of Social Services decides that no further action will be taken in the matter of suspected licensing violations. Except as otherwise provided in this subdivision, confidential information in the possession of the State Department of Social Services may not contain the name of the minor.
(K) Members of children’s multidisciplinary teams, persons, or agencies providing treatment or supervision of the minor.
(L) A judge, commissioner, or other hearing officer assigned to a family law case with issues concerning custody or visitation, or both, involving the minor, and the following persons, if actively participating in the family law case: a family court mediator assigned to a case involving the minor pursuant to Article 1 (commencing with Section 3160) of Chapter 11 of Part 2 of Division 8 of the Family Code, a court-appointed evaluator or a person conducting a court-connected child custody evaluation, investigation, or assessment pursuant to Section 3111 or 3118 of the Family Code, and counsel appointed for the minor in the family law case pursuant to Section 3150 of the Family Code. Prior to allowing counsel appointed for the minor in the family law case to inspect the file, the court clerk may require counsel to provide a certified copy of the court order appointing him or her as the minor’s counsel.
(M) When acting within the scope of investigative duties of an active case, a statutorily authorized or court-appointed investigator who is conducting an investigation pursuant to Section 7663, 7851, or 9001 of the Family Code, or who is actively participating in a guardianship case involving a minor pursuant to Part 2 (commencing with Section 1500) of Division 4 of the Probate Code and acting within the scope of his or her duties in that case.
(N) A local child support agency for the purpose of establishing paternity and establishing and enforcing child support orders.
(O) Juvenile justice commissions as established under Section 225. The confidentiality provisions of Section 10850 shall apply to a juvenile justice commission and its members.
(P) Any other person who may be designated by court order of the judge of the juvenile court upon filing a petition.

The astute reader will note that Axon does not appear anywhere in the list, unless they could be under subsection (P), which I can assure you is not the case here. Or probably with any of the juvenile files uploaded to Axon.

There is a code section 827.1, which allows counties and cities to develop databases, but it does not anywhere say they can be owned by private corporations.

Now let’s be fair. As I’ve told numerous reporters lately—none of whom, by the way, have discussed this point in their articles—it may very well be that an Evidence.com-like solution to collecting, storing, and distributing criminal case discovery files will become the norm. Having worked in the industry, I have little doubt that corporations can do a better job at developing such systems—Odyssey notwithstanding, which also holds juvenile records, by the way—than government agencies simply because they can spread their costs amongst numerous government agencies.

But this should only happen when the Legislature has allowed it, and definitely not when existing statutes do not allow it. Serving, as I do, on the Legislative Committee of the Board of Governors for the California Attorneys for Criminal Justice, I have come to understand just what goes in to making legislation. Numerous individuals, and groups, from the California Attorneys for Criminal Justice, to the California District Attorneys Association—and I’m in California, so I’m using groups I know—to the American Civil Liberties Union, California Prison Focus, and other unions and activists groups all have their say in helping to propose, oppose, and shape legislation.

Before evidence from alleged crimes, including videos, audio records, and whatever else Evidence.com does—or evolves to—store is given over to them, there should be laws that control how, when, where, and to what extent such “storage” occurs. What happens when a juvenile record is ordered sealed? What happens when an adult arrest record is ordered sealed? What happens when an expungement occurs? Certificate of Rehabilitation? Pardon? How long are records kept? Can they be stored on servers outside the United States? How and/or what other regulatory issues are there surrounding private corporations holding such information, and files? Attorneys, both for the defense, and prosecution, must be licensed before they can work in the system. Should this be the same for corporations that float systems to store the evidence upon which those attorneys will depend to do their jobs?

These are all questions that—assuming the Legislature decides private corporations should be allowed to develop programs like Evidence.com—need to be answered.

Until then, I for one, am not comfortable that a Taser is connected to “the file cabinet.”


1“We currently serve our Evidence.com customers from third-party cloud storage providers based in the U.S. and other countries.” See http://investor.axon.com/secfiling.cfm?filingID=1069183-17-42&CIK=1069183 (last visited May 14, 2017 at 4:03 p.m. Pacific Time.

Did you enjoy this post? Leave a comment below! And if you haven’t already subscribed, click the button and get my free ePamphlet on “How to Hire a Criminal Defense Lawyer.”


  1. A somewhat off question from Master of Computer Science: would storage of encrypted data on some corporate infrastructure as Axon be acceptable according to the current laws? If so, I envision that the government agencies that are authorized to keep physical case records would need to keep/manage only encryption/decryption keys. Decryption would be performed on the fly on the client computer accessing specific data (no special client-side software required, can be implemented in a browser). This solution would put a significantly lower infrastructural requirements on the government agency due to key data being many orders of magnitude smaller that the actual size of encrypted data. I would even bet that performance of a single modern server machine would be more than sufficient to serve all the requests. Make that two for redundancy. And make that open source and have independent specialists review the cryptography architecture and code. Offer a bounty for cracking it before it goes to real use.

    1. I don’t personally think this would be acceptable under current laws. I think new laws are needed. The reason I believe this is that law enforcement officers are basically handing records over to someone else who is not accountable to the courts. As I said in my article, this raises questions about what happens when records are ordered sealed, etc. But courts might disagree with me.

      In any event, that’s not the current situation. Don’t forget what Axon has said about how it may access the data. We aren’t looking at a situation where Axon has agreed to house encrypted data which is unaccessible to them.

  2. The definition of “cloud computing” is, basically, “someone else’s computer.” Period. It’s a crap shoot where it ends up, but no matter what the intended use of the data to be stored there, not even the most diligent can give 100% assurance of its privacy or safety.

    And I bet my Texas lawyer buddy, Craig D. Ball, would be very interested in this issue. (http://www.craigball.com/)

  3. I can’t imagine how much of a pain it’d be if you did have to litigate the issue. Just educating the judge and/or jury about the nature of cloud computing would take forever.

Leave a Comment

Your email address will not be published. Required fields are marked *