Some of the most interesting computer search and seizure questions involve consent searches. The Fourth Amendment allows suspects or third parties to consent to a search property over which they have common authority. With the right to consent comes a right to withdraw consent: If you let the cops look through your stuff, you also have a right to stop them from looking mid-way through their search.

  Computer searches create an added wrinkle, however: Computer searches are ordinarily conducted by first making a perfect copy (an "image") of the hard drive. The government then searches the copy rather than the original. It often happens that the suspect or a third party will initially consent, but that when they consult a lawyer, the lawyer tells them to withdraw their consent immediately. This creates a pretty tricky question: if a suspect or third party consents to a computer search, and the government then makes an image, can the suspect or third party withdraw consent and take away the government's authority to search through the image copy? Or is the image the government's property, such that it is too late for the suspect to withdraw consent to search it?

  This is a really fun question, and one that government forensic specialists are often curious about. It's also the topic of a note in my Computer Crime Law casebook. But it had never actually come up in a published decision until last week, when Judge Merryday in Tampa handed down United States v. Megahed, 2009 WL 722481 (M.D.Fla. March 18, 2009).

  The facts involve an explosives case about to go to trial in Tampa, Florida, involving Youseff Megahed, a college student. On August 6, 2007, the FBI came to the family residence of the suspect looking for bombs, bomb-making materials, and anything that could be used to manufacture or build a bomb. The suspect wasn't home, but the suspect's father, Samir, was present. FBI asked the father for consent to search the home. The father signed a consent form in English and Arabic allowing a complete search of the residence an a seizure of "any items which [FBI agents] determine may be related to their investigation." The FBI took away a computer, and the next day asked the father to sign a computer search consent form, which he did.

  Two months later, however, the father, Samir Megahed, withdrew his consent. It is not clear when the image copy was made. However, the computer image wasn't actually searched until a year later, as far as we can tell: The key evidence in this case was discovered in October 2008, a year after consent was withdrawn. In this particular case, the defendant is seeking to suppress the evidence discovered (an Internet history file) on the ground that the image couldn't be searched after the consent was withdrawn.

   Judge Merryday concluded that the motion was moot for reasons unrelated to these questions, but then added that on the merits the argument lacked merit:

[T]he October, 2007, revocation of consent by the defendant and the defendant's parents does not require suppression of the internet history. After agents searched the Megahed residence, seized the computer, captured a mirror image copy of the hard drive, and returned the hard drive to Samir Megahed, the evidence was discovered in the course of an examination of the FBI mirror image copy. In October, 2008, neither the defendant nor Samir Megahed retained a reasonable expectation of privacy in the mirror image copy that the FBI had obtained already with Samir Megahed's consent and had begun already to search. The revocation did not operate retroactively to nullify this history. See United States v. Ponder, 444 F.2d 816, 818 (5th Cir.1971) ("[A] valid consent to a search ... carries with it the right to examine and photocopy."); Mason v. Pulliam, 557 F.2d 426, 429 (5th Cir.1977) (affirming an order that directed the return of original records and documents voluntarily provided to an IRS agent after withdrawal of consent but agreeing that the taxpayer's "withdrawal and reinvocation does not affect the validity of [the agent's] actions prior to the time he received notice that his right to retain Mason's papers was gone. The district court correctly refused to require the return of copies made prior to the demand by Mason's attorney.") (emphasis added); United States v. Ward, 576 F.2d 243, 244-45 (9th Cir.1978) (adopting the reasoning of Mason as to the use of records following revocation but concluding that "any evidence gathered or copies made from the records [before revocation] should not be suppressed.") (emphasis added).

  This is an interesting result, although unfortunately there isn't much analysis here. I also find it a little hard to know what to make of this case without knowing the language of the consent form, the timing of when the image was made, and whether the image was searched before the search that let to the evidence at issue here. If the image was made before the consent was withdrawn, and the form clearly stated that the image would be made and the government would have rights to search the copy, then I think this is quite plausible. On the other hand, if the image wasn't yet made, then I think this is wrong. If the image was made but the search form didn't state clearly that a copy would be made and searched, then I'm not sure what to think.

  These are really hard issues, I think. Do the rights to consent and withdraw consent carry over to the image, such that the image is treated just like the original? Or does consenting to the making of the image waive any rights in that image? What do you think?