The Volokh Conspiracy - Fourth Amendment Rights in Files Stored on Password-Protected Websites:

Does a user have a reasonable expectation of privacy in their files — including images of child pornography — posted on a password-protected website? In a decision handed down last week, Judge Stearns of the U.S. District Court for the District of Massachusetts concluded that the answer is "yes." At the same time, Judge Stearns refused to suppress the evidence in the particular case, finding that its collection was the fruits of a private search by a tipster. The case is United States v. D'Andrea.

Unfortunately, the facts of the case are pretty gruesome, so here is a very brief version. The Massachusetts Department of Social Services received a call from a person reporting that another couple was molesting their 8-year old daughter and putting pictures of the molestation on a password-protected Sprint PCS website. The caller indicated that she was an ex-girlfriend of the man involved, and she told the officials the username and password of the website to access the pictures. A DSS official entered the username and password, accessed the website, and confirmed that images of the molestation were present. The official contacted the police, and the police obtained a warrant to search the couple's home. The woman was home when the warrant was executed; she was taken into custody and confessed to the crime. When charges were brought, both the man and the woman moved to suppress the images and the confession on the ground that they had a reasonable expectation of privacy in the stored files in the account and that the government access to the account without a warrant had violated the Fourth Amendment.

In his opinion, Judge Stearns first concludes that a person has a reasonable expectation of privacy in the contents of files stored on password-protected websites. Judge Stearns relies on two authorities. The first authority is Professor LaFave's treatise:

Professor Warren [sic] LaFave, a preeminent authority on the Fourth Amendment, argues that a person who avails herself of a website’s password protection should be able to claim a reasonable expectation of privacy in the site’s contents. Professor LaFave makes the point that while a service provider has a need to access information regarding the identity of a site holder and the volume and extent of her usage, it has no legitimate reason to inspect the actual contents of the site, anymore than the postal service has a legitimate interest in reading the contents of first class mail, or a telephone company has a legitimate interest in listening to a customer’s conversations. “Reliance on protections such [as] individual computer accounts, password protection, and perhaps encryption of data should be no less reasonable than reliance upon locks, bolts, and burglar alarms, even though each form of protection is penetrable.”13 LaFave, 1 Search and Seizure § 2.6 at 721 (4th ed. 2006).

Judge Stearns also relies heavily on the Sixth Circuit's Warshak case, quoting from it extensively.

But having concluded that there is a reasonable expectation of privacy in password-protected websites, Judge Stearns then seems to reduce that entire discussion to dicta: he concludes that the defendant's Fourth Amendment rights weren't violated because the government officials that accessed the website merely reconstructed the private search of the anonymous caller.

This argument fails for the simple reason that [the government official] intruded no further into defendants’ zone of privacy than did the anonymous caller. Where a private party, acting on his or her own, searches a closed container, a subsequent warrantless search of the same container by government officials does not further burden the owner’s already frustrated expectation of privacy. United States v. Jacobsen, 466 U.S. 109, 117 (1984). “The additional invasions of [a defendant’s] privacy by the Government agent must be tested by the degree to which they exceeded the scope of the private search.” Id. at 115. Moreover, where an expectation of privacy in an item has been effectively destroyed by a private search, police do not violate the Fourth Amendment by examining the same item more thoroughly or with greater intensity so long as they do not “significantly expand” upon or “change the nature” of the underlying private search. United States v. Runyan, 275 F.3d 449, 464-465 (5th Cir. 2001).

Judge Stearns then concludes that either the man or the woman must have given the password to the caller. True, both the man and the woman denied giving out the password. But Judge Stearns concludes in fn 17 that this must be false; there's no other way the caller could have learned the password without the man or woman giving it to her. So having given the password to the caller - at least according to Judge Stearns — the defendants had "assumed the risk" that she would access the account and tell the police about what she saw:

At day’s end, this case falls clearly into the “assumption of the risk” exception identified in Warshak and Supreme Court precedent. “It is well-settled that when an individual reveals private information to another, he assumes the risk that his confidant will reveal that information to the authorities, and if that occurs the Fourth Amendment does not prohibit governmental use of that information.” Jacobsen, 466 U.S. at 117. See also United States v. Maxwell, 45 M.J. 406, 419 (C.A.A.F. 1996) (the sender of an email runs the risk that its recipient will publish its contents). Thus, even granting defendants a reasonable expectation of privacy in the graphic website images of Jane Doe, by sharing the website access information with the anonymous caller, defendants took the risk that their right to privacy in the website’s contents could be compromised.

Hmm, I'm not sure what I think of this case — either on the first section granting Fourth Amendment protection or the second part taking it away.

To read the rest of this post, click here.

  First, I wonder if Judge Stearns was a little quick to find a reasonable expectation of privacy in the contents of the website. How the Fourth Amendment applies to remotely stored files is a major open question these days, and it would be helpful to know who registered the account, whether placing child porn on the account violates the terms of service, what the website's practices were, and more generally what the terms of service were. These things may or may not be relevant to whether there was a reasonable expectation of privacy in the account, but it would be helpful to know them before deciding that the expectation of privacy was "reasonable." So that result was plausible, but I'm not positive it's right.

  Moreover, if you accept that there is a reasonable expectation of privacy in the files, I'm dubious that the search can be saved under the private search doctrine. I can understand why Judge Stearns wanted to reach this result. These defendants are pure evil, and having recognized Fourth Amendment rights broadly Stearns must have been inclined to find an exception to make sure these particular defendants rot in prison for a really long time. But I'm not sure the doctrine fits. The private search doctrine lets the police reconstruct the search undertaken by a private actor; the private actor can in effect show the police what she saw without invading a Fourth Amendment right. Here there's very little evidence that the police merely reconstructed the private person's search. As far as I can tell, we don't know exactly what the private person saw or in what circumstances (or even if she searched the computer at all — she may have just heard about it from someone else).

  Judge Stearns tries to get around the lack of facts by citing the Runyan case from the Fifth Circuit. Runyan held that viewing one file on a computer eliminated a reasonable expectation of privacy with respect to all the files. But I think Runyan is quite unpersuasive for reasons I argued in my recent article Searching and Seizing Computers in A Digital World (see pages 554-57). Given the lack of evidence that the Social Services official merely reconstructed the private search, I'm skeptical that the private search doctrine permitted the initial search of the website without a warrant.

  Finally, Judge Stearns' discussion of the "assumption of the risk" doctrine is pretty weak. The caller, who turned out to be the man's ex-girlfriend, knew the username and password. But we don't know how she knew it. And assuming that she was given rights to access the account, we don't know if there were some kind of conditions placed on her access. As best I can tell, Judge Stearns simply assumes that the defendants must have given her the account and password and given her full access rights. But there are lots of other possibilities: there are ways of finding out someone's username and password without them giving it to you and giving you full access rights to an account. Given the absence of evidence on this point, I found it odd that Judge Stearns simply assumed the facts needed to reach that result.

  What's going to happen to this case? Assuming the defendants are convicted and they appeal, I'll suggest two options. First, if the First Circuit wants to affirm, they'll hold that the access to the website was permitted under the "special needs" doctrine. Given the facts of the tip, this was a reasonable search for a non-law enforcement reason by an official not acting in a law enforcement capacity. This approach lets the court affirm without getting into all of the complicated and fact-specific arguments dealt with by Judge Stearns. (Thanks to Michael Carroll for the suggestion.)

  Alternatively, its possible that the First Circuit would vacate and remand and order Judge Stearns to hold a factual hearing on a number of these issues, ranging from the nature of the website and the TOS to the scope of the private search issue and how the caller found out the username and password. In footnote 9, Judge Stearns explains that he denied the defendants' request for a hearing because he thought the factual issues were clear and there was no need for it. I tend to disagree based on the arguments analyzed in Judge Stearns' opinion.

  Given the gruesomeness of the facts, I suspect the First Circuit will want to decide the case on the special needs doctrine and affirm the conviction on that basis. But if it doesn't go that path, it's possible the court may send the case back to Judge Stearns for fact-finding. Anyway, stay tuned.

	[Orin Kerr, July 24, 2007 at 10:20am] Trackbacks Fourth Amendment Rights in Files Stored on Password-Protected Websites: Does a user have a reasonable expectation of privacy in their files — including images of child pornography — posted on a password-protected website? In a decision handed down last week, Judge Stearns of the U.S. District Court for the District of Massachusetts concluded that the answer is "yes." At the same time, Judge Stearns refused to suppress the evidence in the particular case, finding that its collection was the fruits of a private search by a tipster. The case is United States v. D'Andrea. Unfortunately, the facts of the case are pretty gruesome, so here is a very brief version. The Massachusetts Department of Social Services received a call from a person reporting that another couple was molesting their 8-year old daughter and putting pictures of the molestation on a password-protected Sprint PCS website. The caller indicated that she was an ex-girlfriend of the man involved, and she told the officials the username and password of the website to access the pictures. A DSS official entered the username and password, accessed the website, and confirmed that images of the molestation were present. The official contacted the police, and the police obtained a warrant to search the couple's home. The woman was home when the warrant was executed; she was taken into custody and confessed to the crime. When charges were brought, both the man and the woman moved to suppress the images and the confession on the ground that they had a reasonable expectation of privacy in the stored files in the account and that the government access to the account without a warrant had violated the Fourth Amendment. In his opinion, Judge Stearns first concludes that a person has a reasonable expectation of privacy in the contents of files stored on password-protected websites. Judge Stearns relies on two authorities. The first authority is Professor LaFave's treatise: Professor Warren [sic] LaFave, a preeminent authority on the Fourth Amendment, argues that a person who avails herself of a website’s password protection should be able to claim a reasonable expectation of privacy in the site’s contents. Professor LaFave makes the point that while a service provider has a need to access information regarding the identity of a site holder and the volume and extent of her usage, it has no legitimate reason to inspect the actual contents of the site, anymore than the postal service has a legitimate interest in reading the contents of first class mail, or a telephone company has a legitimate interest in listening to a customer’s conversations. “Reliance on protections such [as] individual computer accounts, password protection, and perhaps encryption of data should be no less reasonable than reliance upon locks, bolts, and burglar alarms, even though each form of protection is penetrable.”13 LaFave, 1 Search and Seizure § 2.6 at 721 (4th ed. 2006). Judge Stearns also relies heavily on the Sixth Circuit's Warshak case, quoting from it extensively. But having concluded that there is a reasonable expectation of privacy in password-protected websites, Judge Stearns then seems to reduce that entire discussion to dicta: he concludes that the defendant's Fourth Amendment rights weren't violated because the government officials that accessed the website merely reconstructed the private search of the anonymous caller. This argument fails for the simple reason that [the government official] intruded no further into defendants’ zone of privacy than did the anonymous caller. Where a private party, acting on his or her own, searches a closed container, a subsequent warrantless search of the same container by government officials does not further burden the owner’s already frustrated expectation of privacy. United States v. Jacobsen, 466 U.S. 109, 117 (1984). “The additional invasions of [a defendant’s] privacy by the Government agent must be tested by the degree to which they exceeded the scope of the private search.” Id. at 115. Moreover, where an expectation of privacy in an item has been effectively destroyed by a private search, police do not violate the Fourth Amendment by examining the same item more thoroughly or with greater intensity so long as they do not “significantly expand” upon or “change the nature” of the underlying private search. United States v. Runyan, 275 F.3d 449, 464-465 (5th Cir. 2001). Judge Stearns then concludes that either the man or the woman must have given the password to the caller. True, both the man and the woman denied giving out the password. But Judge Stearns concludes in fn 17 that this must be false; there's no other way the caller could have learned the password without the man or woman giving it to her. So having given the password to the caller - at least according to Judge Stearns — the defendants had "assumed the risk" that she would access the account and tell the police about what she saw: At day’s end, this case falls clearly into the “assumption of the risk” exception identified in Warshak and Supreme Court precedent. “It is well-settled that when an individual reveals private information to another, he assumes the risk that his confidant will reveal that information to the authorities, and if that occurs the Fourth Amendment does not prohibit governmental use of that information.” Jacobsen, 466 U.S. at 117. See also United States v. Maxwell, 45 M.J. 406, 419 (C.A.A.F. 1996) (the sender of an email runs the risk that its recipient will publish its contents). Thus, even granting defendants a reasonable expectation of privacy in the graphic website images of Jane Doe, by sharing the website access information with the anonymous caller, defendants took the risk that their right to privacy in the website’s contents could be compromised. Hmm, I'm not sure what I think of this case — either on the first section granting Fourth Amendment protection or the second part taking it away. To read the rest of this post, click here. First, I wonder if Judge Stearns was a little quick to find a reasonable expectation of privacy in the contents of the website. How the Fourth Amendment applies to remotely stored files is a major open question these days, and it would be helpful to know who registered the account, whether placing child porn on the account violates the terms of service, what the website's practices were, and more generally what the terms of service were. These things may or may not be relevant to whether there was a reasonable expectation of privacy in the account, but it would be helpful to know them before deciding that the expectation of privacy was "reasonable." So that result was plausible, but I'm not positive it's right. Moreover, if you accept that there is a reasonable expectation of privacy in the files, I'm dubious that the search can be saved under the private search doctrine. I can understand why Judge Stearns wanted to reach this result. These defendants are pure evil, and having recognized Fourth Amendment rights broadly Stearns must have been inclined to find an exception to make sure these particular defendants rot in prison for a really long time. But I'm not sure the doctrine fits. The private search doctrine lets the police reconstruct the search undertaken by a private actor; the private actor can in effect show the police what she saw without invading a Fourth Amendment right. Here there's very little evidence that the police merely reconstructed the private person's search. As far as I can tell, we don't know exactly what the private person saw or in what circumstances (or even if she searched the computer at all — she may have just heard about it from someone else). Judge Stearns tries to get around the lack of facts by citing the Runyan case from the Fifth Circuit. Runyan held that viewing one file on a computer eliminated a reasonable expectation of privacy with respect to all the files. But I think Runyan is quite unpersuasive for reasons I argued in my recent article Searching and Seizing Computers in A Digital World (see pages 554-57). Given the lack of evidence that the Social Services official merely reconstructed the private search, I'm skeptical that the private search doctrine permitted the initial search of the website without a warrant. Finally, Judge Stearns' discussion of the "assumption of the risk" doctrine is pretty weak. The caller, who turned out to be the man's ex-girlfriend, knew the username and password. But we don't know how she knew it. And assuming that she was given rights to access the account, we don't know if there were some kind of conditions placed on her access. As best I can tell, Judge Stearns simply assumes that the defendants must have given her the account and password and given her full access rights. But there are lots of other possibilities: there are ways of finding out someone's username and password without them giving it to you and giving you full access rights to an account. Given the absence of evidence on this point, I found it odd that Judge Stearns simply assumed the facts needed to reach that result. What's going to happen to this case? Assuming the defendants are convicted and they appeal, I'll suggest two options. First, if the First Circuit wants to affirm, they'll hold that the access to the website was permitted under the "special needs" doctrine. Given the facts of the tip, this was a reasonable search for a non-law enforcement reason by an official not acting in a law enforcement capacity. This approach lets the court affirm without getting into all of the complicated and fact-specific arguments dealt with by Judge Stearns. (Thanks to Michael Carroll for the suggestion.) Alternatively, its possible that the First Circuit would vacate and remand and order Judge Stearns to hold a factual hearing on a number of these issues, ranging from the nature of the website and the TOS to the scope of the private search issue and how the caller found out the username and password. In footnote 9, Judge Stearns explains that he denied the defendants' request for a hearing because he thought the factual issues were clear and there was no need for it. I tend to disagree based on the arguments analyzed in Judge Stearns' opinion. Given the gruesomeness of the facts, I suspect the First Circuit will want to decide the case on the special needs doctrine and affirm the conviction on that basis. But if it doesn't go that path, it's possible the court may send the case back to Judge Stearns for fact-finding. Anyway, stay tuned.