NEW YORK — It took nine minutes for Daniel Oppenheimer to strangle himself to death with the zipper of his jail-issued jumpsuit in a La Habra, Calif. police holding cell in January 2015.
An unnamed attorney, charged with defending the city, made notes on his computer. He described what he saw from one of the badly placed surveillance cameras watching over Oppenheimer in his cell as he died.
He noted that a jailer walked back and forth in the hallway where the jail cells are. A few moments later, she entered an office, out of sight. Oppenheimer walked around in his cell for a minute. The notes said that the camera froze momentarily, then restarts. By this point, Oppenheimer was on the ground. The notes mentioned a “shadow of someone walking by,” then six minutes later another “shadow of someone walking around.” Then, ten minutes after she first entered, the jailer exited the office. Then, the attorney wondered if she was seen “making calls?”
Two officers almost immediately rushed to the inmate’s cell, Oppenheimer was cut down, and the officers begin an attempt to resuscitate him. Paramedics arrived and took over, then rushed him to hospital.
He was pronounced dead an hour later.
The attorney, whose law firm Ferguson, Praet & Sherman specializes in defending alleged police misconduct, marked the notes as a “work product,” a legal term that ensures the notes couldn’t leave his law firm. The notes were put in a folder marked “do not forward to new counsel.”
Apparently, someone didn’t want anyone to see what the attorney wrote: Could someone have stopped Oppenheimer from hanging himself?
And that might’ve been the end of it — a two-line notation in a folder that nobody else would have even known about — if it wasn’t for the law firm’s poor approach to information security.
Chris Vickery, a security researcher, discovered the attorney’s notes and the grainy surveillance footage among a huge cache of internal law case files that were inadvertently made accessible on the web. As he showed, no matter the size of a company, a slack approach to data security can have disastrous effects on any business, and people’s lives alike.
He told me on the phone what he found.
Anyone watching the surveillance video would not necessarily know that Oppenheimer was dying, but on two occasions he characterized the “shadows” as a person’s reflection that could be seen in the cell’s glass.
“Twice,” he said, “someone walks past his cell and does nothing to stop it,” he said. The first walk past was six minutes before the jailer raised the alarm, he explained in a blog post detailing what he found.
“It doesn’t look good,” he told me.
As lead security researcher of the MacKeeper security research team, he has found hundreds of databases left open on the internet without passwords — to date that’s included a financial crime and terror watchlist and an energy company’s store of personal customer data. He informs companies so they can secure their leaky systems, then blogs about it.
Of his recent findings, he found a handful of law firms that were inadvertently leaking their own case files. But what set this law firm apart was the sheer volume of data he found.
He said the firm was streaming close to two terabytes of data over the “rsync” protocol, a common way of synchronizing copies of files between two different computers.
Among the files, Vickery found confidential police reports detailing Oppenheimer’s arrest, two recorded calls to 911, and audio conversations between staff on the La Habra police department radio. A mailbox file full of emails between attorneys, the city, and insurance adjusters was also found in the leaked data.
The law firm shut down the data stream after Vickery sent an unreturned email disclosing the leak.
The Orange County district attorney’s investigation into Oppenheimer’s death included a timeline of events leading up to and in the immediate aftermath of his death, but did not mention any reflections or shadows. The report, issued in September following his death, concluded that there was “no evidence” of criminal culpability on the part of La Habra’s police department.
Oppenheimer’s family is now suing the city for his alleged wrongful death.
Vickery provided me with the attorney’s case files on Oppenheimer to independently review.
The attorney’s notes, written months later, included two entries that were not mentioned in the district attorney’s timeline. The exact timestamps of the notes pointing out the reflections can be matched up with the surveillance tape.
Another of the surveillance cameras covering the hallway adjacent to Oppenheimer’s cell froze twice for a minute each — exactly during the moments the unknown reflections were seen in Oppenheimer’s cell. (The district attorney’s report said that the cameras froze “at arbitrary times” as “the result of a malfunction within the recording system.”)
We asked the Orange County district attorney’s office if it would reexamine the footage.
Spokesperson Roxi Fyad said that the September report “is the extent of our comment,” and said, “we won’t be releasing any further information.”
La Habra police department chief Jerry Price declined to comment on pending litigation.
When we spoke, Vickery was frustrated.
“The district attorney’s report claims that many people meticulously examined all the evidence in this matter. If that is true, then they must have seen these people walking past the cell and doing nothing,” he added.
The public court filings make no mention of the reflections of someone looking into the cell, either, referencing only a ten minute period in which the jailer enters the office, then when she radios for help.
Oppenheimer’s family’s civil case now rests in the hands of their attorney. The rules that attorneys abide by say that they cannot know the other side’s attorney-client privileged conversations, for fear of interfering with the case (and violating these strict ethics rules can lead to disciplinary hearings, not least being disbarred).
Neither attorney would confirm if they would alter their arguments to consider the new evidence.
An email to Jeffrey Lenkov, the new attorney on behalf of the city of La Habra, asked if aware of the leaked documents. In his response, he tersely said, “No clue.”
Despite making numerous attempts to reach Ferguson, Praet & Sherman by phone and email, we did not get a response from the firm.
Caleb Mason, the attorney for the Oppenheimer family, said on the phone that he was barred from obtaining or reviewing any privileged files — even if leaked or accidentally disclosed — but did say that he intended to bring the issue of the leak to the presiding judge who may determine on how to proceed.
Given the circumstances of leaked data breaching the sacred barrier of attorney-client privilege, how this plays out in civil court is anybody’s guess.
“Oppenheimer may not have been a great person. He was an admitted meth user and had a long history of run-ins with the law. But when a staff member at the La Habra city jail had a duty to act, this video shows that they did not,” said Vickery.
And all it took was a security researcher happening across files for the public to find that out.