The continuing saga of Dave Champion

[Famspear]

The continuing saga of Dave Champion, uh, continues......

NOTICE OF EVENTS IN RESPONSE TO COURT ORDER

The United States of America submits this notice to apprise the Court of the following events:

On Monday, September 8, the Court ordered Mr. Champion to make his computer available to the IRS, on or before Friday, September 12, for imaging and copying, in connection with the Court’s previous order instructing Mr. Champion to comply with an IRS summons. The Court explained that the IRS could perform the imaging and copying at Mr. Champion’s place of business, if possible, or the IRS was permitted to take possession of the computer to perform the imaging and copying, and then return the computer to Mr. Champion as soon as possible. Mr. Champion agreed to comply with the Court’s order and voiced no objections or conditions.

On Tuesday, September 9, through his attorney, Mr. Champion informed the United States that he would wear a sidearm when the IRS came to image/pick-up his computer. Champion also stated that he intended to videotape the meeting.

For security reasons, the Government requested that Mr. Champion instead deliver the computer to the IRS in Las Vegas.

Mr. Champion, through counsel, has agreed to deliver his computer to the Government in Las Vegas, Nevada, for inspection and copying on Tuesday, September 16, at 11:00 a.m. Champion also agreed to provide all passwords necessary to access his computer and files. The parties are presently negotiating the details of the meeting and the document examination process.

THOMAS P. O’BRIEN
United States Attorney

SANDRA R. BROWN
Assistant United States Attorney
Chief, Tax Division

GAVIN L. GREEN
Assistant United States Attorney

September 12, 2008

--at docket entry 37
United States of America v. David Champion
UNITED STATES DISTRICT COURT
CENTRAL DISTRICT OF CALIFORNIA
case no. CV08-01629-PA-(JWJx)

[ASITStands]

Could Champion not use something like BCWipe before delivering the computer?

Can CI recover data when BCWipe has been used?

[Nikki]

Even if a drive is erased according to DoD standards, there's enough residual magnetism left to permit some data recovery.

Also, if there's any clue as to the type of data, there are fairly powerful mainframe applications which can interpolate missing characters.

The only way to ensure a disk is no longer readable is to physically destroy it.

In any case, if the IRS finds any evidence of files deleted after the subpoena date or file wiping activities, Champion goes to jail for contempt.

That won't happen. He's much too concerned with his own skin to risk it by protecting his clients.

[ASITStands]

Ok. Hadn't thought about contempt after the subpoena date.

[Famspear]

Even if a drive is erased according to DoD standards, there's enough residual magnetism left to permit some data recovery.

Also, if there's any clue as to the type of data, there are fairly powerful mainframe applications which can interpolate missing characters.

The only way to ensure a disk is no longer readable is to physically destroy it.

Nikki, what about using DoD, and wiping multiple times? Ten times? Twenty-five times? Is there a certain number of wipes that the wrongdoer can execute (using DoD) that will defeat any attempt at recovery?

[ASITStands]

I am familiar with a case in which the FBI seized a computer that had used BCWipe.

Nothing was found that could be used as evidence in the resulting trial. There was enough paper trail and testimony to convict for securities crimes. Nothing was said about BCWipe.

Evidently, it was not considered important enough to pursue detection.

[wserra]

I am familiar with a case in which the FBI seized a computer that had used BCWipe.

Me too. While they couldn't recover enough to be useful, they could prove that it had been wiped. That may well have been worse.

[Nikki]

Even if a drive is erased according to DoD standards, there's enough residual magnetism left to permit some data recovery.

Also, if there's any clue as to the type of data, there are fairly powerful mainframe applications which can interpolate missing characters.

The only way to ensure a disk is no longer readable is to physically destroy it.

Nikki, what about using DoD, and wiping multiple times? Ten times? Twenty-five times? Is there a certain number of wipes that the wrongdoer can execute (using DoD) that will defeat any attempt at recovery?

Absent physical destruction of the disk, there is always something recoverable. The only question is how much and how long will it take.

And, as was mentioned above, a carefully scrubbed disk is just much a piece of evidence as is a readable one. The jurors are left to draw their own conclusions as to the reason the information was carefully obliterated.

In any case, DoD (much less NSA) level wiping of a large disk takes a LOT of time.

It consists of multiple passes over the entire disk writing varying patterns of ranging from 00000000 to 11111111 onto each byte. For a large drive, one complete pass can take hours.

[Lambkin]

If you're going to the trouble of erasing a disk, why not just swap the disk for a different one and put a drill bit through the one with the evidence?

[Nikki]

If you're going to the trouble of erasing a disk, why not just swap the disk for a different one and put a drill bit through the one with the evidence?

One hole doth not destruction make.

Shred, melt, warp, etc.

It's necessary to prevent ANYTHING from being able to scan the surface of the disk.

[ASITStands]

While they couldn't recover enough to be useful, they could prove that it had been wiped. That may well have been worse.

Certainly! Understand completely.

One hole doth not destruction make.

Shred, melt, warp, etc.

It's necessary to prevent ANYTHING from being able to scan the surface of the disk.

You can also remove it and use an electromagnet in a circular motion.

Of course, again, you have circumstantial evidence as to "why" it was destroyed.

[Trippy]

Mr. Champion, through counsel, has agreed to deliver his computer to the Government in Las Vegas, Nevada, for inspection and copying on Tuesday, September 16, at 11:00 a.m. Champion also agreed to provide all passwords necessary to access his computer and files. The parties are presently negotiating the details of the meeting and the document examination process.

If you are, or were, a Champion client, I would be doing the following right now:

1) Hiring the best tax lawyer you can afford;
2) Developing an OIC
3) Praying some crabby IRS agent does NOT decide to throw the book at you.

[Doktor Avalanche]

If you're going to the trouble of erasing a disk, why not just swap the disk for a different one and put a drill bit through the one with the evidence?

One hole doth not destruction make.

Shred, melt, warp, etc.

It's necessary to prevent ANYTHING from being able to scan the surface of the disk.

This is true.

Back in the day I used to do data recovery and to illustrate the point on how good my services were I would take a 5.25" floppy full of data, nail it to a tree and then fire a .22 caliber bullet into it and still manage to recover 80% of the data.

[grammarian44]

If you are, or were, a Champion client, I would be doing the following right now:

1) Hiring the best tax lawyer you can afford;
2) Developing an OIC
3) Praying some crabby IRS agent does NOT decide to throw the book at you.

I'm not sure about that. Regardless of what Dave may or may not have done to his computer, I've suspected all along that the controversy about the contents of the computer is kind of a red herring. Dave is not likely the kind of guy who has ever maintained good records on his computer. They may get a list of names, but maybe not even that.

[ClobberroTestii]

I'm not sure about that. Regardless of what Dave may or may not have done to his computer, I've suspected all along that the controversy about the contents of the computer is kind of a red herring. Dave is not likely the kind of guy who has ever maintained good records on his computer. They may get a list of names, but maybe not even that.

I agree. Mr. Champion stated in his latest show that he has always done business in a way that leaves "as small a foot print as possible". I take that to mean that he does not keep a lot of useless (obsolete, unused, old) data.

[Demosthenes]

He may not have kept a business-like database of customers, but I'd put 100 Quatloos on him saving important emails.

[AFTP]

He could try to erase his computer memory but who’s to say he doesn’t just give them a computer that has nothing to do with his business. All they’d find is porn.

[LPC]

The only way to ensure a disk is no longer readable is to physically destroy it.

I have been told that at one time it was the policy of the CIA to run software to wipe clean old hard drives, then dismantle the drives and shred the metal disks, then burn (or melt) the shredded pieces of the hard drive, and then drop the ashes/slag into the ocean in a concrete container.

I don't know what kind of process could be used to extract data from the ashes of a hard drive that had been both shredded and burned, but I guess you can't be too careful.

[Judge Roy Bean]

He may not have kept a business-like database of customers, but I'd put 100 Quatloos on him saving important emails.

Ah, having them find those hidden backup drives can be a real biatch!

And spoliation of evidence isn't going to help his case.

[Demosthenes]

I have been told that at one time it was the policy of the CIA to run software to wipe clean old hard drives, then dismantle the drives and shred the metal disks, then burn (or melt) the shredded pieces of the hard drive, and then drop the ashes/slag into the ocean in a concrete container.

Litterbugs.