Journal Journal: EU Law and searching through *my* computers
It was a hard decision, but I think that this story should, oddly enough, come under the subject of spam, because thats where the whole problem really stemmed from. I'll try to keep it short, and as such will probably omit some details. Questions are welcomed. I apologize that my post may be quite "jumbled" - I'm trying to type as thoughts come to me, and occasionally may insert paragraphs here and there... but I'm sure you'll get there in the end.
On to the story:
Back in February, I had way too much time on my hands, and very little to do - I was waiting for a work permit in an EU country and thus really had the right to do little except exist.
Somehow that led to some trouble. I answered some spam emails (Nigerian Scams, emails for those "Fund Managers" and such) because, as I said, I was bored and really had nothing better to do - yet.
As a result of all this, from about that era I have (had) printouts of "contracts" from these various princes, princesses, village chiefs sons, nephews, neices and daughters of deposed leaders in various nations, not to mention companies whom would supposedly give me a job.
I should mention here that at the time I was also "fighting" with the local companies office and work-permits office to get my company registered and my permits finalized, and at the beginning of April I actually did begin working. During all this I was (am) actively seeking investors to help fund a variety of IT and tourism related projects which I am trying to undertake.
Fast-forward to early April - €10k arrives in my bank account (Who would have thought that I'd get anything without some "initial investment"?). Good news for me: I have €10k. Bad news for me: someone wants me to forward it on to them. A crime otherwise known as money-laundering. Worse news for me: I actually need at least a little bit of it.
Of course, having just literally got permission to stay here permanently (plus I am not the most stupid person in the world, though I can be inclined to do silly things from time-to-time, such as give people my bank account details - not the logins, just the IBAN and SWIFT code - even though these are easily obtained from my invoices which are generated online) I decide that I'd rather not forward large sums of money by Western Union to some guys in the Ukraine.
(Side note: I have friends in the Ukraine, in addition I also occasionally have hired Ukrainians to program/help me out with designs - and as such I have a genuine need to send money in that direction. That said, this was not one of those times)
At this point I have actually spent a little of the money (guys gotta eat, ya know) because waiting and not working for 18-months has put me under some pretty heavy pressure financially - not by choice - I was supposed to have received my permits this time last year)
Fast forward to ANZAC day, or April 25 for non-NZ/non-Aussies. I have just that day received the paperwork confirming the establishment of my company, so off I go to my bank to meet my bank manager as arranged.
After 1 minute, I have sat down, got out my paperwork and I am immediately confronted by two people identifying themselves as policemen. Obviously the proverbial shit is now hitting the proverbial fan. So I am taken away and questioned. For 40-odd hours (not 40-straight).
I was told that I was being kept as a "suspect" and not as a "prisoner". Though the concrete-walls, bad food and large bars didn't really support that - it's not like I was exactly allowed to trot down to the supermarket to grab a carton of milk, ya know.
During questioning, I was also asked what I knew about various computer crimes (spam, phishing, hacking, cracking etc). In addition, I was told (as we went through the events step-by-step) that nothing I did was technically a crime (withdrawing funds from your own bank account is not a crime).
As a geek, and even as evidenced in my emails (I get a lot of these scam emails, emails with "job offers", emails posing to be from banks etc plus, of course, for a number of years, I have been receiving emails from the likes of CNet and ZDNet) I had a lot of information about phishing and the related social-engineering scams to get personal and corporate user ids and passwords - and I was able to describe these crimes and how they work in great detail - and I imagine that most slashdotters could too (though maybe not as much as I could - I happen to have an interest in the security side of computing anyway)
...Oh yeah, and sometime during all this, my computer and 2 external hard drives (I hope they damaged something so I can hit them legally) are taken away, and my girlfriends laptop also is taken away (although it has not been on the internet in nearly 2 months).
Now, I pose a question or 3:
What can they look at?
- Can they check my private chats (MSN, ICQ, Gtalk, Yahoo etc?) I've already voluntarily handed over evidence in the form of emails to most of these people/companies citing that I know its a scam because blah blah blah... as well as the names of various people.
- Can they "break in" to my system? (By way of a password cracker)
- Can they read other emails to unrelated parties (Mum and Dad for example)
- What happens if they were to find, hypothetically, evidence that I know people who might be involved in these kinds of activities, though I'm not benefiting at all.
- What about the fact that I had prior knowledge of all these crimes? Do I "know too much"?
- I was told that there had been "other attempts to put money in to my bank account between January 07 and April 07, all stopped by the banks involved" etc etc. I had no knowledge of any of these transfers BUT chat transcripts between myself and the person I know (see Q4) may indicate otherwise.
- How long can they technically keep my computer? (I need it because it is the core of my business - it's my livelihood and how I make money. Currently I am on a university computer, but I don't have the rights to install any programs, and it just basically sucks)
- How long can they technically keep my girlfriends computer? (She needs it to complete her job as a teacher).
Of course, I'm at risk - I've done something silly, but not (technically) criminal. I co-operated with the authorities as best I could in order to prove my innocence (relatively speaking), yet they have informed me that I *may* face a year or more in prison (how comforting).
My bank details have always been available online, because the service I use to invoice my clients is online and takes these details from my web-server, and I genuinly do probably 85%+ of my business with overseas clients, so it is not uncommon for me to receive transactions ranging from a €x00s to €x000s from overseas.
In all seriousness, should I be as concerned as I am, or are they just doing their authoritarian-gestapo-thing to try and scare me in to slipping up and confessing to being some mastermind or something?
In addition to that, answers to my questions would be helpful. If I have other questions or information, I'll make the appropriate amendments and mark them as clearly as possible.
Interesting sidenote: I have several Linux partitions which are more-or-less hidden at the moment. Grub was overwritten last time I reinstalled Windows and I haven't been able to reinstall/update my Linux distro due to time constraints and the fact that some of my apps don't yet function on Linux.
However, as I move more-and-more to online services, this is changing - my Windows "dependency" is lessening quickly, and I plan to be completely Windows-free as soon as some new linux versions of certain apps appear - hopefully before the end of June '07!
