Leaked files expose flaws in official report into inmate's death

It took nine minutes for Daniel Oppenheimer to strangle himself to death with the zipper of his jail-issued jumpsuit in a La Habra, Calif., police holding cell in January 2015.

An unnamed attorney, charged with defending the city, made notes on his computer. He described what he saw in the grainy footage from the badly placed surveillance cameras covering the inmate’s cell. The attorney noted that he saw “shadows” of a person walking past Oppenheimer’s cell on two separate occasions -- minutes apart -- as he died. But those shadows weren’t mentioned in the district attorney’s report that investigated any potential criminal wrongdoing by the police department into the inmate’s death.

Could someone have stopped Oppenheimer from hanging himself?

The attorney, whose law firm Ferguson, Praet & Sherman specializes in defending alleged police misconduct, marked the notes as a “work product,” a legal term that ensures the notes couldn’t leave his law firm. The notes were put in a folder marked “do not forward to new counsel.”

Apparently, someone didn’t want anyone to see what the attorney wrote.

And that might’ve been the end of it -- a two-line notation in a folder that nobody else would have even known about -- if it wasn’t for the law firm’s poor approach to information security.

The leaked video serves as a graphic illustration of what happens when a company doesn’t prioritize security. It’s become an increasingly widespread problem, which could have a disastrous effect on companies and people.

Chris Vickery, a security researcher, discovered the attorney’s notes and the surveillance footage among a huge cache of internal law case files that were inadvertently made accessible on the web.

He told me on the phone what he found.

Anyone watching the surveillance video would not necessarily know that Oppenheimer was dying, but on two occasions, Vickery characterized the “shadows” as a person’s reflection that could be seen in the cell’s glass.

“Twice,” he said, “someone walks past his cell and does nothing to stop it.” The first reflection moves past six minutes before the jailer raised the alarm, he explained in a blog post detailing what he found.

“It doesn’t look good,” he told me.

As lead security researcher of the MacKeeper security research team, he has found hundreds of databases left open on the internet without passwords. To date, that’s included a financial crime and terror watchlist and an energy company’s store of personal customer data. He informs companies so they can secure their leaky systems, then blogs about his discoveries.

Of his recent findings, he found a handful of law firms that were inadvertently leaking their own case files. But what set this law firm apart was the sheer volume of data he found.

He said the firm was streaming close to two terabytes of data over the “rsync” protocol, a common way of synchronizing copies of files between two different computers.

Among the files, Vickery found confidential police reports detailing Oppenheimer’s arrest, two recorded calls to 911, and audio conversations between staff on the La Habra police department radio. A mailbox file full of emails between attorneys, the city, and insurance adjusters was also found in the leaked data.

The law firm shut down the data stream after Vickery sent an unreturned email disclosing the leak.

The Orange County district attorney’s investigation into Oppenheimer’s death included a timeline of events leading up to and in the immediate aftermath of his death, but it did not mention any reflections or shadows. The report, issued in September following his death, concluded that there was “no evidence” of criminal culpability on the part of La Habra’s police department.

Oppenheimer’s family is now suing the city for his alleged wrongful death.

Vickery provided me with the attorney’s case files on Oppenheimer to independently review.

The attorney’s notes, written months later, included two entries that were not mentioned in the district attorney’s timeline. The exact timestamps of the notes pointing out the reflections can be matched up with the surveillance tape.

Another of the surveillance cameras covering the hallway adjacent to Oppenheimer’s cell froze twice for a minute each -- exactly during the moments the unknown reflections were seen in Oppenheimer’s cell. (The district attorney’s report said that the cameras froze “at arbitrary times” as “the result of a malfunction within the recording system.”)

We asked the Orange County district attorney’s office if it would reexamine the footage.

Spokesperson Roxi Fyad said that the September report “is the extent of our comment,” and said, “we won’t be releasing any further information.”

La Habra Police Department Chief Jerry Price declined to comment on pending litigation.

When we spoke, Vickery was frustrated.

“The district attorney’s report claims that many people meticulously examined all the evidence in this matter. If that is true, then they must have seen these people walking past the cell and doing nothing,” he added.

The public court filings make no mention of the reflections of someone looking into the cell, either, referencing only a 10-minute period in which the jailer enters the office and then radios for help.

Oppenheimer’s family’s civil case now rests in the hands of their attorney. The rules that attorneys abide by say that they cannot know the other side’s attorney-client privileged conversations, for fear of interfering with the case (and violating these strict ethics rules can lead to disciplinary hearings, not least being disbarred).

Neither attorney would confirm if they would alter their arguments to consider the new evidence.

When asked by email if he was aware of the leaked documents, Jeffrey Lenkov, the new attorney on behalf of the city of La Habra, tersely said, “No clue.”

Despite making numerous attempts to reach Ferguson, Praet & Sherman by phone and email, we did not get a response from the firm.

Caleb Mason, the attorney for the Oppenheimer family, said on the phone that he was barred from obtaining or reviewing any privileged files -- even if leaked or accidentally disclosed -- but did say that he intended to bring the issue of the leak to the presiding judge who may determine how to proceed.

Given the circumstances of leaked data breaching the sacred barrier of attorney-client privilege, how this plays out in civil court is anybody’s guess.

“Oppenheimer may not have been a great person. He was an admitted meth user and had a long history of run-ins with the law. But when a staff member at the La Habra city jail had a duty to act, this video shows that they did not,” said Vickery.

And all it took was a security researcher happening across files for the public to find that out.

This article originally appeared on ZDNet.