Posted by Orin Kerr:
Important Fourth Amendment Puzzle:
http://volokh.com/archives/archive_2005_06_12-2005_06_18.shtml#1118678013
Here is an interesting legal question for readers interested in the
Fourth Amendment. It involves a fact pattern that has started to come
up quite often in the last year or two, but that no court has yet
addressed. It's pretty puzzling, too, and it has lots of police
officers and prosecutors unsure of what to do. I'd be interested in
readers' thoughts on it.
Here's the problem. Imagine that the police believe that there is
evidence of crime on a suspect's computer, but they lack probable
cause to obtain a warrant to search it. The police ask the suspect if
he will consent to allow the police to search the computer for
evidence. The suspect agrees, and gives the police his computer to be
searched. A few days later, the suspect talks to an attorney and the
attorney advises the suspect to revoke his consent and demand the
return of the property. The lawyer (or the suspect) calls the police
and withdraws consent to search the computer.
In cases of traditional physical evidence, the law here is very
clear. The basic Fourth Amendment rule is that the police can conduct
a search if someone with common authority over the computer consented,
but that they have to stop their search if and when the consent is
revoked. Given that rule, it's clear that any search of the
defendant's actual computer would have to stop when the suspect
withdraws his consent.
But here's the twist. It turns out that the first step a computer
forensic analyst takes when seeking to retrieve evidence from a hard
drive is to create a "bitstream copy" or "image" of the computer hard
drive. The "image" is an exact copy of the hard drive that copies
every one and zero on the drive. It is created for reasons of
evidentiary integrity; searching a computer drive can alter the data
it contains, so analysts copy the originial and do all of the analysis
on the image copy. After the drive has been imaged, there are two
copies of the data, not one: one copy of data on the defendant's
property and another copy on the government's machine.
Now, back to our hypothetical. It turns out that a suspect often
withdraws his consent after the computer has been imaged, but before
government has begun to search the image. (This is common because
imaging can be done in a few hours, but most government forensic labs
have long waiting lists for the actual analysis.) So here's the big
question: When the suspect withdraws his consent, does the withdrawal
of consent also apply to the image? Can the police search the imaged
copy, or will searching the imaged copy without a warrant violate the
Fourth Amendment? In doctrinal terms, soes a defendant retain a
legitimate expectation of privacy in the image, and if so, does his
common authority to regulate consent to search the original apply
equally or differently to the copy?
I think there are two ways of looking at the problem. On one hand,
you could say that the image is like a photograph taken during a
search. The image is the government's own copy of what the government
software "saw" when it looked through the suspect's computer. In that
case, you might say that the image belongs to the government, and the
suspect can no longer withdraw his consent to the search. Having
obtained the initial consent to search the computer, they can search
the image after consent has been revoked.
On the other hand, you could say that the image is actually just as
private as the original version of the data. What matters is the data,
and it makes no sense to say that the government has "seen" the data
when no search has actually occurred. The imaging software copied the
private file but never exposed the data, and the copy is no different
from the original. In that case, all of the data continues to belong
to the suspect, and the defendant's withdrawal of consent applies
equally to the original hardware and the image.
So which is right? For reasons I explain in [1]this forthcoming
artice (see section II), I think the latter view is probably right.
The right to search the image should track the right to search the
original, and a withdrawal of consent to search the latter should also
apply to the former. Still, it's a pretty difficult question, as the
answer hinges on how you address all sorts of tricky questions
concerning what it means to search and seize digital evidence. One
interesting variable: does the answer depend on the exact language of
the consent agreement? I can imagine a court saying that a defendant's
withdrawal of consent is binding on a search of the image if the
defendant agreed generally to allow the government to search his
computer, but that the withdrawal is not binding on the search of the
image if the defendant agreed specifically to allow the government to
create an image. On the flip side, if I were a defense attorney in a
case raising such issues I would argue that the imaging itself is
beyond the scope of the consent, and thus any data from the image must
be suppressed.
I have enabled comments. As I noted above, this issue has begun to
come up a lot recently, and it's only a matter of time before the
courts start confronting it.
References
1. http://papers.ssrn.com/sol3/papers.cfm?abstract_id=697541
_______________________________________________
Volokh mailing list
[email protected]
http://highsorcery.com/cgi-bin/mailman/listinfo/volokh
