The Fourth Amendment in Cyber Space

1
The Fourth Amendment in Cyber Space

• Sean B. Hoar
• 541-465-6792 (voice)
• 541-465-6840 (fax)
• sean.hoar_at_usdoj.gov

2
Text of the Fourth Amendment

• The right of the people to be secure in their
  persons, houses, papers, and effects, against
  unreasonable searches and seizures, shall not be
  violated, and no Warrants shall issue, but upon
  probable cause, supported by Oath or affirmation,
  and particularly describing the place to be
  searched, and the persons or things to be
  seized.

3
When does a search occur under the Fourth
Amendment?

• A search occurs when the government infringes
  upon a legitimate expectation of privacy
  
• The two part test
• 1. A person must have an actual subjective
  expectation of privacy
  
• 2. Society must be prepared to recognize that
  expectation as reasonable

4
When does a search occur under the Fourth
Amendment?

• What a person knowingly exposes to the public,
  even in his home or office, is not protected by
  the Fourth Amendment

5
Olmstead v. United States, 277 U.S. 438, 48
S.Ct. 564 (1928)

• Facts Wire taps used in an investigation of a
  conspiracy to violate the National Prohibition
  Act (in the Great Northwest!!)
  
• Law First case to apply the Fourth Amendment to
  the act of wire tapping.
  
• No search or seizure occurred.
• Search must be of material things the person,
  the house, papers, or effects
  
• Conversation is not within ambit of Fourth
  Amendment
  
• Admissibility of evidence determined by
  common-law rule not affected by means by which
  acquired
  
• What can be learned from the dissent?

6
A prescient dissent

• The greatest dangers to liberty lurk in
  insidious encroachment by men of zeal,
  well-meaning but without understanding. Quoted
  from Olmstead v. United States, 277 U.S. 438,
  479, 48 S.Ct. 564, 573 (1928) (Brandeis, J.).

7
Berger v. New York, 388 U.S. 41, 87 S.Ct. 1873
(1967)

• Facts Wire taps used to investigate conspiracy
  to bribe Chairman of New York State Liquor
  Authority
  
• Law Conversation within ambit of Fourth
  Amendment protection
  
• Use of electronic devices to capture conversation
  is a search
  
• Warrant supported by probable cause particularly
  describing place to be searched, and things to be
  seized must leave nothing to discretion of
  officer executing warrant

8
Berger v. New York, 388 U.S. 41, 87 S.Ct. 1873
(1967)

• Facts Wire taps used to investigate conspiracy
  to bribe Chairman of New York State Liquor
  Authority
  
• Law Conversation within ambit of Fourth
  Amendment protection
  
• Fourth Amendments right of privacy is
  enforceable against the States through the Due
  Process Clause of the Fourteenth Amendment
  
• Need for Fourth Amendments protections is
  especially great in the case of electronic
  eavesdropping

9
Katz v. United States, 389 U.S. 347, 88 S.Ct.
507 (1967)

• Facts Electronic listening device attached to
  exterior of phone booth was used to listen to
  conversation of suspect in illegal wagering case
  
• Law Conversation to which one has a reasonable
  expectation of privacy is protected by the Fourth
  Amendment
  
• trespass doctrine no longer controls, i.e. the
  lack of physical intrusion has no constitutional
  significance

10
Reasonableness under the Fourth Amendment
Lessons from Katz

• Government agents must obtain judicial
  authorization prior to search
  
• Judicial authorization must be through detached
  scrutiny of a neutral magistrate
  
• Judicial authorization must be obtained through
  showing of probable cause
  
• There must be precise limits on the search
• An accounting of items seized must be made
  subsequent to the search.

11
Kyllo v. United States, 533 U.S. 27, 1215 S.Ct.
2038 (2001)

• Facts Thermal imaging used in investigation of
  marijuana manufacturing (in Florence, Oregon
  can you believe it?!)
  
• Law Where government uses device that is not in
  general public use, to explore details of a
  private home that would previously have not been
  known without physical intrusion, the
  surveillance is a search

12
The Fourth Amendments expectation of privacy in
computer cases

• Computers as Storage Devices
• Generally, there is a reasonable expectation of
  privacy in closed containers, and, therefore, in
  the data stored in electronic devices
  
• Expectation of privacy in information from a
  computer is lost, however, when it is openly
  available

13
The Fourth Amendments expectation of privacy in
computer cases

• Third-party possession
• Reasonable expectation of privacy in stored
  electronic information may be lost when control
  is relinquished to third parties
  
• In third-party possession cases, distinguish
  between possession by a carrier in the course of
  transmission to an intended recipient, and
  subsequent possession by the intended recipient
  
• During transmission, contents generally retain
  Fourth Amendment protection. Government intrusion
  and examination of contents ordinarily violates
  the reasonable expectation of privacy of both the
  sender and receiver

14
The Fourth Amendments expectation of privacy in
computer cases

• Third-party possession
• Once an item has been received by the intended
  recipient, the senders reasonable expectation of
  privacy generally depends upon whether the sender
  can reasonably expect to retain control over the
  item and its contents.
• When a person leaves a package with a third party
  for temporary safekeeping, for example, he
  usually retains control of the package, and thus
  retains a reasonable expectation of privacy in
  its contents.

15
The Fourth Amendments expectation of privacy in
computer cases

• Third-party possession
• Once an item has been received by the intended
  recipient, the senders reasonable expectation of
  privacy generally depends upon whether the sender
  can reasonably expect to retain control over the
  item and its contents. .
• If the sender cannot reasonably expect to retain
  control over the item in the third partys
  possession, however, the sender no longer retains
  a reasonable expectation of privacy in its
  contents. See United States v. Charbonneau, 979
  F. Supp. 1177, 1184 (S.D. Ohio 1997) (defendant
  does not retain reasonable expectation of privacy
  in contents of e-mail message sent to America
  Online chat room after the message has been
  received by chat room participants) and United
  States v. Poulsen, 41 F.3d 1330, 1337 (9th Cir.
  1994) (failure to pay rent to commercial storage
  facility extinguished reasonable expectation of
  privacy in hackers computer tapes at that
  facility).

16
The Fourth Amendments expectation of privacy in
computer cases

• Information shared with third parties
• Generally, one cannot reasonably expect to retain
  control over information revealed to third
  parties, even if senders have a subjective
  expectation that third parties will keep the
  information confidential
• Example subscriber information
• Customers of Internet service providers do not
  have a reasonable expectation of privacy in
  customer account records maintained by and for
  the providers business

17
The Fourth Amendments expectation of privacy in
computer cases

• Private searches
• The Fourth Amendment is inapplicable to a search
  or seizure, even an unreasonable one, conducted
  by a private individual not acting as an agent of
  the government
• No violation of the Fourth Amendment occurs when
  a private individual acting on his own accord
  conducts a search and makes the results available
  to law enforcement

18
The Fourth Amendments expectation of privacy in
computer cases

• Private searches
• In determining whether a private party is an
  instrument or agent of the government, half of
  the federal courts of appeal have adopted a
  totality of the circumstances approach that
  examines three factors (1) whether the
  government knows of or acquiesces in the
  intrusive conduct (2) whether the party
  performing the search intends to assist law
  enforcement efforts at the time of the search
  and (3) whether the government affirmatively
  encourages, initiates or instigates the private
  action

19
Exceptions to the warrant requirement in computer
cases

• Warrantless searches that violate a reasonable
  expectation of privacy will comply with the
  Fourth Amendment if they fall within an
  established exception to the warrant requirement.

20
Exceptions to the warrant requirement in computer
cases

• Consent
• Agents may search a place or object without a
  warrant or even probable cause if a person with
  authority has voluntarily consented to the
  search. Note that Oregon does not recognize
  apparent authority. Consent must be obtained
  from someone who has actual authority to do so.

21
Exceptions to the warrant requirement in computer
cases

• Consent
• Scope of consent Computer cases often raise the
  question of whether consent to search a location
  or item implicitly includes consent to access the
  memory of electronic storage devices encountered
  during the search. In such cases, courts look to
  whether the particular circumstances of the
  agents request for consent implicitly or
  explicitly limited the scope of the search to a
  particular type, scope, or duration

22
Exceptions to the warrant requirement in computer
cases

• Consent
• Written consent should clearly delineate the
  property to be seized and searched. If the
  search is to occur at an off-site location, the
  written consent should clearly authorize the
  property to be searched off-site.
• A signed consent form for the seizure of any
  property under the defendants control and to a
  complete search of the premises and property at
  the defendants address merely permitted the
  agents to seize the defendants computer from his
  apartment, but did not permit them to search the
  computer off-site because it was no longer
  located at the defendants address. United
  States v. Carey, 172 F.3d 1268, 1274 (10th Cir.
  1999).

23
Exceptions to the warrant requirement in computer
cases

• Third-party consent
• General Rules It is common for several people
  to use or own the same computer equipment. If any
  one of those people gives permission to search
  for data, agents may generally rely on that
  consent, so long as the person has authority over
  the computer. In such cases, all users have
  assumed the risk that a co-user might discover
  everything in the computer, and might also permit
  law enforcement to search this common area as
  well.

24
Exceptions to the warrant requirement in computer
cases

• Third party consent
• Spouses and domestic partners
• Parents
• System administrators

25
Exceptions to the warrant requirement in computer
cases

• Third party consent
• Spouses and domestic partners Absent an
  affirmative showing that the consenting spouse
  has no access to the property searched, the
  courts generally hold that either spouse may
  consent to search all of the couples property.
  Most spousal consent searches are valid.

26
Exceptions to the warrant requirement in computer
cases

• Third party consent
• Parental consent Parents can usually consent to
  searches of their childrens rooms when the
  children are under 18 years old. If the children
  are 18 or older, the parents may or may not be
  able to consent, depending on the facts.

27
Exceptions to the warrant requirement in computer
cases

• Third party consent
• System administrator consent Every computer
  network is managed by a system administrator
  whose job is to keep the network running
  smoothly, monitor security, and repair the
  network when problems arise. System operators
  have root level access to the systems they
  administer, which effectively grants them master
  keys to open any account and read any file on
  their systems. System administrators typically
  serve as agents of providers of electronic
  communication service under the ECPA. The ECPA
  regulates law enforcement efforts to obtain the
  consent of a system administrator to search an
  individual's account. See 18 U.S.C. 2702-03.

28
Exceptions to the warrant requirement in computer
cases

• Implied consent
• Users of computer systems may waive their rights
  to privacy as a condition of using the systems.
  A signed policy or employee manual will assist in
  arguing that an employee or user of a network
  system waived any privacy interest in the
  materials stored on the network. Banners
  describing policies of use of network computers
  or warning the user that their use may be
  monitored will be helpful in arguing that the
  employee or user consented to waive any privacy
  interest in their conduct on the network.

29
Exceptions to the warrant requirement in computer
cases

• Exigent circumstances
• Exigent circumstances often arise in computer
  cases because, in some circumstances, electronic
  data is perishable. Computer commands can
  destroy data in a matter of seconds, as can
  humidity, temperature, and physical mutilation.
  Each case is fact dependant.

30
Exceptions to the warrant requirement in computer
cases

• Plain view
• To rely on this exception, the agent must be in a
  lawful position to observe and access the
  evidence, and its incriminating character must be
  immediately apparent. For example, if an agent
  conducts a valid search of a hard drive and comes
  across evidence of an unrelated crime while
  conducting the search, the agent may seize the
  evidence under the plain view doctrine. The
  plain view doctrine does not authorize agents to
  open a computer file and view its contents. The
  contents of an unopened computer file are not in
  plain view. See United States v. Carey, 172 F.3d
  1268, 1273 (10th Cir. 1999)

31
Exceptions to the warrant requirement in computer
cases

• Search incident to a lawful arrest
• Generally, pursuant to a lawful arrest, agents
  may conduct a search of the arrested person, and
  a more limited search of his surrounding area,
  without a warrant. The arrest must be lawful and
  the search reasonably contemporaneous with the
  arrest.

32
Exceptions to the warrant requirement in computer
cases

• Search incident to a lawful arrest
• Pagers Most courts allow police access to
  electronic pagers carried by the arrested person
  at the time of arrest.

33
Exceptions to the warrant requirement in computer
cases

• Search incident to a lawful arrest
• Personal Digital Assistants The limit on a
  search incident to an arrest is that it must be
  reasonable. While a search of physical items
  found on the arrestees person may always be
  reasonable, more invasive searches in different
  circumstances may violate the Fourth Amendment.
  The increasing storage capacity of handheld
  computers suggests that this exception may not
  always apply in the case of electronic searches.
  Courts may conclude that a very time-consuming
  search through a handheld computer that contains
  an entire warehouse of information may require a
  warrant. Seizure, as opposed to the search, may
  be permitted if it is reasonably related to the
  probable cause for the search.

34
Exceptions to the warrant requirement in computer
cases

• Search incident to a lawful arrest
• Inventory Searches. The search must serve a
  legitimate, non-investigatory purpose and must
  follow standardized procedures. It is unlikely
  that the inventory-search exception to the
  warrant requirement would support a search
  through computer files or other electronic data,
  given the difficulties of applying the
  inventory-search requirements to electronic
  storage devices. Generally, information does not
  need to be reviewed to be protected and does not
  pose a risk of physical danger. A warrant is
  most likely required.

35
Exceptions to the warrant requirement in computer
cases

• Search incident to a lawful arrest
• Border Searches Routine searches at the
  border or its functional equivalent do not
  require a warrant, probable cause, or reasonable
  suspicion that the search may uncover contraband
  or evidence. Searches that are especially
  intrusive require reasonable suspicion.

36
Exceptions to the warrant requirement in computer
cases

• Special case workplace searches.
• The legality of warrantless workplace searches
  depends on often-subtle factual distinctions such
  as whether the workplace is public sector or
  private sector, whether employment policies exist
  that authorize a search, and whether the search
  is work-related

37
Exceptions to the warrant requirement in computer
cases

• Private workplace searches
• Generally, law enforcement officers can conduct a
  warrantless search of private (i.e.,
  non-government) workplaces only if the officers
  obtain the consent of either the employer or
  another employee with common authority over the
  area searched. .

38
Exceptions to the warrant requirement in computer
cases

• Public workplace searches
• In public (i.e., government) workplaces, officers
  cannot rely on an employers consent, but can
  conduct searches if written employment policies
  or office practices establish that the government
  employees targeted by the search cannot
  reasonably expect privacy in their workspace.
  Further, government employers and supervisors can
  conduct reasonable work-related searches of
  employee workspaces without a warrant even if the
  searches violate employees reasonable
  expectation of privacy.

39
Exceptions to the warrant requirement in computer
cases

• Private sector workplace searches
• Private company employees generally retain a
  reasonable expectation of privacy in their
  workplaces. As a result, private-workplace
  searches by law enforcement will usually require
  a warrant unless the agents can obtain the
  consent of an employer or a co-worker with common
  authority.

40
Exceptions to the warrant requirement in computer
cases

• Private sector workplace searches
• Consent in private sector-workplaces
• Private-sector employers and supervisors
  generally enjoy a broad authority to consent to
  searches in the workplace. While employers
  generally retain the right to access their
  employees work spaces, co-workers may or may
  not, depending on the facts. When co-workers do
  exercise common authority over a workspace,
  however, investigators can rely on a co-workers
  consent to search that space.

41
Exceptions to the warrant requirement in computer
cases

• Private sector workplace searches
• Employer searches in private-sector workplaces
• Warrantless workplace searches by private
  employers rarely violate the Fourth Amendment.
  So long as the employer is not acting as an
  instrument or agent of the government at the time
  of the search, the search is a private search and
  the Fourth Amendment does not apply

42
Exceptions to the warrant requirement in computer
cases

• Public-sector workplace searches
• Public employees are less likely to retain a
  reasonable expectation of privacy against
  government searches at work than are private
  employees. The following factors may be
  relevant whether the work area is assigned
  solely to the employee whether others have
  access to the space whether the nature of the
  employment requires a close working relationship
  with others whether office regulations place
  employees on notice that certain areas are
  subject to search and whether the property
  searched is public or private.

43
Exceptions to the warrant requirement in computer
cases

• Public-sector workplace searches
• Implied consent
• Generally, government employees who are notified
  that their employer has retained rights to access
  or inspect information stored on the employers
  computers can have no reasonable expectation of
  privacy in the information stored there. Note
  that in government workplaces, employers acting
  in their official capacity cannot consent to a
  law enforcement search of their employees offices

44
Exceptions to the warrant requirement in computer
cases

• Public-sector workplace searches
• Reasonable workplace searches
• A public employer or the employers agent can
  conduct a workplace search that violates a public
  employees reasonable expectation of privacy so
  long as the search is reasonable. A
  warrantless search must satisfy two requirements
  to qualify as reasonable. First, the search
  must have a work-related reason, rather than
  merely to obtain evidence for use in criminal
  proceedings. Second, the search must be justified
  at its inception and permissible in its scope. A
  search will be justified at its inception when
  there are reasonable grounds for suspecting that
  the search will turn up evidence that the
  employee is guilty of work-related misconduct, or
  that the search is necessary for a
  non-investigatory work-related purpose. A search
  will be permissible in its scope when the
  measures adopted are reasonably related to the
  objectives of the search and are not
  excessively intrusive in light of the nature of
  the misconduct. O Connor, 480 U.S. at 726

45
Searching computers with a warrant

• Practical aspects of planning the search
• Assemble the team
• Learn as much as possible about the computer
  system
  
• Formulate a strategy for conducting the search
• Identify role of computer in offense storage
  device for evidence? Or contraband, evidence,
  instrumentality, or fruit of crime?
  
• On-site or off-site search?
• Multiple warrants for data stored in multiple
  locations?
  
• Drafting the affidavit and warrant
• Accurately and particularly describe the property
  to be seized
  
• Hardware vs. software issues
• Establish probable cause that location to be
  searched contains the specified evidence of
  specified criminal violations
  
• Explain search strategy, especially if off-site
  examination will be necessary

46
Execution of warrants

• Knock and announce issues
• Notice of items to be seized must be provided to
  the subject of the search at the outset of
  search
  
• Receipt of items seized must be provided to the
  subject of search
  
• Accounting of items seized must be provided to
  the court

47
Execution of warrants

• Sneak and peak warrants
• 18 U.S.C. 3103(b) provides that the required
  notice of the service of a warrant may be delayed
  if the court finds "reasonable cause" to believe
  that providing immediate notification of the
  execution of the warrant may have an adverse
  result as defined by 18 U.S.C. 2705 (includes
  endangering the life or physical safety of an
  individual, flight from prosecution, destruction
  of or tampering with evidence, intimidation of
  witnesses, or otherwise seriously jeopardizing an
  investigation or unduly delaying a trial).
  Notice of the search must nonetheless be provided
  within a "reasonable period" of a warrant's
  execution, which period can be further extended
  by a court for good cause.

48
Execution of warrants

• Sneak and peak warrants
• The sneak and peak provision is primarily
  designed to authorize delayed notice of searches,
  rather than delayed notice of seizures the
  provision requires that any warrant issued under
  it must prohibit the seizure of any tangible
  property, any wire or electronic communication,
  or, except as expressly provided in the
  Electronic Communications Privacy Act, any stored
  wire or electronic information, unless the court
  finds "reasonable necessity" for the seizure.

49
Execution of warrants

• Searching networks
• Technically, agents can obtain a warrant to seize
  an entire network suspected of use in a criminal
  enterprise. However, seizing the entire network
  might cripple a functioning business and disrupt
  customer access, as well as subject the
  government to civil suits under the PPA and the
  ECPA. Steve Jackson Games, Inc. v. Secret
  Service, 816 F. Supp. 432, 440, 443 (W.D. Tex.
  1993).
• Privileged documents issues
• Develop strategy for reviewing privileged
  computer files
  

50
Post-seizure issues

• If an initial search reveals evidence of a
  different crime than that which was authorized in
  the initial search, a second warrant should be
  obtained for the additional evidence

51
Post-seizure issues

• Permissible time periods for examining seized
  computers
  
• The forensic examination of seized computers
  often takes months to complete. Neither Rule 41
  nor the Fourth Amendment impose any specific time
  limitation for the forensic examination.
  However, unless the computer is itself an
  instrumentality or a proceed of fraud and
  therefore subject to forfeiture, a strategy
  should be developed to obtain a mirror image of
  any hard drive and otherwise obtain evidence from
  the seized computer as soon as practicable so
  that it can be returned within a reasonable
  period of time.

52
Questions?
53
The Fourth Amendment in Cyber Space

• Sean B. Hoar
• 541-465-6792 (voice)
• 541-465-6840 (fax)
• sean.hoar_at_usdoj.gov