Posted by Orin Kerr:
*United States v. Megahed* and Withdrawn Consent to Search a Computer Image:
http://volokh.com/archives/archive_2009_03_22-2009_03_28.shtml#1237772798
Some of the trickiest and most interesting computer search and seizure
questions involve consent searches. The Fourth Amendment allows
suspects or third parties to consent to a search property over which
they have common authority. With the right to consent comes a right to
withdraw consent: If you let the cops look through your stuff, you
also have a right to stop them from looking mid-way through their
search.
Computer searches create an added wrinkle, however: Computer
searches are ordinarily executed by first making a completely copy (an
"image") of the hard drive and then searching the copy rather than the
original. An important question is, if a suspect or third party
consents to a computer search, and the government then makes an image,
can the suspect or third party withdraw consent and take away the
government's authority to search through the image copy? Or is the
image the government's property, such that it is too late for the
suspect to withdraw consent?
This is a really fun question, and one that gets debated among
computer crime law cognoscenti all the time. It's also the topic of a
note in my [1]Computer Crime Law casebook. But it had never actually
come up in a published decision until last week, when Judge Merryday
in Tampa handed down United States v. Megahed, 2009 WL 722481
(M.D.Fla. March 18, 2009).
The facts involve [2]an apparent terrorism case about to go to trial
in Tampa, Florida, involving Youseff Megahed, a college student. On
August 6, 2007, the FBI came to the family residence of the suspect
looking for bombs, bomb-making materials, and anything that could be
used to manufacture or build a bomb. The suspect wasn't home, but the
suspect's father, Samir, was present. FBI asked the father for consent
to search the home. The father signed a consent form in English and
Arabic allowing a complete search of the residence an a seizure of
�any items which [FBI agents] determine may be related to their
investigation.� The FBI took away a computer, and the next day asked
the father to sign a computer search consent form, which he did.
Two months later, however, the father, Samir Megahed, withdrew his
consent. It is not clear when the image copy was made. However, the
computer image wasn't actually searched until a year later, as far as
we can tell: The key evidence in this case was discovered in October
2008, a year after consent was withdrawn. In this particular case, the
defendant is seeking to suppress the evidence discovered (an Internet
history file) on the ground that the image couldn't be searched after
the consent was withdrawn.
Judge Merryday concluded that the motion was moot for reasons
unrelated to these questions, but then added that on the merits the
argument lacked merit:
[T]he October, 2007, revocation of consent by the defendant and the
defendant's parents does not require suppression of the internet
history. After agents searched the Megahed residence, seized the
computer, captured a mirror image copy of the hard drive, and
returned the hard drive to Samir Megahed, the evidence was
discovered in the course of an examination of the FBI mirror image
copy. In October, 2008, neither the defendant nor Samir Megahed
retained a reasonable expectation of privacy in the mirror image
copy that the FBI had obtained already with Samir Megahed's consent
and had begun already to search. The revocation did not operate
retroactively to nullify this history. See United States v. Ponder,
444 F.2d 816, 818 (5th Cir.1971) (�[A] valid consent to a search
... carries with it the right to examine and photocopy.�); Mason v.
Pulliam, 557 F.2d 426, 429 (5th Cir.1977) (affirming an order that
directed the return of original records and documents voluntarily
provided to an IRS agent after withdrawal of consent but agreeing
that the taxpayer's �withdrawal and reinvocation does not affect
the validity of [the agent's] actions prior to the time he received
notice that his right to retain Mason's papers was gone. The
district court correctly refused to require the return of copies
made prior to the demand by Mason's attorney.�) (emphasis added);
United States v. Ward, 576 F.2d 243, 244-45 (9th Cir.1978)
(adopting the reasoning of Mason as to the use of records following
revocation but concluding that �any evidence gathered or copies
made from the records [before revocation] should not be
suppressed.�) (emphasis added).
This is an interesting result, although unfortunately there isn't
much analysis here. I also find it a little hard to know what to make
of this case without knowing the language of the consent form, the
timing of when the image was made, and whether the image was searched
before the search that let to the evidence at issue here. If the image
was made before the consent was withdrawn, and the form clearly stated
that the image would be made and the government would have rights to
search the copy, then I think this is quite plausible. On the other
hand, if the image wasn't yet made, then I think this is wrong. If the
image was made but the search form didn't state clearly that a copy
would be made and searched, then I'm not sure what to think.
These are really hard issues, I think. Do the rights to consent and
withdraw consent carry over to the image, such that the image is
treated just like the original? Or does consenting to the making of
the image waive any rights in that image? What do you think?
References
1. http://www.amazon.com/Kerrs-Computer-Crime-Law-American/dp/0314144005
2. http://www.msnbc.msn.com/id/29753214/
_______________________________________________
Volokh mailing list
[email protected]
http://lists.powerblogs.com/cgi-bin/mailman/listinfo/volokh
