pageok
pageok
pageok
Fourth Amendment Seizures of Computer Data:
I have just posted a draft of a forthcoming essay, Fourth Amendment Seizures of Computer Data, forthcoming in the Yale Law Journal.

  Here's the abstract:
What does it mean to "seize" computer data for Fourth Amendment purposes? Does copying data amount to a seizure, and if so, when? This essay argues that copying data "seizes" it under the Fourth Amendment when copying occurs without human observation and interrupts the course of its possession or transmission. It offers this position by reaching back to the general purposes of regulating seizures in Fourth Amendment law and then applying that function to the new environment of computers. The test prevents the government from copying data without regulation and yet also meets and answers the objections that have puzzled scholars and made it difficult to apply the old definition of seizures in the new computer environment.
  Also, here's the end of the introduction:
Finally, this essay offers a correction of some of my prior work. In a 2005 article published in the Harvard Law Review, I concluded somewhat uncomfortably that copying should never be considered a Fourth Amendment seizure. At the time, I was influenced by the cases holding that photographing and writing down numbers were not a seizure, as well as by what seemed to be considerable practical problems with calling all copying a seizure. I now see I was wrong. A middle ground is not only possible but also most consistent with both the cases and common sense. This essay identifies the new middle ground and explains why I now disavow my earlier approach.
As always, comments welcome.
cboldt (mail):
This essay argues that copying data "seizes" it under the Fourth Amendment when copying occurs without human observation and interrupts the course of its possession or transmission. It offers this position by reaching back to the general purposes of regulating seizures in Fourth Amendment law and then applying that function to the new environment of computers. The test prevents the government from copying data without regulation.

.
I take it that prevention of "seizure" under the definition you offer does not inhibit "searching." If copying were to take place in a fashion that did NOT interrupt the course of its possession or transmission, then there would be no seizure. Copying (broadening possession) can be arranged so that it does not interrupt possession, and also can be accomplished in a time duration that renders any delay in transmission to be either non-existent or imperceptible.
.
Accepting your definition of "seizure," I don't see how the test prevents the government from copying data without regulation.
4.13.2009 8:59pm
OrinKerr:
cboldt,

1) Can you give an example of copying that would not interrupt the course of possession or transmission but that you think should be regulated?

2) The Fourth Amendment's prohibition on searches would still limit the actual revealing of information stored on the copy, regardless of whether the copying is a seizure.
4.13.2009 9:03pm
cboldt (mail):
-- Can you give an example of copying that would not interrupt the course of possession or transmission but that you think should be regulated? --
.
I was deliberately avoiding stating a value judgement about the government engaging in copying of data transmission (and possession by the government, of the copy) and whether, the extent, and authority for limiting or regulating that copying. My comment was challenging (or not comprehending) your contention that "The [seizure] test prevents the government from copying data without regulation."
.
As to copying that does not inhibit possession, see telephone conversations (making a recording does not inhibit the conversation), and all electronic network traffic.
.
-- The Fourth Amendment's prohibition on searches would still limit the actual revealing of information stored on the copy, regardless of whether the copying is a seizure. --
.
Again, my point was in (and limited to) the context of your conclusion that the [seizure] test prevents the government from copying data. To the extent one accepts the assertion the government is prohibited from copying the data in the first place, any prohibition on searching would be moot, as the government can't search what it doesn't have.
4.13.2009 9:42pm
Bruce:
Your admission in your Yale Law Journal article that your Harvard Law Review article was mistaken indicates that you're never going to go far in this business.
4.13.2009 10:11pm
Angus:
Bruce is correct. In academia, it is a must to say "I was correct previously and I am also correct now, even though what I say now contradicts my previous position."
4.13.2009 10:28pm
Barrister's Handshake (mail) (www):
Indeed, Bruce and Angus have it. Next time I publish in the Yale Law Journal, I won't say a thing about what I previously published in the Harvard Law Review (or what I published that same year in the Stanford Law Review for that matter).

I may though mention that I design some sweet t-shirts.
4.13.2009 10:41pm
cboldt (mail):
I saw that [since deleted] post.
4.13.2009 11:51pm
OrinKerr:
cblodt,

And?
4.14.2009 12:04am
cboldt (mail):
-- And? --
.
In my opinion, it was educational, and ought to be restored.
4.14.2009 12:28am
OrinKerr:
Ah, thanks. I thought it was mildly amusing, but then I didn't know if people would misread it as somehow suggesting that I saw myself as Duncan Kennedy. So right after posting it, I rethought the decision and deleted it.
4.14.2009 12:50am
Lior:
Example for cboldt's hypothetical: my personal computers all run Unix-like operating systems. If the police obtained login credentials for one of my machines they could log on remotely and run a script that would automatically copy all files off my hard-drive as after they are created. This will not interrupt any other functions of the computer or limit my ability to access the data (they system will happily run multiple programs at the same time). This should be a search for 4th amendment purposes for the same reason that the police obtaining a duplicate key to my door and walking in is a search.

Nevertheless, since computer data can be accessed concurrently, it can be "searched" without interfering with its "transmission or possession".
4.14.2009 2:48am
David Schwartz (mail):
OrinKerr: The police can slip in your house when you're not there and photograph all your documents. That doesn't disrupt anything you're doing, nor does it "seize" anything in that you still have everything you had before. Surely the fourth amendment prohibits that.

A duplication is a search. To "search" is to look though so as to see what's there. If you look at a document and take notes, that's search. The same applies if the "look" is automated and the "notes" are a perfect replica.

To argue that there must be some interference would make the NSA's total domestic Internet surveillance lawful.
4.14.2009 3:04am
caligulazhang (mail):
My point of view, this subject very well, I like. I welcome you and to discuss related issues.
4.14.2009 3:21am
iknowitwheniseeit (mail):
Orin, I'm not sure your Rob Schneider quote works the way you want it to work. "Alright! The Rand Old Opry, makin' copies!" clearly signals that this is an act of emotional and psychological significance". The man has obviously been effected in some profound way by a simple, administrative task. So I think that it actually cuts against your view that copying is a generic job.
4.14.2009 4:10am
chris m (mail) (www):
I have to wonder, how is it that the government is exempted from copyright laws when conducting investigations?

if they copy every thing on the suspects computer, do they not violate the copyright of every piece of software on the machine?
4.14.2009 4:36am
David Schwartz (mail):
chris m: No, they do not. Copyright only applies when there are a million equally good ways to do something and you creatively pick one of them. Only the actual data on the suspect's computer will serve this evidentiary purpose. It's akin to a "magic word", which cannot be protected by copyright. In this case, only this exact form will serve this function.
4.14.2009 8:01am
East:
Can you give an example of copying that would not interrupt the course of possession or transmission but that you think should be regulated?

Reading network traffic/wiretapping.
4.14.2009 8:23am
pintler:
I'm not sure I follow the decision in the exigent circumstances serial number case. In those circumstances, could the officer pull a diary off the shelf, set down on the couch and spend an hour leafing through it? Could he boot the computer and do the same? Pull out a thumb drive and copy the computer contents to look over later? [note 1]

Being a libertarian whacko, I lean towards even thinking that lifting up the turntable was over the line - if you are looking for someone who was yelling for help, they aren't likely to be hidden under a turntable. I see this as analogous to a search warrant for a stolen car not allowing the police to open a jewelry box, IIUC.

In any event, just as an IANAL gut feeling, I am a lot more upset with someone reading my diary than reading a serial number, and I view most computer searches as a lot closer to reading my diary than writing down a serial number. That someone might photocopy my diary on a whim and then seek a warrant doesn't leave me feeling 'secure in [my] ... papers, and effects'.


[note 1]I am assuming the particular exigent circumstances (say, reports of cries for help) provide no justification for reading the diary/looking at computer. If the exigent circumstances were looking for a missing person, there might be justification.
4.14.2009 10:03am
Realist Liberal:
David Schwartz~

It seems like you are combining the concept of search and the concept of seizure into one concept. They are not. Clearly they are related and usually they go together but not always.

Of course, in a criminal case usually the searcher has found evidence (and thus seized it). However, this is not always true. Consider a 1983 action complaining that officers strip searched a suspect in broad daylight without even having reasonable suspicion but found nothing. Clearly there was no seizure of evidence (let's leave aside the fact that there was a seizure of the person) however there was a search. That search would be unconstitutional even though there was no seizure.
4.14.2009 11:07am
Oren:
Very insightful as always.

Lior is right on the technical details. If the police managed to get the right credentials (by hook or crook) to a machine (and possibly intervening routers) they can make an exact image without disturbing the normal function of the machine (might take a while for large drives over a home internet connection). That is clearly a search, but not a seizure that is much analogous to Katz in that is clearly involves gathering data to which the owner has a REP.

Absent a SW, I can't see how such a thing is legal.
4.14.2009 11:58am
OrinKerr:
In response to a few comments here, government wiretapping interrupts the course of transmission -- indeed, it is the classic case of it. As the examples at the end of the essay indicate, the test is whether the government's copy is outside the usual course of transmission, not whether the suspect's copy is interrupted.
4.14.2009 12:00pm
Oren:

... government wiretapping interrupts the course of transmission ...

In what sense? The call must go through unimpeded or else there would be no point to wiretapping it in the first place.

I can envision totally "passive" methods of wiretapping (optical lines can be spliced so that the original path is not at all obstructed, just some of the signal is diverted, even regular copper wiring can be tapped by induction) in the sense that one could claim they don't touch the original transmission at all, only "listen in" and make a copy. A small wireless microphone embedded in a phone would likewise not interrupt the transmission at all, merely picking up some vibrations in the air and recording them (vibrations that, coincidentally, correspond to the contents of the phone conversation, but not by dint of intercepting them in any fashion).
4.14.2009 12:06pm
Oren:
I guess my point is that it seems very odd to me that the technical means of acquisition (intercept versus observation) should make a legal difference. If I'm not misread OK's last post, it makes a big difference indeed.
4.14.2009 12:07pm
xyzzy:
Professor Kerr,

I've given your paper a first reading, and I've also gone back and (re-) read Searches and Seizures in a Digital World. At this time, I still want to reserve my comments until after I've given your paper the careful second reading it deserves.

In the meantime, though, there's some current news, and I'd like you to relate your thesis to that news.

The EFF is representing a Boston College student In re: matter of search warrant. In the student's Motion for Emergency Relief to Quash the Warrant and for Return of Property, and Memorandum in Support, the student asks the court to:
and (4) order that any stored copies of Mr. Calixte's data be deleted.

Would you please contrast your thesis regarding copies as seizures with Professor Ohm's ”previously unidentified Fourth Amendment interest: the right to delete” (quoted in your paper).

Specifically, under your current thesis, would the Boston College student have a fourth amendment interest sufficient for the relief he requests?
4.14.2009 12:23pm
East:
I can envision totally "passive" methods of wiretapping

This is correct. Listening on a network doesn't require that you actually insert yourself between parties communicating. It's less like reading your mail and more like overhearing a conversation.
4.14.2009 12:46pm
cboldt (mail):
-- In response to a few comments here, government wiretapping interrupts the course of transmission -- indeed, it is the classic case of it. --
.
The word "interrupt" has been the source of confusion on my part, and that of others, as well. I took it in the sense of "impede" or "block," rather than as you intended it to be taken.
.
"seizes" it under the Fourth Amendment when copying occurs without human observation and interrupts the course of its possession or transmission.

.
If the word "accesses" is substituted for "interrupts" (which substitution may or may not be what you intend), then I see how the [seizure] test prevents the government from copying data. One cannot copy what one lacks access to.
4.14.2009 1:12pm
Oren:
xyzzy, why is deletion different from normal requests for the government to destroy documents that were illegally seized (and their copies)?
4.14.2009 1:57pm
Oren:
xyzzy, another thought occurs to me regarding the Boston College student -- could a judge order all seized property "frozen" from further observation for long enough to get a full hearing on the validity of the search warrant? The way I see it, the validity of the search warrant should be fully briefed and explored before a drastic remedy such as return of the property and deletion of the evidence.

After all, the search warrant affidavit is not implausible on its face.
4.14.2009 2:03pm
xyzzy:
why is deletion different from normal requests for the government to destroy documents that were illegally seized (and their copies)?


In context here, I'm not sure why you're directing that question specifically to me. Let me punt by quoting from Professor Ohm's paper, “The Fourth Amendment Right To Delete”:
If imaging is neither search nor seizure, law enforcement agents would have the incentive to image every hard drive they could find. Whether or not a drive was found to contain evidence, the image could be loaded into the data store. The government could end up indefinitely possessing the private correspondence (e-mail), reading habits (web traffic), lists of associates (instant messenger buddy lists), most private thoughts (diaries), and financial information (Quicken data-bases) of thousands (or more) of people.
4.14.2009 2:17pm
Michael J.Z. Mannheimer (mail):
Orin,

I hope you threw in the obligatory cite to Henslee v. Union Planters Nat. Bank &Trust Co., 335 U.S. 595, 600 (1949) (Frankfurter, J., dissenting) ("Wisdom too often never comes, and so one ought not to reject it merely because it comes late.").

Much props on the fantastic placement.
4.14.2009 2:32pm
xyzzy:
After all, the search warrant affidavit is not implausible on its face.


‘Plausibility’ is insufficient for a search warrant.

The threshold is probable cause.
4.14.2009 2:57pm
Oren:
xyzzy, I meant to say that the accusation in the affidavit are not implausible and, if true, would certainly constitute probable cause.

As for the deletion, given that there was a search warrant, I think the government has already conceded that a search has taken place.
4.14.2009 4:54pm
xyzzy:
I meant to say that the accusation in the affidavit are not implausible and, if true, would certainly constitute probable cause.


A conclusory allegation that a statute has has been violated is not a “fact” sufficient to warrant the belief by a person of ordinary prudence and caution that a crime has been committed.

As the EFF points out, M.G.L. 266 §33A: Obtaining computer services by fraud or misrepresentation is specifically limited to:
... where such use, access or copying is offered by the proprietor or operator of the computer, system, program, network or data to others on a subscription or other basis for monetary consideration.

(Emphasis added.)

The warrant affidavit alleges facts which lead me to believe that first accusation must fail as a matter of law. The affiant alleges the use of services which the court may notice are well-known as free services.

Further, the inclusion of that accusation casts some doubt on the rest of the affidavit.

The second alleged crime, violation M.G.L. 266 §120F: Unauthorized access to computer system, is a little fuzzier. Here the affiant simply fails to allege any lack of authorization.

So we seem to have a situation where an invalid warrant must be quashed, and the seized property must be returned. The question —directly pertaining to the approaches of Professors Kerr and Ohm— is whether copies that the goverment made must be deleted on fourth amendment grounds.
4.14.2009 7:29pm
David Schwartz (mail):
I think the analogy with the postal mail shows the problem. If no disruption or delay in service is required to constitute a seizure, then how do you distinguish between the package traveling in a "siezure truck" and traveling in a "non-seizure truck"?

To argue that it would take a different path but for the seizure is bootstrapping. If it's a seizure, then it would take a different path but for the seizure. If not, then it would take the same path.

What distinguishes the NSA's copying equipment for all the other equipment the packet has to travel through to get from point A to point B?

How do you respond to "The packet travels through lots of devices, they all make copies in the course of getting the packet from point A to point Z. This machine is between points D and F and is a point E just like every other point." If you argue the packet could get to its destination just as well without the device, then I'd argue it can get to the destination just as well without any device on the path, if you connect the device before it directly to the device after it.
4.14.2009 8:06pm
David Schwartz (mail):
Here's a better example: A municipality operates a Wi-Fi access service. The service is working fine, but at one location, they anticipate future demand will make their capability inadequate. They plan to add an additional access point there.

So they have a tech go out, disconnect the existing access point from the trunk line, and connect it to a switch. The switch is also connected to the trunk line.

Why is the installation of this switch not a seizure? The switch makes copies of all the data it receives (switches are typically store-and-forward devices). But for the installation of the switch, the copy made by the switch would not be made. The intended data will flow just as well without this switch.

Clearly this is not a seizure, but under the proposed test, it is.
4.14.2009 10:11pm
Lior:
@Prof. Kerr:
In response to a few comments here, government wiretapping interrupts the course of transmission -- indeed, it is the classic case of it. As the examples at the end of the essay indicate, the test is whether the government's copy is outside the usual course of transmission, not whether the suspect's copy is interrupted.


In many situation this is not, in fact, the case. Consider the real-world example of eavesdropping. As I listen to the conversation of my neighbours, I have not interrupted the transmission of information in any way. I a sit at a crowded room I can choose to listen to any particular conversation without interrupting any of them.

For a digital example, Ethernet (your home network, for example) is not a point-to-point protocol. All the devices connected to a LAN see all the transmissions made by all other devices. The Ethernet protocol is designed to allow pairwise communication (say, allow your computer separately send information to the printer and the cable modem), but this is achieved by having each connected device voluntarily choose to ignore information labelled as not intended for it, not by any "privacy" function in the hardware. When you plug all the devices into the a "hub", all the hub does is implement the common "shouting space" -- it does not create private point-to-point connections [devices that do this, called "switches", do exist but are rarely used for home networks].

A "packet sniffer" is the Ethernet analogue of a microphone in the middle of the crowded room. It is simply an ethernet device which does not ignore information not addressed to it. Instead, it records all information reaching it. This does not interrupt communications, because the protocol inherently transmits all the information to all the device.

The problem of Prof. Kerr's rule is a naive view of "wiretapping" as an act of introducing an intermediary device between two endpoints. In practice, many communication protocols are inherently multi-party.

For a more difficult example (technically and legally), everyday ethernet cables are simply pieces of wire carrying non-constant current. As such they function as antennas, broadcasting the information they carry as electromagnetic waves. It is not hard to receive this microwave signal, "tapping" the wire without physically interfering with the communication (this is why secure installations run their network cables through metal ducts, or use fibre-optics). This radio transmission is an inherent feature of the hardware -- receiving it is certainly does not interrupt the course of transmission.

Though my private (non-expert) view is that this kind of electromagnetic surveillance should comport with the 4th Amendment (precisely because the wire is actively broadcasting the information to everyone who wants to receive it), the Supreme Court famously disagreed in Kyllo. If there is a fundamental reason why Kyllo applies to infrared surveillance but not microwave surveillance I cannot see it.
4.15.2009 4:31pm
Lior:
I misunderstood Prof. Kerr's point -- my apologies. Surreptitious microwave reception of network signals is not "the usual course of transmission".
4.15.2009 4:47pm
David Schwartz (mail):
Lior: Then what's the test for whether something is "surreptitious" or not? Internet service providers don't normally tell me what routers my packets pass through. So it can't mean that secret.

You can't mean surreptitious in the sense of unauthorized. Otherwise, there would be no seizures on a government-owned WiFi network. And if you argue that it has to be authorized by the user, then every switch on a government-owned WiFi network 'seizes'.

I don't think "a secret copy is a seizure" works either.
4.15.2009 7:13pm
Rich Rostrom (mail):
ISTM that information fundamentally differs from physical objects in that it can be freely duplicated. Two parties can have it at the same time. If the state makes a full copy of some information, it has possession of that information; I don't see how one gets possession without seizure.
4.16.2009 12:16am
David Schwartz (mail):
RR: I think you're missing the context of what the discussion is about. If any time the government obtained something it was a seizure, then the government would be seizing my packages when I mailed them at the post office.

The issue here is when the government winds up with some information. We contend it's a seizure. The government's response is, "no, we just wound up with it without having seized it".

Normally, it would be an easy question -- do you have it or does the government have it? Did the government disrupt its flow from how you intended it to flow?

But with information, those tests fail. You have it and the government has it. The flow is not disrupted, the data still arrives at its destination without issue.

So how do you distinguish "seizure" from the government simply winding up with it from the ordinary course of its flow?

IMO, a "violation of a reasonable expectation of privacy" doctrine works very well and the proposed test (interrupts or alters the stream) do not. A wiretap is a seizure because we reasonably expect the government not to wind up with a persistent copy of the information. When I send data, even through a government-operated WiFi gateway, I reasonably expect the government not to keep a copy.

My basic argument is that the "interrupts the flow" test is circular. The government adds a new switch to their network. This switch copies data. Is this a seizure? Does it "interrupt the flow"? The flow from what? The flow from what it would have been absent a seizure? Well, we don't know, since we don't yet know if this was a seizure or not.
4.17.2009 3:00am

Post as: [Register] [Log In]

Account:
Password:
Remember info?

If you have a comment about spelling, typos, or format errors, please e-mail the poster directly rather than posting a comment.

Comment Policy: We reserve the right to edit or delete comments, and in extreme cases to ban commenters, at our discretion. Comments must be relevant and civil (and, especially, free of name-calling). We think of comment threads like dinner parties at our homes. If you make the party unpleasant for us or for others, we'd rather you went elsewhere. We're happy to see a wide range of viewpoints, but we want all of them to be expressed as politely as possible.

We realize that such a comment policy can never be evenly enforced, because we can't possibly monitor every comment equally well. Hundreds of comments are posted every day here, and we don't read them all. Those we read, we read with different degrees of attention, and in different moods. We try to be fair, but we make no promises.

And remember, it's a big Internet. If you think we were mistaken in removing your post (or, in extreme cases, in removing you) -- or if you prefer a more free-for-all approach -- there are surely plenty of ways you can still get your views out.