Drake Law Review
2000
Articles
THE SEARCH AND
SEIZURE OF COMPUTERS: ARE WE SACRIFICING PERSONAL
PRIVACY FOR THE
ADVANCEMENT OF TECHNOLOGY?
Stephan K. Bayens
[FNa1]
Copyright © 2000 Drake University; Stephan K. Bayens
New technologies should lead us to look
more closely at just what values the Constitution seeks to preserve.--Laurence
H. Tribe, The Constitution in Cyberspace [FN1]
I. Introduction
It
is amazing how such simple statements can embody such overwhelming notions and
concepts. The Fourth Amendment states quite simply that people have the right "to be secure in their persons,
houses, papers, and effects, against unreasonable searches and seizures . . .
." [FN2] Despite its
simplicity, this statement continues to protect an ever-advancing society from
the oppressive nature of the state. The Fourth Amendment's simplicity and
flexibility has permitted the judiciary to shape and mold its prescriptions
into a timeless document. The timeless nature of the Fourth Amendment, however,
faces a serious challenge in present-day society technology. The Fourth
Amendment has, throughout its history, not only faced technological advancement
but has met technological challenges head on. The Fourth Amendment now faces
its newest technological foe-computer systems.
This Article examines the Fourth Amendment's current ability to protect
individual privacy from the rapid evolution of computer technology. Computer
technology is a worthy challenger given its unique idiosyncrasies. This Article
seeks first to address those idiosyncrasies inherent in computer technology and
then to examine the Fourth Amendment's ability to provide adequate protections in
this new computer-based world.
Part II of this Article examines the Fourth Amendment's touchstone "reasonable expectation of
privacy" standard and its current application in various computer-based
settings. Part III analyzes the Fourth Amendment's particularity requirements
with regard to computers. Finally, Part IV looks at statutory provisions
created especially to address problems unique to computer- based communications.
II. Technology
and the Fourth Amendment: Unequal Risings?
In
order for the protections of the Fourth Amendment to cloak the individual from
intrusive government searches and seizures, a judicially construed threshold
must first be crossed. The United States Supreme Court in Katz v. United States
[FN3] ruled the
constitutional protections embodied in the Fourth Amendment are only triggered
upon the showing of a reasonable expectation of privacy. [FN4] Justice Harlan,
in concurring with the majority, created a two-pronged test designed to
objectively quantify this seemingly amorphous standard. [FN5] The Court
subsequently adopted this test in examining all potential Fourth Amendment
cases. [FN6] The first prong
requires "[t]he person must have had an actual or subjective expectation
of privacy." [FN7] The second prong
demands that this subjective "expectation be one that society is prepared
to recognize as 'reasonable."'[FN8] If a court determines either of
these prerequisites are lacking, the Fourth Amendment is not triggered, and the
government may search and seize without a warrant even the most rudimentary
showing of reasonable suspicion is unnecessary. [FN9] The
"reasonable expectation of privacy" test is a flexible one because it
is dependent upon current societal expectations as to what is reasonable. [FN10] However, the
test is becoming increasingly more difficult
to apply consistently given the rapid advancements in technology. [FN11] As technology
evolves so do societal expectations of reasonableness. But is the traditional
Katz formula flexible enough to evolve along side both technology and our
societal expectations?
A. The Reasonable
Expectation of Privacy Formula and Employee Computers
In
assessing an employee's expectation of privacy in the workplace, it is important
to distinguish between government employers and private employers. The
distinction is important because in order to trigger the Fourth Amendment the
search or seizure must be by a government or state actor. [FN12] Private
employers are not bound by the constraints of the Fourth Amendment [FN13] unless their
actions were at the behest of government officials. [FN14] Given this
important distinction, an initial examination regarding areas of Fourth
Amendment jurisprudence that apply to both the government workplace and the
private workplace is necessary. Only then can the unique government workplace
settings be addressed.
1. The Government Workplace and the Private
Workplace: Common Threads
A
number of initial hurdles must be cleared in asserting a reasonable expectation
of privacy in data stored on an employee's work computer. These initial hurdles
deal with the numerous exceptions courts have carved out of the sweeping language of the Fourth Amendment.
Although there are numerous exceptions to the Fourth Amendment, the plain view
doctrine and consent are particularly relevant in the area of employee
computers.
a.
The Plain View Doctrine. The plain view doctrine allows for seizure of evidence
without a warrant if an officer is "in a lawful position to observe the
evidence, and its incriminating" nature is immediately apparent. [FN15] Justice Harlan,
in his Katz concurrence, succinctly expressed the rationale behind the plain
view doctrine stating, "objects, activities or statements that [one]
exposes to the 'plain view' of outsiders are not 'protected' because no
intention to keep them to [one]self has been exhibited." [FN16] In the computer
context, e-mail or other electronic messaging that require no password for
access and are open to all employees, as well as personal data stored on a work
computer, may be subject to the plain view doctrine. [FN17] The plain view
doctrine would likely apply in these circumstances because no reasonable
expectation of privacy could be asserted when such a high number of employees
would have accessto the messages sent.
In reality, however, this particular situation is fairly rare. The
majority of workplaces provide their employees with individual passwords in
order to ensure some semblance of privacy in e-mail transmissions. [FN18] Password-based
access restriction would take e-mail and other electronic communications out of
the purview of the plain view doctrine, as third-party access to the
transmitted material would be practically
nonexistent. [FN19]
The
other specific factual situation where the plain view doctrine may apply is
"through a process of 'timesharing' in which multiple users share
concurrently the resources of a single computer system." [FN20] Like e-mail
messaging if the use of the timeshared computer or network is not apportioned
off by the use of passwords, the computer data is likely subject to the plain
view doctrine. [FN21] This is
especially true if the data is saved to a communal hard drive networked
throughout the business or organization. [FN22] Similar to the
above discussion of e-mail, if individualized passwords are used to gain access
to specific material saved by that user, and other employees could not access
that material, the material would likely be taken out of the purview of the
plain view doctrine. [FN23] It should additionally be noted
that Fourth Amendment protections are not based solely on possessory interests
in the items searched and seized. [FN24] Thus, although users of multi-user
computer systems "do not own the hardware, they nevertheless maintain an
expectation of privacy in the information stored on the system" [FN25] as long as
appropriate privacy safeguards are in place. [FN26]
Therefore, in the majority of workplace situations the employee may
safely store data on a work computer without fear the plain view doctrine will
strip him of his constitutional rights under the Fourth Amendment. Employees should, however, inquire as to: (1) the
individual password restrictions instituted by the company or government
agency; (2) the appropriate place to save and store data to limit access; and
(3) the number of employees that have unrestricted access to all employee
computers regardless of password protections.
b.
The Consent Exception. The consent exception to the Fourth Amendment is
implicated more deeply in the workplace than in the limited factual situations
discussed above concerning plain view. [FN27] The consent of "one who
possesses common authority over premises or effects is valid as against the
absent, nonconsenting person with whom the authority is shared." [FN28] Thus, if several people own or use
a particular computer, any one of those people could possibly grant consent to
search the "common area" of the computer. [FN29]
The
greatest obstacle, however, in the consent area deals with the growing number
of explicit workplace policies stating Internet use and e-mail transmissions
may be monitored. [FN30] Accepting or continuing employment
with a company or governmental agency that has instituted such a policy may
operate as employee consent and could bar application of Fourth Amendment
protections. [FN31] Initially, this
possibility was just a theory among scholars. [FN32] A federal district court, however,
recently removed this from the theoretical plane and placed it in established
case law. [FN33]
In United States v. Simons, [FN34] defendant Mark
Simons was employed with the Foreign Bureau of Information Services (FBIS), a
division of the Central Intelligence Agency (CIA), as an electronic engineer. [FN35] The Systems
Operation Center Manager, who manages the computer network for FBIS, was
investigating the capabilities of a new system placed on the FBIS network that
logged all computer traffic going outside the network. [FN36] A component of
this program allowed the systems manager to do a keyword search of the logged
material. [FN37] The systems
manager, attempting to discover if the new program could unearth inappropriate
Internet usage, ran the keyword "sex." [FN38] A significant
number of responses were traced back to a particular workstation, later
determined to belong to the defendant. [FN39] The search results indicated that
the accessed Internet sites appeared to be pornographic in nature, and the
frequency with which these sites were accessed dispelled any possibility of
accidental activity. [FN40] Upon direction of his supervisor,
the systems manager verified the sites were pornographic, accessed defendant's
computer through the network and discovered over 1,000 downloaded graphic files
containing pornographic material. [FN41] The systems manager copied
defendant's hard drive via the network. [FN42] This copy was then handed over to
the special investigation unit of the CIA where it was discovered that a number
of the downloaded graphic files depicted child pornography. [FN43] A special agent
obtained a search warrant permitting the agent
to copy defendant's hard drive, floppy disks, documents concerning screen
names, and personal correspondence. [FN44]
Simons claimed the searches were conducted in violation of the Fourth
Amendment and therefore, all evidence should be suppressed. [FN45] In denying
defendant's motion to suppress, the court relied heavily on the FBIS's official
policy regarding computer use. [FN46] In light of this specific policy,
the court ruled defendant had no reasonable expectation of privacy regarding
his Internet usage. [FN47] "The Court [gave] significant
weight to the portion of the policy stating that audits shall be implemented to
support identification, termination and prosecution of unauthorized activity.
The Court also [gave] weight to the part [of the policy] providing that audits
would be capable of recording web sites visited." [FN48] Based on the
ruling of the Simons court many workers may now "be expected to consent to
monitoring if they decide that earning a livelihood is more important than
enjoying privacy protections in the workplace." [FN49] Although this is
a troubling conclusion, governmental employees may at least have some degree of
protection from this practice. [FN50]
2. Issues Unique to the Government Workplace
Given the Fourth Amendment's applicability to searches by government
employers, the Supreme Court created an exception to the Fourth Amendment designed to ensure the government's ability to
properly and effectively supervise, control, and run the government workplace. [FN51] If the Court had
not created such an exception, a government supervisor would have to obtain a
valid search warrant every time she searched an employee's workstation for a
missing file. [FN52] Thus, in
O'Connor v. Ortega, [FN53] the Court ruled two types of
workplace searches were exempt from the auspices of the Fourth Amendment: (1) a
non-investigatory, work-related intrusion and (2) an investigation into
work-related employee misfeasance. [FN54]
The
Court, however, did not intend to institute a carte blanche rule permitting the
warrantless search of all items in an employee's workstation. Personal items,
such as a handbag or brief case, were explicitly excluded from those items an
employer could search. [FN55] This exclusion of personal items
from workplace searches presents an interesting dilemma in regard to items that
could conceivably serve a dual purpose, like a floppy disk. [FN56] A floppy disk has the capability of
being either an integral part of the workplace or an extremely personal
container of intimate thoughts. Courts, however, will likely find it reasonable
to assume that floppy disks located at the workplace fall within the workplace
context, thus resolving the amorphous nature of a computer disk. [FN57]
In
theory at least, government employees receive greater constitutional
protections against workplace searches and seizures of their computers than their private sector counterparts. Yet, given
the workplace exception carved out in O'Connor [FN58] and the apparent
assumption that items capable of storing electronic data immediately fall in
the workplace context, [FN59] these additional protections are
limited.
B. The Reasonable
Expectation of Privacy Standard and the Internet
"The Internet is not a physical or tangible entity, but rather a
giant network which interconnects innumerable smaller groups of linked computer
networks." [FN60] The Internet is
an overwhelming mass of information that has no centralized administrator,
storage location, or control point. [FN61] "It exists
and functions as a result of the fact that hundreds of thousands of separate
operators of computers and computer networks independently decided to use
common data transfer protocols to exchange communications and information with
other computers (which in turn exchange communications and information with
still other computers)." [FN62] By the close of 1999, an estimated
200 million people will be using the Internet. [FN63] Many methods can
be used in communicating on the Internet. Those that best contemplate Fourth
Amendment protections are real time communications (chat rooms) and one-to-one
messaging (e-mail). [FN64]
1. Chat away . . . the Government Is
Listening
The use of-real time communication on the
Internet permits the computer user to engage in instantaneous dialog with
another person or an entire group of people. [FN65] These real time communications
"allow[ ] two or more [people] to type messages to each other that almost
immediately appear on the others' computer screens." [FN66] Those wishing to
discuss similar topics of interest can utilize "chat rooms," which
are electronic meeting places that allow people with a mutual interest to
electronically discuss a chosen topic. [FN67] The range of
subjects is innumerable, and new chat rooms are created daily. [FN68]
In
order to assert the protections of the Fourth Amendment in electronic dialogs,
participants would have to demonstrate a subjective expectation of privacy that
society is prepared to recognize as reasonable. The primary difficulty in
asserting the Fourth Amendment in a chat room setting is the previously
discussed plain view exception. [FN69] In a public chat room, it would be
difficult to claim a reasonable expectation of privacy as the contents of the
discussion are open for all in the chat room to read. [FN70] An Ohio federal
district court squarely addressed this issue in United States v. Charbonneau. [FN71]
In
Charbonneau, an agent with the FBI began perusing various chat rooms posing as
a pedophile. [FN72] The agent
operated primarily in private chat rooms titled "BOYS" and
"PRETEEN." [FN73] The agent did not actively engage in conversation with the other
members of the chat room; rather he passively observed and recorded the dialog
between members. [FN74] Child
pornography was often exchanged by using information gained during these
electronic communications. [FN75] The agent identified one of those
involved in the distribution of the child pornography by his screen name. [FN76] The agent then
obtained defendant's true identity through the use of a search warrant. [FN77] Defendant sought
suppression of the statements he made while in the chat room as well as the
e-mail messages he sent to other users. [FN78]
The
court, in denying defendant's motion to suppress, ruled when defendant engaged
in chat room conversations, he essentially assumed the risk that one of his
fellow users could possibly be a law enforcement official. [FN79] The court further ruled defendant could not
have a reasonable expectation of privacy because he was aware of the operating
procedures in the chat room and continued to use the chat room despite its open
nature. [FN80] Thus, there is
no recognizable expectation of privacy in publicly accessible chat rooms.
2. E-mail: Akin to Telephone Calls and First
Class Mail?
E-mailing someone is essentially the same as sending someone a written
letter, except that the written letter has been reduced to electronic form and
sent to the recipient's e-mail address. [FN81] This electronic letter can be sent to one person or a host of
different people by simply including the e-mail addresses of the additional
people. [FN82] Any particular
message can be forwarded to another person by adding the appropriate address. [FN83] "The message
then crosses the Internet, moving from node to node until it reaches its
destinations." [FN84] In attempting to apply the
reasonable expectation of privacy standard to this relatively new form of
communication, courts analogize e-mail to other forms of communication. [FN85] In United States v. Maxwell, [FN86] the United
States Court of Appeals for the Armed Forces likened e-mail to both first class
mail and telephone calls. [FN87]
In
Maxwell, FBI agents received several e-mails and graphic files discussing and
depicting child pornography from a concerned citizen, along with the screen
names of the users that sent the messages and material. [FN88] Based on this
information, the agent sought a search warrant permitting him to unearth the
true identity of the users by obtaining the master list of users and screen
names from the Internet service provider. [FN89] Upon discovering the true identity
of those involved, agents discovered the defendant was in the Air Force. [FN90] The Air Force
Office of Special Investigations sought a warrant to search the defendant's
quarters. [FN91] A number of
graphic files depicting child pornography were located on his computer. [FN92] He subsequently
sought suppression of all physical evidence recovered during the various searches. [FN93]
The
court, in addressing whether the defendant could properly litigate the issue,
ruled e-mail was similar to first class mail in that "if a sender of
first-class mail seals an envelope and addresses it to another person, the
sender can reasonably expect the contents to remain private and free from the
eyes of the police absent a search warrant founded upon probable cause." [FN94] The court additionally ruled e-mail
maintained some qualities of telephone calls as "the maker of a telephone
call has a reasonable expectation that police officials will not intercept and
listen to the conversation." [FN95] Relying on these parallels, the
court found "the transmitter of an e-mail message enjoys a reasonable
expectation that police officials will not intercept the transmission." [FN96] The court, however,
proceeded to narrowly define its ruling by stating "once the [e-mail] is
received and opened, the destiny of the letter then lies in the control of the
recipient of the letter, not the sender, absent some legal privilege." [FN97] The court further narrowed its
holding stating:
Expectations of privacy in e-mail transmissions depend in large part on
the type of e-mail involved and the intended recipient . . . . [E]-mail that is
"forwarded" from correspondent to correspondent lose[s] any semblance
of privacy. Once these transmissions are sent out to more and more subscribers,
the subsequent expectation of privacy incrementally diminishes. [FN98]
The court, in addressing the government's
claim defendant disclosed the information to the Internet service provider
thereby eliminating the protections of the Fourth Amendment, denoted that
although the service provider would always have ultimate access to messages
stored on its computers, it was in a radically different position. [FN99] To use the mail
and telephone analogy, "[t]he post office cannot indiscriminately
intercept the letters it transmits, and neither may the telephone company
routinely eavesdrop on the conversations occurring on its lines." [FN100] Thus, defendant
was permitted to litigate the issue because he had a reasonable expectation of
privacy in the e-mail messages, despite the service provider's ability to
access the contents of any particular message. [FN101]
The
Charbonneau court, relying on the narrowing factors in Maxwell, ruled not only
did defendant's chat room conversations lack Fourth Amendment protection, but
his e-mail messages sent to others in the chat room and the e-mail sent or
forwarded to the undercover agents also lacked Fourth Amendment protection. [FN102] Defendant lacked a reasonable
expectation of privacy in the e-mail sent to other members of the chat room
because his privacy interests exponentially diminished based on his forwarding
of messages from correspondent to correspondent. [FN103] Furthermore,
defendant bore the risk that one of his fellow users in the chat room could
possibly be a law enforcement official. [FN104] Thus, those items actually
forwarded or sent to the officers had no
Fourth Amendment protection. [FN105] Subject to certain restrictions,
courts are willing to recognize a reasonable expectation of privacy in e-mail. [FN106] Yet, that
recognition can be quickly dashed once the recipient accesses the e-mail or if
it is forwarded to a relatively large number of people.
C. Not Only Will
They Fix Your Computer, but They'll Fix Your Wagon As Well
The
Fourth Amendment to the Constitution provides citizens shall be free from
unreasonable searches and seizures by the government. [FN107] The Fourth
Amendment, however, "is wholly inapplicable to a search or seizure, even
an unreasonable one, effected by a private individual not acting as an agent of
the Government or with the participation or knowledge of any governmental
official." [FN108] In determining
whether a private party is acting as an agent of the government, courts apply a
two-pronged test. [FN109] First the court must examine
whether "the [g]overnment knew of or acquiesced in the intrusive conduct.
. . ." [FN110] The court must
then decide whether "the private party's purpose for conducting the search
was to assist law enforcement efforts or further his own ends." [FN111] Searches by
private parties in the computer arena normally occur when computer technicians
inadvertently stumble upon illegal material when servicing a computer. [FN112] The conversion from a private party
to an agent of the government is difficult
to ascertain and must be determined ad hoc. [FN113]
In
United States v. Hall, [FN114] the defendant took the central
processing unit of his computer to a local computer store for repairs. [FN115] A computer technician, in order to
diagnose the particular problem with the unit, accessed a number of file
directories. [FN116] In viewing these
directories, the technician observed a number of files with sexually explicit
titles. [FN117] The technician
opened these files and discovered what he believed to be child pornography. [FN118] The employee
immediately contacted local law enforcement officers who instructed him to make
copies of the material. [FN119] Agents eventually procured a search
warrant relying solely on the technician's affidavit; at no time did the agents
review the copied material. [FN120] The search of defendant's computer
and home revealed numerous graphic images of child pornography. [FN121] Defendant moved
to suppress the evidence claiming an agent of the government made the discovery
of the images. [FN122]
The
Seventh Circuit denied defendant's motion ruling the technician's search was
pursuant to the maintenance work performed and not at the behest of the
government. [FN123] The court ruled
neither of the private-actor conversion prongs were satisfied. [FN124] First, the
government agents had no knowledge of the intrusive action, and second, the
purpose of the intrusion was not to unearth evidence of a crime but to complete
the normal course of the repair shop's
business. [FN125] The government
would not concede that the subsequent copying of the files at the behest of the
agents converted the technician into a government agent. [FN126] However the
court ruled the affidavits in support of the warrant did not rely on the
unreasonable search to establish probable cause. [FN127] Thus, the copied
images were independently discovered through proper channels. [FN128]
Similarly, in United States v. Barth, [FN129] the defendant, owner of his own
accounting firm, was experiencing difficulties with his office computer and
called in a computer technician to alleviate the problem. [FN130] The technician while searching for
viruses by opening various files, discovered computer images of child
pornography. [FN131] The technician,
a confidential informant for the FBI, contacted an agent and was instructed to
copy the contents of the hard drive. [FN132] The following day local law
enforcement agents, without a warrant, reviewed the contents of defendant's
hard drive. [FN133] Based solely on
an affidavit detailing the technician's initial discovery, a state magistrate
issued a warrant to search defendant's hard drive. [FN134] A forensic
computer analyst was brought in to conduct the search. [FN135] Before the
search began, however, the analyst was briefed about the contents of the
computer and its various systemic processes. [FN136] The analyst
discovered further pornographic images and defendant sought suppression of the
images due to an unreasonable search and seizure
under the Fourth Amendment. [FN137]
The
court, in granting defendant's motion to suppress, ruled the initial discovery
by the technician constituted a search by a private party. [FN138] The court found
"no evidence that [the technician] intended to assist law enforcement
officers when he initially viewed the image." [FN139] The technician's
status, however, quickly changed. [FN140] As soon as the technician contacted
the FBI, the government knew that a reliable confidential informant was in
possession of a computer containing contraband, and thus, the government
acquiesced to all further conduct by the technician. [FN141]
Unlike the court in Hall, the court found the independent source
doctrine was not implicated. [FN142] Although the application for the
warrant contained only information gained by the technician's initial
discovery, the forensic computer analyst who conducted the search received
information from the officers as to the computer's contents and operating
system. [FN143] The court ruled
"[b]ecause [the forensic computer analyst] was aware of and used the
information obtained by the [officers] in their initial unlawful search, [[the
analyst's] search pursuant to warrant was not a 'genuinely independent source
of information and evidence."' [FN144] The court found no merit in all
other asserted exceptions and granted defendant's motion to suppress. [FN145]
As
the above cases demonstrate, private computer owners as well as business owners need to be aware of the
substantial risk in seeking computer assistance. The vast majority of computer
related problems could only be properly diagnosed and repaired by actually
accessing specific files or file directories on the computer. Thus, the
likelihood that inappropriate material will be discovered is substantial. Given
this likelihood, it is no surprise that private computer technicians are
rapidly becoming confidential informants for various law enforcement agencies. [FN146] Due to the
growing number of these "dual purpose" technicians and the public's
absolute reliance on these technicians for computer assistance, the analysis
for when a private individual is converted into a government actor may need to
be modified to protect privacy interests.
D. Third-Party
Consent and Home Computer Systems
The
in-home single system computer user, although free from the prying eyes of her
employer who owns and maintains her workplace computer system, must still be
wary of exceptions to the Fourth Amendment. One of the most common exceptions
applicable to the private computer user is third-party consent. [FN147] Government officials may search
premises or effects without a warrant or probable cause if a person with the
proper authority has voluntarily granted consent. [FN148] The Supreme
Court in United States v. Matlock [FN149] expounded upon
the traditional notion of consent by ruling officers may obtain voluntary consent "from a third
party who possessed common authority over or other sufficient relationship to
the premises or effects sought to be inspected." [FN150]
Common authority is . . . not to be implied from the mere property
interest a third party has in the property. The authority which justifies the
third- party consent does not rest upon the law of property, with its attendant
historical and legal refinements, but rests rather on mutual use of the property
by persons generally having joint access or control for most purposes . . . . [FN151]
In
examining third-party consent under a single computer system, [FN152] it is important to
note that normally "[t]here are no formal restrictions as to privacy,
although if more than one person uses the system, there may be an informal
respect for each other's private files." [FN153] A third party's
ability to consent to the search of a home computer will depend heavily upon
the steps taken to define mutually exclusive zones of privacy. [FN154] "From this,
it might be asserted that the aforementioned 'informal respect' counts for
something here, to which might be added the contention that this understanding
between family members takes on greater significance in light of the especially
private nature of information likely to be found in computer files." [FN155] A United States
district court in Illinois, however, did not find this argument convincing. [FN156]
In United States v. Smith, [FN157] the defendant's
live-in girlfriend granted officers voluntary consent to search the computer
located in their master bedroom. [FN158] Officers accessed the computer,
which was not password protected, and discovered numerous graphic files containing
child pornography. [FN159] At the suppression hearing,
defendant's girlfriend testified her youngest daughter would occasionally use
the computer, the location of the computer was open to the remainder of the
house, and defendant had previously attempted to show her how to use the
computer. [FN160] Defendant
countered by testifying that immediately prior to the search "he had
removed the passwords from the hardware but had kept the passwords in place on
the software." [FN161]
The
court, in denying defendant's motion to suppress, found defendant's girlfriend
had the requisite actual authority to consent to the search of the computer. [FN162] In addition to
the claims of the girlfriend, the court relied heavily on the fact that
officers were not hindered in their search due to protective passwords guarding
the system. [FN163] The court found
this fact belying of defendant's claim he maintained exclusive and possessory
control over the computer. [FN164] Given the court's emphasis on
password protections, however, it is highly probable that the use of protective
passwords could eliminate or at least narrow the scope of consent given by
third parties. [FN165]
III. The Fourth
Amendment's Particularity Requirements and Computers
The
Fourth Amendment to the United States Constitution demands all warrants
particularly describe the place to be searched and the items to be seized. [FN166] Throughout
history, application of the particularity requirements has been fairly straightforward
due to the obvious physical constraints of society. "But computers create
a 'virtual' world where data exists 'in effect or essence though not in actual
fact or form."' [FN167]
A. Describing the
Place to Be Searched
The
Fourth Amendment's particularity requirement with regard to the place to be
searched as well as Federal Rule of Criminal Procedure 41(a) [FN168] are ill prepared
to deal with this new virtual world. Specifically, Federal Rule of Criminal Procedure 41(a) provides that
"a search warrant . . . may be issued . . . by a federal magistrate, or a
state court of record within the federal district, for a search of property or
for a person . . . within the district . . . ." [FN169] The difficulty
lies in a networked computer system where the actual material sought might be
on a file server in a different "office, building, district, state, or
even country." [FN170] This dilemma is even more troubling
because law enforcement officials are currently only guided by way of analogy
to similar problems involving the wiretapping of
phones. [FN171] In these network
scenarios, there are essentially two variations: (1) law enforcement knows the
material is located in a place other than the one described in the warrant, and
(2) the file server, unbeknownst to the government, is located outside the
district. [FN172]
In
a situation where the government knows the location of the information is in a
different place than the warrant describes, The Federal Guidelines for
Searching Computers encourages law enforcement officials to simply seek an
additional warrant describing the other location. [FN173] This may entail
going to another federal district, despite its distance, or even coordinating
with their foreign law enforcement counterparts. [FN174] If officers
believe the information is on a file server located in some anonymous place,
The Federal Guidelines for Searching Computers instructs officers to be candid
with the issuing judge concerning their belief. [FN175] Officers should
support their candid claim by pointing to specific efforts aimed at uncovering
the true source of the data. [FN176] The officers should also attempt to
demonstrate a clear relationship between the computer they wish to search and
an additional file server located elsewhere. [FN177] If, however, the
executing agency fails to obtain the necessary safeguard of an additional
warrant or fails to be candid with the issuing judge or magistrate, its
warrantless intrusion of a file server located elsewhere may still be permitted
in limited circumstances. [FN178]
In United States v. Judd, [FN179] officers
executed a search warrant on the office suite of the defendant's business. [FN180] The warrant
precisely described by number a particular office suite but officers failed to
locate the items prescribed in the warrant. [FN181] Officers questioned the defendant,
and he indicated the items sought were located in the company's bookkeeping
suite next door. [FN182] Without a warrant, the officers
went to the bookkeeping suite and seized the specified documents. [FN183] The court ruled
that both suites were offices of the same business, officers reasonably
misunderstood the floor plan of the corporate offices, and the warrant
authorized a search of the entire corporate office. [FN184] The court,
therefore, permitted the warrantless search of the second suite. [FN185] Thus, by analogy if the file server
containing the information sought was located in the same set of corporate
offices, a court may allow the warrant to cover the search of both places. [FN186]
In
the second networked scenario, the file server is unknowingly located outside
the district where the warrant is issued. In this situation, the true virtual
nature of networked systems becomes apparent. For example, if officers were
forced to access a file server outside the district to obtain authorized data, the
officers would technically still be physically present in the issuing district.
Yet, it could also be argued the officers essentially made a virtual leap into
the other district via the computer network. This example truly exposes the limits of a physically-based rule.
In attempting to resolve this quandary, however,courts may turn to a similar
issue involving federal wiretap statutes. [FN187] Similar to the district limitation
in Federal Rule of Criminal Procedure 41(a), 18 U.S.C.
§ 2518(3) permits a judge
to enter an order "authorizing or approving interception of wire, oral, or
electronic communications within the territorial jurisdiction of the court in
which the judge is sitting . . . ." [FN188] Given this definitional similarity,
cases involving the location of wiretaps outside the issuing judge's district
may prove useful in making an inferential leap to computer networks.
With regard to the interception of communications by wiretap, the United States Court of Appeals for the Second Circuit ruled a wiretap occurs in two locations simultaneously. [FN189] The wiretap occurs at the place where the tapped phone is located and at the place where the communication is first heard by law enforcement. [FN190] The court reached this conclusion by turning to the statute's definition of interception. [FN191] Section 2510(4) defines interception as "the aural or other acquisition of the contents of any . . . communication . . . ." [FN192] The court reasoned that because the definition included "'aural' acquisition of the contents of the communication, the interception must also be considered to occur at the place where the redirected contents are first heard." [FN193] Thus, the court ruled that although the wiretap was issued in the Southern District of New York, the tapped phone was located in New Jersey, and the officers were redirecting the tapped phone back to New York for interception; the district court had jurisdiction to authorize the wiretap. [FN194]