How the Ninth Circuit Tried To End Plain View for Computer Searches Without Ending Plain View for Computer Searches:
I think the best way to understand today's remarkable Ninth Circuit Fourth Amendment decision in United States v. Comprehensive Drug Testing is that the Ninth Circuit did its best to end the plain view exception for computer searches without formally ending plain view for computer searches. Chief Judge Kozinski's opinion created an elaborate statute-like new regime to make sure the government acts like there is no plain view exception. The decision is a workaround that effectively ends plain view for computer searches by making sure the government will never collect electronic evidence in plain view in the first place. In this post, I want to explain the basic problem and how the Ninth Circuit took some very unusual steps to solve it.
I. Particularity and Plain View
First, some context. The Fourth Amendment requires that warrants must particularly describe the place to be searched and the items to be seized. This co-called particularity requirement is designed to limit the scope of searches: Instead of conducting broad, free-ranging searches, the police have to only look in one place for only what the warrant says. One key exception to this is the plain view exception. If the police come across other evidence not described in the warrant, they can seize that evidence as well as long as it is "immediately apparent" that the item is evidence of a crime. The Supreme Court has justified this added power on the ground that if the police are lawfully in a place, they see something that is evidence, and it is so clear that the item is incriminating, they could just get a warrant at that stage anyway. Given that, the thinking goes, it makes sense to let them take it at the time rather than wait for another warrant.
Critics of the plain view exception argue that it gives the police too much power to conduct general searches. According to critics, the police would say they are searching for evidence A when really they want to poke around for evidence B, C and D, which they suspect is there but don't have enough cause to get a warrant. That would be bad, as it would no longer ensure narrow searches. The Supreme Court has responded that this is unlikely for two reasons. First, the particularly requirement makes this unlikely because it requires police have to conduct narrow searches. If the police they are only conducting narrow searches, they shouldn't have an incentive to look for other stuff. Second, the police can only search where the evidence described in the warrant physically could be located. They can't search in narrow spaces for big things, for example. According to the Court, these realities allow the plain view exception despite fears that it will allow general searches.
II. How Computers Change Particularity and Plain View
Computers change that. Computer evidence can be located anywhere on a very small storage device, and there can be no obvious shortcut for how to find the evidence sought. As a result, a search for evidence means that no place on the computer can be ruled out: A comprehensive search for the evidence in the warrant will bring almost everything into plain view. Further, electronic storage devices contain an incredible amount of information, and with changing technology, tend to store more and more every passing year. Suddenly the particularity requirement doesn't do the work it once did; suddenly the reasons for allowing the plain view exception don't really apply. As I argued in a 2005 article, Searches and Seizures in a Digital World:
III. Understanding United States v. Comprehensive Drug Testing
The Ninth Circuit did not come out and directly abolish plain view for computer searches in today's case. They really couldn't do that, as there would have been no case or controversy: The search hasn't even happened yet, at least as far as I can tell, so there isn't yet any evidence to exclude and any discussion of plain view directly would have just been dicta.
Rather than wait until a search has occurred, and then announcing such a dramatic shift then, the EZ Rider & Co. did one better: They created a set of prophylactic rules that has the effect of banning plain view through ex ante restrictions. The Ninth Circuit took a truly remarkable step: It ordered the government to behave exactly as it would behave if the plain view exception did not exist. The court wrote out a list of ways that the government would act if there were no plain view exception, and then ordered the government to follow those rules as a condition of getting the warrant in the first place. The plain view exception is gutted by ensuring the government will never be in a position to try to offer the evidence to a court in the first place.
I. Particularity and Plain View
First, some context. The Fourth Amendment requires that warrants must particularly describe the place to be searched and the items to be seized. This co-called particularity requirement is designed to limit the scope of searches: Instead of conducting broad, free-ranging searches, the police have to only look in one place for only what the warrant says. One key exception to this is the plain view exception. If the police come across other evidence not described in the warrant, they can seize that evidence as well as long as it is "immediately apparent" that the item is evidence of a crime. The Supreme Court has justified this added power on the ground that if the police are lawfully in a place, they see something that is evidence, and it is so clear that the item is incriminating, they could just get a warrant at that stage anyway. Given that, the thinking goes, it makes sense to let them take it at the time rather than wait for another warrant.
Critics of the plain view exception argue that it gives the police too much power to conduct general searches. According to critics, the police would say they are searching for evidence A when really they want to poke around for evidence B, C and D, which they suspect is there but don't have enough cause to get a warrant. That would be bad, as it would no longer ensure narrow searches. The Supreme Court has responded that this is unlikely for two reasons. First, the particularly requirement makes this unlikely because it requires police have to conduct narrow searches. If the police they are only conducting narrow searches, they shouldn't have an incentive to look for other stuff. Second, the police can only search where the evidence described in the warrant physically could be located. They can't search in narrow spaces for big things, for example. According to the Court, these realities allow the plain view exception despite fears that it will allow general searches.
II. How Computers Change Particularity and Plain View
Computers change that. Computer evidence can be located anywhere on a very small storage device, and there can be no obvious shortcut for how to find the evidence sought. As a result, a search for evidence means that no place on the computer can be ruled out: A comprehensive search for the evidence in the warrant will bring almost everything into plain view. Further, electronic storage devices contain an incredible amount of information, and with changing technology, tend to store more and more every passing year. Suddenly the particularity requirement doesn't do the work it once did; suddenly the reasons for allowing the plain view exception don't really apply. As I argued in a 2005 article, Searches and Seizures in a Digital World:
For a variety of reasons, computer technologies may allow warrants that are particular on their face to become general warrants in practice. Computers tend to play an ever greater role in our lives as computer technologies advance, as they are likely to record and store increasingly detailed pictures of our daily experience. At the same time, the particularity requirement does less and less work as the storage capacity of computer devices gets greater and greater. Even if the property described in the warrant is a very specific file or type of information, locating that information may require a broad search for technical reasons.The question is, what to do about it? In my article, I discussed a few different possibilities and ended up concluding that eventually courts will have to narrow the plain view exception for computers:
the best way to neutralize dragnet searches is to rethink the plain view exception in the context of digital evidence. The dynamics of computer searches upset the basic assumptions underlying the plain view doctrine. More and more evidence comes into plain view, and the particularity requirement no longer functions effectively as a check on dragnet searches. In this new environment, a tightening of the plain view doctrine may be necessary to ensure that computer warrants that are narrow in theory do not become broad in practice.Eventually, I argued, the solution will be to abolish plain view for computer searches entirely. It was too early to take such a step, I argued. But "in time, abolishing the plain view exception may best balance the competing needs of privacy and law enforcement in light of developments in computer technology and the digital forensics process."
III. Understanding United States v. Comprehensive Drug Testing
The Ninth Circuit did not come out and directly abolish plain view for computer searches in today's case. They really couldn't do that, as there would have been no case or controversy: The search hasn't even happened yet, at least as far as I can tell, so there isn't yet any evidence to exclude and any discussion of plain view directly would have just been dicta.
Rather than wait until a search has occurred, and then announcing such a dramatic shift then, the EZ Rider & Co. did one better: They created a set of prophylactic rules that has the effect of banning plain view through ex ante restrictions. The Ninth Circuit took a truly remarkable step: It ordered the government to behave exactly as it would behave if the plain view exception did not exist. The court wrote out a list of ways that the government would act if there were no plain view exception, and then ordered the government to follow those rules as a condition of getting the warrant in the first place. The plain view exception is gutted by ensuring the government will never be in a position to try to offer the evidence to a court in the first place.
Related Posts (on one page):
- What Happens When Comprehensive Drug Testing Meets the New Rule 41?:
- An Interesting Consequence of United States v. Comprehensive Drug Testing:
- How the Ninth Circuit Tried To End Plain View for Computer Searches Without Ending Plain View for Computer Searches:
- Do Magistrate Judges Have a Power to Refuse To Sign Warrants Based on Expectations of How a Warrant Would be Executed?:
- Ninth Circuit Enacts Miranda-Like Code for Computer Search and Seizure:
- Ninth Circuit Hands Down En Banc Decision in United States v. Comprehensive Drug Testing:
- Oral Argument in United States v. Comprehensive Drug Testing:
- An Analysis of United States v. Comprehensive Drug Testing:
Grubbs allows judges to put conditions precedent on warrants, so why can't they impose the conditions precedent or subsequent here? Essentially issueing two warrants, one for the house and one for the computer?
Why is that? The way I see it, you can't "view" anything on a storage device except by intentionally opening it. The content of files (as distinguished from the meta-data) are entirely hidden until look inside them -- almost exactly in analogy to a closed container.
I'm tempted to come to the exact opposite conclusion then -- that nothing on a storage device can come into plain view.
Just as aside, this is already the order of battle in civil suits where personal computers are subject to subpoena. I can dig up the cite, if you like (IIRC, involving a strike a Northwest Airlines).
Sorry I wasn't clear: everything comes into plain view *when the computer is searched.*
When you are searching a computer (or a copy of the storage device) you can plainly view all the metadata (file names, size, date modified) but you cannot possibly view the content of the file without deliberately and intentionally doing so.
That is to say, searching a computer is analogous to searching a large warehouse with many many boxes, each of which has on the exterior some labels and some content in the interiors. As I understand the 4A, plain view of the content of the boxes (in meatspace) would not be allowed as plain view unless it was apparent from the exterior that they were incriminating.
The relevant part is reproduced here [PDF].
However, I have a question somewhat tangential to the OP. Assuming a valid search warrant for computer records containing specific data, say, financial transactions identified by account name or number, for instance, the only way to identify the specific records sought might be to open and review those files capable of containing the data. I can see that examining all of the image files on a hard drive, while ostensibly searching for a bank record, is a reach (unless you can articulate grounds for believing there is a picture of the records extant). However, opening and reviewing speadsheets (or electronic email confirmations, or whatever the original supporting affidavit describes) would seem no different that opening a file cabinet and reviewing paper files, looking for the specific files described and authorized for S &S. Under these circumstances, if the investigator/reviewer reviews a file and discovers evidence of new crime, I do not see why this should be disallowed only when the media is electronic rather than paper.
Could it be that this objection to "plain view" search and seizure of electronic media is actually predicated in the method sometimes (often?) used in the actually mapping of the hard drive, and then predictive programs used to locate contraband (usually pornography)? Would it change the dynamics if someone actually sat at a computer, and physically opened and reviewed those files which met some criteria as defined by warrant?
Having read some of Orin's law review articles... I wonder if he is advocating a similar line between content an noncontent.
Orin:
Great article and a lot of food for thought.
It is a trivial matter to "grep" the contents of a hard drive for a particular string that one is looking for. In your hypothetical, you can grep for the account number and look at the content of only such files that have at least one match.
As to image files, following your logic here would implicate every file on the system since arbitrary data can be hidden in any file -- thus, in your hypothetical, the government could inspect every executable, sound file, movie file, library file and so forth because they *could* contain evidence of financial crimes.
I actually don't know enough about the 4A to assess the soundness of this line of thought. In meatspace, can the government seize and inspect items that seem innocent simply because it is theoretically possible that it contains incriminating evidence? For instance, if my house is searched for evidence of running an illegal betting operation, can my photo album be seized because the placement of photos might be relevant (e.g. Joe on the right column of page 15 means he owes me $1500)?
You must read "everything" mean something different than mine. I interpreted his statement to read that once you are looking at a storage device, the contents of each and every file is essentially plain-view.
If they can look into the boxes for the item they're authorized to search for, then anything they see comes in under the plain view rule, regardless of what the exterior says. Obviously if they can't look into the boxes -- say, if they're looking for a stolen car, and the boxes are only the size of a shoebox -- then the plain view rule wouldn't help them.
Yeah, I thought about that -- it's one of dozens of loose ends floating around the opinion.
Having read some of Orin's law review articles... I wonder if he is advocating a similar line between content an noncontent.
No. Everything on a personal computer is protected by the Fourth Amendment: There's no content/non-content distinction.
When you are searching a computer (or a copy of the storage device) you can plainly view all the metadata (file names, size, date modified) but you cannot possibly view the content of the file without deliberately and intentionally doing so.
I don't know what you mean by this. Is that your experience as a user? Your experience using computer forensic software like EnCase? Plus, the issue isn't whether you know it's content or non-content information, because warrants don't draw the distinction.
Imagine that you have a threat case, and there is probable cause to believe that suspect A sent the threat from a computer at home. The warrant would ask for "evidence of the threat, information as to when a threat was sent, and other evidence of a threat offense that is a violation of 18 USC 875(c)." How would you search the computer for that evidence in a way that does not bring any other evidence of any other crime into plain view? See my article for the argument that there is no way to know this in advance.
If I can search your house for firearms, the carpet is in plain view. Does that mean I can chemically test every square inch for cocaine residue and then argue the residue was in "plain view"?
The search for the listed items must bring things into plain view, and not because the depth of the search was widened beyond what the listed items reasonably justified.
Surely the fourth amendment not only permits but requires searches be no more intrusive than the probable cause justifies. Searching for ammunition in someone's rectum is unusually intrusive and some unusual justification would be needed.
Someone hiding a threat in a folder called "My Pictures" (assuming the threat didn't involve a picture) is as unusual as someone hiding ammunition in their rectum. There's simply no reason to search there.
As best I can tell, we're debating two issues: You're arguing what you think the Fourth Amendment should mean, and I'm arguing what the thousands of Fourth Amendment cases say it does mean.
As for your strip search example, it's such a strange example given all the cases on that issue: Are you saying that you disagree with those cases?
My understanding is plain view exception only allows the police to seize items whose incriminating character is immediately apparent. So in this hypo, no, they can't take the photo album (assuming it's not among the items listed with particularity in the warrant along with facts supporting probable cause to believe that it will be evidence of some crime).
(In theory. In practice, from most of the warrants I've seen, which basically copy and paste boilerplate from one affidavit to the next, more likely is that if they're investigating an illegal betting operation, the warrant is going to have been written broadly enough to include "photos, documents, etc. etc. that may show ownership of the premises" or something similarly capacious that will basically let them get whatever they want.)
This doesn't bode well for computer searches then, because any evidence can be hidden in any file. So effectively they can look into every file and whatever they happen to see is plain view.
Thanks for the explanation -- which gets directly to the heart of the problem that the 9CA was (by improper means) attempting to address.
Absolutely agree. The distinction comes not in the degree of protection but in the fact that o
I mean, one cannot view the contents of "~OKerr/Docs/PlansForSept09.txt" accidentally. Whether you use fancy forensic software or just mount the drive on your local system, one can only view the content of that file by intentionally opening it.
By contrast one could legitimately, in the course of searching for "~Okerr/Docs/PlansForJan09.txt" (perhaps he allegedly committed a crime in that month), make a list of all the files in the docs folder, which would reveal the existence of the "PlansForSep09" file.
This is a bit jumbled in my head right now, but I'm working on clearing it up.
How is "ownership of the premises" evidence of (or even relevant to) the existence of an illegal betting operation?
I agree with you that a magistrate cannot impose these conditions. Your cites convinced me that this is the law, whether or not it should be the law.
However, I still think it violates the fourth amendment to make the search unreasonably intrusive or destructive absent unusual probable cause that justifies it.
Cites please.
I don't understand this. Are you saying that if a warrant mentions ammunition the police *can* strip-search all the occupants on the grounds that they may have ammunition in their rectum?
I'm saying that there are cases on whether and when the police can strip search individuals for evidence when they execute a warrant. See, e,g., Williams v. Kaufman County, 352 F.3d 994 (5th Cir. 2003). Maybe I am insufficiently academic in my approach, but I just think we would do better by looking at the cases.
I understand what you are saying but I still wonder some unusual elements.
BTW, I have so me limited experience with a suite of forensic software called, appropriately enough, The Coroner's Toolkit. This software, btw, does make a content/metadata distinction in that the tools are almost entirely designed to look for hidden content (deleted and partially overwritten files, data intentionally hidden in normally unusable disk addresses, etc). They are the best tools I have to conduct a post-incident investigation (for example, due to unauthorized access to the computer systems).
However, I was thinking of a different case. Suppose one has a search warrant for searching for financial information relating to drug sales. In such a warrant we might reasonably conclude that each file is the equivalent of a closed box. Even though everything is "inside" the box for the purpose of plain view, when executing such a warrant, not everything in the computer might be subject. For example, it might be reasonable to require that files be filtered out by magic number, xml schema spec, etc. In this case, we might conclude that police conducing detailed examinations of jpegs n order to look for CP might still be outside the bounds of the warrant.
This is from the 5CA, affirming the award of damages.
Its functionality in civil trials (see Northwest Airlines v. Teamsters, cited above) undercuts that assertion.
Oren: your argument about not being able to view file content without an intentional action to do so isn't necessarily true, particularly wrt images. Many people have their computers set to display any images in a directory in thumbnail size. Suppose a police officer went to a computer, opened 'My Documents', and saw a thumbnail size child porn image? The OS has taken the liberty of displaying the image automatically (as per the user's configuration of course); the police officer hasn't taken any action beyond viewing metadata, which you seem to think is OK.
At the same time, we all agree that "while the warrant must state with particularity the materials to be seized from a computer, the warrant need not specify how the computers will be searched".
So then we are at a point where the government can seize items to which it is not entitled to search (inverting the usual scheme) but the government may search it in a manner that reveals that information because the magistrate cannot specify the manner of the search.
Then he was tampering with evidence and the whole thing gets thrown out anyway. The basic principle of computer forensics is that the first task is to make a read-only disk image that one can testify is an exact record of the state of the hard drive at the time of the search.
Does this happen IRL, or is this your preference?
i don't think this is true at all. if i'm doing something illegal, hacking into other computers for example, i'm not going to store all of the files in a folder marked "illegal hacking files". i'll instead store it in a folder named "boring school stuff" or "pictures of grandma in a bikini" or something mundane. just ask any male college student where they store their porn. i doubt most of them keep it in a folder named "porn"...it'll be too easy for someone at there computer to accidentally find.
You seem to be making an assumption (re: "My Documents/Pictures" and the like) that the file system's representation of organization has anything to do with the data on disk; the contents of that data; or the location of that data.
That is a huge fallacy, and I really can't go into why, other than to say that the organizational structure and location of data (what is commonly called a filesystem) is just a specific area of data on a hard drive, in a known or computed location. You could easily have a text document, that in terms of actual storage on disk, is spread between 15, 20, or more places. Next to one of those places could be an image. Next to another could be a video, or parts of video, image, or other document data - there is no way to know, except to either look; or to trust the filesystem's representation of the data/ And you should never really trust a filesystem's representation of data; it is too easy to hide or obscure things.
I would think law enforcement would prefer a regime where the threshold for searching for the evidence you really want is low in exchange for protections against exposing private information inadvertently stumbled on. If police and law enforcement oppose such rules, it is strong indication that their real motives for warrants are the hopes of stumbling on evidence for which they do not have probable cause.
In any event, I think your argument is self-defeating. If a person expects the warrant, they can just as well encrypt the data or otherwise make it inaccessible to law enforcement totally. So you also cut against the expectation that the evidence will be there at all.
If the police want to strip search everyone on the premises in a search for illegal ammunition, we might reasonably suspect they're really looking for drugs. So we might strike a reasonable deal with them -- you can perform the more invasive search, but in exchange you most give up the ability to use the evidence for other crimes and protect the privacy of those searched. Otherwise, you don't get to strip search.
This especially applies in the computer context where the government will ask for techniques that are easier for it to perform (copy the whole hard disk and take it to a lab rather than search on the premises) but also have greater collateral risks to privacy. I think it's quite reasonable to let the government do the search the convenient way, but in exchange they give up the extra information they wouldn't have if they did it the harder way. Otherwise, make them do it the hard way.
Privacy is that important, especially when we're talking the privacy of totally innocent (of any of the crimes the warrant intentionally relates to) third parties. (As was the case in this case.)
That isn't a link and I can't get to it. Why not just answer the question instead?
(And to avoid nitpicking over words, let's phrase it this way: if the police have a warrant for ammunition, can they search anything at all bigger than a bullet--body cavities, smashing all appliances, killing the family pet--solely on the grounds that ammunition can fit inside?)
If that theory catches on, I'm moving all my threats to 'My Pictures'.
I'll risk leaving the ammo in the cabinet for now, though.
Seriously - I don't see how you can use a directory structure to guide/limit a search. I have never used any of the default ('My Documents', 'My Pictures', etc) directories - I lay out a structure that works for me. People don't hide rifles in cereal boxes because they can't, but if hiding the cooked books from searchers is as simple as renaming MyDocs/Financial/Cooked.xls to FamilyFotos/YellowStone08/OldFaithful.png, people will do it.
Considering that many of these computer crime cases involve "finding" CP while looking for something else, this is something specific that should be addressed - if you see the thumbnail, what are you supposed to do with it, if it looks like CP or evidence of a murder, etc?
I would tend to agree that technology change has upended traditional 4th amendment considerations and has rendered the the plain view doctrine obsolete in much the same way that the invention of the telephone was found to have rendered previous location-focused distinctions obsolete in Katz.
However, I would also tend to agree that a Court of Appeals has no authority to overrule decisions of the Court of Appeals simply because it thinks them obselete. Were the Supreme Court to do what the 9th Circuit wants, it might encourage future rebellions. The Supreme Court might do better vacating and remanding to the 9th Circuit with a terse message it instructing it to apply its precedents, and then taking a case from a circuit court of appeals which has been willing to follow the law in order to decide the question.
The North Carolina Supreme Court, faced with a Court of Appeals that had just claimed authority to abolish the torts of alienation of affection and criminal conversation over state Supreme Court decisions holding them to be good law, issued such a terse message in Canon v. Miller, 313 N.C. 324, 327 S.E.2d 888 (1985).
The better course would be to apply precedent, then add an appendix explaining why the court thinks the precedent obsolete and asking the U.S. Supreme Court to take the case and review it.
As I understand it, the law treats things as they work, not at some trivial level. "Gee your honor, if you start reading at offset 0x2b400 it's child porn, but if you start at offset 0x4a000, it's just junk." is not a valid defense.
Apply for a second warrant at your soonest convenience.
Well said.
Does part of the plain view search allow for collecting evidence of those not named in the warrant?
You've not only confused me, but used an approach to law that I find methodologically insupportable.
What the heck is this? Oren is just restating the 9th's circuit's own justification for its rules. The 9th circuit doesn't need cites to interpret the meaning and applicability of the fourth amendment. Interpreting said meaning and applicability is its *job*. Now, it should not ignore precedent from the Supreme Court that disagrees, but from what you've posted, as far as I can tell there isn't any beyond the "plain view" doctrine - and this whole argument is about what is or is not "plain view".
The whole point of the fourth amendment is to limit the government's ability to search whatever they want. If, in an electronic environment, the government can search all the info on your computer while searching for *anything* on your computer, the fourth amendment has been functionally eliminated for everything electronically stored.
The plain view exception is for things that are 'immediately obvious' that they are a crime, found without taking any actions beyond what was neccessary to implement the original probable cause search.
Copying all the data from a hard drive and rummaging through it back at HQ indiscriminately is nothing like seeing cocaine on the table at someone's house. It's more like using a search warrant to load everything someone owns onto a truck, bringing it back to HQ, and putting every square inch of all property to months-long forensic analysis for evidence of any crime.
Secondly, Orin - please try to remember that laymen with an interest in the law also read this blog. Don't just dismiss an argument by saying "see Case X". I'm interested enough in law to read your summaries, but not to spend hours hunting through massive data libraries for random cases and then reading 100-page legalese decisions. If you argue by saying "See Case X", you should at least describe the gist of the argument made there, or I, for one, will disregard it. It becomes an appeal to authority, a basic logical fallacy.
Isn't it a perfectly good argument that the 9th is really ending the perversion of the plain view argument beyond the Supreme Court's intent by law enforcement, rather than the plain view argument itself?
Alternatively, isn't there a good argument that in 1970s, when the plain view document was made, the electronic realm's differences, simply by looking at chronology, were impossible to consider at that time? In that case, this judgement on the applicability of that doctrine in a new domain is *extremely* appropriate for the 9th circuit.
As long as Scalia flips - isn't he a constitutional originalist? - this should be able to get 5 votes. Dissenters are Thomas, Roberts, Alito, and Breyer.
"It is a trivial matter to "grep" the contents of a hard drive for a particular string that one is looking for. In your hypothetical, you can grep for the account number and look at the content of only such files that have at least one match. "
I guess that was my point. If, upon opening only those files which meet some initial match, the investigator finds evidence of crime but which was not specified by the original warrant, why would he/she be precluded from obtaining a new warrant based on this observation? Isn't that what the 9th has just done?
"As to image files, following your logic here would implicate every file on the system since arbitrary data can be hidden in any file -- thus, in your hypothetical, the government could inspect every executable, sound file, movie file, library file and so forth because they *could* contain evidence of financial crimes. "
Sorry, guess I was not very clear. My thought here was that such would not be allowable unless and until the investigator could articulate a specific basis for thinking, as in our example say, that financial data would be included in a graphics file, or so other non-intuitive chain. I think one of the better known cases of this genre has to do with investigators searching a computer for evidence of drug dealing, and discovering child porn, ostensibly via a thumbnail which was "plain view."
However, I also think that a search of a computer these days in hardly ever done in this fashion, i.e. someone actually sitting at the keyboard and selecting files and viewing them. Typically, the hard drive is mirrored, scanned and predictive search engines used. I was suggesting that the complete mapping and listing of the contents was what lead to the suggestion that the "plain view" exception was turning into a everyday occurrence, by choice and design, and was what lead to this rather ridiculous ruling from the CCA. But maybe I misunderstood the HLR article cited by the OP.
Not a computer forensics expert, but if searchers typically search for fragments of deleted files, etc, then I would think the distinction is less clear.
The government (especially Jeff Novitzky - also SF DA Nedrow) played fast and loose with the warrants in this case - going around Judge Illston's rulings and finding a friendly judge at the very moment one of their warrants is being challenged in another court.
I'm not a lawyer, but all I see is a massive government operation of abuse of the law, courts and power simply to slime Barry Bonds because the perjury case is weak and they want revenge in the court of public opinion.
The question though here is what "unreasonable" would mean in that case. There seems to be a long line of cases which suggest, for example, that when a car or business is searched that individuals which happen to be in the business or car but are not named on the warrant cannot be searched under that warrant. Ybarra v. Illinois was interestingly based on one of Justice Jackson's opinions (United States v. Di Re). I am wondering if Orin Kerr seems to think these have been overruled.
From Justice Jackson's opinion:
In essence I don't think Justice Jackson, and the majority in Di Re saw any significant difference between searching persons in a house and persons in a car, or that search powers (either via warrant or warrant exceptions) would be sufficiently contageous as to allow searching of persons who happen to be within areas described in the warrant where no other grounds allowed for them to search.
However, I think a lot of this gets back to the problems of particularity though in computer searches. I think that a lot of the doctrines COULD be applied. For example:
1) Plain view exception: This could be limited to what is IMMEDIATELY APPARENT on the desktop without any intervention by officer when computer is not listed on warrant. I.e. screen savers obstruct plain view.
2) When a computer is searched there might be particularity requirements. However, when searching for financial data, file names and other non-content information might be considered to be "in plain view" but it might not allow content-related data to be searched without being sufficiently particular. Nor would swap space be initially searchable unless specifically covered under the warrant.
In short I am thinking about boxes inside boxes and what is "inside" in one context might be "outside" in another.
The thing is, the tools I work with to investigate rootkits, etc. are EVEN MORE INTRUSIVE than I suspect OK expects. I can look not just for deliberately hidden or deleted information but also what sorts of activity the computer was doing prior to being shut down (I can look inside memory pages that were swapped to disk and not overwritten later to construct a partial picture of what the computer was doing, what files were open, etc. prior to shutdown).
Most people have absolutely no idea what sorts of information the hard drive contains, and it isn't just limited to files which have, at one point, been saved to it.
Re: Stiller's comment above re: Grubbs, I don't think the analogy holds here. Grubbs concerned anticipatory warrants, cases in which PC does not exist unless and until the specified condition is satisfied (ex: agents see the target bring the package containing child pornography into his house). Grubbs allows a magistrate to use conditions to determine whether a search is permitted at all; it is not a open grant of discretion for a magistrate to impose his/her own conditions as to how the search will be carried out.
So a search is conditioned on only reviewing the 10 customer files on the server where probable cause exists but not the records of the other 1000 customers, where there is none.
The court's proposed future remedy, however, seems right to me only if Congress decides to make that the law. Otherwise, the remedy has to be after the right is violated.
The data is still organized into distinct chunks, even if those chunks are stored on a block device.
??
So an officer is looking through a filing cabinet for evidence of drug dealing. He sees two folders, one is marked "N. Accounting" and the other is marked "porn." He opens up the N. Accounting to find it is full of materials relating to the sales of narcotics.
If he opens up the "porn" folder and finds out it is child pornography, does that fall inside the plain view exception? I would assume so, but I don't formally know.
The problem here is that the hard drive can be seen as a filing cabinet. Those discrete chunks require further analysis to determine what they are. This involves opening them up and looking at them, either through human means or via automatic tools. Either way they are already being opened and searched.
In particular both Ybarra and Di Re hold that separate analysis exists for an individual searched when premises are searched.
I.e. a Terry frisk in Ybarra was proper, but opening the container found in his pocket was even though he was on the premises, was not authorized by the warrant.
In Di Re, the police had probable cause to search a car and one suspect in a car, but erred in searching a second occupant in the car.
These suggest that, unless these cases have been overturned, that one can't strip search all occupants in a building merely because you have an warrant to search a building for ammunition.
If you have a comment about spelling, typos, or format errors, please e-mail the poster directly rather than posting a comment.
Comment Policy: We reserve the right to edit or delete comments, and in extreme cases to ban commenters, at our discretion. Comments must be relevant and civil (and, especially, free of name-calling). We think of comment threads like dinner parties at our homes. If you make the party unpleasant for us or for others, we'd rather you went elsewhere. We're happy to see a wide range of viewpoints, but we want all of them to be expressed as politely as possible.
We realize that such a comment policy can never be evenly enforced, because we can't possibly monitor every comment equally well. Hundreds of comments are posted every day here, and we don't read them all. Those we read, we read with different degrees of attention, and in different moods. We try to be fair, but we make no promises.
And remember, it's a big Internet. If you think we were mistaken in removing your post (or, in extreme cases, in removing you) -- or if you prefer a more free-for-all approach -- there are surely plenty of ways you can still get your views out.