|
|
individual’s expectation of privacy even in password-protected files. In United
States v. Buckner, 407 F. Supp. 2d 777 (W.D. Va. 2006), the Court held that
the defendant’s wife could validly consent to a search of the family computer,
including her husband’s password-protected files. Te Court distinguished
Trulock by noting that the computer was leased solely in the wife’s name, the
allegedly fraudulent activity that provoked the search had occurred through
accounts in the wife’s name, the computer was located in a common area of the
house, none of the files were encrypted, and the computer was on even though
the husband had apparently fled the area. Id. at 780-81. Furthermore, if the
co-user has been given the password by the suspect, then she probably has the
requisite common authority to consent to a search of the files under Matlock.
See United States v. Murphy, 506 F.2d 529, 530 (9th Cir. 1974) (per curiam)
(concluding that an employee could consent to a search of an employer’s
locked warehouse because the employee possessed the key, and finding “special
significance” in the fact that the employer had himself delivered the key to the
employee).
As a practical matter, agents may have little way of knowing the precise
bounds of a third party’s common authority when the agents obtain third-
party consent to conduct a search. When queried, consenting third parties
may falsely claim that they have common authority over property. In Illinois
v. Rodriguez, 497 U.S. 177 (1990), the Supreme Court held that the Fourth
Amendment does not automatically require suppression of evidence discovered
during a consent search when it later comes to light that the third party who
consented to the search lacked the authority to do so. See id. at 188-89. Instead,
the Court held that agents can rely on a claim of authority to consent if based
on “the facts available to the officer at the moment, . . . a man of reasonable
caution . . .
[would believe] that the consenting party had authority” to
consent to a search of the premises. Id. (internal quotation marks omitted)
(quoting Terry v. Ohio, 392 U.S. 1, 21-22 (1968)). When agents reasonably
rely on apparent authority to consent, the resulting search does not violate
the Fourth Amendment. For example, in United States v. Morgan, 435 F.3d
660 (6th Cir. 2006), investigators received consent from the defendant’s wife
to search a computer located in the common area of the home. Te wife told
police that she had access to the computer, that neither she nor her husband
used individual usernames or passwords, and that she had recently installed
spyware on the computer to monitor her husband’s suspected viewing of child
pornography. Id. at 663-64. She did not tell the police that she had her own,
separate computer for her primary use. Id. at 662. Nevertheless, the Court
1. Without a Warrant
21
found that the police could reasonably rely on her statements and conclude
that she had authority to consent to the search. Id. at 664. See also United States
v. Andrus, 483 F.3d 711, 720-21 (10th Cir. 2007) (holding that parent had
apparent authority to consent to search of computer in room of adult child,
where parent had unrestricted access to adult child’s bedroom and paid for
Internet access).
Te Supreme Court has held, however, that investigators cannot rely on a
third party’s consent to search a residence when the target of the search is present
and expressly objects to the search. See Georgia v. Randolph, 547 U.S. 103, 121
(2006). Te court’s conclusion was based on its determination that a “co-tenant
wishing to open the door to a third party has no recognized authority in law
or social practice to prevail over a present and objecting co-tenant.” Id. at 114.
Moreover, unless police remove a potential objector “for the sake of avoiding
a possible objection,” Randolph does not apply to “potential” objectors who
have not taken part in the consent colloquy, even if the potential objector is
nearby. Id. at 121. For example, in United States v. Hudspeth, 518 F.3d 954
(8th Cir. 2008) (en banc), officers arrested the defendant at his workplace for
possession of child pornography, and the defendant refused to consent to a
search of his home. Nevertheless, his wife subsequently consented to a search
of a computer in their home. Te Eighth Circuit upheld the search, explaining
that “unlike Randolph, the officers in the present case were not confronted
with a ‘social custom’ dilemma, where two physically present co-tenants have
contemporaneous competing interests and one consents to a search, while the
other objects.” Id. at 960. See also United States v. Crosbie, 2006 WL 1663667,
at *2 (S.D. Ala. June 9, 2006) (defendant’s wife’s consent to computer search
was valid even though wife had ordered her husband out of the house, thus
depriving him of the “opportunity to object”).
ii. Spouses and Domestic Partners
Most spousal consent searches are valid.
Absent an affirmative showing that the consenting spouse has no access to
the property searched, the courts generally hold that either spouse may consent
to a search of all of the couple’s property. See, e.g., Trulock v. Freeh, 275 F.3d
391, 398, 403-04 (4th Cir. 2001) (holding that woman did not have authority
to consent to search of computer files of the man with whom she lived, when
she had told agents that she did not know the password to access his files);
United States v. Duran, 957 F.2d 499, 504-05 (7th Cir. 1992) (concluding that
22
Searching and Seizing Computers
wife could consent to search of barn she did not use because husband had not
denied her the right to enter barn); United States v. Long, 524 F.2d 660, 661
(9th Cir. 1975) (holding that wife who had left her husband could consent to
search of jointly-owned home even though husband had changed the locks).
For example, in United States v. Smith, 27 F. Supp. 2d 1111 (C.D. Ill. 1998),
a man named Smith was living with a woman named Ushman and her two
daughters. When allegations of child molestation were raised against Smith,
Ushman consented to the search of his computer, which was located in the
house in an alcove connected to the master bedroom. Although Ushman used
Smith’s computer only rarely, the district court held that she could consent
to the search of Smith’s computer. Because Ushman was not prohibited from
entering the alcove and Smith had not password-protected the computer, the
court reasoned, she had authority to consent to the search. See id. at 1115-
16. Even if she lacked actual authority to consent, the court added, she had
apparent authority to consent. See id. at 1116 (citing Illinois v. Rodriguez, 497
U.S. 177 (1990)).
iii. Parents
Parents can consent to searches of their children’s computers
when the children are under 18 years old. If the children are 18 or
older, the parents may or may not be able to consent, depending
on the facts.
In some computer crime cases, the perpetrators are relatively young and
reside with their parents. When the perpetrator is a minor, parental consent to
search the perpetrator’s property and living space will almost always be valid.
See 3 Wayne LaFave, Search and Seizure: A Treatise on the Fourth Amendment
§ 8.4(b) at 283 (2d ed. 1987) (noting that courts have rejected “even rather
extraordinary efforts by [minor] child[ren] to establish exclusive use.”).
When the sons and daughters who reside with their parents are legal adults,
however, the issue is more complicated. Under Matlock, it is clear that parents
may consent to a search of common areas in the family home regardless of
the perpetrator’s age. See, e.g., United States v. Lavin, 1992 WL 373486, at *6
(S.D.N.Y. Nov. 30, 1992) (recognizing right of parents to consent to search of
basement room where son kept his computer and files). When agents would
like to search an adult child’s room or other private areas, however, agents
cannot assume that the adult’s parents have authority to consent. Although
courts have offered divergent approaches, they have paid particular attention
1. Without a Warrant
23
to three factors: the suspect’s age; whether the suspect pays rent; and whether
the suspect has taken affirmative steps to deny his or her parents access to
the suspect’s room or private area. When suspects are older, pay rent, and/
or deny access to parents, courts have generally held that parents may not
consent. See United States v. Whitfield, 939 F.2d 1071, 1075 (D.C. Cir. 1991)
(“cursory questioning” of suspect’s mother insufficient to establish right to
consent to search of 29-year-old son’s room); United States v. Durham, 1998
WL 684241, at *4 (D. Kan. Sept. 11, 1998) (mother had neither apparent nor
actual authority to consent to search of 24-year-old son’s room, because son
had changed the locks to the room without telling his mother, and son also
paid rent for the room). In contrast, parents usually may consent if their adult
children do not pay rent, are fairly young, and have taken no steps to deny their
parents access to the space to be searched. See United States v. Andrus, 483 F.3d
711, 713, 720-21 (10th Cir. 2007) (parent had apparent authority to consent
to search of computer in room of 51-year-old son who did not pay rent, where
parent had unrestricted access to adult child’s bedroom and paid for Internet
access); United States v. Rith, 164 F.3d 1323, 1331 (10th Cir. 1999) (suggesting
that parents were presumed to have authority to consent to a search of their
18-year-old son’s room because he did not pay rent); United States v. Block, 590
F.2d 535, 541 (4th Cir. 1978) (mother could consent to police search of 23-
year-old son’s room when son did not pay rent).
iv. Computer Repair Technicians
As discussed above in Section B.4, computer searches by repairman prior
to contact with law enforcement are private searches and do not implicate the
Fourth Amendment. Most commonly, law enforcement will use information
revealed through a repairman’s private search as a basis to secure a warrant for
a full search of the computer. In some cases, however, law enforcement officers
have relied on the consent of the repairman as the basis for a search of the
computer that exceeds the scope of the initial private search. District courts
have split on whether computer repairmen have the authority to authorize
such searches. Compare United States v. Anderson, 2007 WL 1121319, at *6
(N.D. Ind. Apr. 16, 2007) (technicians had “actual and apparent authority”
to consent to a search of computer brought in for repair because they had
authority to access the computer), with United States v. Barth, 26 F. Supp. 2d
929, 938 (W.D. Tex. 1998) (repairman lacked actual or apparent authority to
consent to search of hard drive because the defendant had given the hard drive
24
Searching and Seizing Computers
to the technician only for a limited purpose unrelated to the specific files and
only for a limited period of time).
v. System Administrators
Computer network accounts, including the accounts provided by private
employers to their employees, by government entities to public employees,
and by large commercial service providers to their customers, often contain
information relevant to criminal investigations. When investigators suspect
that a computer network account contains relevant evidence, they may want
to know whether the network’s owner or manager has authority to voluntarily
disclose information related to the account. As a practical matter, every computer
network is managed by a “system administrator” or “system operator” whose
job is to keep the network running smoothly, monitor security, and repair the
network when problems arise. System operators have “root level” access to the
systems they administer, which effectively grants them master keys to open
any account and read any file on their systems. However, whether a system
administrator (generally at the direction of an appropriate supervisory official)
may voluntarily consent to disclose information from or regarding a user’s
account varies based on whether the network belongs to a communication
service provider, a private business, or a government entity.
Regarding public commercial communication service providers (such as
Google or Yahoo!), the primary barrier to voluntary disclosure by the service
provider is statutory, not constitutional. As discussed in Chapter
3, any
attempt to obtain a system administrator’s consent to disclose information
regarding an account must comply with the Stored Communications Act
(“SCA”), 18 U.S.C. §§ 2701-2712. Section 2702 of the SCA prohibits public
service providers from voluntarily disclosing to the government information
pertaining to their customers except in certain specified situations—which
often track Fourth Amendment exceptions—such as with the consent of the
user, to protect the service provider’s rights and property, or in an emergency. See
Chapter 3.E, infra. Significantly for Fourth Amendment purposes, commercial
service providers typically have terms of service that confirm their authority
to access information stored on their systems, and such terms of service may
establish a service provider’s common authority over their users’ accounts. See
United States v. Young, 350 F.3d 1302, 1308-09 (11th Cir. 2003) (holding that
Federal Express’s terms of service, which authorized it to inspect packages, gave
it common authority to consent to a government search of a package); see also
United States v. Beckett, 544 F. Supp. 2d 1346, 1350 (S.D. Fla. 2008) (“where
1. Without a Warrant
25
service providers have an agreement to share information under circumstances
similar to those in our case (for investigation, to cooperate with law enforcement,
and to take legal action), there is no objectively reasonable expectation of privacy
and therefore no Fourth Amendment protection for subscriber information”).
But see Quon v. Arch Wireless Operating Co., 529 F.3d 892, 904-08 (9th Cir.
2008) (finding government employee had reasonable expectation of privacy in
pager messages stored by provider of communication service based on “informal
policy that the text messages would not be audited”).
As discussed more fully in Section D.1.b below, private-sector employers
generally have broad authority to consent to searches in the workplace, and
this authority extends to workplace networks. For example, in United States v.
Ziegler, 474 F.3d 1184 (9th Cir. 2007), the Ninth Circuit held that an employer
could consent to a search of the computer it provided to an employee and
stated that “the computer is the type of workplace property that remains within
the control of the employer even if the employee has placed personal items in
it.” Id. at 1191 (internal quotation marks omitted). Tus, law enforcement
can generally rely on the consent of an appropriate manager to search a private
workplace network. In contrast, as discussed in Section D.2 below, the Fourth
Amendment rules for government computer networks differ significantly from
the rules that apply to private networks. Searches of government computer
networks are not evaluated under Matlock; instead, they are evaluated under
the standards of O’Connor v. Ortega, 480 U.S. 709 (1987).
c. Implied Consent
Individuals often enter into agreements with the government in which
they waive some of their Fourth Amendment rights. For example, prison
guards may agree to be searched for drugs as a condition of employment, and
visitors to government buildings may agree to a limited search of their person
and property as a condition of entrance. Similarly, users of computer systems
may waive their rights to privacy as a condition of using the systems. When
individuals who have waived their rights are then searched and challenge the
searches on Fourth Amendment grounds, courts typically focus on whether
the waiver eliminated the individual’s reasonable expectation of privacy against
the search. See, e.g., United States v. Simons, 206 F.3d 392, 398 (4th Cir. 2000)
(government employee had no reasonable expectation of privacy in computer
in light of computer use policy); American Postal Workers Union, Columbus
Area Local AFL-CIO v. United States Postal Service, 871 F.2d 556, 559-61 (6th
Cir. 1989) (postal employees retained no reasonable expectation of privacy
26
Searching and Seizing Computers
in government lockers after signing waivers). For an expanded discussion of
workplace searches, see Section D below.
A few courts have approached the same problem from a slightly different
direction and have asked whether the waiver established implied consent to
the search. According to the doctrine of implied consent, consent to a search
may be inferred from an individual’s conduct. For example, in United States v.
Ellis, 547 F.2d 863 (5th Cir. 1977), a civilian visiting a naval air station agreed
to post a visitor’s pass on the windshield of his car as a condition of bringing
the car on the base. Te pass stated that “[a]cceptance of this pass gives your
consent to search this vehicle while entering, aboard, or leaving this station.”
Id. at 865 n.1. During the visitor’s stay on the base, a station investigator who
suspected that the visitor had stored marijuana in the car approached the
visitor and asked him if he had read the pass. After the visitor admitted that
he had, the investigator searched the car and found 20 plastic bags containing
marijuana. Te Fifth Circuit ruled that the warrantless search of the car was
permissible, because the visitor had impliedly consented to the search when he
knowingly and voluntarily entered the base with full knowledge of the terms of
the visitor’s pass. See id. at 866-67.
Ellis notwithstanding, it must be noted that several circuits have been critical
of the implied consent doctrine in the Fourth Amendment context. Despite
the Fifth Circuit’s broad construction, other courts have been reluctant to
apply the doctrine absent evidence that the suspect actually knew of the search
and voluntarily consented to it at the time the search occurred. See McGann v.
Northeast Illinois Regional Commuter R.R. Corp., 8 F.3d 1174, 1180 (7th Cir.
1993) (“Courts confronted with claims of implied consent have been reluctant
to uphold a warrantless search based simply on actions taken in the light of a
posted notice.”); Security and Law Enforcement Employees, Dist. Council 82 v.
Carey, 737 F.2d 187, 202 n.23 (2d Cir. 1984) (rejecting argument that prison
guards impliedly consented to search by accepting employment at prison where
consent to search was a condition of employment). Absent such evidence, these
courts have preferred to examine general waivers of Fourth Amendment rights
solely under the reasonable-expectation-of-privacy test. See id.
2. Exigent Circumstances
Te exigent circumstances exception to the warrant requirement generally
applies when one of the following circumstances is present: (1) evidence is
in imminent danger of destruction; (2) a threat puts either the police or the
1. Without a Warrant
27
public in danger; (3) the police are in “hot pursuit” of a suspect; or (4) the
suspect is likely to flee before the officer can secure a search warrant. Georgia
v. Randolph, 547 U.S. 103, 117 n.6 (2006) (collecting cases); Brigham City v.
Stuart, 547 U.S. 398, 403-06 (2006) (police appropriately entered house to
stop assault when occupants did not respond to the officers’ verbal directions);
Illinois v. McArthur, 531 U.S. 326, 331-33 (2001) (police appropriately seized
house for two hours while warrant was obtained); Cupp v. Murphy, 412 U.S.
291, 294-96 (1973) (murder suspect was temporarily seized and his fingernails
scraped to prevent destruction of evidence). Of the four factors justifying an
exigent circumstances search, the first—that the evidence is in imminent danger
of destruction—is generally the most relevant in the context of computer
searches.
In determining whether exigent circumstances exist, agents should consider:
(1) the degree of urgency involved, (2) the amount of time necessary to obtain a
warrant, (3) whether the evidence is about to be removed or destroyed, (4) the
possibility of danger at the site, (5) whether those in possession of the contraband
know that the police are on their trail, and (6) the ready destructibility of the
contraband. See United States v. Reed, 935 F.2d 641, 642 (4th Cir. 1991); see
also United States v. Plavcak, 411 F.3d 655, 664-65 (6th Cir. 2005) (agents
appropriately seized computer without warrant when targets were caught
burning relevant documentary evidence and then ran from residence carrying
computer); United States v. Trowbridge, 2007 WL 4226385, at *4-5 (N.D.
Tex. Nov. 29, 2007) (agents appropriately seized computers without a warrant
based on exigent circumstances where agents were concerned for their safety
during a fast-moving investigation and it was likely that computer evidence
would be destroyed).
Exigent circumstances can arise in computer cases before the evidence
has been properly secured because electronic data is inherently perishable.
Computer data can be effectively put out of law enforcement reach with widely-
available and powerful encryption programs that can be triggered with just a
few keystrokes. In addition, computer commands can destroy data in a matter
of seconds, as can moisture, high temperature, physical mutilation, or magnetic
fields created, for example, by passing a strong magnet over a disk. For example,
in United States v. David, 756 F. Supp. 1385 (D. Nev. 1991), agents saw the
defendant deleting files on his computer and seized the computer immediately.
Te district court held that the agents did not need a warrant to seize the
computer because the defendant’s acts had created exigent circumstances. See
28
Searching and Seizing Computers
id. at 1392. See also United States v. Gorshkov, 2001 WL 1024026, at *4 (W.D.
Wash. May 23, 2001) (circumstances justified downloading without a warrant
data from computer in Russia where probable cause existed to believe that
Russian computer contained evidence of crime, where good reason existed to
fear that delay could lead to destruction of or loss of access to evidence, and
where agent merely copied data and subsequently obtained search warrant).
With some electronic devices, exigent circumstances may arise because
information may be lost when the device’s battery dies, or new information may
cause older information to be lost permanently. For example, in United States v.
Romero-Garcia, 991 F. Supp. 1223, 1225 (D. Or. 1997), aff’d on other grounds
168 F.3d 502 (9th Cir. 1999), a district court held that agents had properly
accessed the information in an electronic pager in their possession because
they had reasonably believed that it was necessary to prevent the destruction
of evidence. Te information stored in pagers is readily destroyed, the court
noted: incoming messages can delete stored information, or the batteries can
die, erasing the information. Accordingly, the agents were justified in accessing
the pager without first acquiring a warrant. See also United States v. Ortiz, 84
F.3d 977, 984 (7th Cir. 1996) (in conducting search incident to arrest, agents
were justified in retrieving numbers from pager because pager information is
easily destroyed). In United States v. Parada, 289 F. Supp. 2d 1291 (D. Kan.
2003), a court reached the same result for a cell phone, although the court’s
analysis may have been based in part on a misunderstanding of how cell phones
function. Te court held that exigent circumstances justified the search of a
cell phone because the phone had limited memory and subsequent calls could
overwrite previously stored numbers, whether the phone was on or off. See id.
at 1303-04.
However, in electronic device cases, as in all others, the existence of exigent
circumstances is tied to the facts of the individual case, and other courts have
rejected claims that exigent circumstances justified a search of an electronic
device. For example, in United States v. Morales-Ortiz, 376 F. Supp. 2d 1131,
1142 (D.N.M. 2004), the court held that exigent circumstances did not justify
a search of the names and numbers held within a cell phone’s address book. Te
court distinguished a search of the cell phone’s address book records from the
search of the incoming call log approved in Parada. See id.; see also United States
v. Wall, 2008 WL 5381412, at *3-4 (S.D. Fla. Dec. 22, 2008) (noting that
cell phones store text messages until they are deleted by the user and therefore
rejecting argument that exigent circumstances justified search of seized cell
1. Without a Warrant
29
phone); David, 756 F. Supp at 1392 n.2 (dismissing as lame the government’s
argument that exigent circumstances supported search of a battery-operated
computer because the agent did not know how much longer the computer’s
batteries would live); United States v. Reyes, 922 F. Supp. 818, 835-36 (S.D.N.Y.
1996) (exigent circumstances could not justify search of a pager because the
government agent unlawfully created the exigency by turning on the pager).
Recent technological advances in pagers, cell phones, and PDAs may have
an impact on the existence of exigent circumstances justifying the search of
these devices without a warrant. Some of the advances may undercut the basis
for finding exigent circumstances. For example, current electronic devices are
more likely to rely on a storage mechanism (such as flash memory) that does
not require battery power to maintain storage. However, other technological
advances have created new exigencies. For example, a “kill command” can be
sent to some devices that will cause the device to encrypt itself or overwrite data
stored on the device. Similarly, other devices can be set to delete information
stored on the device after a certain period of time. See United States v. Young,
2006 WL 1302667, at *13 (N.D.W.Va. May 9, 2006) (exigent circumstances
justified searching a cell phone for text messages where the cell phone had an
option for automatically deleting text messages after one day).
Importantly, because “a warrantless search must be strictly circumscribed
by the exigencies which justify its initiation,” Mincey v. Arizona, 437 U.S. 385,
393 (1978) (internal quotation marks omitted), exigent circumstances that
support the warrantless seizure of a computer may not support the subsequent
search of the computer by law enforcement. “Recognizing the generally less
intrusive nature of a seizure, the [Supreme] Court has frequently approved
warrantless seizures of property, on the basis of probable cause, for the time
necessary to secure a warrant.” Segura v. United States, 468 U.S. 796, 806
(1984) (internal citations omitted). Tus, the need to seize a container to
prevent the destruction of evidence does not necessarily authorize agents to
take further steps without a warrant. See United States v. Doe, 61 F.3d 107,
110-11 (1st Cir. 1995); David, 756 F. Supp. at 1392 (exigency justified seizure
but not search of computer); Morales-Ortiz, 376 F. Supp. 2d at 1142 n.2
(emphasizing that while exigent circumstances may justify seizing a pager to
preserve evidence, the exception does not justify manipulating the pager in
order to retrieve messages). In addition, absent an immediate need to access the
data, practical factors may favor a forensic analysis of a seized computer based
on a search warrant. A trained analyst working in a forensic setting can often
30
Searching and Seizing Computers
extract detailed and relevant information from a computer that would not be
recovered through a hastily conducted search.
3. Search Incident to a Lawful Arrest
Pursuant to a lawful arrest, agents may conduct a “full search” of the
arrested person, and a more limited search of his surrounding area, without
a warrant. See United States v. Robinson, 414 U.S. 218, 235 (1973); Chimel v.
California, 395 U.S. 752, 762-63 (1969). For example, in Robinson, a police
officer conducting a patdown search incident to an arrest for a traffic offense
discovered a crumpled cigarette package in the suspect’s left breast pocket.
Not knowing what the package contained, the officer opened the package and
discovered fourteen capsules of heroin. Te Supreme Court held that the search
of the package was permissible, even though the officer had no articulable
reason to open the package. See Robinson, 414 U.S. at 234-35. In light of the
general need to preserve evidence and prevent harm to the arresting officer, the
Court reasoned, it was per se reasonable for an officer to conduct a “full search
of the person” pursuant to a lawful arrest. Id. at 235.
Te permissible temporal scope for a search incident to arrest varies based
on whether the item searched is an item “immediately associated with the
person of an arrestee,” such as clothing or a wallet, or other personal property
near the arrestee, such as luggage. United States v. Chadwick, 433 U.S. 1, 15
(1977). Two Supreme Court cases illustrate this distinction. First, United States
v. Edwards, 415 U.S. 800, 808-09 (1974), demonstrates the substantial time
allowed for a search incident to arrest of items immediately associated with
the person of an arrestee: the Court upheld a search of a defendant’s clothing
after a night in jail. In contrast, in United States v. Chadwick, the Court held
that officers impermissibly searched a footlocker seized incident to arrest when
they searched the locker away from the site of the arrest ninety minutes after
the arrest. See Chadwick, 433 U.S. at 14-16. Te Court stated that “[o]nce
law enforcement officers have reduced luggage or other personal property
not immediately associated with the person of the arrestee to their exclusive
control, and there is no longer any danger that the arrestee might gain access to
the property to seize a weapon or destroy evidence, a search of that property is
no longer an incident of the arrest.” Id. at 15.
Te Supreme Court recently revisited the search incident to arrest doctrine
in Arizona v. Gant, 129 S. Ct. 1710 (2009). Tere, the Court authorized a
search of a passenger compartment of a vehicle incident to arrest in only two
1. Without a Warrant
31
situations: first, “when the arrestee is unsecured and within reaching distance
of the passenger compartment at the time of the search”; and second, “when it
is reasonable to believe evidence relevant to the crime of arrest might be found
in the vehicle.” Id. at 1719 (internal quotation marks omitted). Caution is
appropriate until courts consider whether the reasoning of Gant is limited to
vehicle searches, but there is good reason to conclude that the “evidence relevant
to the crime of arrest” requirement should apply only to such searches. Gant
states that its second exception is based on “circumstances unique to the vehicle
context” and cites Justice Scalia’s concurrence in Tornton v. United States, 541
U.S. 615, 632 (2004). Tat concurrence proposed the second exception in the
context of vehicle searches and explained that “[a] motorist may be arrested for
a wide variety of offenses; in many cases, there is no reasonable basis to believe
relevant evidence might be found in the car.” Tornton, 541 U.S. at 632.
Beginning with pagers and now extending to cell phones and personal
digital assistants, courts have generally agreed that the search incident to arrest
doctrine applies to portable electronic devices. First, numerous cases over the
last decade have approved searches of pagers incident to arrest. See United States
v. Brookes, 2005 WL 1940124, at *3 (D.V.I. Jun. 16, 2005); Yu v. United States,
1997 WL 423070, at *2 (S.D.N.Y. Jul. 29, 1997); United States v. Tomas,
114 F.3d 403, 404 n.2 (3d Cir. 1997) (dicta); United States v. Reyes, 922 F.
Supp. 818, 833 (S.D.N.Y. 1996); United States v. Lynch, 908 F. Supp. 284,
287 (D.V.I. 1995); United States v. Chan, 830 F. Supp. 531, 535 (N.D. Cal.
1993); see also United States v. Ortiz, 84 F.3d 977, 984 (7th Cir. 1996) (same
holding, but relying on an exigency theory). More recently, many courts have
upheld searches of cell phones incident to arrest. United States v. Finley, 477
F.3d 250, 259-60 (5th Cir. 2007); United States v. Valdez, 2008 WL 360548, at
*2-4 (E.D. Wis. Feb. 8, 2008); United States v. Curry, 2008 WL 219966, at *10
(D. Me. Jan. 23, 2008); United States v. Mercado-Nava, 486 F. Supp. 2d 1271,
1278-79 (D. Kan. 2007); United States v. Dennis, 2007 WL 3400500, at *7-8
(E.D. Ky. Nov. 13, 2007); United States v. Mendoza, 421 F.3d 663, 666-68
(8th Cir. 2005); United States v. Brookes, 2005 WL 1940124, at *3 (D.V.I. Jun.
16, 2005); United States v. Cote, 2005 WL 1323343, at *6 (N.D. Ill. May 26,
2005). In addition, one appellate court has approved a search incident to arrest
of an electronic address book. See United States v. Goree, 2002 WL 31050979,
at *5-6 (6th Cir. Sept. 12, 2002).
Courts have disagreed about whether a search incident to arrest of a cell
phone is more like the footlocker in Chadwick (and thus subject to strict
32
Searching and Seizing Computers
temporal requirements) or the search of the personal property in Edwards (and
thus subject to more flexible temporal requirements). Te only appellate court
to consider the issue held that a cell phone found on the defendant’s person
constitutes personal property “immediately associated” with the arrestee. Finley,
477 F.3d at 260 n.7. See also United States v. Wurie, 2009 WL 1176946, at *5
(D. Mass. 2009); Brookes, 2005 WL 1940124, at *3 (analogizing pager and cell
phone to wallet or address book); Cote, 2005 WL 1323343, at *6 (upholding
search of cell phone at police station two and a half hours after arrest). However,
two district courts have analogized cell phones to the footlocker in Chadwick
and held that cell phone searches not contemporaneous with arrest violated
the Fourth Amendment. See United States v. Lasalle, 2007 WL 1390820, at *7
(D. Haw. May 9, 2007) (rejecting cell phone search more than two hours and
fifteen minutes after arrest); United States v. Park, 2007 WL 1521573, at *5-9
(N.D. Cal. May 23, 2007) (rejecting cell phone search approximately ninety
minutes after arrest). See also United States v. Wall, 2008 WL 5381412, at *3-4
(S.D. Fla. Dec. 22, 2008) (search of cell phone performed at stationhouse after
arrest could not be justified as incident to arrest).
Courts have not yet addressed whether electronic media with the vast
storage capacity of today’s laptop computers may be searched incident to
arrest. However, courts have allowed extensive searches of written materials
discovered incident to lawful arrests. For example, courts have uniformly held
that agents may inspect the entire contents of a suspect’s wallet found on his
person. See, e.g., United States v. Molinaro, 877 F.2d 1341, 1347 (7th Cir.
1989) (citing cases); United States v. Castro, 596 F.2d 674, 677 (5th Cir. 1979).
Similarly, one court has held that agents could photocopy the entire contents
of an address book found on the defendant’s person during the arrest, see
United States v. Rodriguez, 995 F.2d 776, 778 (7th Cir. 1993), and others have
permitted the search of a defendant’s briefcase that was at his side at the time of
arrest. See, e.g., United States v. Johnson, 846 F.2d 279, 283-84 (5th Cir. 1988);
United States v. Lam Muk Chiu, 522 F.2d 330, 332 (2d Cir. 1975). If these
holdings are applied to searches incident to arrest where computers and similar
storage media are recovered, agents should be able to review the contents of
such devices without securing a search warrant.
On the other hand, courts may analogize a laptop to the footlocker in
Chadwick, so a search incident to arrest of a laptop may be judged under
Chadwick’s restrictive temporal standard if it is not seized from the suspect’s
person. As a practical matter, it may not be feasible to conduct an appropriate
1. Without a Warrant
33
search of a laptop incident to arrest (though a brief review may be possible in
some cases, particularly as forensic tools designed for on-site review become
available). A complete forensic search often requires that the data on a computer
be copied and then searched using tools designed for forensic analysis, and
such a full search may be impossible under Chadwick. Instead, agents may
choose to seize a laptop incident to arrest and then obtain a search warrant for
the subsequent thorough search.6 When making an arrest, seizure of items on
the arrestee’s person or within his reach is entirely appropriate. See Edwards,
415 U.S. at 805.
4. Plain View
Evidence of a crime may be seized without a warrant under the plain view
exception to the warrant requirement. To rely on this exception, the agent must
be in a lawful position to observe and access the evidence, and its incriminating
character must be immediately apparent. See Horton v. California, 496 U.S.
128, 136 (1990). Although officers may occasionally come upon incriminating
evidence on the screen of a computer, the most common use of the plain view
doctrine in the computer context occurs when agents examine a computer
pursuant to a search warrant and discover evidence of a separate crime that falls
outside the scope of the search warrant. For example, in United States v. Wong,
334 F.3d 831, 838 (9th Cir. 2003), an agent discovered child pornography
on a hard drive while conducting a valid search of the drive for evidence of a
murder. Because the agent was properly searching graphics files for evidence
of the murder, the child pornography was properly seized and subsequently
admitted under the plain view doctrine. Te plain view doctrine can also be
useful in other circumstances when agents are lawfully in a position to discover
incriminating evidence on a computer. See, e.g., United States v. Herndon, 501
F.3d 683, 693 (6th Cir. 2007) (officer permissibly seized a computer based
upon plain view after a probation agent showed the officer child pornography
discovered on subject’s computer); United States v. Tucker, 305 F.3d 1193,
1203 (10th Cir. 2002) (approving seizure of computer under plain view
doctrine by officer conducting parole search of home after officer noticed that
computer had recently visited child pornography newsgroup). Most computer
6 In addition, cell phones increasingly resemble computers, as they now may incorporate
functions such as Internet, email, and photography. A complete forensic search of such cell
phones may disclose more evidence than a brief search incident to arrest. See generally Wayne
Jansen and Rick Ayers, Guidelines on Cell Phone Forensics (National Institute of Standards and
Technology No. 800-101, 2007).
34
Searching and Seizing Computers
plain view cases involve agents viewing incriminating images, but in some
circumstances the names associated with files (especially child pornography)
can be incriminating as well. Compare Commonwealth v. Hinds, 768 N.E.2d
1067, 1073 (Mass. 2002) (finding that an officer lawfully searching for evidence
of assault could open and seize image files whose sexually explicit names were
in “plain view” and incriminating), with United States v. Stierhoff, 477 F. Supp.
2d 423, 445-49 (D.R.I. 2007) (rejecting the government’s argument that the
label on a computer file, “offshore,” was sufficiently incriminating to justify
opening the file under the plain view exception).
The plain view doctrine does not authorize agents to open and
view the contents of a container that they are not otherwise
authorized to open and review.
Importantly, the plain view exception cannot justify violations of an
individual’s reasonable expectation of privacy. Te exception merely permits
the seizure of evidence that an agent is already authorized to view in accordance
with the Fourth Amendment. Tis means that agents cannot rely on the plain
view exception to justify opening a closed container that they are not otherwise
authorized to view. See United States v. Maxwell, 45 M.J. 406, 422 (C.A.A.F.
1996) (holding that computer files opened by agents were not in plain view);
United States v. Villarreal, 963 F.2d 770, 776 (5th Cir. 1992) (concluding that
labels fixed to opaque 55-gallon drums do not expose the contents of the drums
to plain view because “a label on a container is not an invitation to search it”).
As discussed above in Section B.2, courts have reached differing conclusions
over whether each individual file stored on a computer should be treated as a
separate closed container, and this distinction has important ramifications for
the scope of the plain view exception. Most courts have analyzed individual
computer files as separate stored containers. See Guest v. Leis, 255 F.3d 325,
335 (6th Cir. 2001); United States v. Carey, 172 F.3d 1268, 1273-75 (10th Cir.
1999). When each file is treated as a separate closed container, agents cannot
rely on the plain view doctrine to open files on a computer. However, Fifth
Circuit decisions in United States v. Runyan, 275 F.3d 449, 464-65 (5th Cir.
2001), and United States v. Slanina, 283 F.3d 670, 680 (5th Cir. 2002), vacated
on other grounds, 537 U.S. 802 (2002), aff’d, 359 F.3d 356, 358 (5th Cir.
2004), suggest that plain view of a single file on a computer or storage device
could provide a basis for a more extensive search. In those two cases, the court
held that when a warrantless search of a portion of a computer or storage device
had been proper, the defendant no longer retained any reasonable expectation
1. Without a Warrant
35
of privacy in the remaining contents of the computer or storage device. See
Slanina, 283 F.3d at 680; Runyan, 275 F.3d at 464-65. Tus, a more extensive
search of the computer or storage device by law enforcement did not violate
the Fourth Amendment. Tis rationale may also apply when a file has been
placed in plain view.
Te plain view doctrine arises frequently in the search warrant context
because it is usually necessary to review all files on a computer to find evidence
that falls within the scope of a warrant. As the Ninth Circuit explained in
United States v. Adjani, 452 F.3d 1140, 1150 (9th Cir. 2006), “[c]omputer files
are easy to disguise or rename, and were we to limit the warrant to such a specific
search protocol [e.g., key word searches], much evidence could escape discovery
simply because of [the defendants’] labeling of the files.” As agents review a
computer for information that falls within the scope of the warrant, they may
discover evidence of an additional crime, and they are entitled to seize it under
the plain view doctrine. Nevertheless, the Tenth Circuit’s decision in United
States v. Carey, 172 F.3d 1268, 1273 (10th Cir. 1999), provides a cautionary
example regarding continuing the review of a computer after finding evidence
of a second crime. In Carey, a police detective searching a hard drive with a
warrant for drug trafficking evidence opened a “jpg” file and instead discovered
child pornography. At that point, the detective spent five hours accessing and
downloading several hundred “jpg” files in a search not for evidence of the
narcotics trafficking that he was authorized to seek and gather pursuant to the
original warrant, but for more child pornography. When the defendant moved
to exclude the child pornography files on the ground that they were seized
beyond the scope of the warrant, the government argued that the detective
had seized the “jpg” files properly because the contents of the contraband files
were in plain view. Te Tenth Circuit rejected this argument with respect to
all of the files except for the first “jpg” file the detective discovered. See id. at
1273, 1273 n.4. As best as can be discerned, the rule in Carey seems to be that
the detective could seize the first “jpg” file that came into plain view when the
detective was executing the search warrant, but could not rely on the plain view
exception to justify the search solely for additional “jpg” files containing child
pornography on the defendant’s computers, evidence beyond the scope of the
warrant. In subsequent cases, the Tenth Circuit has interpreted Carey narrowly,
explaining that it “simply stands for the proposition that law enforcement may
not expand the scope of a search beyond its original justification.” United States
v. Grimmett, 439 F.3d 1263, 1268 (10th Cir. 2006). For example, in United
States v. Walser, 275 F.3d 981, 986-87 (10th Cir. 2001), the court found no
36
Searching and Seizing Computers
Fourth Amendment violation when an officer with a warrant to search for
electronic records of drug transactions opened a single computer file containing
child pornography, suspended the search, and then returned to a magistrate
for a second warrant to search for child pornography. See also United States v.
Kearns, 2006 WL 2668544, at *8 (N.D. Ga. Feb. 21, 2006) (suggesting that
agent who opened every file on a compact disk, regardless of file extension, in
a search for evidence of fraud could have seized images of child pornography
under the “plain view” doctrine as long as he did not abandon his search).
5. Inventory Searches
Law enforcement officers routinely inventory the items they have seized.
Such “inventory searches” are reasonable—and therefore fall under an exception
to the warrant requirement—when two conditions are met. First, the search
must serve a legitimate, non-investigatory purpose (e.g., to protect an owner’s
property while in custody; to insure against claims of lost, stolen, or vandalized
property; or to guard the police from danger) that outweighs the intrusion on
the individual’s Fourth Amendment rights. See Illinois v. Lafayette, 462 U.S.
640, 644 (1983); South Dakota v. Opperman, 428 U.S. 364, 369-70 (1976).
Second, the search must follow standardized procedures. See Colorado v. Bertine,
479 U.S. 367, 374 n.6 (1987); Florida v. Wells, 495 U.S. 1, 4-5 (1990).
It is unlikely that the inventory-search exception to the warrant requirement
would support a search of seized computer files. See United States v. O’Razvi,
1998 WL 405048, at *6-7 (S.D.N.Y. July 17, 1998) (noting the difficulties of
applying the inventory-search requirements to computer disks); see also United
States v. Wall, 2008 WL 5381412, at *3 (S.D. Fla. Dec. 22, 2008) (inventory
search exception did not justify search of cell phone); United States v. Flores, 122
F. Supp. 2d 491, 493-95 (S.D.N.Y. 2000) (finding search of cellular telephone
“purely investigatory” and thus not lawful inventory search). Even assuming
that standard procedures authorized such a search, the legitimate purposes
served by inventory searches in the physical world do not translate well into
the intangible realm. Information does not generally need to be reviewed to be
protected and does not pose a risk of physical danger. Although an owner could
claim that his computer files were altered or deleted while in police custody,
an officer’s examination of the contents of the files would offer little protection
from tampering. Accordingly, agents will generally need to obtain a search
warrant in order to examine seized computer files held in custody unless some
other exception to the warrant requirement applies.
1. Without a Warrant
37
6. Border Searches
In order to protect the government’s ability to monitor contraband and
other property that may enter or exit the United States illegally, the Supreme
Court has recognized a special exception to the warrant requirement for
searches that occur at the border of the United States (or at the border’s
functional equivalent). According to the Court, routine searches at the border
do not require a warrant, probable cause, or even reasonable suspicion that the
search may uncover contraband or evidence. See United States v. Montoya de
Hernandez, 473 U.S. 531, 538 (1985). Searches that are especially intrusive,
however, require at least reasonable suspicion. See id. at 541. Tese rules apply
to people and property both entering and exiting the United States. See United
States v. Oriakhi, 57 F.3d 1290, 1297 (4th Cir. 1995).
Te Supreme Court’s most recent border search case, United States v.
Flores-Montano, 541 U.S. 149 (2004), suggests that reasonable suspicion is
not required for most non-destructive border searches of property. In Flores-
Montano, the Court determined that the border search of an automotive fuel
tank did not require reasonable suspicion. Te Court explained that “the
reasons that might support a requirement of some level of suspicion in the
case of highly intrusive searches of the person—dignity and privacy interests
of the person being searched—simply do not carry over to vehicles.” Id. at
1585. Although there may be a lesser privacy interest in gas tanks than in other
property (such as computers), the Court’s analysis in Flores-Montano does not
appear to be narrowly confined to gas tanks or vehicles. In response to the
defendant’s argument that the Fourth Amendment protects property as much
as privacy, the Court emphasized the lack of physical damage to the gas tank
and concluded that “[w]hile it may be true that some searches of property are
so destructive as to require a different result, this was not one of them.” Id. at
1587. One appellate court has noted that “[t]he Supreme Court recently made
clear that reasonable suspicion is usually not required for officers to conduct
non-destructive border searches of property.” United States v. Camacho, 368
F.3d 1182, 1183 (9th Cir. 2004).
Since Flores-Montano, courts have upheld suspicionless border searches of
computers. In United States v. Arnold, 523 F.3d 941, 946 (9th Cir. 2008),
the Ninth Circuit held that “reasonable suspicion is not needed for customs
officials to search a laptop or other personal electronic storage devices.” In
so holding, the Arnold court explicitly rejected the defendant’s argument,
previously adopted by the district court, that searching a laptop is more
38
Searching and Seizing Computers
“intrusive” than a typical search of property and more like searching a home
because of its large storage capacity. Instead, the Arnold court found no logical
distinction between a suspicionless border search of a traveler’s luggage and a
similar suspicionless search of a laptop. See id. at 947. See also United States v.
Hampe, 2007 WL 1192365, at *4 (D. Me. Apr. 18, 2007) (rejecting the Arnold
district court analysis and holding that border search of computer files did not
require reasonable suspicion); United States v. Romm, 455 F.3d 990, 996-97
(9th Cir. 2006) (upholding border search of computer and suggesting, but not
holding, that reasonable suspicion is not required for non-destructive property
searches at the border).
In United States v. Ickes, 393 F.3d 501, 506-07 (4th Cir. 2005), the Fourth
Circuit also held that a search of a computer and disks within the defendant’s
car was permissible under the border search exception, emphasizing the
breadth of the government’s border search authority. Te Ickes court did not
address whether the search of the defendant’s car, and the computer and disks it
contained, was “routine.” However, the court did note that, while most searches
of computers at the border would likely result from reasonable suspicion, it
would not “enthron[e] this notion as a matter of constitutional law.” Id. at 507.
See also United States v. Linarez-Delgado, 259 Fed. Appx. 506, 508 (3d Cir.
2007) (“Data storage media and electronic equipment, such as films, computer
devices, and videotapes, may be inspected and viewed during a reasonable
border search.”). In addition, Ickes rejected the defendant’s argument that
border searches of computers should be limited based on computers’ storage
of expressive materials. Ickes, 359 F.3d at 506. See also Arnold, 523 F.3d at 948
(following Ickes and refusing to carve out a First Amendment exception to the
border search doctrine).
In two pre-Flores-Montano cases, district courts upheld warrantless searches
of computer disks for contraband computer files, finding that the searches
were “routine” and did not require reasonable suspicion. In United States v.
Irving, 2003 WL 22127913, at *5 (S.D.N.Y. Sept. 15, 2003), the court noted
that “any other decision effectively would allow individuals to render graphic
contraband, such as child pornography, largely immune to border search.” On
appeal, after Flores-Montano, the Second Circuit upheld the district court’s
denial of Irving’s motion to suppress. United States v. Irving, 452 F.3d 110 (2d
Cir. 2006). However, because the Second Circuit found that the customs agents
who searched Irving had reasonable suspicion, it did not consider whether
reasonable suspicion was required. Id. at 124. Similarly, in United States v.
1. Without a Warrant
39
Roberts, 86 F. Supp. 2d 678 (S.D. Tex. 2000), aff’d on other grounds, 274 F.3d
1007 (5th Cir. 2001), the court held that a search of the defendant’s computer
and floppy disks was a routine search for which no suspicion was required. See
id. at 688. On appeal, the Fifth Circuit affirmed on other grounds and did not
reach the issue of whether the seizure of the defendant’s computer equipment
could be considered routine. See Roberts, 274 F.3d at 1017.
7. Probation and Parole
Individuals on probation, parole, or supervised release enjoy a diminished
expectation of privacy and may be subject to warrantless searches based on
reasonable suspicion, or, potentially, without any particularized suspicion.
In United States v. Knights, 534 U.S. 112, 122 (2001), the Supreme Court
considered the validity of a warrantless search based on reasonable suspicion
of a probationer’s home where the conditions of the probation required the
probationer to submit to a search at any time, with or without a warrant or
reasonable cause. Te Court did not rely on the “special needs” analysis of Griffin
v. Wisconsin, 483 U.S. 868 (1987), a previous probation search case. Instead,
the Court employed “ordinary Fourth Amendment analysis that considers all
the circumstances of a search.” Knights, 534 U.S. at 122. Te Court noted
the probationer’s diminished expectation of privacy, the government’s interests
in preventing recidivism and reintegrating probationers into the community,
and the government’s concern that probationers are more likely to commit
(and conceal) crime than ordinary citizens. See id. at 120-21. Balancing these
factors, the Court found that the search required “no more than reasonable
suspicion.” Id. at 121.
In Samson v. California, 547 U.S. 843, 857 (2006), the Supreme Court
extended Knights, holding that the Fourth Amendment does not prohibit a
suspicionless search of a parolee. As in Knights, the Court employed a “totality
of the circumstances” approach and considered the parole agreement that
unambiguously allowed for suspicionless searches, the government’s interests
in supervising parolees, and the government’s interest in reducing recidivism.
See Samson, 547 U.S. at 852-53. However, the Court in Samson did not make
clear whether its holding extended to probationers, and the Court noted that
parolees have “fewer expectations of privacy than probationers.” Id. at 850; see
also United States v. Herndon, 501 F.3d 683, 688 n.2 (6th Cir. 2007) (noting
that Samson’s application to probationers is unclear).
40
Searching and Seizing Computers
Following Knights and Samson, the Sixth Circuit upheld a warrantless
search of a probationer’s computer based on reasonable suspicion that the
probationer had violated his probation by using the Internet. See United States
v. Herndon, 501 F.3d 683, 692 (6th Cir. 2007). Herndon, on probation for
sexual exploitation of a minor, was subject to a specific condition prohibiting
him from using the Internet and requiring him to allow his probation officer to
search his computer at any time for Internet use. See id. at 685. After Herndon
told his probation officer that he had used the Internet to search for a job, the
probation officer went to Herndon’s residence and searched his computer and
an external hard drive, ultimately finding child pornography. While finding
that the probation condition did not meet the “special need” standard of Griffin
because it did not itself specifically include a reasonable suspicion requirement,
the court nevertheless found the search was
“reasonable” under Knights:
Herndon’s reasonable expectation of privacy was “dramatically reduced” by
the probation condition and was outweighed by the government’s interest in
preventing recidivism. Id. at 689-91. Te Sixth Circuit concluded that the
probation officer’s search was proper, as it required “no more than reasonable
suspicion.” Id. at 691.
At least one court has upheld the warrantless search of a probationer’s
computer even in the absence of an explicit probation condition requiring the
probationer to submit to a warrantless search. In United States v. Yuknavich, 419
F.3d 1302, 1311 (11th Cir. 2005), probationer Yuknavich had been convicted
of child pornography-related charges. While his probation did not include a
warrantless search provision, it did prohibit him from using the Internet, except
for work purposes during work hours. During a routine home visit, Yuknavich’s
probation officers observed a computer connected to a modem, examined it,
and discovered that Yuknavich had been downloading child pornography. Te
Court held that even in the absence of a provision in his probation agreement
authorizing warrantless searches, Yuknavich’s expectation of privacy in his
computer was diminished by the condition specifically restricting his Internet
access, especially in light of the crime for which he was on probation. See id. at
1310. Tus, the court followed Knights and held that the search of Yuknavich’s
computer required, at most, reasonable suspicion. See id. at 1311.
1. Without a Warrant
41
D. Special Case: Workplace Searches
Workplace searches occur often in computer cases, as workplace computers
frequently store evidence of criminal activity. Whether such searches require
a warrant depends on several factual distinctions, beginning with whether
the workplace is in the public sector or the private sector. In general, law
enforcement officers can conduct a warrantless search of private (i.e., non-
government) workplaces only if the officers obtain the consent of either the
employer or an employee with common authority over the area searched.
For government workplaces, the inquiry into whether a warrant is required
to conduct a workplace search is based on the “special needs” framework set
forth in O’Connor v. Ortega, 480 U.S. 709 (1987). Under that framework, a
government employee may, depending on circumstances, enjoy a reasonable
expectation of privacy in his workplace. However, even when the employee
has a reasonable expectation of privacy, employers can nevertheless conduct
warrantless searches provided the searches are work-related, justified at their
inception, and permissible in scope. Id. at 725-26.
One cautionary note is in order here. Tis discussion evaluates the legality
of warrantless workplace searches of computers under the Fourth Amendment.
In many cases, however, workplace searches will implicate federal privacy
statutes in addition to the Fourth Amendment. For example, efforts to obtain
an employee’s files and email from the employer’s network server raise issues
under the Stored Communications Act, 18 U.S.C. §§ 2701-2712 (discussed
in Chapter 3), and workplace monitoring of an employee’s Internet use may
implicate Title III, 18 U.S.C. §§ 2510-2522 (discussed in Chapter 4). Before
conducting a workplace search, investigators must make sure that their search
will not violate either the Fourth Amendment or relevant federal privacy
statutes. Investigators should contact CCIPS at (202) 514-1026 or the CHIP
in their district (see Introduction, p. xii) for further assistance.
1. Private-Sector Workplace Searches
Te rules for conducting warrantless searches and seizures in private-sector
workplaces generally mirror the rules for conducting warrantless searches in
homes and other personal residences. Private company employees generally
retain a reasonable expectation of privacy in their workplaces. As a result,
searches by law enforcement of a private workplace will usually require a
warrant unless the agents obtain the consent of an employer or a co-worker
with common authority.
42
Searching and Seizing Computers
a. Reasonable Expectation of Privacy in Private-Sector Workplaces
Private-sector employees will usually retain a reasonable expectation of
privacy in their office space. In Mancusi v. DeForte, 392 U.S. 364, 365 (1968),
police officers conducted a warrantless search of an office at a local union
headquarters that defendant Frank DeForte shared with several other union
officials. In response to DeForte’s claim that the search violated his Fourth
Amendment rights, the police officers argued that the joint use of the space by
DeForte’s co-workers made his expectation of privacy unreasonable. Te Court
disagreed, stating that DeForte “still could reasonably have expected that only
[his officemates] and their personal or business guests would enter the office,
and that records would not be touched except with their permission or that of
union higher-ups.” Id. at 369. Because only a specific group of people actually
enjoyed joint access and use of DeForte’s office, the officers’ presence violated
DeForte’s reasonable expectation of privacy. See id. See also United States v.
Most, 876 F.2d 191, 198 (D.C. Cir. 1989) (“[A]n individual need not shut
himself off from the world in order to retain his fourth amendment rights.
He may invite his friends into his home but exclude the police; he may share
his office with co-workers without consenting to an official search.”); United
States v. Lyons, 706 F.2d 321, 325 (D.C. Cir. 1983) (“One may freely admit
guests of one’s choosing—or be legally obligated to admit specific persons—
without sacrificing one’s right to expect that a space will remain secure against
all others.”). As a practical matter, then, private employees will generally retain
an expectation of privacy in their work space unless that space is “open to the
world at large.” Id. at 326.
Some courts have held that a private-sector employee has no reasonable
expectation of privacy in the contents of his work computer or email account
when his employer has explicitly reserved the right to monitor the employee’s
computer use or search his computer files. See United States v. Bailey, 272 F.
Supp. 2d 822, 835-36 (D. Neb. 2003); Muick v. Glenayre Electronics, 280 F.3d
741, 743 (7th Cir. 2002). However, these cases rely on precedents from the
public-sector context without considering the distinction between private and
public employers. For example, the fact that a private employer reserves the
right to search an employee’s computer should not imply that the government
can seize the computer without a warrant, absent the employer consenting or
conducting a private search. Prosecutors should be wary in relying on these
cases. For example, in United States v. Ziegler, 456 F.3d 1138, 1144-46 (9th
Cir. 2006), the Ninth Circuit initially held that a private-sector employee had
1. Without a Warrant
43
no reasonable expectation of privacy in his workplace computer based on his
employer’s monitoring and computer use policy. However, this opinion was
withdrawn and superseded by United States v. Ziegler, 474 F.3d 1184, 1189-
90 (9th Cir. 2007), in which the court, relying on Mancusi v. DeForte, held
that the employee in fact retained a reasonable expectation of privacy in his
workplace computer.
b. Consent in Private-Sector Workplaces
Although most non-government workplaces will support a reasonable
expectation of privacy from a law enforcement search, agents can defeat
this expectation by obtaining the consent of a party who exercises common
authority over the area searched. See Matlock, 415 U.S. at 171. In practice, this
means that agents can often overcome the warrant requirement by obtaining
the consent of the target’s employer or supervisor. Depending on the facts, a
co-worker’s consent may suffice as well.
Private-sector employers and supervisors generally enjoy a broad authority
to consent to searches in the workplace. For example, in United States v. Gargiso,
456 F.2d 584 (2d Cir. 1972), a pre-Matlock case, agents conducting a criminal
investigation of an employee of a private company sought access to a locked,
wired-off area in the employer’s basement. Te agents explained their needs
to the company’s vice-president, who took the agents to the basement and
opened the basement with his key. When the employee attempted to suppress
the evidence that the agents discovered in the basement, the court held that
the vice-president’s consent was effective. Because the vice-president shared
supervisory power over the basement with the employee, the court reasoned,
he could consent to the agents’ search of that area. See id. at 586-87. See also
United States v. Bilanzich, 771 F.2d 292, 296-97 (7th Cir. 1985) (holding that
the owner of a hotel could consent to search of locked room used by hotel
employee to store records, even though owner did not carry a key, because
employee worked at owner’s bidding); J.L. Foti Constr. Co. v. Donovan, 786 F.2d
714, 716-17 (6th Cir. 1986) (per curiam) (holding that a general contractor’s
superintendent could consent to an inspection of an entire construction site,
including subcontractor’s work area).
In most cases, private-sector employers will retain sufficient authority over
workplace computers to consent to a government search of the computers. In
United States v. Ziegler, 474 F.3d 1184, 1191 (9th Cir. 2007), the court held
that an employer could consent to a search of the computer it provided to an
44
Searching and Seizing Computers
employee, explaining that “the computer is the type of workplace property that
remains within the control of the employer ‘even if the employee has placed
personal items in [it].’” Te court also noted the existence of a workplace
policy and practice of monitoring employee computer use. See id. In a close
case, an employment policy or computer network banner that establishes
the employer’s right to consent to a workplace search can help establish the
employer’s common authority to consent under Matlock. For more information
on banners, see Appendix A.
When co-workers exercise common authority over a workspace, investigators
can rely on a co-worker’s consent to search that space. For example, in United
States v. Buettner-Janusch, 646 F.2d 759 (2d Cir. 1981), a professor and an
undergraduate research assistant at New York University consented to a search
of an NYU laboratory managed by a second professor suspected of using his
laboratory to manufacture LSD and other drugs. Although the search involved
opening vials and several other closed containers, the Second Circuit held that
Matlock authorized the search because both consenting co-workers had been
authorized to make full use of the lab for their research. See id. at 765-66. See
also United States v. Jenkins, 46 F.3d 447, 455-58 (5th Cir. 1995) (allowing
an employee to consent to a search of the employer’s property); United States
v. Murphy, 506 F.2d 529, 530 (9th Cir. 1974) (per curiam) (same); United
States v. Longo, 70 F. Supp. 2d 225, 256 (W.D.N.Y. 1999) (allowing secretary
to consent to search of employer’s computer). But see United States v. Buitrago
Pelaez, 961 F. Supp. 64, 67-68 (S.D.N.Y. 1997) (holding that a receptionist
could consent to a general search of the office, but not of a locked safe to which
receptionist did not know the combination).
c. Employer Searches in Private-Sector Workplaces
Warrantless workplace searches by private employers rarely violate the
Fourth Amendment. So long as the employer is not acting as an instrument
or agent of the Government at the time of the search, the search is a private
search and the Fourth Amendment does not apply. See Skinner v. Railway Labor
Executives’ Ass’n, 489 U.S. 602, 614 (1989).
2. Public-Sector Workplace Searches
Although warrantless computer searches in private-sector workplaces follow
familiar Fourth Amendment rules, the application of the Fourth Amendment
to public-sector workplace searches of computers presents a different matter.
In O’Connor v. Ortega, 480 U.S. 709 (1987), the Supreme Court introduced
1. Without a Warrant
45
a distinct framework for evaluating warrantless searches in government
workplaces, a framework that applies to computer searches. According to
O’Connor, a government employee can enjoy a reasonable expectation of
privacy in his workplace. See id. at 717 (O’Connor, J., plurality opinion); id.
at 730 (Scalia, J., concurring). However, an expectation of privacy becomes
unreasonable if “actual office practices and procedures, or . . . legitimate
regulation” permit the employee’s supervisor, co-workers, or the public to
enter the employee’s workspace. Id. at 717 (O’Connor, J., plurality opinion).
Further, employers can conduct “reasonable” warrantless searches even if the
searches violate an employee’s reasonable expectation of privacy. Such searches
include work-related, noninvestigatory intrusions (e.g., entering an employee’s
locked office to retrieve a file) and reasonable investigations into work-related
misconduct. See id. at 725-26 (O’Connor, J., plurality opinion); id. at 732
(Scalia, J., concurring).
a. Reasonable Expectation of Privacy in Public Workplaces
Te reasonable expectation of privacy test formulated by the O’Connor
plurality asks whether a government employee’s workspace is “so open to
fellow employees or to the public that no expectation of privacy is reasonable.”
O’Connor, 480 U.S. at 718 (plurality opinion). Tis standard differs significantly
from the standard analysis applied in private workplaces. Whereas private-sector
employees enjoy a reasonable expectation of privacy in their workspace unless
the space is “open to the world at large,” Lyons, 706 F.2d at 326, government
employees retain a reasonable expectation of privacy in the workplace only if
a case-by-case inquiry into “actual office practices and procedures” shows that
it is reasonable for employees to expect that others will not enter their space.
See O’Connor, 480 U.S. at 717 (plurality opinion); Rossi v. Town of Pelham,
35 F. Supp. 2d. 58, 63-64 (D.N.H. 1997). See also O’Connor, 480 U.S. at
730-31 (Scalia, J., concurring) (noting the difference between the expectation-
of-privacy analysis offered by the O’Connor plurality and that traditionally
applied in private workplace searches). From a practical standpoint, then,
public employees are less likely to retain a reasonable expectation of privacy
against government searches at work than are private employees.
Courts evaluating public employees’ reasonable expectation of privacy in
the wake of O’Connor have considered the following factors: whether the work
area in question is assigned solely to the employee; whether others have access
to the space; whether the nature of the employment requires a close working
46
Searching and Seizing Computers
relationship with others; whether office regulations place employees on notice
that certain areas are subject to search; and whether the property searched is
public or private. See Vega-Rodriguez v. Puerto Rico Tel. Co., 110 F.3d 174,
179-80 (1st Cir. 1997) (summarizing cases); United States v. Mancini, 8 F.3d
104, 109 (1st Cir. 1993). In general, the courts have rejected claims of an
expectation of privacy in an office when the employee knew or should have
known that others could access the employee’s workspace. See, e.g., United
States v. King, 509 F.3d 1338, 1341-42 (11th Cir. 2007) (contractor had no
reasonable expectation of privacy in “shared” files accessible by entire military
base computer network); United States v. Barrows, 481 F.3d 1246, 1248-49
(10th Cir. 2007) (public employee had no reasonable expectation of privacy in
his own computer in workplace when he left computer out and unprotected
from use by others); Sheppard v. Beerman, 18 F.3d 147, 152 (2d Cir. 1994)
(judge’s search through his law clerk’s desk and file cabinets did not violate the
clerk’s reasonable expectation of privacy because of the clerk’s close working
relationship with the judge); Schowengerdt v. United States, 944 F.2d 483, 488
(9th Cir. 1991) (civilian engineer employed by the Navy who worked with
classified documents at an ordinance plant had no reasonable expectation of
privacy in his office because investigators were known to search employees’
offices for evidence of misconduct on a regular basis). But see United States v.
Taketa, 923 F.2d 665, 673 (9th Cir. 1991) (concluding that public employee
retained expectation of privacy in office shared with several co-workers). In
contrast, the courts have found that a search violates a public employee’s
reasonable expectation of privacy when the employee had no reason to expect
that others would access the space searched. See O’Connor, 480 U.S. at 718-
19 (plurality) (physician at state hospital retained expectation of privacy in his
desk and file cabinets where there was no evidence that other employees could
enter his office and access its contents); Rossi, 35 F. Supp. 2d at 64 (holding that
town clerk enjoyed reasonable expectation of privacy in 8’ x 8’ office that the
public could not access and other town employees did not enter).
While agents must evaluate whether a public employee retains a reasonable
expectation of privacy in the workplace on a case-by-case basis, official written
employment policies can simplify the task dramatically. See O’Connor, 480
U.S. at 717 (plurality) (“legitimate regulation” of the work place can reduce
public employees’ Fourth Amendment protections). Courts have uniformly
deferred to public employers’ official policies that expressly authorize access to
the employee’s workspace and have relied on such policies when ruling that the
employee does not retain a reasonable expectation of privacy in the workplace.
1. Without a Warrant
47
See American Postal Workers Union, Columbus Area Local AFL-CIO v. United
States Postal Serv., 871 F.2d 556, 559-61 (6th Cir. 1989) (postal employees
retained no reasonable expectation of privacy in contents of government
lockers after signing waivers stating that lockers were subject to inspection
at any time, even though lockers contained personal items); United States v.
Bunkers, 521 F.2d 1217, 1219-1221 (9th Cir. 1975) (same, noting language
in postal manual stating that locker is “subject to search by supervisors and
postal inspectors”). Of course, whether a specific policy eliminates a reasonable
expectation of privacy is a factual question. Employment policies that do not
explicitly address employee privacy may prove insufficient to eliminate Fourth
Amendment protection. See, e.g., Taketa, 923 F.2d at 672-73 (concluding that
regulation requiring DEA employees to “maintain clean desks” did not defeat
workplace expectation of privacy of non-DEA employee assigned to DEA
office).
When planning to search a government computer in a government
workplace, agents should look for official employment policies
or computer log on “banners” that can eliminate a reasonable
expectation of privacy in the computer.
Written employment policies and computer log on
“banners” are
particularly important in cases that consider whether government employees
enjoy a reasonable expectation of privacy in government computers. Banners
are written notices that greet users before they log on to a computer or computer
network; they can inform users of the privacy rights that they do or do not
retain in their use of the computer or network. See generally Appendix A.
In general, government employees who are notified that their employer
has retained rights to access or inspect information stored on the employer’s
computers can have no reasonable expectation of privacy in the information
stored there. For example, in United States v. Simons, 206 F.3d 392 (4th Cir.
2000), computer specialists at a division of the Central Intelligence Agency
learned that an employee named Mark Simons had been using his desktop
computer at work to obtain pornography available on the Internet, in violation
of CIA policy. Te computer specialists accessed Simons’ computer remotely
without a warrant, and obtained copies of over a thousand picture files that
Simons had stored on his hard drive. Many of these picture files contained
child pornography, which were turned over to law enforcement. When Simons
filed a motion to suppress the fruits of the remote search of his hard drive,
the Fourth Circuit held that the CIA division’s official Internet usage policy
48
Searching and Seizing Computers
eliminated any reasonable expectation of privacy that Simons might otherwise
have in the copied files. See id. at 398. Te policy stated that the CIA division
would “periodically audit, inspect, and/or monitor [each] user’s Internet access
as deemed appropriate,” and that such auditing would be implemented “to
support identification, termination, and prosecution of unauthorized activity.”
Id. at 395-96. Simons did not deny that he was aware of the policy. See id. at
398 n.8. In light of the policy, the Fourth Circuit held, Simons did not retain
a reasonable expectation of privacy “with regard to the record or fruits of his
Internet use,” including the files he had downloaded. Id. at 398.
Other courts have agreed with the approach articulated in Simons and have
held that banners and policies generally eliminate a reasonable expectation of
privacy in contents stored in a government employee’s network account. See
Biby v. Board of Regents, 419 F.3d 845, 850-51 (8th Cir. 2005) (university
policy stating that computer files and emails may be searched in response to
litigation discovery requests eliminated computer user’s reasonable expectation
of privacy); United States v. Torn,
375 F.3d 679, 683 (8th Cir. 2004)
(computer use policy eliminated employee’s reasonable expectation of privacy
in computer); United States v. Angevine, 281 F.3d 1130, 1134-35 (10th Cir.
2002) (banner and computer policy eliminated a public employee’s reasonable
expectation of privacy in data downloaded from Internet); United States v.
Monroe, 52 M.J. 326, 330 (C.A.A.F. 2000) (Air Force sergeant did not have
a reasonable expectation of privacy in his government email account because
email use was reserved for official business and network banner informed each
user upon logging on to the network that use was subject to monitoring);
Wasson v. Sonoma County Junior College Dist., 4 F. Supp. 2d 893, 905-06
(N.D. Cal. 1997) (public employer’s computer policy giving the employer “the
right to access all information stored on [the employer’s] computers” defeats
an employee’s reasonable expectation of privacy in files stored on employer’s
computers); Bohach v. City of Reno, 932 F. Supp. 1232, 1235 (D. Nev. 1996)
(police officers did not retain a reasonable expectation of privacy in their use
of a pager system, in part because the Chief of Police had issued an order
announcing that all messages would be logged). But see DeMaine v. Samuels,
2000 WL 1658586, at *7 (D. Conn. Sept. 25, 2000) (suggesting that the
existence of an employment manual explicitly authorizing searches “weighs
heavily” in the determination of whether a government employee retained a
reasonable expectation of privacy at work, but “does not, on its own, dispose
of the question”). Conversely, a court may note the absence of a banner or
computer policy in finding that an employee has a reasonable expectation of
1. Without a Warrant
49
privacy in the use of his computer. See United States v. Slanina, 283 F.3d 670,
676-77 (5th Cir. 2002), vacated on other grounds, 537 U.S. 802 (2002), aff’d,
359 F.3d 356, 358 (5th Cir. 2004); Leventhal v. Knapek, 266 F.3d 64, 73-74
(2d Cir. 2001) (noting that agency had not placed employee on notice that he
had no expectation of privacy in his computer).
Of course, whether a specific policy eliminates a reasonable expectation of
privacy is a factual question. Agents and prosecutors must consider whether
a given policy is broad enough to reasonably contemplate the search to be
conducted. If the policy is narrow, it may not waive the government employee’s
reasonable expectation of privacy against the search that the government
plans to execute. For example, in Simons, the Fourth Circuit concluded that
although the CIA division’s Internet usage policy eliminated Simons’ reasonable
expectation of privacy in the fruits of his Internet use, it did not eliminate
his reasonable expectation of privacy in the physical confines of his office. See
Simons, 206 F.3d at 399 n.10. Accordingly, the policy by itself was insufficient
to justify a physical entry into Simons’ office. See id. at 399. See also Taketa,
923 F.2d at 672-73 (concluding that regulation requiring DEA employees to
“maintain clean desks” did not defeat workplace expectation of privacy of non-
DEA employee assigned to DEA office). In addition, United States v. Long, 64
M.J. 57 (C.A.A.F. 2006), supplies an example of a court interpreting a banner
very narrowly. In Long, a Department of Defense banner warned users that
the government could monitor the computer system “for all lawful purposes,
including to ensure that their use is authorized, for management of the system,
to facilitate protection against unauthorized access, and to verify security
procedures
” Te court held that a user maintained a reasonable expectation
of privacy in her email, stating that the “banner described access to ‘monitor’ the
computer system, not to engage in law enforcement intrusions by examining
the contents of particular emails in a manner unrelated to maintenance of the
e-mail system.” Id. at 63. However, in a subsequent case before the same court
with a similar computer banner, the court declined to follow Long. See United
States v. Larson, 66 M.J. 212, 216 (2008) (finding no expectation of privacy in
government computer where banner established consent to monitor). Sample
banners appear in Appendix A.
Furthermore, courts may consider whether or how the employer actually
enforces its policy when deciding whether the policy eliminates an employee’s
expectation of privacy. For example, in Quon v. Arch Wireless Operating Co.,
529 F.3d 892 (9th Cir. 2008), a city employee had signed a computer use
50
Searching and Seizing Computers
policy acknowledging that he had no expectation of privacy in his use of the
pager provided to him by the city. Although the court noted that this policy
would eliminate the employee’s reasonable expectation policy “[i]f that were
all,” id. at 906, the court nevertheless found that the employee had a reasonable
expectation of privacy because of an “informal policy that the text messages
would not be audited” if the employee paid any charges incurred through his
use of text messaging for non-official purposes. Id. See also Long, 64 M.J. at 64
(noting network administrator’s testimony that he did not monitor individual
email accounts when testing or monitoring the network).
b. “Reasonable” Workplace Searches Under O’Connor v. Ortega
Government employers and their agents can conduct “reasonable”
work-related searches without a warrant even if those searches
violate an employee’s reasonable expectation of privacy.
In most circumstances, a warrant must be obtained before a government
actor can conduct a search that violates an individual’s reasonable expectation
of privacy. In the context of government employment, however, the
government’s role as an employer (as opposed to its role as a law-enforcer)
presents a special case. In O’Connor, the Supreme Court held that a public
employer or the employer’s agent can conduct a workplace search that violates
a public employee’s reasonable expectation of privacy so long as the search is
“reasonable.” See O’Connor, 480 U.S. at 722-23 (plurality); id. at 732 (Scalia, J.,
concurring). Te Court’s decision adds public workplace searches by employers
to the list of “special needs” exceptions to the warrant requirement. Te “special
needs” exceptions permit the government to dispense with the usual warrant
requirement when its officials infringe upon protected privacy rights in the
course of acting in a non-law enforcement capacity. See, e.g., New Jersey v.
T.L.O., 469 U.S. 325, 351 (1985) (Blackmun, J., concurring) (applying the
“special needs” exception to permit public school officials to search student
property without a warrant in an effort to maintain discipline and order in
public schools); National Treasury Employees Union v. Von Raab, 489 U.S. 656,
677 (1989) (applying the “special needs” exception to permit warrantless drug
testing of Customs employees who seek promotions to positions where they
would handle sensitive information). In these cases, the Court has held that the
need for government officials to pursue legitimate non-law-enforcement aims
justifies a relaxing of the warrant requirement because “the burden of obtaining
a warrant is likely to frustrate the [non-law-enforcement] governmental purpose
1. Without a Warrant
51
behind the search.” O’Connor, 480 U.S. at 720 (quoting Camara v. Municipal
Court, 387 U.S. 523, 533 (1967)).
According to O’Connor, a warrantless search must satisfy two requirements
to qualify as “reasonable.” First, the employer or his agents must participate
in the search for a work-related reason, rather than merely to obtain evidence
for use in criminal proceedings. Second, the search must be justified at its
inception and permissible in its scope.
i. Te Search Must Be Work-Related
Te first element of O’Connor’s reasonableness test requires that the employer
or his agents must participate in the search for a work-related reason, rather
than merely to obtain evidence for use in criminal proceedings. See O’Connor,
480 U.S. at 721. Tis element limits the O’Connor exception to circumstances
in which the government actors who conduct the search act in their capacity
as employers, rather than law enforcers. Te O’Connor Court specified two
such circumstances. First, the Court concluded that public employers can
conduct reasonable work-related noninvestigatory intrusions, such as entering
an employee’s office to retrieve a file or report while the employee is out.
See id. at 721-22 (plurality); id. at 732 (Scalia, J., concurring). Second, the
Court concluded that employers can conduct reasonable investigations into
an employee’s work-related misconduct, such as entering an employee’s
office to investigate employee misfeasance that threatens the efficient and
proper operation of the office. See id. at 724 (plurality); id. at 732 (Scalia, J.,
concurring).
Te line between a legitimate work-related search and an illegitimate search
for criminal evidence is clear in theory, but often blurry in fact. Public employers
who learn of misconduct at work may investigate it with dual motives: they may
seek evidence both to root out “inefficiency, incompetence, mismanagement,
or other work-related misfeasance,” id. at 724, and also to collect evidence
for a criminal prosecution. Indeed, the two categories may merge altogether.
For example, government officials who have criminal investigators under their
command may respond to allegations of work-related misconduct by directing
the investigators to search employee offices for evidence of a crime.
Te courts have adopted fairly generous interpretations of O’Connor
when confronted with mixed-motive searches. In general, the presence and
involvement of law enforcement officers will not invalidate the search so long
as the employer or his agent participates in the search for legitimate work-
52
Searching and Seizing Computers
related reasons. See, e.g., United States v. Slanina, 283 F.3d 670, 678-79 (5th
Cir. 2002), vacated on other grounds, 537 U.S. 802 (2002), aff’d, 359 F.3d
356, 358 (5th Cir. 2004) (approving search by official in charge of fire and
police departments and stating that “O’Connor’s goal of ensuring an efficient
workplace should not be frustrated simply because the same misconduct that
violates a government employer’s policy also happens to be illegal”); Gossmeyer
v. McDonald, 128 F.3d 481, 492 (7th Cir. 1997) (presence of law enforcement
officers in a search team looking for evidence of work-related misconduct does
not transform search into an illegitimate law enforcement search); Taketa, 923
F.2d at 674 (search of DEA office space by DEA agents investigating allegations
of illegal wiretapping “was an internal investigation directed at uncovering
work-related employee misconduct.”); Shields v. Burge, 874 F.2d 1201, 1202-
05 (7th Cir. 1989) (applying the O’Connor exception to an internal affairs
investigation of a police sergeant that paralleled a criminal investigation);
Ross v. Hinton, 740 F. Supp. 451, 458 (S.D. Ohio 1990) (a public employer’s
discussions with law enforcement officer concerning employee’s alleged criminal
misconduct, culminating in officer’s advice to “secure” the employee’s files, did
not transform employer’s subsequent search of employee’s office into a law
enforcement search).
Although the presence of law enforcement officers ordinarily will not
invalidate a work-related search, a few courts have indicated that whether
O’Connor applies depends as much on the identity of the personnel who
conduct the search as whether the purpose of the search is work-related. For
example, in United States v. Simons, 206 F.3d 392, 400 (4th Cir. 2000), the
Fourth Circuit concluded that O’Connor authorized the search of a government
employee’s office by his supervisor even though the dominant purpose of the
search was to uncover evidence of a crime. Because the search was work-related
and conducted by the employee’s supervisor, the Court indicated, it fell within
the scope of O’Connor. See id. (“[Te employer] did not lose its special need for
the efficient and proper operation of the workplace merely because the evidence
obtained was evidence of a crime.” (internal quotation marks and citations
omitted)). Conversely, one district court has held that the O’Connor exception
did not apply when a government employer sent a uniformed police officer to
an employee’s office, even though the purpose of the police officer’s presence
was entirely work-related. See Rossi v. Town of Pelham, 35 F. Supp. 2d 58, 65-
66 (D.N.H. 1997) (in civil action pursuant to 42 U.S.C. § 1983, concluding
that O’Connor exception did not apply when town officials sent a single police
officer to town clerk’s office to ensure that clerk did not remove public records
1. Without a Warrant
53
from her office before a scheduled audit could occur; the resulting search was a
“police intrusion” rather than an “employer intrusion”).
Of course, courts will invalidate warrantless workplace searches when the
facts establish that law enforcement provided the real reason for the search, and
the search violated an employee’s reasonable expectation of privacy. See United
States v. Hagarty, 388 F.2d 713, 717 (7th Cir. 1968) (surveillance installed
by criminal investigators violated the Fourth Amendment where purpose of
surveillance was “to detect criminal activity” rather than “to supervise and
investigate” a government employee); United States v. Kahan, 350 F. Supp.
784, 791 (S.D.N.Y. 1972) (invalidating warrantless search of INS employee’s
wastebasket by INS criminal investigator who searched the employee’s
wastebasket for evidence of a crime every day after work with the employer’s
consent), rev’d in part on other grounds, 479 F.2d 290 (2d Cir. 1973), rev’d with
directions to reinstate the district court judgment, 415 U.S. 239 (1974).
ii. Te Search Must Be Justified At Its Inception
and Permissible In Its Scope
To be
“reasonable” under the Fourth Amendment, a work-related
employer search of the type endorsed in O’Connor must also be both “justified
at its inception” and “permissible in its scope.” O’Connor, 480 U.S. at 726
(plurality). A search will be justified at its inception “when there are reasonable
grounds for suspecting that the search will turn up evidence that the employee
is guilty of work-related misconduct, or that the search is necessary for
a noninvestigatory work-related purpose.” Id. See, e.g., Simons, 206 F.3d at
401 (entrance into employee’s office to seize his computer was justified at its
inception because employer knew that employee had used the computer to
download child pornography); Gossmeyer, 128 F.3d at 491 (co-worker’s specific
allegations of serious misconduct made Sheriff’s search of Child Protective
Investigator’s locked desk and file cabinets justified at its inception); Taketa,
923 F.2d at 674 (report of misconduct justified initial search of employee’s
office); Shields, 874 F.2d at 1204 (suggesting in dicta that search of police
officer’s desk for narcotics pursuant to internal affairs investigation might
be reasonable following an anonymous tip); DeMaine v. Samuels, 2000 WL
1658586, at *10 (D. Conn. Sept. 25, 2000) (search of police officer’s day
planner was justified by information from two reliable sources that the officer
kept detailed attendance notes relevant to overtime investigation involving
other officers); Williams v. Philadelphia Housing Auth., 826 F. Supp. 952, 954
(E.D. Pa. 1993) (employee’s search for a computer disk in employee’s office was
54
Searching and Seizing Computers
justified at its inception because employer needed contents of disk for official
purposes). But see Wiley v. Department of Justice, 328 F.3d 1346, 1356-57 (Fed.
Cir. 2003) (search of employee’s car based on ten-month-old anonymous tip
was not justified); Ortega v. O’Connor, 146 F.3d 1149, 1162 (9th Cir. 1998)
(vague, uncorroborated and stale complaints of misconduct do not justify a
decision to search an employee’s office). A search will be “permissible in its
scope” when “the measures adopted are reasonably related to the objectives
of the search and [are] not excessively intrusive in light of the nature of the
misconduct.” O’Connor, 480 U.S. at 726 (plurality) (internal quotation marks
omitted). Tis standard requires employers and their agents to tailor work-
related searches to the alleged misfeasance. See, e.g., Leventhal v. Knapek, 266
F.3d 64, 75-77 (2d Cir. 2001) (search for the presence of non-agency-approved
software on employee’s computer was not excessively intrusive because
officials searched only file names at first and then searched only suspicious
directories on subsequent visits); Simons, 206 F.3d at 401 (search for child
pornography believed to be stored in employee’s computer was permissible in
scope because individual who conducted the search “simply crossed the floor
of [the defendant’s] office, switched hard drives, and exited”); Gossmeyer, 128
F.3d at 491 (workplace search for images of child pornography was permissible
in scope because it was limited to places where such images would likely be
stored); Samuels, 2000 WL 1658586, at *10 (search through police officer’s
day planner was reasonable because Internal Affairs investigators had reason
to believe day planner contained information relevant to investigation of
overtime abuse). If employers conduct a search that unreasonably exceeds the
scope necessary to pursue the employer’s legitimate work-related objectives,
the search will be “unreasonable” and will violate the Fourth Amendment.
See O’Connor, 146 F.3d at 1163 (“a general and unbounded” search of an
employee’s desk, cabinets, and personal papers was impermissible in scope
where the search team did not attempt to limit their investigation to evidence
of alleged misconduct); Narducci v. Village of Bellwood, 444 F. Supp. 2d 924,
932 (N.D. Ill. 2006) (purpose of addressing threats to employees did not justify
recording all employee phone calls, without notice to employees, for six years
after complaints of threats had stopped).
c. Consent in Public-Sector Workplaces
Although public employers may search employees’ workplaces without a
warrant for work-related reasons, public workplaces offer a more restrictive
milieu in one respect. In government workplaces, employers acting in their
1. Without a Warrant
55
official capacity generally cannot consent to a law enforcement search of their
employees’ offices. See United States v. Blok, 188 F.2d 1019, 1021 (D.C. Cir.
1951) (a government supervisor cannot consent to a law enforcement search of
a government employee’s desk); Taketa, 923 F.2d at 673; Kahan, 350 F. Supp. at
791. Te rationale for this result is that the Fourth Amendment cannot permit
one government official to consent to a search by law enforcement that he could
not conduct himself. See Blok, 188 F.2d at 1021 (“Operation of a government
agency and enforcement of criminal law do not amalgamate to give a right of
search beyond the scope of either.”). Accordingly, law enforcement searches
conducted pursuant to a public employer’s consent must be evaluated under
O’Connor rather than the third-party consent rules of Matlock. Te question
in such cases is not whether the public employer had common authority to
consent to the search, but rather whether the combined law enforcement and
employer search satisfied the Fourth Amendment standards of O’Connor v.
Ortega.
E. International Issues
Increasingly, electronic evidence necessary to prevent, investigate, or
prosecute a crime may be located outside the borders of the United States.
Tis can occur for several reasons. Criminals can use the Internet to commit or
facilitate crimes remotely, e.g., when Russian hackers steal money from a bank
in New York, or when the kidnappers of an American citizen deliver demands
by email for release of their captive. Communications also can be “laundered”
through third countries, such as when a criminal in Brooklyn uses the Internet
to pass a communication through Tokyo, Tel Aviv, and Johannesburg before
it reaches its intended recipient in Manhattan—much the way money can be
laundered through banks in different countries in order to hide its source.
In addition, provider architecture may route or store communications in the
country where the provider is based, regardless of the location of its users.
When United States authorities investigating a crime believe electronic
evidence is stored by an Internet service provider on a computer located abroad
(in “Country A”), U.S. law enforcement usually must seek assistance from law
enforcement authorities in Country A. Because, in general, law enforcement
officers exercise their functions in the territory of another country only with the
consent of that country, U.S. law enforcement should only make direct contact
with an ISP located in Country A with (1) prior permission of the foreign
government; (2) approval of DOJ’s Office of International Affairs (“OIA”)
56
Searching and Seizing Computers
(which would know of particular sensitivities and accepted practices); or (3)
other clear indicia that such practice would not be objectionable in Country
A. Te U.S. view (and that of some other countries) is that prior consultation
is not required to (1) access publicly available materials in Country A, such as
those posted to a public website, and (2) access materials in Country A with
the voluntary consent of a person who has lawful authority to disclose the
materials. For advice regarding what constitutes voluntary consent or lawful
authority for such disclosures, contact CCIPS.
Under certain circumstances, such as where the matter under consideration
constitutes a violation of the foreign country’s criminal law, foreign law
enforcement authorities may be able to share evidence informally with U.S.
counterparts. However, finding the appropriate official in Country A with
which to explore such cooperation is an inexact science, at best. Possible
avenues for entree to foreign law enforcement are: (1) the designated expert
who participates in the G8’s network of international high-tech crime points of
contact (discussed below); (2) CCIPS’s high-tech law enforcement contacts in
many countries that are not a part of that network; (3) law enforcement contacts
maintained by OIA; (4) representatives of U.S. law enforcement agencies who
are stationed at the relevant American embassy (e.g., FBI Legal Attaches, or
“LegAtts,” and agents from the U.S. Secret Service and U.S. Immigration
and Customs Enforcement); and (5) the Regional Security Officer (from the
Diplomatic Security Service) at the American embassy (who may have good in-
country law enforcement contacts). CCIPS can be reached at 202-514-1026;
OIA can be reached at 202-514-0000.
Where Country A cannot otherwise provide informal assistance, requests
for evidence usually will be made under existing Mutual Legal Assistance
Treaties (MLATs) or Mutual Legal Assistance Agreements, or through the
Letters Rogatory process. See 28 U.S.C. §§ 1781-1782. Tese official requests
for assistance are made by OIA to the designated “Central Authority” of
Country A or, in the absence of an MLAT, to other appropriate authorities.
(Central Authorities are usually located within the Justice Ministry, or another
Ministry or office in Country A that has law enforcement authority.) OIA has
attorneys responsible for every country and region of the world. Since official
requests of this nature require specified documents and procedures and can
take some time to produce results, law enforcement should contact OIA as
soon as a request for international legal assistance becomes a possibility.
1. Without a Warrant
57
When U.S. law enforcement has reason to believe that electronic evidence
exists on a computer or computer network located abroad, a request to foreign
law enforcement for preservation of the evidence should be made as soon as
possible. Such a request, similar to a request under 18 U.S.C. § 2703(f ) to a
U.S. provider (see Chapter 3.G.1), will have varying degrees of success based
on several factors, most notably whether Country A has a data preservation
law and whether the U.S. has sufficient law enforcement contacts in Country
A to ensure prompt execution of the request. Te International Convention
on Cybercrime, completed in 2001, obligates all Parties to have the ability
to effect cross-border preservation requests, and the availability of this critical
form of assistance therefore is expected to increase greatly in the near future.
Significantly, many countries do not have preservation and, if they receive
a preservation request, will instead do a search. Such a search may not be
appropriate for some cases; for example, it may risk tipping off the target of
the investigation. Investigators may consult with CCIPS regarding the likely
outcome of such a preservation request.
To secure preservation, or in emergencies when immediate international
assistance is required, the international Network of 24-hour Points of Contact
established by the High-tech Crime Subgroup of the G8 countries can provide
assistance. Tis network, created in 1997, is comprised of approximately fifty
member countries and continues to grow every year. Participating countries
have a dedicated computer crime expert and a means to contact that office or
person twenty-four hours a day. CCIPS is the point of contact for the United
States and can be contacted at 202-514-1026 during regular business hours or
at other times through the Department of Justice Command Center at 202-
514-5000. Te Council of Europe’s Cybercrime Convention obligates all Parties
to have a 24-hour point of contact for cybercrime cases, and international 24-
hour response capabilities are therefore expected to continue to increase. Te
G8 and Council of Europe lists will be consolidated.
In the event that United States law enforcement inadvertently accesses a
computer located in another country, CCIPS, OIA, or another appropriate
authority should be consulted immediately, as issues such as sovereignty and
comity may be implicated. Likewise, if exigencies such as terrorist threats
indicate that direct access by United States law enforcement to a computer
located abroad is crucial, appropriate U.S. authorities should be consulted
immediately.
58
Searching and Seizing Computers
Searching, seizing, or otherwise obtaining electronic evidence located
outside of the United States can raise difficult questions of both law and policy.
For example, the Fourth Amendment may apply under certain circumstances,
but not under others. See generally United States v. Verdugo-Urquidez, 494 U.S.
259 (1990) (considering the extent to which the Fourth Amendment applies
to searches outside of the United States). Tis manual does not attempt to
provide detailed guidance on how to resolve difficult international issues that
may arise in cases involving electronic evidence located beyond our borders.
Investigators and prosecutors should contact CCIPS or OIA for assistance in
particular cases.
1. Without a Warrant
59
60
Searching and Seizing Computers
Chapter 2
Searching and Seizing
Computers With a Warrant
A. Introduction
Tis Chapter discusses the legal and practical rules governing the use of
warrants to search for and seize evidence stored in computers and electronic
media. Section B discusses the strategic considerations any investigator or
attorney should bear in mind before applying to the court for a warrant.
Section C discusses the issues that arise in drafting a computer search warrant
and affidavit. Section D addresses forensic analysis of the media. Section E
discusses challenges to the search process. Finally, Section F discusses the
limited circumstances in which statutes or other rules prohibit the government
from using search warrants to obtain computers or electronic media. A sample
computer search warrant appears in Appendix F.
B. Devising a Search Strategy
Before drafting a warrant application and affidavit, careful consideration
should be given to what sort of evidence a search might reveal. A search of a
computer’s hard drive can reveal many different types of evidence. A search
strategy should be chosen after considering the many possible roles of the
computer in the offense:
1) A computer can be contraband—either because the computer
is a repository of data that is contraband
(such as child
pornography) or because the computer is stolen property;
2) a computer can be a repository of data that is evidence of a
crime—such as a spreadsheet showing illegal drug transactions,
a letter used in an ongoing fraud, or log files showing IP
addresses assigned to the computer and websites accessed; or
61
3) a computer can be an instrumentality of a crime—for example,
the computer was used as a tool to hack into websites, distribute
copyrighted videos, or produce illegal pornography.
Additionally, in devising a search strategy, investigators should bear in mind
both the elements that must be proven should the prosecution go to trial and
also the sources of electronic evidence that are relevant to those elements.
Te typical computer user thinks of the contents of a hard drive in terms
of what the computer’s user interface chooses to reveal: files, folders, and
applications, all neatly arranged and self-contained. Tis, however, is merely
an abstraction presented to make the computer easier to use. Tat abstraction
hides the evidence of computer usage that modern operating systems leave
on hard drives. As computers run, they leave evidence on the hard drive—
considerably more evidence than just the files visible to users. Remnants of
whole or partially deleted files can still remain on the drive. Portions of files
that were edited away also might remain. “Metadata” and other artifacts left
by the computer can reveal information about what files have recently been
accessed, when a file was created and edited, and sometimes even how it was
edited. Virtual memory paging systems can leave traces of information on
the hard drive that the user might have believed were stored only in volatile
computer memory such as RAM and expected to disappear when the computer
was shut down. Browsers, mail readers, chat clients, and other programs leave
behind configuration files that might reveal online nicknames and passwords.
Operating systems and applications record additional information on the hard
drive, such as records of Internet usage, the attachment of peripherals and flash
drives, and the times the computer was in use. Collectively, this information
can reveal to an investigator not just what a computer happens to contain at
the time of the search, but also evidence of who has used a computer, when,
and how.
Obviously, discovering contraband or substantive evidence of a crime on the
hard drive will be a frequent goal of a computer search. However, investigators
should consider other goals that a computer search might meet. Consider the
following examples:
1) It may be necessary to prove that a particular individual
put contraband on the hard drive, rather than someone else
with access to the computer. Tis might be shown through
evidence that a particular user was logged on, or by evidence
62
Searching and Seizing Computers
that the computer was used shortly after the offense to check
the individual’s bank account or email account.
2) It may be necessary to satisfy the investigator that a virus
or other piece of malware was not responsible for the offense.
Often, an investigator can establish this by running a simple
virus-checking program on an image of the hard drive.
3) It may be necessary to show that a defendant had knowledge
of some particular subject. Web browsing history, for example,
might reveal that an individual was researching how to build a
methamphetamine laboratory.
A prosecutor or investigator should carefully consider the appropriate goals
in drafting the warrant so as to ensure that sufficient evidence may be collected
pursuant to the warrant.
C. Drafting the Affidavit, Application, and Warrant
An affidavit and application for a warrant to search a computer are in
most respects the same as any other search warrant affidavit and application:
the affiant swears to facts that establish that there is probable cause to believe
that evidence of crime (such as records), contraband, fruits of crime, or
instrumentalities of crime is present in a private space (such as a computer’s
hard drive, or other media, which in turn may be in another private space,
such as a home or office), and the warrant describes with particularity the
things (records and other data, or perhaps the computer itself ) to be searched
and seized. Te process of drafting an affidavit and application, then, falls into
two general steps: establishing probable cause to search the computer, and
describing with particularity the data to be taken from the computer or the
computer hardware itself.
1. Include Facts Establishing Probable Cause
Te probable cause necessary to search a computer or electronic media is
probable cause to believe that the media contains or is contraband, evidence of
a crime, fruits of crime, or an instrumentality of a crime. See Fed. R. Crim. P.
41(c). Evidence of crime can include evidence of ownership and control. See,
e.g., United States v. Horn, 187 F.3d 781, 787-88 (8th Cir. 1999) (approving in
child pornography case a warrant provision authorizing seizure of “[r]ecords,
documents, receipts, keys, or other objects showing access to, and control of,
2. With a Warrant
63
the residence”). According to the Supreme Court, the probable cause standard
is satisfied by an affidavit that establishes “a fair probability that contraband or
evidence of a crime will be found in a particular place.” Illinois v. Gates, 462
U.S. 213, 238 (1983). Tis requires a practical, common-sense determination
of the probabilities, based on a totality of the circumstances. See id. Of course,
probable cause will not exist if the agent can only point to a “bare suspicion”
that criminal evidence will be found in the place searched. See Brinegar v. United
States, 338 U.S. 160, 175 (1949). Once a magistrate judge finds probable cause
and issues the warrant, the magistrate’s determination that probable cause
existed is entitled to “great deference,” Gates, 462 U.S. at 236, and will be
upheld so long as there is a “substantial basis for concluding that probable
cause existed.” Id. at 238-39 (internal quotations omitted).
Often, no special facts in the affidavit are necessary to establish probable
cause to search a computer. As a general rule, “[a] container that may conceal
the object of a search authorized by a warrant may be opened immediately;
the individual’s interest in privacy must give way to the magistrate’s official
determination of probable cause.” United States v. Ross, 456 U.S. 798, 823
(1982). Tus, if a warrant authorizes a search of a premises (for example, a
doctor’s office) for a particularized list of records (for example, false Medicare
bills), then the warrant should authorize agents to search a computer they
encounter on the premises if they reasonably believe the warrant describes records
that might be stored on that computer. See, e.g., United States v. Giberson, 527
F.3d 882, 887 (9th Cir. 2008) (agents were justified in searching a computer
“where there was ample evidence that the documents authorized in the warrant
could be found” on that computer); United States v. Rogers, 521 F.3d 5, 9-10
(1st Cir. 2008) (holding that “videotape is a plausible repository for a photo,”
such that a warrant authorizing seizure of “photos of DW” allowed seizure and
review of videotape for such photos). In such a case, it is necessary to establish
probable cause to believe that the records will be found on the premises, but
it is no more necessary to establish that a computer or other electronic storage
media will be found there than it is necessary to establish that file cabinets,
piles of paper, or other record storage systems will be found there. In short, the
probable cause requirement should not require agents to be clairvoyant in their
knowledge of the precise forms of evidence or contraband that will exist in the
location to be searched. See United States v. Reyes, 798 F.2d 380, 382 (10th Cir.
1986) (noting that “in the age of modern technology . . . , the warrant could
not be expected to describe with exactitude the precise forms the records would
take”).
64
Searching and Seizing Computers
However, in United States v. Payton, ___ F.3d ___, 2009 WL 2151348
(9th Cir. July 21, 2009), the Ninth Circuit held that law enforcement is not
necessarily entitled to examine a computer that may contain evidence that falls
within the scope of a warrant. See id. at * 3. In Payton, an officer executing a
search warrant that authorized a seizure of drug sales records and other financial
records searched a computer capable of storing such records. Te court held that
because the warrant did not specifically authorize a search of the computer, and
because nothing else present at the scene of the search suggested that records
falling within the scope of the warrant would be found on the computer, the
search violated the Fourth Amendment. See id. Under Payton, it is good policy
for prosecutors and agents seeking a warrant in the Ninth Circuit to always
seek specific authorization to search computers, though failure to do so will not
necessarily invalidate the search.
Probable cause will look different in every case, but in the computer search
context a few common scenarios have emerged. Tey are discussed below.
a. Probable Cause Established Trough an Internet Protocol Address
In a common computer search scenario, investigators learn of online
criminal conduct. Using records obtained from a victim or from a service
provider, investigators determine the Internet Protocol (“IP”) address used to
commit the crime. Using a subpoena or other process discussed in Chapter
3, investigators then compel the Internet Service Provider (“ISP”) that has
control over that IP address to identify which of its customers was assigned
that IP address at the relevant time, and to provide (if known) the user’s name,
street address, and other identifying information. In some cases, investigators
confirm that the person named by the ISP actually resides at that the street
address by, for example, conducting a mail cover or checking utility bills.
Affidavits that describe such an investigation are typically sufficient to
establish probable cause, and the probable cause is strengthened if the affidavit
corroborates with some additional facts the association of an IP address with
a physical address. See, e.g., United States v. Perez, 484 F.3d 735, 740 (5th
Cir. 2007) (probable cause established through IP address used to access child
pornography and ISP records of physical address); United States v. Grant, 218
F.3d 72, 76 (1st Cir. 2000) (evidence that an Internet account belonging to the
defendant was involved in criminal activity on several occasions, and that the
defendant’s car was parked at his residence during at least one such occasion,
created probable cause to search the defendant’s residence); United States v.
2. With a Warrant
65
Carter, 549 F. Supp. 2d 1257, 1261 (D. Nev. 2008) (probable cause established
through IP address, ISP records, and utility records); United States v. Hanson,
2007 WL 4287716, at *8 (D. Me. Dec. 5, 2007) (finding probable cause based
on IP address and physical address despite “no direct knowledge whether any
computer hardware . . . was physically located at the” residence); United States
v. Huitt, 2007 WL 2355782, at *4 (D. Idaho Aug. 17, 2007) (probable cause
established through IP address and separate email address both linked to same
physical location).
Defendants sometimes will argue that the mere association of an IP address
with a physical address is insufficient to establish probable cause because it is
technologically possible for individuals not residing at that address to use the
defendant’s Internet connection. Most often, this argument takes the form of
a defendant arguing that he has, or could have had, an open wireless Internet
connection, which would have allowed any nearby person with commonly
available equipment to use the defendant’s Internet connection and IP address.
Courts have consistently rejected this argument because the probable cause
standard for warrants requires only a fair probability that evidence or contraband
will be found. See, e.g., Perez, 484 F.3d at 740 (probable cause standard met
by the association of an IP address with a physical address despite defendant’s
argument that he could have had an “unsecure wireless connection” allowing
others to use his IP address); Carter, 549 F. Supp. 2d at 1267-69 (rejecting
argument that affidavit for search warrant should have mentioned the possibility
of an open wireless connection); United States v. Latham, 2007 WL 4563459,
at *11 (D. Nev. Dec. 18, 2007) (finding probable cause even though “[i]t was
possible that someone other than Larry Latham or a resident of his household
had accessed the internet either through his wireless router or by ‘spoofing’ his
address in order to engage in the exchange of child pornography”). Indeed,
this argument is particularly weak because the wireless access point itself will
typically contain evidence within the scope of the warrant. For similar reasons,
courts have rejected challenges to a finding of probable cause based on the failure
of an affidavit to rule out “hacking, ‘spoofing’, tampering, theft, destruction,
or viral infections by others.” United States v. Hibble, 2006 WL 2620349, at *4
(D. Ariz. Sept. 11, 2006) (citing United States v. Gourde, 440 F.3d 1065, 1073
n.5 (9th Cir. 2006) (en banc)). As the Fifth Circuit explained, “though it was
possible that the transmissions originated outside of the residence to which the
IP address was assigned, it remained likely that the source of the transmissions
was inside that residence.” Perez, 484 F.3d at 740. Alternative explanations “are
66
Searching and Seizing Computers
more suited to being raised as a defense at trial.” Hibble, 2006 WL 2620349,
at *4.
b. Probable Cause Established Trough Online Account Information
In another scenario, a defendant establishes an account with an online
service—such as a Web-based email service or a pornography site—and the
credit card information or contact information associated with that account is
used to identify the defendant and support probable cause to search computer
media in the defendant’s home. For example, in United States v. Kelley, 482 F.3d
1047, 1053 (9th Cir. 2007), an affidavit established probable cause through
the real name and physical address associated with several America Online
“screen names” used to receive child pornography. Similarly, in United States
v. Terry, 522 F.3d 645, 648 (6th Cir. 2008), probable cause to search a home
was established by demonstrating that an AOL email account was used to send
child pornography, that the account’s owner lived in that home, and that the
account’s owner had a computer in that home that he had used to send email
through that account in the past. See also United States v. Wilder, 526 F.3d 1, 6
(1st Cir. 2008) (“it was a fair inference from his subscription to the Lust Gallery
website, as described in the affidavit, that downloading and preservation in his
home of images of child pornography might very well follow”).
Frequently, this scenario arises when investigators have discovered a
child pornography website or email group and have successfully obtained its
membership list. In United States v. Gourde, 440 F.3d 1065, 1070-71 (9th
Cir. 2006) (en banc), the affidavit established probable cause through the
defendant’s membership in a known child pornography website, without
independent evidence such as an IP address. Several other courts have also held
that it is reasonable to infer from a defendant’s voluntary membership in a child
pornography website or “e-group” (a hybrid of an email discussion list and web
forum) that the defendant downloaded or kept child pornography, although
many of these courts pointed to corroborating evidence as well. See, e.g., United
States v. Wagers, 452 F.3d 534, 539-40 (6th Cir. 2006); United States v. Shields,
458 F.3d 269, 279 (3d Cir. 2006) (membership in on-line child pornography
Yahoo group, combined with “suggestive” email address of “LittleLolitaLove”
supported probable cause); United States v. Martin, 426 F.3d 68, 77 (2d Cir.
2005) (“those who view are likely to download and store child pornography”);
United States v. Froman, 355 F.3d 882, 890-91 (5th Cir. 2004) (considering
factors of joining a group, remaining a member for a month, and using screen
names “that reflect his interest in child pornography”).
2. With a Warrant
67
Not all courts, however, have agreed that membership alone supports
probable cause. In United States v. Coreas, 419 F.3d 151 (2d Cir. 2005), a Second
Circuit panel sharply disagreed with the panel in Martin. Coreas involved an
affidavit that, after false accusations were excised, contained “[s]imply” the
allegation that the defendant, “by clicking a button, responded affirmatively to
a three-sentence invitation … to join [a child pornography] e-group.” Coreas,
419 F.3d at 156. Te court held that this allegation “does not remotely satisfy
Fourth Amendment standards” because “a ‘person’s mere propinquity to others
independently suspected of criminal activity does not, without more, give rise
to probable cause to search that person.’” Id. (quoting Ybarra v. Illinois, 444
U.S. 85, 91 (1979)). Similarly, in United States v. Falso, 544 F.3d 110, 121
(2d Cir. 2008), the Second Circuit held that there was no substantial basis
for probable cause in a warrant that alleged only that it “appear[ed]” that the
defendant “gained access or attempted to gain access” to a child pornography
site.
c. Probable Cause Established Trough Off-Line Conduct
In some cases, the defendant’s name and address are known through
traditional investigative techniques, and agents wish to search the individual’s
computer for evidence related to the crime. Tese cases are no different from
any other computer search case: the objective of the affidavit is to establish
“a fair probability that contraband or evidence of a crime would be found in
computers at” the place to be searched. United States v. Adjani, 452 F.3d 1140,
1145 (9th Cir. 2006) (internal quotation marks and brackets omitted). For
example, in United States v. Khanani, 502 F.3d 1281, 1290 (11th Cir. 2007),
the court found probable cause to search an accountant’s computer because the
affidavit identified him as accountant for an employer of illegal aliens, stated
that a tax return for that employer was found in the trash outside the office,
and stated that an agent saw computers inside the office. See also United States
v. Flanders, 468 F.3d 269, 271 (5th Cir. 2006) (probable cause to search a
computer supported by defendant’s “past sexual abuse of his daughter, coupled
with his decision to take a digital photograph of that child naked”).
d. Staleness
Defendants often claim that the facts alleged in the warrant affidavit were
too stale to establish probable cause at the time the warrant was issued. Most
such challenges have occurred in child pornography cases, and the courts have
generally found little merit in these arguments: “When a defendant is suspected
68
Searching and Seizing Computers
of possessing child pornography, the staleness determination is unique because
it is well known that images of child pornography are likely to be hoarded by
persons interested in those materials in the privacy of their homes.” United
States v. Irving, 452 F.3d 110, 125 (2d Cir. 2006) (internal quotations marks
omitted); see also United States v. Paull, 551 F.3d 516, 522 (6th Cir. 2009)
(“because the crime is generally carried out in the secrecy of the home and over
a long period, the same time limitations that have been applied to more fleeting
crimes do not control the staleness inquiry for child pornography”); United
States v. Watzman, 486 F.3d 1004, 1008 (7th Cir. 2007) (crediting affidavit
saying that child pornographers “keep and collect items containing child
pornography over long periods of time”); United States v. Newsom, 402 F.3d
780, 783 (7th Cir. 2005) (“[i]nformation a year old is not necessarily stale as a
matter of law, especially where child pornography is concerned”); United States
v. Riccardi, 405 F.3d 852, 861 (10th Cir. 2005) (five-year old information that
defendant sought to convert a Polaroid photograph to a digital format was not
stale); United States v. Hay, 231 F.3d 630, 636 (9th Cir. 2000); United States
v. Horn, 187 F.3d 781, 786-87 (8th Cir. 1999); United States v. Lacy, 119 F.3d
742, 745-46 (9th Cir. 1997). Courts have also noted that advances in computer
forensic analysis allow investigators to recover files even after they are deleted,
casting greater doubt on the validity of “staleness” arguments. See Hay, 231
F.3d at 636; United States v. Cox, 190 F. Supp. 2d 330, 334 (N.D.N.Y. 2002).
But see United States v. Doan, 2007 WL 2247657, at *3 (7th Cir. Aug. 6, 2007)
(seventeen-month-old information, combined with a lack of information
about “the duration of the website subscriptions, the download capability
accompanying those subscriptions, the last date Doan accessed the websites,
whether Doan downloaded images from these sites, whether Doan owned a
computer, or whether Doan had internet access at his home” insufficient to
establish probable cause); United States v. Zimmerman, 277 F.3d 426, 433-34
(3d Cir. 2002) (distinguishing retention of adult pornography from retention
of child pornography and holding that evidence that adult pornography had
been on computer at least six months before a warrant was issued was stale);
United States v. Frechette, 2008 WL 4287818, at *4 (W.D. Mich. Sept. 17,
2008) (sixteen-month-old information stale in a child pornography case).
2. Describe With Particularity the Tings to be Seized
a. Te Particularity Requirement
Te Fourth Amendment requires that every warrant
“particularly
describ[e]” two things: “the place to be searched” and “the persons or things
2. With a Warrant
69
to be seized.” U.S. Const. Amend. IV; see United States v. Grubbs, 547 U.S.
90, 97 (2006). Describing with particularity the “things to be seized” has two
distinct elements. See United States v. Upham, 168 F.3d 532, 535 (1st Cir.
1999). First, the warrant must describe the things to be seized with sufficiently
precise language so that it tells the officers how to separate the items properly
subject to seizure from irrelevant items. See Marron v. United States, 275 U.S.
192, 296 (1927) (“As to what is to be taken, nothing is left to the discretion
of the officer executing the warrant.”); Davis v. Gracey, 111 F.3d 1472, 1478
(10th Cir. 1997). Second, the description of the things to be seized should be
limited to the scope of the probable cause established in the warrant. See In
re Grand Jury Investigation Concerning Solid State Devices, Inc., 130 F.3d 853,
857 (9th Cir. 1997). Considered together, the elements forbid agents from
obtaining “general warrants” and instead require agents to conduct narrow
seizures that attempt to “minimize[] unwarranted intrusions upon privacy.”
Andresen v. Maryland, 427 U.S. 463, 482 n.11 (1976).
b. Seizing Hardware vs. Seizing Information
Te most important decision agents must make when describing the
property in the warrant is whether the seizable property is the computer
hardware or merely the information that the hardware contains. If computer
hardware is contraband, evidence, fruits, or instrumentalities of crime, the
warrant should describe the hardware itself. If the probable cause relates only
to information, however, the warrant should describe the information to be
seized, and then request the authority to seize the information in whatever
form it may be stored (whether electronic or not).
c. Hardware seizures
Depending on the nature of the crime being investigated, computer
hardware might itself be contraband, an instrumentality of a crime, or fruits
of crime and therefore may be physically seized under Rule 41. For example, a
computer that stores child pornography is itself contraband. See United States v.
Hay, 231 F.3d 630, 637 (9th Cir. 2000) (upholding seizure of entire computer
as contraband in child pornography case). A computer may also be used as an
instrumentality of crime, as when it is used to commit a hacking offense or
send threats. See, e.g., United States v. Adjani, 452 F.3d 1140, 1145-46 (9th
Cir. 2006) (computer used to send extortive threat is instrumentality); Davis
v. Gracey, 111 F.3d 1472, 1480 (10th Cir. 1997) (computer used to operate
bulletin board distributing obscene materials is instrumentality); United States
70
Searching and Seizing Computers
v. Lamb, 945 F. Supp. 441, 462 (N.D.N.Y. 1996) (computer used to send or
receive child pornography is instrumentality). Although it could be argued
that any computer that is used to store evidence of crime is an instrumentality,
the reasoning in Davis suggests that in order for a computer to qualify as an
instrumentality, more substantial use of the computer in the crime is necessary.
See Davis, 111 F.3d at 1480 (stating that “the computer equipment was more
than merely a ‘container’ for the files; it was an instrumentality of the crime”).
If the computer hardware is itself contraband, an instrumentality of crime,
or fruits of crime, the warrant should describe the hardware and indicate that
the hardware will be seized. In most cases investigators will simply seize the
hardware during the search, and then search through the defendant’s computer
for the contraband files back at a computer forensics laboratory. In such cases,
the agents should explain clearly in the supporting affidavit that they plan to
search the computer for evidence and/or contraband after the computer has
been seized and removed from the site of the search. Courts have generally held
that descriptions of hardware can satisfy the particularity requirement so long
as the subsequent searches of the seized computer hardware appear reasonably
likely to yield evidence of crime; in many of these cases, the computers contain
child pornography and are thus contraband. See, e.g., United States v. Hay, 231
F.3d 630, 634 (9th Cir. 2000) (upholding seizure of “computer hardware” in
search for materials containing child pornography); United States v. Campos,
221 F.3d 1143, 1147 (10th Cir. 2000) (upholding seizure of “computer
equipment which may be, or is used to visually depict child pornography,” and
noting that the affidavit accompanying the warrant explained why it would be
necessary to seize the hardware and search it off-site for the images it contained);
United States v. Upham, 168 F.3d 532, 535 (1st Cir. 1999) (upholding seizure
of “[a]ny and all computer software and hardware, . . . computer disks, disk
drives” in a child pornography case because “[a]s a practical matter, the seizure
and subsequent off-premises search of the computer and all available disks was
about the narrowest definable search and seizure reasonably likely to obtain
the [sought after] images”); United States v. Lacy, 119 F.3d 742, 746 (9th Cir.
1997) (warrant permitting “blanket seizure” of computer equipment from
defendant’s apartment not insufficiently particular when there was probable
cause to believe that computer would contain evidence of child pornography
offenses); United States v. Henson, 848 F.2d 1374, 1382-83 (6th Cir. 1988)
(permitting seizure of “computer[s], computer terminals, . . . cables, printers,
discs, floppy discs, [and] tapes” that could hold evidence of the defendants’
odometer-tampering scheme because such language “is directed toward items
2. With a Warrant
71
likely to provide information concerning the [defendants’] involvement in the
. . . scheme and therefore did not authorize the officers to seize more than what
was reasonable under the circumstances”); United States v. Albert, 195 F. Supp.
2d 267, 275-76 (D. Mass. 2002) (upholding warrant for seizure of computer
and all related software and storage devices where such an expansive search was
“the only practical way” to obtain images of child pornography).
d. Information seizures
When electronic storage media are to be searched because they
store information that is evidence of crime, the items to be seized
under the warrant should usually focus on the content of the
relevant files rather than the physical storage media.
Many investigations seek to search computers for evidence of a crime
only; the computer might contain business records relevant to a white-collar
prosecution, for example, but the computer itself does not store contraband
and was not used to commit the crime. Te computer is “evidence” only to the
extent that some of the data it stores is evidence. See United States v. Giberson,
527 F.3d 882, 887 (9th Cir. 2008) (“Computers, like briefcases and cassette
tapes, can be repositories for documents and records.”).
When probable cause to search relates in whole or in part to information
stored on the computer, rather than to the computer itself, the warrant should
identify that information with particularity, focusing on the content of the
relevant files rather than on the storage devices which may happen to contain
them. See, e.g., United States v. Otero, 563 F.3d 1127, 1132 (10th Cir. 2009)
(stating that the ability of a computer to store “a huge array” of information
“makes the particularity requirement that much more important”); United
States v. Vilar, 2007 WL 1075041, at *36 (S.D.N.Y. Apr. 4, 2007) (“underlying
information must be identified with particularity and its seizure independently
supported by probable cause”); United States v. Carey, 172 F.3d 1268, 1275
(10th Cir. 1999) (stating that a warrant to seize evidence stored on a computer
should specify “which type of files are sought”); United States v. Gawrysiak,
972 F. Supp. 853, 860 (D.N.J. 1997), aff’d, 178 F.3d 1281 (3d Cir. 1999)
(upholding seizure of “records [that] include information and/or data stored
in the form of magnetic or electronic coding on computer media . . . which
constitute evidence” of enumerated federal crimes). In cases where the computer
is merely a storage device for evidence, failure to focus on the relevant files
may lead to a Fourth Amendment violation. For example, in United States v.
72
Searching and Seizing Computers
Riccardi, 405 F.3d 852, 862 (10th Cir. 2005), which involved an investigation
into harassing phone calls, the court held that a warrant authorizing seizure of
all storage media and “not limited to any particular files” violated the Fourth
Amendment.
Agents should be particularly careful when seeking authority to seize a
broad class of information. Tis sometimes occurs when agents plan to search
computers at a business. See, e.g., United States v. Leary, 846 F.2d 592, 600-04
(10th Cir. 1988). Agents cannot simply request permission to seize “all records”
from an operating business unless agents have probable cause to believe that the
criminal activity under investigation pervades the entire business. See United
States v. Ford, 184 F.3d 566, 576 (6th Cir. 1999) (citing cases); In re Grand
Jury Investigation Concerning Solid State Devices, Inc., 130 F.3d 853, 857 (9th
Cir. 1997). A similarly dangerous phrase, “any and all data, including but not
limited to” a list of items, has been held to turn a computer search warrant into
an unconstitutional general warrant. United States v. Fleet Management Ltd.,
521 F. Supp. 2d 436, 443-44 (E.D. Pa. 2007); see also Otero, 563 F.3d at 1132
(warrant authorizing seizure of “any and all information and/or data” fails the
particularity requirement).
Instead, the description of the files to be seized should be limited. One
successful technique has been to identify records that relate to a particular
crime and to include specific categories of the types of records likely to be
found. For example, the Ninth Circuit upheld such a warrant that limited
the search for evidence of a specific (and specified) crime. See United States
v. Adjani, 452 F.3d 1140, 1148 (9th Cir. 2006). It is sometimes helpful to
also specify the target of the investigation (if known) and the time frame of
the records involved (if known). See, e.g., United States v. Kow, 58 F.3d 423,
427 (9th Cir. 1995) (invalidating warrant for failure to name crime or limit
seizure to documents authored during time frame under investigation ); Ford,
184 F.3d at 576 (“Failure to limit broad descriptive terms by relevant dates,
when such dates are available to the police, will render a warrant overbroad.”);
United States v. Hunter, 13 F. Supp. 2d 574, 584 (D. Vt. 1998) (concluding
that warrant to seize “[a]ll computers” was not sufficiently particular where
description “did not indicate the specific crimes for which the equipment
was sought, nor were the supporting affidavits or the limits contained in the
searching instructions incorporated by reference.”).
Tus, one effective approach is to begin with an “all records” description;
add limiting language stating the crime, the suspects, and relevant time period
2. With a Warrant
73
if applicable; include explicit examples of the records to be seized; and then
indicate that the records may be seized in any form, whether electronic or
non-electronic. For example, when drafting a warrant to search a computer at
a business for evidence of a drug trafficking crime, agents might describe the
property to be seized in the following way:
All records relating to violations of 21 U.S.C. § 841(a) (drug
trafficking) and/or
21 U.S.C. § 846 (conspiracy to traffic
drugs) involving [the suspect] since January 1, 2008, including
lists of customers and related identifying information; types,
amounts, and prices of drugs trafficked as well as dates, places,
and amounts of specific transactions; any information related
to sources of narcotic drugs
(including names, addresses,
phone numbers, or any other identifying information); any
information recording [the suspect’s] schedule or travel from
2008 to the present; all bank records, checks, credit card bills,
account information, and other financial records.
Te terms “records” and “information” include all of the
foregoing items of evidence in whatever form and by whatever
means they may have been created or stored, including any
form of computer or electronic storage (such as hard disks or
other media that can store data); any handmade form (such
as writing, drawing, painting); any mechanical form (such
as printing or typing); and any photographic form (such as
microfilm, microfiche, prints, slides, negatives, videotapes,
motion pictures, photocopies).
Mentioning that records might appear in electronic form is helpful for
agents and lawyers who read the warrant. However, the courts have generally
permitted agents to seize computer equipment when agents reasonably believe
that the content described in the warrant may be stored there, regardless of
whether the warrant states expressly that the information may be stored in
electronic form. See, e.g., United States v. Giberson, 527 F.3d 882, 888 (9th Cir.
2008) (“[t]he format of a record or document should not be dispositive to a
Fourth Amendment inquiry”); United States v. Pontefract, 2008 WL 4461850,
at *3 (W.D. La. Oct. 1, 2008) (warrant that specified photographs but not
computers allowed the search of a computer for photographs because “in
today’s digital world, a laptop computer is as likely a place to find photographs
as a photo album”). As the Tenth Circuit explained in United States v. Reyes,
74
Searching and Seizing Computers
798 F.2d 380, 383 (10th Cir. 1986), “in the age of modern technology and
commercial availability of various forms of items, the warrant c[an] not be
expected to describe with exactitude the precise form the records would take.”
Accordingly, what matters is the substance of the evidence, not its form, and
the courts will defer to an executing agent’s reasonable construction of what
property must be seized to obtain the evidence described in the warrant. See
United States v. Hill, 19 F.3d 984, 987-89 (5th Cir. 1994); Hessel v. O’Hearn,
977 F.2d 299 (7th Cir. 1992); United States v. Word, 806 F.2d 658, 661 (6th Cir.
1986); United States v. Gomez-Soto, 723 F.2d 649, 655 (9th Cir. 1984) (“Te
failure of the warrant to anticipate the precise container in which the material
sought might be found is not fatal.”). See also United States v. Abbell, 963 F.
Supp. 1178, 1997 (S.D. Fla. 1997) (noting that agents may legitimately seize
“[a] document which is implicitly within the scope of the warrant - even if it
is not specifically identified”). Tis approach is consistent with a forthcoming
amendment to Rule 41(e) (which, assuming no contrary congressional action,
is scheduled to take effect on December 1, 2009) specifying that a “warrant
under Rule 41(e)(2)(A) may authorize the seizure of electronic storage media
or the seizure or copying of electronically stored information.”
Of course, agents do not need to follow this approach in every case; judicial
review of search warrants is “commonsensical” and “practical,” rather than
“overly technical.” United States v. Ventresca, 380 U.S. 102, 108 (1965). When
agents cannot know the precise form that records will take before the search
occurs, a generic description must suffice. See United States v. Logan, 250 F.3d
350, 365 (6th Cir. 2001) (approving a broadly worded warrant and noting
that “the warrant’s general nature” was appropriate in light of the investigation’s
circumstances); Davis v. Gracey, 111 F.3d 1472, 1478 (10th Cir. 1997) (“Even
a warrant that describes the items to be seized in broad or generic terms may
be valid when the description is as specific as the circumstances and the nature
of the activity under investigation permit.”) (internal quotations omitted);
United States v. Lacy, 119 F.3d 742, 746-47 (9th Cir. 1997) (holding that
the general description of computer equipment to be seized was sufficient as
there was “no way to specify what hardware and software had to be seized to
retrieve the images accurately”); United States v. London, 66 F.3d 1227, 1238
(1st Cir. 1995) (noting that where the defendant “operated a complex criminal
enterprise where he mingled ‘innocent’ documents with apparently-innocent
documents which, in fact, memorialized illegal transactions,
[it] would
have been difficult for the magistrate judge to be more limiting in phrasing the
warrant’s language, and for the executing officers to have been more discerning
2. With a Warrant
75
in determining what to seize.”); United States v. Scharfman, 448 F.2d 1352,
1354-55 (2d Cir. 1971); Gawrysiak, 972 F. Supp. at 861. Warrants sometimes
authorize seizure of all records relating to a particular criminal offense. See
London, 66 F.3d at 1238 (upholding search for “books and records . . . and
any other documents . . . which reflect unlawful gambling”); United States
v. Riley, 906 F.2d 841, 844-45 (2d Cir. 1990) (upholding seizure of “items
that constitute evidence of the offenses of conspiracy to distribute controlled
substances”); United States v. Wayne, 903 F.2d 1188, 1195 (8th Cir. 1990)
(upholding search for “documents and materials which may be associated with
. . . contraband [narcotics]”). Even an “all records” search may be appropriate
in certain circumstances. See also United States v. Hargus, 128 F.3d 1358, 1362-
63 (10th Cir. 1997) (upholding seizure of “any and all records relating to the
business” under investigation for mail fraud and money laundering); United
States v. Lamb, 945 F. Supp. 441, 458-59 (N.D.N.Y. 1996) (not insufficiently
particular to ask for “[a]ll stored files” in AOL network account when searching
account for obscene pornography, because as a practical matter all files need to
be reviewed to determine which files contain the pornography).
3. Establishing the Necessity for Imaging and Off-Site Examination
With limited exceptions, a search of a hard drive or other media
requires too much time to conduct on-site during the execution
of a warrant. The search warrant affidavit should explain why it is
necessary to image an entire hard drive (or physically seize it) and
later examine it for responsive records.
Examining a computer for evidence of crime is nearly always a time
consuming process. Even if the agents know specific information about the files
they seek, the data may be mislabeled, encrypted, stored in hidden directories,
or embedded in “slack space” that a simple file listing will ignore. See United
States v. Hill, 322 F. Supp. 2d 1081, 1089-90 (C.D. Cal. 2004) (Kozinski, J.),
aff’d 459 F.3d 966 (9th Cir. 2006); United States v. Gray, 78 F. Supp. 2d 524,
530 (E.D. Va. 1999) (noting that agents executing a search for computer files
“are not required to accept as accurate any file name or suffix and [to] limit
[their] search accordingly,” because criminals may “intentionally mislabel files,
or attempt to bury incriminating files within innocuously named directories.”).
Moreover, evidence of a crime will not always take the form of a file. It may
be in a log, operating system artifact, or other piece of recorded data that
can be difficult to locate and retrieve without the appropriate tools and time.
76
Searching and Seizing Computers
It may take days or weeks to find the specific information described in the
warrant because computer storage devices can contain extraordinary amounts
of information. See United States v. Hill, 459 F.3d 966, 974-75 (9th Cir. 2006)
(“the officers would have to examine every one of what may be thousands of
files on a disk—a process that could take many hours and perhaps days.”).
Because examining a computer for evidence of crime is so time consuming,
it will be infeasible in almost every case to do an on-site search of a computer
or other storage media for evidence of crime. Agents cannot reasonably be
expected to spend more than a few hours searching for evidence on-site, and in
some circumstances (such as executing a search at a suspect’s home) an extended
search may be unreasonable. See United States v. Santarelli, 778 F.2d 609, 615-
16 (11th Cir. 1985). In cases involving large quantities of paper documents,
courts traditionally have allowed investigators to remove the documents to an
off-site location to review the documents to determine which documents fall
within the scope of the warrant. See Santarelli, 778 F.2d at 616; United States v.
Hargus, 128 F.3d 1358, 1363 (10th Cir. 1997) (upholding seizure of an entire
file cabinet when such seizure was motivated by the impracticability of on-site
sorting); United States v. Tamura, 694 F.2d 591, 595-96 (9th Cir. 1982).
For similar reasons, courts have approved removal of computers to an off-
site location for review. See United States v. Upham, 168 F.3d 532, 535 (1st
Cir. 1999) (the “narrowest definable search and seizure reasonably likely to
obtain” the evidence described in a warrant is, in most instances, “the seizure
and subsequent off-premises search of the computer and all available disks”);
United States v. Hay, 231 F.3d 630, 637 (9th Cir. 2000) (seizure of entire
computer reasonable because affidavit “justified taking the entire system off
site because of the time, expertise, and controlled environment required for a
proper analysis”); Guest v. Leis, 255 F.3d 325, 335 (6th Cir. 2001) (“[b]ecause
of the technical difficulties of conducting a computer search in a suspect’s
home, the seizure of the computers, including their content, was reasonable
in these cases to allow police to locate the offending files”); cf. United States
v. Giberson,
527 F.3d 882, 886 (9th Cir. 2008) (holding that a warrant
that “clearly limited the types of documents and records that were seizable”
permitted the seizure of an entire computer); United States v. Grimmett, 439
F.3d 1263, 1269 (10th Cir. 2006) (“we have adopted a somewhat forgiving
stance when faced with a ‘particularity’ challenge to a warrant authorizing the
seizure of computers”). Moreover, attempting to search storage media on-site
may even risk damaging the evidence itself in some cases. Modern operating
2. With a Warrant
77
systems continually read from and write to the hard disk, changing some
of the information recorded there; thus, the simple act of using a computer
might alter the evidence recorded on the hard drive. Internet-connected
computers are additionally vulnerable, because someone at a remote location
might be able to access the computer and delete data while investigators are
examining it on-site. Tus, the best strategy will generally be to review storage
media off-site where forensic examiners can ensure the integrity of the data.
In many cases, rather than seize an entire computer for off-site review,
agents can instead create a digital copy of the hard drive that is identical to the
original in every relevant respect. Tis copy is called an “image copy”—a copy
that “duplicates every bit and byte on the target drive including all files, the
slack space, Master File Table, and metadata in exactly the order they appear
on the original.” United States v. Vilar, 2007 WL 1075041, *35 n.22 (S.D.N.Y.
Apr. 4, 2007), quoting Orin S. Kerr, Searches and Seizures in a Digital World,
119 Harv. L. Rev. 531 (2005); see also United States v. Stierhoff, 477 F. Supp.
2d 423, 439 & n.8 (D.R.I. 2007). An image copy cannot be created by simply
dragging and dropping icons or running conventional backup programs;
the process of making one usually involves opening the computer case and
connecting the investigator’s own hardware directly to the hard drive. In some
cases, investigators will make the image copy on-site; in others, investigators
will seize the computer hardware from the premises and make the image copy
off-site.
To justify the possible imaging and/or removal for off-site review of
a computer or other storage media, the Ninth Circuit requires the affidavit
to explain why practical constraints might require the seizure of the entire
computer system for off-site examination. See United States v. Hill, 459 F.3d
966, 975-76 (9th Cir. 2006) (stating that the affidavit must “demonstrate
to the magistrate factually why such a broad search and seizure authority is
reasonable in the case at hand”). As imaging and/or removal is necessary in
nearly every computer search warrant case, it is doubtful that failure to include
such a statement in the affidavit constitutes a Fourth Amendment violation.
Nevertheless, although explicitly required only by the Ninth Circuit, it is a
good practice for every search warrant affidavit to explain why it is necessary
to image an entire hard drive (or physically seize it) and later examine it for
responsive records. Including these facts in the affidavit provides a considerable
degree of reassurance that the Fourth Amendment will be satisfied. See United
States v. Hill, 459 F.3d 966, 976 (9th Cir. 2006); United States v. Hay, 231
78
Searching and Seizing Computers
F.3d 630, 637 (9th Cir. 2000) (“the affidavit explained why it was necessary
to seize the entire computer system” and “justified taking the entire system
off site because of the time, expertise, and controlled environment required
for a proper analysis”); United States v. Adjani, 452 F.3d 1140, 1149 n.7 (9th
Cir. 2006). As noted below, these facts justifying removal of storage media for
off-site review should not commit the agents to any particular “protocol” for
reviewing the media to find evidence that falls within the scope of the warrant.
Instead, the affidavit will simply note that off-site review might be required.
4. Do Not Place Limitations on the Forensic Techniques
Tat May Be Used To Search
Limitations on search methodologies have the potential to seriously impair
the government’s ability to uncover electronic evidence. “[A] search can be as
much an art as a science,” United States v. Brooks, 427 F.3d 1246, 1252 (10th
Cir. 2005), and the forensic process can require detective work, including
intuition and on-the-spot judgment in deciding, based on what the examiner
has just seen, what is the best step to take next. One particularly burdensome
restriction that could be placed on a forensic investigator is the requirement
that the investigator limit the search to files containing particular keywords.
Forensic analysis may include keyword searches, but a properly performed
forensic analysis will rarely end there, because keyword searches will fail to find
many kinds of files that fall within the scope of a warrant. For example, at the
time of this writing, a number of file types, such as TIFF files and some PDF
files, cannot be searched for keywords. See, e.g., United States v. Evanson, 2007
WL 4299191, at *5 (D. Utah Dec. 5, 2007) (noting that in the search at issue
some files “were in ‘tiff’ format,” a “‘digital picture of a hard copy document’
that has been scanned,” and that these files “had numbers as file names, rather
than recognizable file names that purportedly described the data in the files”).
In addition, keyword searches can also be thwarted through the use of code
words or even unintentional misspellings. Law and investment firms—not to
mention individuals involved in criminal activity—often use code words to
identify entities, individuals, and specific business arrangements in documents
and communications; sometimes the significance of such terms will not be
apparent until after a careful file-by-file review has commenced. Every Westlaw
or LEXIS user is familiar with the difficulty of crafting search terms that find
the correct case on the first try; requiring a forensic investigator to find crucial
evidence with a keyword search specified prior to forensic analysis is just as
impractical.
2. With a Warrant
79
Court-mandated forensic protocols are also unnecessary because
investigators already operate under significant constitutional restrictions. As
with any search, “the manner in which a warrant is executed is subject to later
judicial review as to its reasonableness.” Dalia v. United States, 441 U.S. 238,
258 (1979); United States v. Ramirez, 523 U.S. 65, 71 (1998) (“Te general
touchstone of reasonableness which governs Fourth Amendment analysis
… governs the method of execution of the warrant.”); Hill, 459 F.3d at 978
(“reasonableness of the officer’s acts both in executing the warrant and in
performing a subsequent search of seized materials remains subject to judicial
review”). Unreasonable conduct can be remedied after the fact, including, as a
“last resort,” with suppression of evidence. Hudson v. Michigan, 547 U.S. 586,
591 (2006).
A few magistrate judges issue warrants to search computers only subject
to limitations on the way that the seized media may later be examined. For
example, some magistrates require that the forensic analysis of the computer
be completed within a set time period; issues related to the timing of forensic
analysis are discussed in Section D.5 below. In addition, some magistrates may
refuse to sign a warrant that does not include a protocol specifying how the
government will examine seized media to find evidence that falls within the
scope of the warrant. See, e.g., In re Search of 3817 W. West End, 321 F. Supp.
2d 953, 962-63 (N.D. Ill. 2004). Neither Rule 41 nor the Fourth Amendment
requires magistrates to impose such restrictions, and prosecutors should oppose
such restrictions whenever they significantly interfere with the government’s
ability to obtain evidence that falls within the scope of the warrant. While
it might be helpful for the affidavit to contain backg2round information that
might justify particular steps taken during the search—such as describing the
ease with which evidence can be concealed in a computer, explaining the need
to search off-site, or justifying the seizure of commingled records—neither the
search warrant application nor the affidavit need contain special restrictions on
how agents search for the things described in the warrant.
Any significant limitation (such as a restriction to keyword searches) on
the techniques the government may use to find evidence that falls within the
scope of a warrant is inconsistent with Supreme Court precedent. Te Supreme
Court has held that “[n]othing in the language of the Constitution or in [the
Supreme Court’s] decisions interpreting that language suggests that, in addition
to the requirements set forth in the text [of the Fourth Amendment], search
warrants also must include a specification of the precise manner in which they
80
Searching and Seizing Computers
are to be executed.” United States v. Grubbs, 547 U.S. 90, 98 (2006) (quoting
Dalia, 441 U.S. at 255). “It would extend the Warrant Clause to the extreme
to require that, whenever it is reasonably likely that Fourth Amendment rights
may be affected in more than one way, the court must set forth precisely the
procedures to be followed by the executing officers.” Dalia, 441 U.S. at 258.
Furthermore, any limitation on the government’s ability to find evidence
that falls within the scope of a warrant is inconsistent with the rule that “[a]
container that may conceal the object of a search authorized by a warrant may
be opened immediately; the individual’s interest in privacy must give way to
the magistrate’s official determination of probable cause.” United States v. Ross,
456 U.S. 798, 823 (1982).
Magistrates requiring the government to set forth a protocol for forensic
analysis have typically cited the Supreme Court’s decision in Andresen v.
Maryland, 427 U.S. 463 (1976), in which the Court noted that when search
warrants authorize the seizure of documents, “responsible officials, including
judicial officials, must take care to assure that they are conducted in a manner
that minimizes unwarranted intrusions upon privacy.” Id. at
482 n.11.
Under Andresen, it is surely appropriate for magistrates to strictly enforce the
Particularity Clause in computer cases involving commingled records. However,
nothing in Andresen authorizes magistrates to control the manner in which a
warrant is executed, and such control was rejected by the Court in Dalia and
Grubbs. In addition, the Andresen Court recognized that it is necessary to look
at “innocuous documents . . . in order to determine whether they are, in fact,
among those papers authorized to be seized.” Andresen, 427 U.S. at 482 n.11.
Circuit courts have upheld computer search warrants that included neither
a protocol (a list of steps the investigator is required to undertake in examining
the computer) nor an explanation for the lack of a protocol. In United States v.
Giberson, 527 F.3d 882 (9th Cir. 2008), the court upheld a seizure of a computer
and a search through it for particularly described records, even though the
records were intermingled with other files, without requiring any protocol.
Te court held that “the potential intermingling of materials does not justify
an exception or heightened procedural protections for computers beyond the
Fourth Amendment’s reasonableness requirement.” Id. at 889. In United States
v. Hill, 459 F.3d 966 (9th Cir. 2006), the defendant challenged the search
of his computer, arguing, among other things, that the warrant was invalid
because “it did not include a search protocol to limit the officer’s discretion as
to what they could examine when searching the defendant’s computer media.”
2. With a Warrant
81
Id. at 977. Te court held that no search protocol was necessary, and that
it also was not necessary to explain the absence of a search protocol in the
warrant application. Id. at 978. Te Tenth Circuit emphasized in United States
v. Brooks, 427 F.3d 1246 (10th Cir. 2005), that while warrants must describe
“with particularity the objects of their search,” the methodology used to find
those objects need not be described: “Tis court has never required warrants to
contain a particularized computer search strategy.” Id. at 1251. In United States
v. Khanani, 502 F.3d 1281, 1290-91 (11th Cir. 2007), the Eleventh Circuit
rejected the argument that a warrant should have included a search protocol,
pointing in part to the careful steps agents took to ensure compliance with the
warrant. See also United States v. Cartier, 543 F.3d 442, 447-48 (8th Cir. 2008)
(“While we acknowledge that there may be times that a search methodology
or strategy may be useful or necessary, we decline to make a blanket finding
that the absence of a search methodology or strategy renders a search warrant
invalid per se”); United States v. Upham, 168 F.3d 532, 537 (1st Cir. 1999)
(“Te warrant process is primarily concerned with identifying what may be
searched or seized—not how”). But see United States v. Payton, ___ F.3d ___,
2009 WL 2151348, at *3-5 (9th Cir. July 21, 2009) (holding that search of
computer without explicit authorization violated Fourth Amendment where
nothing present at the residence searched suggested that records falling within
the scope of the warrant would be found on the computer, and suggesting in
dicta that judges issuing computer search warrants “may place conditions on
the manner and extent of such searches”).
If a search strategy is described in the affidavit, the affidavit should clearly
state that the strategy is an illustration of a likely strategy that will be employed,
but not “a specification of the precise manner in which [the warrant is] to be
executed.” Grubbs, 547 U.S. at 98. Indeed, one court has held that “search
protocols and keywords are not ‘material’ for purposes of Rule 16(a)(1)(E),”
and thus are not discoverable. United States v. Fumo, 2007 WL 3232112, at *7
(E.D. Pa. Oct. 30, 2007).
Finally, if a magistrate judge refuses to issue a warrant without conditioning
its execution on certain requirements, and if law enforcement officials choose
to execute the warrant anyway, the officials should not ignore the requirements.
See, e.g., United States v. Brunette, 76 F. Supp. 2d 30, 42 (D. Maine 1999), aff’d,
256 F.3d 14 (1st Cir. 2001) (suppression appropriate because the government
failed to comply with time limits for reviewing seized computers when those
time limits were required by the warrant). Instead, law enforcement officials
82
Searching and Seizing Computers
should follow the requirements of the warrant unless they obtain relief from
the issuing magistrate or an appropriate higher court. Prosecutors encountering
such issues should contact CCIPS at (202) 514-1026 for further assistance.
5. Seeking Authorization for Delayed Notification Search Warrants
If certain conditions are met, a court may authorize so-called “surreptitious
entry” or “sneak-and-peek” warrants that excuse agents from having to notify
at the time of the search the person whose premises are searched. Neither the
Fourth Amendment nor Rule 41 requires an officer executing a search warrant
to present the property owner with a copy of the warrant before conducting
his search. United States v. Grubbs, 547 U.S. 90, 98-99 (2006). In addition,
under 18 U.S.C. § 3103a, a court may grant the delay of notice associated with
the execution of a search warrant if it finds “reasonable cause” to believe that
providing immediate notification of the execution of the warrant may have
one of the adverse effects enumerated in 18 U.S.C. § 2705 (except for unduly
delaying a trial): endangering the life or physical safety of an individual, flight
from prosecution, evidence tampering, witness intimidation, or otherwise
seriously jeopardizing an investigation.
Under § 3103a, law enforcement authorities must provide delayed notice
within a “reasonable period not to exceed 30 days after the date of [the warrant’s]
execution” or, alternatively, “on a later date certain if the facts of the case justify
a longer period of delay.” 18 U.S.C. § 3103a(b)(3). Tis initial period can be
extended “for good cause” upon “an updated showing of the need for further
delay;” such extensions are “limited to periods of 90 days or less, unless the
facts of the case justify a longer period of delay.” 18 U.S.C. § 3103a(c).
Section
3103a distinguishes between delaying notice of a search and
delaying notice of a seizure. Indeed, unless the court finds “reasonable necessity”
for a seizure, warrants issued under this section must prohibit the seizure of
any tangible property, any wire or electronic communication, or any stored
wire or electronic information (except as expressly provided in chapter 121).
Congress intended that if investigators intended to make surreptitious copies
of information stored on a suspect’s computer, they would obtain authorization
from the court in advance. For more information regarding section 3103a,
prosecutors and investigators should contact the Office of Enforcement
Operations (“OEO”) at (202) 514-6809.
2. With a Warrant
83
6. Multiple Warrants in Network Searches
Agents should obtain multiple warrants if they have reason to
believe that a network search will retrieve data stored in multiple
locations.
Fed. R. Crim. P. 41(a) states that a magistrate judge located in one judicial
district may issue a search warrant for “a search of property . . . within the
district,” or “a search of property . . . outside the district if the property . . .
is within the district when the warrant is sought but might move outside the
district before the warrant is executed.” Rule 41 defines “property” to include
“information,” see Fed. R. Crim. P. 41(a)(2)(A), and the Supreme Court has
held that “property” as described in Rule 41 includes intangible property such
as computer data. See United States v. New York Tel. Co., 434 U.S. 159, 170
(1977). Although the courts have not directly addressed the matter, the language
of Rule 41 combined with the Supreme Court’s interpretation of “property”
may limit searches of computer data to data that resides in the district in which
the warrant was issued. Cf. United States v. Walters, 558 F. Supp. 726, 730 (D.
Md. 1980) (suggesting such a limit in a case involving telephone records).
A territorial limit on searches of computer data poses problems for law
enforcement because computer data stored in a computer network can be located
anywhere in the world. For example, agents searching an office in Manhattan
pursuant to a warrant from the Southern District of New York may sit down
at a terminal and access information stored remotely on a computer located
in New Jersey, California, or even a foreign country. A single file described by
the warrant could be located anywhere on the planet, or could be divided up
into several locations in different districts or countries. Even worse, it may be
impossible for agents to know when they execute their search whether the data
they are seizing has been stored within the district or outside of the district.
Agents may in some cases be able to learn where the data is located before the
search, but in others they will be unable to know the storage site of the data
until after the search has been completed.
When agents can learn prior to the search that some or all of the data
described by the warrant is stored in a different location than where the agents
will execute the search, the best course of action depends upon where the
remotely stored data is located. When the data is stored remotely in two or
more different places within the United States and its territories, agents should
obtain additional warrants for each location where the data resides to ensure
84
Searching and Seizing Computers
compliance with a strict reading of Rule 41(a). For example, if the data is
stored in two different districts, agents should obtain separate warrants from
the two districts.
When agents learn before a search that some or all of the data is stored
remotely outside of the United States, matters become more complicated. Te
United States may be required to take actions ranging from informal notice
to a formal request for assistance to the country concerned. Further, some
countries may object to attempts by U.S. law enforcement to access computers
located within their borders. Although the search may seem domestic to a U.S.
law enforcement officer executing the search in the United States pursuant
to a valid warrant, other countries may view matters differently. Agents and
prosecutors should contact the Office of International Affairs at (202) 514-
0000 for assistance with these difficult questions.
When agents do not and even cannot know that data searched from one
district is actually located outside the district, evidence seized remotely from
another district ordinarily should not lead to suppression of the evidence
obtained. Te reasons for this are twofold. First, courts may conclude that agents
sitting in one district who search a computer in that district and unintentionally
cause intangible information to be sent from a second district into the first
have complied with Rule 41(a). Cf. United States v. Ramirez, 112 F.3d 849,
852 (7th Cir. 1997) (Posner, C.J.) (adopting a permissive construction of the
territoriality provisions of Title III); United States v. Denman, 100 F.3d 399,
402 (5th Cir. 1996) (same); United States v. Rodriguez, 968 F.2d 130, 135-36
(2d Cir. 1992) (same).
Second, even if courts conclude that the search violates Rule
41(a),
the violation will not lead to suppression of the evidence unless the agents
intentionally and deliberately disregarded the Rule, or the violation leads to
“prejudice” in the sense that the search might not have occurred or would not
have been so “abrasive” if the Rule had been followed. See United States v. Burke,
517 F.2d 377, 386 (2d Cir. 1975) (Friendly, J.); United States v. Martinez-Zayas,
857 F.2d 122, 136 (3d Cir. 1988) (citing cases); cf. Herring v. United States, 129
S. Ct. 695, 702 (2009) (exclusionary rule is applied in Fourth Amendment cases
only if police conduct is “sufficiently deliberate that exclusion can meaningfully
deter it, and sufficiently culpable that such deterrence is worth the price paid by
the justice system”). Under the widely-adopted Burke test, courts generally deny
motions to suppress when agents executing the search cannot know whether it
violates Rule 41 either legally or factually. See Martinez-Zayas, 857 F.2d at 136
2. With a Warrant
85
(concluding that a search passed the Burke test “[g]iven the uncertain state of
the law” concerning whether the conduct violated Rule 41(a)). Accordingly,
evidence acquired from a network search that accessed data stored in multiple
districts should not lead to suppression unless the agents intentionally and
deliberately disregarded Rule 41(a) or prejudice resulted. See generally United
States v. Trost, 152 F.3d 715, 722 (7th Cir. 1998) (“[I]t is difficult to anticipate
any violation of Rule 41, short of a defect that also offends the Warrant Clause
of the fourth amendment, that would call for suppression.”).
D. Forensic Analysis
1. Te Two-Stage Search
In the vast majority of cases, forensic analysis of a hard drive (or other
computer media) takes too long to perform on-site during the initial execution
of a search warrant. Tus, as discussed in Section C.3 above, investigators
generally must remove storage media for off-site analysis to determine the
information that falls within the scope of the warrant. Tis process has two
steps: imaging, in which the entire hard drive is copied, and analysis, in which
the copy of the hard drive is culled for records that are responsive to the
warrant.
Imaging is described in Section C.3 above. It results in the creation of an
“image copy” of the hard drive—a copy that “duplicates every bit and byte
on the target drive including all files, the slack space, Master File Table, and
metadata in exactly the order they appear on the original.” United States v. Vilar,
2007 WL 1075041, at *35 n.22 (S.D.N.Y. Apr. 4, 2007), quoting Orin S.
Kerr, Searches and Seizures in a Digital World, 119 Harv. L. Rev. 531 (2005).
After imaging, the second step of the forensic review process begins: the
hard drive image is examined, and data that falls within the scope of the
warrant is identified. In computer search cases, where the purpose for the off-
site analysis is to determine whether information stored on computer media
falls within the scope of a warrant, courts have treated the off-site forensic
analysis of computer media seized pursuant to a warrant as a continuation of
the search, still bound by the Fourth Amendment. See United States v. Syphers,
426 F.3d 461, 468 (1st Cir. 2005) (referring to a forensic review of a seized
computer as a “search”); United States v. Mutschelknaus, 564 F. Supp. 2d 1072,
1076 (D.N.D. 2008) (referring to forensic analysis as a “subsequent search”);
86
Searching and Seizing Computers
United States v. Triumph Capital Group, Inc., 211 F.R.D. 31, 66 (D. Conn.
2002) (referring to an examination of a hard drive image as a “search”).
Once a computer seized pursuant to a warrant has been reviewed and
items within the computer determined to fall within the scope of the warrant,
subsequent review of those items should not implicate the Fourth Amendment.
As the Ninth Circuit has explained, “once an item in an individual’s possession
has been lawfully seized and searched, subsequent searches of that item, so long
as it remains in the legitimate uninterrupted possession of the police, may be
conducted without a warrant.” United States v. Turner, 28 F.3d 981, 983 (9th
Cir. 1994) (quoting United States v. Burnette, 698 F.2d 1038, 1049 (1983)).
2. Searching Among Commingled Records
Few computers are dedicated to a single purpose; rather, computers can
perform many functions, such as “postal services, playgrounds, jukeboxes, dating
services, movie theaters, daily planners, shopping malls, personal secretaries,
virtual diaries, and more.” United States v. Andrus, 483 F.3d 711, 718 (10th
Cir. 2007). Tus, almost every hard drive encountered by law enforcement
will contain records that have nothing to do with the investigation. Te Fourth
Amendment governs how investigators may search among the commingled
records to isolate those records that are called for by the warrant.
Te Supreme Court has noted that in a search of commingled records, “it
is certain that some innocuous documents will be examined, at least cursorily,
in order to determine whether they are, in fact, among those papers authorized
to be seized.” Andresen v. Maryland, 427 U.S. 463, 482 n.11 (1976). Terefore,
“responsible officials, including judicial officials, must take care to assure that
[these searches] are conducted in a manner that minimizes unwarranted
intrusions upon privacy.” Id.
Following on the acknowledgement in Andresen that “innocuous” documents
can be “cursorily” examined, courts have set forth guidelines for agents review of
commingled records to find documents that fall within the scope of a warrant.
Te leading case is United States v. Heldt, which allows a “brief perusal” of each
document, and requires that “the perusal must cease at the point of which the
warrant’s inapplicability to each document is clear.” United States v. Heldt, 668
F.2d 1238, 1267 (D.C. Cir. 1982); see also United States v. Rude, 88 F.3d 1538,
1552 (9th Cir. 1996); United States v. Giannetta, 909 F.2d 571, 577 (1st Cir.
1990) (“the police may look through . . . file cabinets, files and similar items
and briefly peruse their contents to determine whether they are among the
2. With a Warrant
87
documentary items to be seized”); United States v. Slocum, 708 F.2d 587, 604
(11th Cir. 1983); United States v. Ochs, 595 F.2d 1247, 1258 (2d. Cir. 1979)
(“some perusal, generally fairly brief.”). If a document falls outside the warrant
but nonetheless is incriminating, Heldt allows that document’s “seizure” only
if during that brief perusal the document’s “otherwise incriminating character
becomes obvious.” Heldt, 668 F.2d at 1267.
Similar reasoning has been applied to computer searches. See United States
v. Khanani, 502 F.3d 1281, 1290 (11th Cir. 2007) (endorsing a search in which
“a computer examiner eliminated files that were unlikely to contain material
within the warrants’ scope”); Manno v. Christie, 2008 WL 4058016, at *4
(D.N.J. Aug. 22, 2008) (finding it “reasonable for [Agent] to briefly review
each electronic document to determine if it is among the materials authorized
by the warrant, just as he could if the search was only of paper files”); United
States v. Potts, 559 F. Supp. 2d 1162, 1175-76 (D. Kan. 2008) (warrant did
not authorize an overbroad search when it allowed the investigator “to search
the computer by . . . opening or cursorily reviewing the first few ‘pages’ of
such files in order to determine the precise content” (internal quotation marks
removed)); United States v. Fumo, 2007 WL 3232112, at *6 (E.D. Pa. Oct.
30, 2007) (“search protocols and keywords do not mark the outer bounds of
a lawful search; to the contrary, because of the nature of computer files, the
government may legally open and briefly examine each file when searching a
computer pursuant to a valid warrant”); United States v. Scarfo, 180 F. Supp.
2d 572, 578 (D.N.J. 2001) (in holding that a key stroke logger could be used
to obtain a passphrase even though it would capture other keystrokes, noting
that “law enforcement officers must be afforded the leeway to wade through
a potential morass of information in the target location to find the particular
evidence which is properly specified in the warrant”). When it becomes
necessary for an investigator to personally examine a computer file to determine
whether it falls within the scope of the warrant, the investigator should take all
necessary steps to analyze the file thoroughly, but the investigator should cease
the examination of that file as soon as it becomes clear that the warrant does
not apply to that file.
Some older cases appear to suggest that when agents executing a search
encounter commingled records, they should seize the records, and then seek
additional approval from the magistrate before proceeding. For example, the
Ninth Circuit, writing about a search of paper files in an age before computer
searches were common, suggested that in the “comparatively rare instances”
88
Searching and Seizing Computers
where “documents are so intermingled that they cannot feasibly be sorted on
site,” law enforcement “can avoid violating fourth amendment rights by sealing
and holding the documents pending approval by a magistrate of a further
search.” United States v. Tamura, 694 F.2d 591, 595-596 (9th Cir. 1982). Te
Tenth Circuit suggested in dicta that the same procedure might be followed
for computer searches. See United States v. Carey, 172 F.3d 1268, 1275 (10th
Cir. 1999) (“the officers may seal or hold the documents pending approval
by a magistrate of the conditions and limitations on a further search through
the documents”). Both courts, however, have subsequently clarified that a
procedure in which the initial warrant establishes the criteria for off-site review
is sufficient. See United States v. Hay, 231 F.3d 630, 637 (9th Cir. 2000) (affidavit
that establishes “why it was necessary to seize the entire computer system” and
“justified taking the entire system off site,” with magistrate approval, “makes
inapposite United States v. Tamura”); United States v. Brooks, 427 F.3d 1246,
1251 (10th Cir. 2005) (“we have not required a specific prior authorization
along the lines suggested in Carey in every computer search”).
3. Analysis Using Forensic Software
Provided the forensic examiner is attempting to find data that is
responsive to the warrant, the Fourth Amendment does not limit
the techniques an examiner may use to examine a hard drive.
“[A] computer search may be as extensive as reasonably required to locate
the items described in the warrant.” United States v. Grimmett, 439 F.3d 1263,
1270 (10th Cir. 2006). So long as the forensic examiner is attempting to find
data that is responsive to the warrant, the Fourth Amendment does not restrain
the techniques an examiner uses. Te use of forensic software, no matter how
“sophisticated,” also does not affect Fourth Amendment analysis. Cf. United
States v. Long, 425 F.3d 482, 487 (7th Cir. 2005) (noting in consent search
case that “it is impossible to search computer hardware or software without
using some type of software,” and “[t]he fact that the Encase search engine [is]
sophisticated is of no importance.”).
Even if a defendant has taken steps to conceal evidence on a hard drive,
a forensic review that nonetheless uncovers it does not invade a reasonable
expectation of privacy so long as the warrant permitted a search of the hard
drive for that evidence. For example, reading the contents of deleted files by
examining unallocated space on the disk has been upheld. See United States v.
Upham, 168 F.3d 532, 537 (1st Cir. 1999) (“recovery [by law enforcement of
2. With a Warrant
89
unlawful images] after attempted destruction, is no different than decoding a
coded message lawfully seized or pasting together scraps of a torn-up ransom
note”).
4. Changes of Focus and the Need for New Warrants
A single computer can be involved in several types of crimes, so a computer
hard drive might contain evidence of several different crimes. When an agent
searches a computer under the authority of a warrant, however, the warrant will
often authorize a search of the computer only for evidence of certain specified
crimes. If the agent comes across evidence of a crime that is not identified by the
warrant, it may be a safe practice to obtain a second warrant. In United States v.
Carey, 172 F.3d 1268 (10th Cir. 1999), detectives obtained a warrant to search
the defendant’s computer for records of narcotics sales. Searching the computer
back at the police station, a detective discovered images of child pornography.
At that point, the detective “abandoned the search for drug-related evidence”
and instead searched the entire hard drive for evidence of child pornography.
Id. at 1277-78. Te Tenth Circuit suppressed the child pornography, holding
that the subsequent search for child pornography exceeded the scope of the
original warrant. See id. at 1276. Compare Carey with United States v. Walser,
275 F.3d 981, 986-87 (10th Cir. 2001) (upholding search where officer with
warrant to search for electronic records of drug transactions discovered child
pornography on computer, suspended search, and then returned to magistrate
for second warrant to search for child pornography), and Gray, 78 F. Supp.
2d at 530-31 (upholding search where agent discovered child pornography in
the course of looking for evidence of computer hacking pursuant to a warrant,
and then obtained a second warrant before searching the computer for child
pornography).
Te Tenth Circuit has subsequently characterized Carey as
“simply
stand[ing] for the proposition that law enforcement may not expand the scope
of a search beyond its original justification.” United States v. Grimmett, 439 F.3d
1263, 1268 (10th Cir. 2006). Grimmett, then, shifts the analysis away from
the agent’s subjective intent and toward what the warrant justified. Notably,
Carey’s focus on the agent’s subjective intent reflects a somewhat outdated view
of the Fourth Amendment. Te Supreme Court has declined to examine an
agent’s subjective intent and instead has focused on whether the circumstances,
viewed objectively, justified the agent’s conduct. See, e.g., Brigham City v.
Stuart, 547 U.S. 398, 404 (2006) (“An action is ‘reasonable’ under the Fourth
Amendment, regardless of the individual officer’s state of mind, as long as the
90
Searching and Seizing Computers
circumstances, viewed objectively, justify the action.”)
(internal quotation
marks removed); Whren v. United States, 517 U.S. 806, 813 (1996); Horton
v. California, 496 U.S. 128, 138 (1990). Relying on these precedents, several
courts have indicated that an agent’s subjective intent during the execution of
a warrant no longer determines whether the search exceeded the scope of the
warrant and violated the Fourth Amendment. See United States v. Van Dreel,
155 F.3d 902, 905 (7th Cir. 1998) (“[U]nder Whren, . . . once probable cause
exists, and a valid warrant has been issued, the officer’s subjective intent in
conducting the search is irrelevant.”); United States v. Ewain, 88 F.3d 689,
694 (9th Cir. 1996) (“Using a subjective criterion would be inconsistent with
Horton, and would make suppression depend too much on how the police tell
their story, rather than on what they did.”). According to these cases, the proper
inquiry is whether, from an objective perspective, the search that the agents
actually conducted was consistent with the warrant obtained. See Ewain, 88
F.3d at 694. Te agent’s subjective intent is either “irrelevant,” Van Dreel, 155
F.3d at 905, or else merely one factor in the overall determination of “whether
the police confined their search to what was permitted by the search warrant.”
Ewain, 88 F.3d at 694.
Under an objective standard for agents’ conduct, there is inherent tension
between Carey and cases such as Hill, 322 F. Supp. 2d at 1090, which
recognized that “[t]here is no way to know what is in a file without examining
its contents.” Tis fact, combined with the principle that “[a] container that
may conceal the object of a search authorized by a warrant may be opened
immediately,” United States v. Ross, 456 U.S. 798, 823 (1982), suggests that
it should not be necessary to seek a second warrant after discovering evidence
of a separate crime. As the court explained in Gray, 78 F. Supp. 2d at 531
n.11, “[a]rguably, [the agent] could have continued his systematic search of
defendant’s computer files pursuant to the first search warrant, and, as long
as he was searching for the items listed in the warrant, any child pornography
discovered in the course of that search could have been seized under the ‘plain
view’ doctrine.” Nevertheless, Carey has not been overruled, so it remains
prudent to seek a second warrant upon discovering evidence of an additional
crime not identified in the initial warrant.
5. Permissible Time Period for Examining Seized Media
Neither the Fourth Amendment nor Rule 41 imposes any specific limitation
on the time period of the government’s forensic examination. Te government
ordinarily may retain the seized computer and examine its contents in a careful
2. With a Warrant
91
and deliberate manner, subject only to the reasonableness requirement of the
Fourth Amendment, and the reasonableness of the government’s search is
determined primarily by whether probable cause for the search has dissipated.
Te absence of a specific time frame for forensic examination is confirmed by a
new amendment to Rule 41(e), which is scheduled to take effect (assuming no
contrary congressional action) on December 1, 2009:
A warrant under Rule 41(e)(2)(A) may authorize the seizure
of electronic storage media or the seizure or copying of
electronically stored information. Unless otherwise specified,
the warrant authorizes a later review of the media or information
consistent with the warrant. Te time for executing the warrant
in Rule 41(e)(2)(A) and (f )(1)(A) refers to the seizure or on-site
copying of the media or information, and not to any later off-
site copying or review.
Courts have agreed that neither the Fourth Amendment nor Rule 41 places
explicit limits on the duration of any of forensic analysis, and courts have
upheld forensic analyses begun months after investigators acquire a computer
or data. See United States v. Burns, 2008 WL 4542990, at *8-9 (N.D. Ill. Apr.
29, 2008) (ten month delay); United States v. Gorrell, 360 F. Supp. 2d 48,
55 n.5 (D.D.C. 2004) (ten month delay); United States v. Hernandez, 183 F.
3d 468, 480 (D.P.R. 2002) (six week delay); United States v. Triumph Capital
Group, Inc., 211 F.R.D. 31, 66 (D. Conn. 2002); cf. United States v. New
York Tel. Co., 434 U.S. 159, 169 n.16 (1977) (applying Fourth Amendment
standards to pen registers before the enactment of the pen register act, holding
that “the requirement … that the search be conducted within 10 days of its
issuance does not mean that the duration of a pen register surveillance may not
exceed 10 days”).
Te Fourth Amendment does require that forensic analysis of a computer
be conducted within a reasonable time. See United States v. Mutschelknaus, 564
F. Supp. 2d 1072, 1077 (D.N.D. 2008) (“[T]he Federal Rules of Criminal
Procedure do not require that the forensic analysis of computers and other
electronic equipment take place within a specific time limit. Any subsequent
search only needs to be conducted within a reasonable time.”); Burns, 2008
WL 4542990, at *8 (“A delay must be reasonable, but there is no constitutional
upper limit on reasonableness.”); United States v. Grimmett, 2004 WL 3171788,
at *5 (D. Kan. Aug. 10, 2004), aff’d 439 F.3d 1263 (10th Cir. 2006). In judging
the reasonableness of time for forensic analysis, courts may recognize that
92
Searching and Seizing Computers
analysis of computers is a difficult and time-consuming process. See Triumph
Capital Group, Inc., 211 F.R.D. at 66 (finding that time to complete search
reasonable because “computer searches are not, and cannot be subject to any
rigid time limit because they may involve much more information than an
ordinary document search, more preparation and a greater degree of care in
their execution”).
Importantly, courts usually treat the dissipation of probable cause as the
chief measure of the “reasonableness” of a search’s length under the Fourth
Amendment. For example, in United States v. Syphers, 426 F.3d 461 (1st Cir.
2005), the First Circuit stated that the Fourth Amendment “contains no
requirements about when the search or seizure is to occur or the duration,” but
cautioned that “unreasonable delay in the execution of a warrant that results
in the lapse of probable cause will invalidate a warrant.” Id. at 469 (quotations
omitted). See Burns, 2008 WL 4542990 at *9 (upholding search despite
“lengthy” delay because “Burns does not assert that the time lapse affected the
probable cause to search the computer (nor could he, given that suspected child
pornography had already been found on the hard drive), that the government
has acted in bad faith, or that he has been prejudiced in any way by the delay”).
Significantly, dissipation of probable cause is unlikely in computer search cases
because evidence is “frozen in time” when storage media is imaged or seized.
Triumph Capital Group, Inc., 211 F.R.D. at 66.
A few magistrate judges have taken a different view, however, and have
refused to sign search warrants authorizing the seizure of computers unless
the government conducts the forensic examination in a short period of time,
such as thirty days. Some magistrate judges have imposed time limits as short
as seven days, and several have imposed specific time limits when agents apply
for a warrant to seize computers from operating businesses. In support of these
limitations, a few magistrate judges have expressed their concern that it might
be constitutionally
“unreasonable” under the Fourth Amendment for the
government to deprive individuals of their computers for more than a short
period of time.1
Prosecutors should oppose such limitations. Te law does not expressly
authorize magistrate judges to issue warrants that impose time limits on law
enforcement’s examination of seized evidence, and the authority of magistrates
1 When the computer does not contain contraband (such as child pornography), this
specific concern can usually be addressed by imaging the computer, returning it promptly, and
later taking as much time as necessary to conduct the forensic exam on the image copy.
2. With a Warrant
93
to impose such limits is open to question, especially in light of the forthcoming
amendment to Rule 41 stating that the time for executing a warrant “refers to
the seizure or on-site copying of the media or information, and not to any later
off-site copying or review.” As the Supreme Court suggested in one early case,
the proper course is for the magistrate to issue the warrant so long as probable
cause exists, and then to permit the parties to litigate the constitutional issues
afterwards. See Ex Parte United States, 287 U.S. 241, 250 (1932) (“Te refusal
of the trial court to issue a warrant . . . is, in reality and effect, a refusal to
permit the case to come to a hearing upon either questions of law or fact, and
falls little short of a refusal to permit the enforcement of the law.”). Prosecutors
encountering this issue may contact CCIPS at (202) 514-1026 for further
assistance.
At least one court has adopted the severe position that suppression is
appropriate when the government fails to comply with court-imposed limits
on the time period for reviewing seized computers. In United States v. Brunette,
76 F. Supp. 2d 30 (D. Me. 1999), a magistrate judge permitted agents to seize
the computers of a child pornography suspect on the condition that the agents
searched through the computers for evidence “within 30 days.” Te agents
executed the search five days later and seized several computers. A few days
before the thirty-day period elapsed, the government applied for and obtained
a thirty-day extension of the time for review. Te agents then reviewed all but
one of the seized computers within the thirty-day extension period, and found
hundreds of images of child pornography. However, the agents did not begin
reviewing the last of the computers until two days after the extension period
had elapsed. Te defendant moved for suppression of the child pornography
images found in the last computer, on the ground that the search outside of the
sixty-day period violated the terms of the warrant and subsequent extension
order. Te court agreed, stating that “because the Government failed to adhere
to the requirements of the search warrant and subsequent order, any evidence
gathered from the . . . computer is suppressed.” Id. at 42.
Te result in Brunette makes little sense either under Rule 41 or the Fourth
Amendment. Even assuming that a magistrate judge has the authority to impose
time constraints on forensic testing in the first place, it seems incongruous to
impose suppression for violations of such conditions when analogous violations
of Rule 41 itself would not result in suppression. Compare Brunette with United
States v. Twenty-Two Tousand, Two Hundred Eighty Seven Dollars ($22,287.00),
U.S. Currency, 709 F.2d 442, 448 (6th Cir. 1983) (rejecting suppression when
94
Searching and Seizing Computers
agents began search “shortly after” 10 p.m., even though Rule 41 states that
all searches must be conducted between 6:00 a.m. and 10 p.m.). Similarly,
the Fourth Amendment requires only reasonableness, and courts have rejected
challenges based on claims of delay, as discussed above. Tis incongruity is
especially true when the hardware to be searched is a container of contraband
child pornography, and it is therefore subject to forfeiture and will not be
returned.
Te use of the exclusionary rule to police delays by forensic examiners is even
more questionable after Hudson v. Michigan, 547 U.S. 586 (2006). In Hudson,
in which the Supreme Court rejected a suppression remedy for violation of
the knock-and-announce rule, the Court held that “but-for causality is only a
necessary, not a sufficient, condition for suppression.” Id. at 592. In rejecting
suppression, the Court also relied on the conclusion that suppression would
not “vindicate the interests protected by the [constitutional] requirement [at
issue],” id. at 593, and that “the exclusionary rule has never been applied”
when its “substantial social costs” outweigh its deterrent benefits. Id. (citation
omitted).
6. Contents of Rule 41(f ) Inventory Filed With the Court
Officers should file inventories with returns that simply indicate
the hardware devices that were seized.
Rule 41(f ) requires an officer executing a warrant to “prepare and verify an
inventory of any property seized,” and to “return [the warrant]—together with
a copy of the inventory—to the magistrate judge designated on the warrant,”
Fed. R. Crim. P. 41(f )(1)(B), (D). Currently, “[t]he Rules do not dictate a
requisite level of specificity for inventories of seized items,” and whether an
inventory is sufficiently specific is a question of fact. In re Searches of Semtex
Indus. Corp., 876 F. Supp. 426, 429 (E.D.N.Y. 1995). When documents are
seized, an inventory listing each of them is not required; such “specificity
and particularization would not seem to be called for even under an extreme
construction of Rule 41” in light of its requirement that an inventory be
“promptly” filed with the magistrate. United States v. Birrell, 269 F. Supp. 716,
722 (S.D.N.Y. 1967).
Tus, in computer cases, officers have typically filed inventories with returns
that simply indicate the information or hardware devices that were seized, such
as “image of one Maxtor 500 gigabyte hard drive.” Tis approach has been
2. With a Warrant
95
adopted in a new amendment to Rule 41(f ), which is scheduled to take effect
(assuming no contrary congressional action) on December 1, 2009. Te new
rule specifies that “[i]n a case involving the seizure of electronic storage media
or copying of electronically stored information, the inventory may be limited
to describing the physical storage media that were seized or copied.”
Courts have also held that when the government seizes documents or
data, providing defendants with “a copy of everything seized” has been held to
“obviate[] the need for a detailed inventory.” United States v. Triumph Capital
Group, Inc., 211 F.R.D. 31, 66 (D. Conn. 2002); United States v. Ogden, 2008
WL 2247074, at *13 (W.D. Tenn. May 28, 2008) (rejecting suppression motion
based on failure to provide a timely inventory of a computer search “[b]ecause
the Defendant has had access to the seized files, has personal knowledge of
the files, and was recently given a list of the files”). Providing defendants with
“access” to paper records seized from an office also “obviates the need for a
more detailed inventory” beyond one that simply identifies which file cabinets
were seized. Semtex, 876 F. Supp. at 429-30.
E. Challenges to the Search Process
1. Challenges Based on “Flagrant Disregard”
Defense counsel will sometimes attempt to use the seizure of storage
media or commingled information as the basis for a motion to suppress all
of the evidence obtained in a search. To be entitled to the extreme remedy of
blanket suppression, the defendant must establish that the seizure of additional
materials proves that the agents executed the warrant in “flagrant disregard”
of its terms. See, e.g., United States v. Khanani, 502 F.3d 1281, 1289 (11th
Cir. 2007); United States v. Le, 173 F.3d 1258, 1269 (10th Cir. 1999); United
States v. Matias, 836 F.2d 744, 747-48 (2d Cir. 1988) (citing cases). A search is
executed in “flagrant disregard” of its terms when the officers so grossly exceed
the scope of the warrant during execution that the authorized search appears
to be merely a pretext for a “fishing expedition” through the target’s private
property. See, e.g., United States v. Liu, 239 F.3d 138 (2d Cir. 2000); United
States v. Foster, 100 F.3d 846, 851 (10th Cir. 1996); United States v. Young, 877
F.2d 1099, 1105-06 (1st Cir. 1989).
As discussed above in Section C.3, for practical and technical reasons, agents
executing computer searches frequently must seize hardware or files beyond
those described in the warrant. Defense lawyers sometimes argue that by
96
Searching and Seizing Computers
seizing more than the specific computer files named in the warrant, the agents
“flagrantly disregarded” the seizure authority granted by the warrant. See, e.g.,
United States v. Henson, 848 F.2d 1374, 1383 (6th Cir. 1988); United States v.
Hunter, 13 F. Supp. 2d 574, 585 (D. Vt. 1998); United States v. Gawrysiak, 972
F. Supp. 853, 865 (D.N.J. 1997), aff’d, 178 F.3d 1281 (3d Cir. 1999); United
States v. Schwimmer, 692 F. Supp. 119, 127 (E.D.N.Y. 1988).
Prosecutors can best respond to “flagrant disregard” motions by showing
that any seizure of property not named in the warrant resulted from a good
faith response to inherent practical difficulties, rather than an attempt to
conduct a general search of the defendant’s property under the guise of a
narrow warrant. Te courts have recognized the practical difficulties that agents
face in conducting computer searches for specific files, and they routinely
approve off-site searches despite the incidental seizure of additional property.
See, e.g., United States v. Hill, 459 F.3d 966, 974-75 (9th Cir. 2006) (“the
officers would have to examine every one of what may be thousands of files
on a disk—a process that could take many hours and perhaps days”); Davis v.
Gracey, 111 F.3d 1472, 1280 (10th Cir. 1997) (noting “the obvious difficulties
attendant in separating the contents of electronic storage [sought as evidence]
from the computer hardware [seized] during the course of a search”); United
States v. Schandl, 947 F.2d 462, 465-466 (11th Cir. 1991) (noting that an
on-site search “might have been far more disruptive” than the off-site search
conducted); Henson, 848 F.2d at 1383-84 (“We do not think it is reasonable
to have required the officers to sift through the large mass of documents and
computer files found in the [defendant’s] office, in an effort to segregate those
few papers that were outside the warrant.”); United States v. Scott-Emuakpor,
2000 WL 288443, at *7 (W.D. Mich. Jan. 25, 2000) (noting “the specific
problems associated with conducting a search for computerized records”
that justify an off-site search); Gawrysiak, 972 F. Supp. at 866 (“Te Fourth
Amendment’s mandate of reasonableness does not require the agent to spend
days at the site viewing the computer screens to determine precisely which
documents may be copied within the scope of the warrant.”); United States
v. Sissler, 1991 WL 239000, at *4 (W.D. Mich. Jan. 25, 1991) (“Te police .
. . were not obligated to inspect the computer and disks at the . . . residence
because passwords and other security devices are often used to protect the
information stored in them. Obviously, the police were permitted to remove
them from the . . . residence so that a computer expert could attempt to ‘crack’
these security measures, a process that takes some time and effort. Like the
seizure of documents, the seizure of the computer hardware and software was
2. With a Warrant
97
motivated by considerations of practicality. Terefore, the alleged carte blanche
seizure of them was not a ‘flagrant disregard’ for the limitations of a search
warrant.”). See also United States v. Upham, 168 F.3d 532, 535 (1st Cir. 1999)
(“It is no easy task to search a well-laden hard drive by going through all of the
information it contains
Te record shows that the mechanics of the search
for images later performed [off-site] could not readily have been done on the
spot.”); United States v. Lamb, 945 F. Supp. 441, 462 (N.D.N.Y. 1996) (“[I]f
some of the image files are stored on the internal hard drive of the computer,
removing the computer to an FBI office or lab is likely to be the only practical
way of examining its contents.”).
2. Motions for Return of Property
Rule 41(g) allows an “aggrieved” person to move for the property’s return.
Fed. R. Crim. P. 41(g). Tis rule has particular importance in computer search
cases because it permits owners of seized computer equipment to move for
the return of the equipment before an indictment is filed. In some cases,
defendants will file such motions because they believe that the seizure of their
equipment violated the Fourth Amendment. If they are correct, the equipment
must be returned. See, e.g., In re Grand Jury Investigation Concerning Solid State
Devices, Inc., 130 F.3d 853, 855-56 (9th Cir. 1997). Rule 41(g) also permits
owners to move for a return of their property when the seizure was lawful,
but the movant is “aggrieved by the government’s continued possession of the
seized property.” Id. at 856. Te multi-functionality of computer equipment
occasionally leads to Rule 41(g) motions on this basis. For example, a suspect
under investigation for computer hacking may file a motion claiming that he
must have his computer back to calculate his taxes or check his email. Similarly,
a business suspected of fraud may file a motion for the return of its equipment
claiming that it needs the equipment returned or else the business will suffer.
Owners of properly seized computer equipment must overcome several
formidable barriers before a court will order the government to return the
equipment. First, the owner must convince the court that it should exercise
equitable jurisdiction over the owner’s claim. See Floyd v. United States, 860
F.2d 999, 1003 (10th Cir. 1988) (“Rule 41(e) jurisdiction should be exercised
with caution and restraint.”). Although the jurisdictional standards vary widely
among different courts, most courts will assert jurisdiction over a Rule 41(g)
motion only if the movant establishes: (1) that being deprived of possession of
the property causes “irreparable injury,” and (2) that the movant is otherwise
without a remedy at law. See In re Search of Kitty’s East, 905 F.2d 1367, 1370-
98
Searching and Seizing Computers
71 (10th Cir. 1990). Cf. Ramsden v. United States, 2 F.3d 322, 325 (9th Cir.
1993) (articulating four-factor jurisdictional test from pre-1989 version of
Rule 41(g)). If the movant established these elements, the court will move
to the merits of the claim. On the merits, seized property will be returned
only if the government’s continued possession is unreasonable. See Ramsden, 2
F.3d at 326. Tis test requires the court to weigh the government’s interest in
continued possession of the property with the owner’s interest in the property’s
return. See United States v. Premises Known as 608 Taylor Ave., 584 F.2d 1297,
1304 (3d Cir. 1978). In particular,
If the United States has a need for the property in an investigation
or prosecution, its retention of the property generally is
reasonable. But, if the United States’ legitimate interests can be
satisfied even if the property is returned, continued retention
of the property would be unreasonable.
Advisory Committee Notes to the 1989 Amendment of Rule 41(g) (quoted
in Ramsden, 2 F.3d at 326); see also In re Search of Law Office, 341 F.3d 404,
413-14 (5th Cir. 2003) (“Rule 41(e) does not permit a district court to order
complete suppression of seized evidence absent, at the very least, a substantial
showing of irreparable harm”).
Motions requesting the return of properly seized computer equipment
succeed only rarely. First, courts will usually decline to exercise jurisdiction
over the motion if the government has offered the property owner an electronic
copy of the seized computer files. See, e.g., In re Search of 5444 Westheimer
Road, 2006 WL 1881370, at *2 (S.D. Tex. Jul. 6, 2006) (declining to
exercise jurisdiction over a claim for pre-indictment return of property when
government had provided copies of seized computer data); In re Search Warrant
Executed February 1, 1995, 1995 WL 406276, at *2 (S.D.N.Y. Jul. 7, 1995)
(concluding that owner of seized laptop computer did not show irreparable
harm where government offered to allow owner to copy files it contained);
United States v. East Side Ophthalmology, 1996 WL 384891, at *4 (S.D.N.Y.
Jul. 9, 1996). See also Standard Drywall, Inc. v. United States, 668 F.2d 156,
157 n.2. (2d Cir. 1982) (“We seriously question whether, in the absence of
seizure of some unique property or privileged documents, a party could ever
demonstrate irreparable harm [justifying jurisdiction] when the Government
either provides the party with copies of the items seized or returns the originals
to the party and presents the copies to the jury.”).
2. With a Warrant
99
Second, courts that reach the merits generally find that the government’s
interest in the computer equipment outweighs the defendant’s so long as a
criminal prosecution or forfeiture proceeding is in the works. See United States
v. Stowe, 1996 WL 467238, at *1-3 (N.D. Ill. Aug. 15, 1996) (continued
retention of computer equipment is reasonable after
18 months where
government claimed that investigation was ongoing and defendant failed to
articulate convincing reason for the equipment’s return); In the Matter of Search
Warrant for K-Sports Imports, Inc., 163 F.R.D. 594, 597 (C.D. Cal. 1995)
(denying motion for return of computer records relating to pending forfeiture
proceedings); see also Johnson v. United States, 971 F. Supp. 862, 868 (D.N.J.
1997) (denying Rule 41(e) motion to return bank’s computer tapes because
bank was no longer an operating business). If the government does not plan to
use the computers in further proceedings, however, the computer equipment
must be returned. See United States v. Moore, 188 F.3d 516, 1999 WL 650568,
at
*6 (9th Cir. Aug. 25, 1999) (ordering return of computer where “the
government’s need for retention of the computer for use in another proceeding
now appears . . . remote”); K-Sports Imports, Inc., 163 F.R.D. at 597. Further,
a court may grant a Rule 41(g) motion if the defendant cannot operate his
business without the seized computer equipment and the government can work
equally well from a copy of the seized files. See United States v. Bryant, 1995
WL 555700, at *3 (S.D.N.Y. Sept. 18, 1995) (referring to magistrate judge’s
prior unpublished ruling ordering the return of computer equipment, and
stating that “the Magistrate Judge found that defendant needed this machinery
to operate his business”).
F. Legal Limitations on the Use of Search Warrants to
Search Computers
In general, so long as the proper procedures are followed, the government
may execute a search warrant against any individual—including individuals
not themselves suspected of crimes—if there is probable cause to believe that
the search will reveal contraband or evidence of a crime. See Zurcher v. Stanford
Daily, 436 U.S. 547 (1978); Warden v. Hayden, 387 U.S. 294, 309 (1967).
Yet in a few circumstances, Congress and the Attorney General have limited
the situations in which criminal investigators can use search warrants to obtain
evidence. Tree of these limitations apply with special force to the field of
computer searches.
100
Searching and Seizing Computers
|
||
|
|
|