pageok
pageok
pageok
How the Ninth Circuit Tried To End Plain View for Computer Searches Without Ending Plain View for Computer Searches:
I think the best way to understand today's remarkable Ninth Circuit Fourth Amendment decision in United States v. Comprehensive Drug Testing is that the Ninth Circuit did its best to end the plain view exception for computer searches without formally ending plain view for computer searches. Chief Judge Kozinski's opinion created an elaborate statute-like new regime to make sure the government acts like there is no plain view exception. The decision is a workaround that effectively ends plain view for computer searches by making sure the government will never collect electronic evidence in plain view in the first place. In this post, I want to explain the basic problem and how the Ninth Circuit took some very unusual steps to solve it.

I. Particularity and Plain View

  First, some context. The Fourth Amendment requires that warrants must particularly describe the place to be searched and the items to be seized. This co-called particularity requirement is designed to limit the scope of searches: Instead of conducting broad, free-ranging searches, the police have to only look in one place for only what the warrant says. One key exception to this is the plain view exception. If the police come across other evidence not described in the warrant, they can seize that evidence as well as long as it is "immediately apparent" that the item is evidence of a crime. The Supreme Court has justified this added power on the ground that if the police are lawfully in a place, they see something that is evidence, and it is so clear that the item is incriminating, they could just get a warrant at that stage anyway. Given that, the thinking goes, it makes sense to let them take it at the time rather than wait for another warrant.

  Critics of the plain view exception argue that it gives the police too much power to conduct general searches. According to critics, the police would say they are searching for evidence A when really they want to poke around for evidence B, C and D, which they suspect is there but don't have enough cause to get a warrant. That would be bad, as it would no longer ensure narrow searches. The Supreme Court has responded that this is unlikely for two reasons. First, the particularly requirement makes this unlikely because it requires police have to conduct narrow searches. If the police they are only conducting narrow searches, they shouldn't have an incentive to look for other stuff. Second, the police can only search where the evidence described in the warrant physically could be located. They can't search in narrow spaces for big things, for example. According to the Court, these realities allow the plain view exception despite fears that it will allow general searches.

II. How Computers Change Particularity and Plain View

  Computers change that. Computer evidence can be located anywhere on a very small storage device, and there can be no obvious shortcut for how to find the evidence sought. As a result, a search for evidence means that no place on the computer can be ruled out: A comprehensive search for the evidence in the warrant will bring almost everything into plain view. Further, electronic storage devices contain an incredible amount of information, and with changing technology, tend to store more and more every passing year. Suddenly the particularity requirement doesn't do the work it once did; suddenly the reasons for allowing the plain view exception don't really apply. As I argued in a 2005 article, Searches and Seizures in a Digital World:
For a variety of reasons, computer technologies may allow warrants that are particular on their face to become general warrants in practice. Computers tend to play an ever greater role in our lives as computer technologies advance, as they are likely to record and store increasingly detailed pictures of our daily experience. At the same time, the particularity requirement does less and less work as the storage capacity of computer devices gets greater and greater. Even if the property described in the warrant is a very specific file or type of information, locating that information may require a broad search for technical reasons.
  The question is, what to do about it? In my article, I discussed a few different possibilities and ended up concluding that eventually courts will have to narrow the plain view exception for computers:
the best way to neutralize dragnet searches is to rethink the plain view exception in the context of digital evidence. The dynamics of computer searches upset the basic assumptions underlying the plain view doctrine. More and more evidence comes into plain view, and the particularity requirement no longer functions effectively as a check on dragnet searches. In this new environment, a tightening of the plain view doctrine may be necessary to ensure that computer warrants that are narrow in theory do not become broad in practice.
  Eventually, I argued, the solution will be to abolish plain view for computer searches entirely. It was too early to take such a step, I argued. But "in time, abolishing the plain view exception may best balance the competing needs of privacy and law enforcement in light of developments in computer technology and the digital forensics process."

III. Understanding United States v. Comprehensive Drug Testing

  The Ninth Circuit did not come out and directly abolish plain view for computer searches in today's case. They really couldn't do that, as there would have been no case or controversy: The search hasn't even happened yet, at least as far as I can tell, so there isn't yet any evidence to exclude and any discussion of plain view directly would have just been dicta.

  Rather than wait until a search has occurred, and then announcing such a dramatic shift then, the EZ Rider & Co. did one better: They created a set of prophylactic rules that has the effect of banning plain view through ex ante restrictions. The Ninth Circuit took a truly remarkable step: It ordered the government to behave exactly as it would behave if the plain view exception did not exist. The court wrote out a list of ways that the government would act if there were no plain view exception, and then ordered the government to follow those rules as a condition of getting the warrant in the first place. The plain view exception is gutted by ensuring the government will never be in a position to try to offer the evidence to a court in the first place.

Stiller:
I asked these in the other post:

Grubbs allows judges to put conditions precedent on warrants, so why can't they impose the conditions precedent or subsequent here? Essentially issueing two warrants, one for the house and one for the computer?
8.26.2009 8:57pm
Oren:
Thanks for the illuminating post!

Computers change that. Computer evidence can be located anywhere on a very small storage device, and there can be no obvious shortcut for how to find the evidence sought, meaning that almost everything can come into plain view.

Why is that? The way I see it, you can't "view" anything on a storage device except by intentionally opening it. The content of files (as distinguished from the meta-data) are entirely hidden until look inside them -- almost exactly in analogy to a closed container.

I'm tempted to come to the exact opposite conclusion then -- that nothing on a storage device can come into plain view.


Then, the forensic search either will be undertaken by a third party who won't share the evidence with the government or else a government forensic agent who can't share the evidence with investigators. All evidence has to be returned, or in the case of contraband, destroyed.

Just as aside, this is already the order of battle in civil suits where personal computers are subject to subpoena. I can dig up the cite, if you like (IIRC, involving a strike a Northwest Airlines).
8.26.2009 8:59pm
OrinKerr:
I'm tempted to come to the exact opposite conclusion then -- that nothing on a storage device can come into plain view.

Sorry I wasn't clear: everything comes into plain view *when the computer is searched.*
8.26.2009 9:01pm
Oren:

Sorry I wasn't clear: everything comes into plain view *when the computer is searched.*

When you are searching a computer (or a copy of the storage device) you can plainly view all the metadata (file names, size, date modified) but you cannot possibly view the content of the file without deliberately and intentionally doing so.

That is to say, searching a computer is analogous to searching a large warehouse with many many boxes, each of which has on the exterior some labels and some content in the interiors. As I understand the 4A, plain view of the content of the boxes (in meatspace) would not be allowed as plain view unless it was apparent from the exterior that they were incriminating.
8.26.2009 9:11pm
Oren:
Cite for my earlier proposition --

Northwest Airlines, Inc., Plaintiff; v. Local 2000, International, Brotherhood of Teamsters, AFL-CIO, et al., Defendants.
2000 U.S. Dist. LEXIS 22638

The relevant part is reproduced here [PDF].
8.26.2009 9:14pm
jccamp (mail):
I understand and agree with the premise of the OP. It seems as though the judges are preemptively ruling, universally and without considering particular circumstances, than any search of electronic media cannot discover evidence not specified by the existing warrant. There is a procedure for exactly that contingency. Why not utilize it? Moreover, the judges have moved the requirements for warrant issuance beyond that required by Constitution, and without authority of statute. I think this beyond is the 9's bailiwick.

However, I have a question somewhat tangential to the OP. Assuming a valid search warrant for computer records containing specific data, say, financial transactions identified by account name or number, for instance, the only way to identify the specific records sought might be to open and review those files capable of containing the data. I can see that examining all of the image files on a hard drive, while ostensibly searching for a bank record, is a reach (unless you can articulate grounds for believing there is a picture of the records extant). However, opening and reviewing speadsheets (or electronic email confirmations, or whatever the original supporting affidavit describes) would seem no different that opening a file cabinet and reviewing paper files, looking for the specific files described and authorized for S &S. Under these circumstances, if the investigator/reviewer reviews a file and discovers evidence of new crime, I do not see why this should be disallowed only when the media is electronic rather than paper.

Could it be that this objection to "plain view" search and seizure of electronic media is actually predicated in the method sometimes (often?) used in the actually mapping of the hard drive, and then predictive programs used to locate contraband (usually pornography)? Would it change the dynamics if someone actually sat at a computer, and physically opened and reviewed those files which met some criteria as defined by warrant?
8.26.2009 9:31pm
krs:
Thanks for the post. This is better than law school.
8.26.2009 9:33pm
einhverfr (mail) (www):
Oren:

Having read some of Orin's law review articles... I wonder if he is advocating a similar line between content an noncontent.

Orin:

Great article and a lot of food for thought.
8.26.2009 9:54pm
Occasional Lurker:
Orin, does this case intersect with Payton or change the way you think about Payton?
8.26.2009 9:57pm
Oren:

Assuming a valid search warrant for computer records containing specific data, say, financial transactions identified by account name or number, for instance, the only way to identify the specific records sought might be to open and review those files capable of containing the data.
[SNIP]
Under these circumstances, if the investigator/reviewer reviews a file and discovers evidence of new crime, I do not see why this should be disallowed only when the media is electronic rather than paper.

It is a trivial matter to "grep" the contents of a hard drive for a particular string that one is looking for. In your hypothetical, you can grep for the account number and look at the content of only such files that have at least one match.

As to image files, following your logic here would implicate every file on the system since arbitrary data can be hidden in any file -- thus, in your hypothetical, the government could inspect every executable, sound file, movie file, library file and so forth because they *could* contain evidence of financial crimes.

I actually don't know enough about the 4A to assess the soundness of this line of thought. In meatspace, can the government seize and inspect items that seem innocent simply because it is theoretically possible that it contains incriminating evidence? For instance, if my house is searched for evidence of running an illegal betting operation, can my photo album be seized because the placement of photos might be relevant (e.g. Joe on the right column of page 15 means he owes me $1500)?
8.26.2009 10:10pm
Oren:

Having read some of Orin's law review articles... I wonder if he is advocating a similar line between content an noncontent.

You must read "everything" mean something different than mine. I interpreted his statement to read that once you are looking at a storage device, the contents of each and every file is essentially plain-view.
8.26.2009 10:11pm
John (mail):
You seem to be saying that (a) info on a disk is very dense and that therefore (b) virtually everything is in plain view. I think this is a non-sequitur, but even granting that everything is in plain view, so what? As I understand the prior Supreme Court law, the Fourth Amendment is not violated if the stuff is in plain view. If anybody wants to give new rights to suspects, that's fine--we have legislatures to do that. We have legislatures whose JOB is to say, "look, what's going on here doesn't violate your constitutional rights, but we think you ought to be protected anyway." Is it still lame to suggest that that is not the role of judges?
8.26.2009 10:15pm
David M. Nieporent (www):
That is to say, searching a computer is analogous to searching a large warehouse with many many boxes, each of which has on the exterior some labels and some content in the interiors. As I understand the 4A, plain view of the content of the boxes (in meatspace) would not be allowed as plain view unless it was apparent from the exterior that they were incriminating.
No. The plain view test is not whether someone looking at the premises from a distance can see an item. The test is whether the police, in the course of conducting their authorized search, can see an item.

If they can look into the boxes for the item they're authorized to search for, then anything they see comes in under the plain view rule, regardless of what the exterior says. Obviously if they can't look into the boxes -- say, if they're looking for a stolen car, and the boxes are only the size of a shoebox -- then the plain view rule wouldn't help them.
8.26.2009 10:20pm
OrinKerr:
Orin, does this case intersect with Payton or change the way you think about Payton?

Yeah, I thought about that -- it's one of dozens of loose ends floating around the opinion.

Having read some of Orin's law review articles... I wonder if he is advocating a similar line between content an noncontent.

No. Everything on a personal computer is protected by the Fourth Amendment: There's no content/non-content distinction.

When you are searching a computer (or a copy of the storage device) you can plainly view all the metadata (file names, size, date modified) but you cannot possibly view the content of the file without deliberately and intentionally doing so.

I don't know what you mean by this. Is that your experience as a user? Your experience using computer forensic software like EnCase? Plus, the issue isn't whether you know it's content or non-content information, because warrants don't draw the distinction.

Imagine that you have a threat case, and there is probable cause to believe that suspect A sent the threat from a computer at home. The warrant would ask for "evidence of the threat, information as to when a threat was sent, and other evidence of a threat offense that is a violation of 18 USC 875(c)." How would you search the computer for that evidence in a way that does not bring any other evidence of any other crime into plain view? See my article for the argument that there is no way to know this in advance.
8.26.2009 10:20pm
David Schwartz (mail):
In a search, one can bring anything into plain view by searching the right way. The question is whether the fourth amendment requires that the search be no more intrusive than reasonably necessary to find the items for which there is probable cause.

If I can search your house for firearms, the carpet is in plain view. Does that mean I can chemically test every square inch for cocaine residue and then argue the residue was in "plain view"?

The search for the listed items must bring things into plain view, and not because the depth of the search was widened beyond what the listed items reasonably justified.
8.26.2009 10:22pm
David Schwartz (mail):
Imagine that you have a threat case, and there is probable cause to believe that suspect A sent the threat from a computer at home. The warrant would ask for "evidence of the threat, information as to when a threat was sent, and other evidence of a threat offense that is a violation of 18 USC 875(c)." How would you search the computer for that evidence in a way that does not bring any other evidence of any other crime into plain view? See my article for the argument that there is no way to know this in advance.
You seem to be back to arguing that every warrant for illegal ammunition permits strip searching all the occupants. After all, how can you know in advance that the ammunition won't be hidden in someone's rectum?

Surely the fourth amendment not only permits but requires searches be no more intrusive than the probable cause justifies. Searching for ammunition in someone's rectum is unusually intrusive and some unusual justification would be needed.

Someone hiding a threat in a folder called "My Pictures" (assuming the threat didn't involve a picture) is as unusual as someone hiding ammunition in their rectum. There's simply no reason to search there.
8.26.2009 10:26pm
OrinKerr:
David,

As best I can tell, we're debating two issues: You're arguing what you think the Fourth Amendment should mean, and I'm arguing what the thousands of Fourth Amendment cases say it does mean.

As for your strip search example, it's such a strange example given all the cases on that issue: Are you saying that you disagree with those cases?
8.26.2009 10:39pm
law student:

I actually don't know enough about the 4A to assess the soundness of this line of thought. In meatspace, can the government seize and inspect items that seem innocent simply because it is theoretically possible that it contains incriminating evidence? For instance, if my house is searched for evidence of running an illegal betting operation, can my photo album be seized because the placement of photos might be relevant (e.g. Joe on the right column of page 15 means he owes me $1500)?


My understanding is plain view exception only allows the police to seize items whose incriminating character is immediately apparent. So in this hypo, no, they can't take the photo album (assuming it's not among the items listed with particularity in the warrant along with facts supporting probable cause to believe that it will be evidence of some crime).

(In theory. In practice, from most of the warrants I've seen, which basically copy and paste boilerplate from one affidavit to the next, more likely is that if they're investigating an illegal betting operation, the warrant is going to have been written broadly enough to include "photos, documents, etc. etc. that may show ownership of the premises" or something similarly capacious that will basically let them get whatever they want.)
8.26.2009 10:41pm
Oren:

If they can look into the boxes for the item they're authorized to search for, then anything they see comes in under the plain view rule, regardless of what the exterior says. Obviously if they can't look into the boxes -- say, if they're looking for a stolen car, and the boxes are only the size of a shoebox -- then the plain view rule wouldn't help them.

This doesn't bode well for computer searches then, because any evidence can be hidden in any file. So effectively they can look into every file and whatever they happen to see is plain view.

Thanks for the explanation -- which gets directly to the heart of the problem that the 9CA was (by improper means) attempting to address.
8.26.2009 11:05pm
Oren:

No. Everything on a personal computer is protected by the Fourth Amendment: There's no content/non-content distinction.

Absolutely agree. The distinction comes not in the degree of protection but in the fact that o



When you are searching a computer (or a copy of the storage device) you can plainly view all the metadata (file names, size, date modified) but you cannot possibly view the content of the file without deliberately and intentionally doing so.

I don't know what you mean by this. Is that your experience as a user? Your experience using computer forensic software like EnCase? Plus, the issue isn't whether you know it's content or non-content information, because warrants don't draw the distinction.

I mean, one cannot view the contents of "~OKerr/Docs/PlansForSept09.txt" accidentally. Whether you use fancy forensic software or just mount the drive on your local system, one can only view the content of that file by intentionally opening it.

By contrast one could legitimately, in the course of searching for "~Okerr/Docs/PlansForJan09.txt" (perhaps he allegedly committed a crime in that month), make a list of all the files in the docs folder, which would reveal the existence of the "PlansForSep09" file.

This is a bit jumbled in my head right now, but I'm working on clearing it up.


more likely is that if they're investigating an illegal betting operation, the warrant is going to have been written broadly enough to include "photos, documents, etc. etc. that may show ownership of the premises" or something similarly capacious that will basically let them get whatever they want.

How is "ownership of the premises" evidence of (or even relevant to) the existence of an illegal betting operation?
8.26.2009 11:18pm
drunkdriver:
I've read through the opinion a couple of times now- much thanks to Orin for his roadmap- and this is such an irresponsible move by "EZ Rider &Co."
8.26.2009 11:40pm
David Schwartz (mail):
As best I can tell, we're debating two issues: You're arguing what you think the Fourth Amendment should mean, and I'm arguing what the thousands of Fourth Amendment cases say it does mean.
You are correct that we are debating two issues, but I think you're wrong about what the two issues *are*. I'm arguing about what the fourth amendment requires, and you're arguing about what conditions a magistrate can impose in order to issue a warrant.

I agree with you that a magistrate cannot impose these conditions. Your cites convinced me that this is the law, whether or not it should be the law.

However, I still think it violates the fourth amendment to make the search unreasonably intrusive or destructive absent unusual probable cause that justifies it.
8.27.2009 12:00am
OrinKerr:
However, I still think it violates the fourth amendment to make the search unreasonably intrusive or destructive absent unusual probable cause that justifies it.

Cites please.
8.27.2009 12:08am
Ken Arromdee:
As for your strip search example, it's such a strange example given all the cases on that issue: Are you saying that you disagree with those cases?

I don't understand this. Are you saying that if a warrant mentions ammunition the police *can* strip-search all the occupants on the grounds that they may have ammunition in their rectum?
8.27.2009 12:11am
Oren:
Not quite on point, but strip searching for small amount of marijuana is unreasonable.
8.27.2009 12:25am
OrinKerr:
Ken,

I'm saying that there are cases on whether and when the police can strip search individuals for evidence when they execute a warrant. See, e,g., Williams v. Kaufman County, 352 F.3d 994 (5th Cir. 2003). Maybe I am insufficiently academic in my approach, but I just think we would do better by looking at the cases.
8.27.2009 12:32am
einhverfr (mail) (www):
OK:

I understand what you are saying but I still wonder some unusual elements.

BTW, I have so me limited experience with a suite of forensic software called, appropriately enough, The Coroner's Toolkit. This software, btw, does make a content/metadata distinction in that the tools are almost entirely designed to look for hidden content (deleted and partially overwritten files, data intentionally hidden in normally unusable disk addresses, etc). They are the best tools I have to conduct a post-incident investigation (for example, due to unauthorized access to the computer systems).

However, I was thinking of a different case. Suppose one has a search warrant for searching for financial information relating to drug sales. In such a warrant we might reasonably conclude that each file is the equivalent of a closed box. Even though everything is "inside" the box for the purpose of plain view, when executing such a warrant, not everything in the computer might be subject. For example, it might be reasonable to require that files be filtered out by magic number, xml schema spec, etc. In this case, we might conclude that police conducing detailed examinations of jpegs n order to look for CP might still be outside the bounds of the warrant.
8.27.2009 12:33am
OrinKerr:
einhverfr , I discuss what such an approach would look like -- and why I don't think it would work -- in the article I cite above.
8.27.2009 12:36am
OrinKerr:
einhverfr , I discuss what such an approach would look like -- and why I don't think it would work -- in the article I cite above.
8.27.2009 12:36am
Oren:
From William v. Kaufman County:

As outlined above, the degree of reprehensibility of Harris's conduct is high because he perpetrated extremely invasive searches on innocent individuals without specific probable cause or reasonable suspicion, in contravention of the warrant itself and clear precedent.

This is from the 5CA, affirming the award of damages.
8.27.2009 12:37am
Oren:

I discuss what such an approach would look like -- and why I don't think it would work -- in the article I cite above.

Its functionality in civil trials (see Northwest Airlines v. Teamsters, cited above) undercuts that assertion.
8.27.2009 12:44am
JBC:
you cannot possibly view the content of the file without deliberately and intentionally doing so.

Oren: your argument about not being able to view file content without an intentional action to do so isn't necessarily true, particularly wrt images. Many people have their computers set to display any images in a directory in thumbnail size. Suppose a police officer went to a computer, opened 'My Documents', and saw a thumbnail size child porn image? The OS has taken the liberty of displaying the image automatically (as per the user's configuration of course); the police officer hasn't taken any action beyond viewing metadata, which you seem to think is OK.
8.27.2009 12:45am
Oren:
Incidentally, you wrote about US v. Vilar in which the judge said:

Thus, when the government seeks to seize the information stored on a computer, as opposed to the computer itself, that underlying information must be identified with particularity and its seizure independently supported by probable cause.


At the same time, we all agree that "while the warrant must state with particularity the materials to be seized from a computer, the warrant need not specify how the computers will be searched".

So then we are at a point where the government can seize items to which it is not entitled to search (inverting the usual scheme) but the government may search it in a manner that reveals that information because the magistrate cannot specify the manner of the search.
8.27.2009 12:53am
Oren:

Suppose a police officer went to a computer, opened 'My Documents', and saw a thumbnail size child porn image?

Then he was tampering with evidence and the whole thing gets thrown out anyway. The basic principle of computer forensics is that the first task is to make a read-only disk image that one can testify is an exact record of the state of the hard drive at the time of the search.
8.27.2009 1:15am
JBC:
Then he was tampering with evidence and the whole thing gets thrown out anyway.

Does this happen IRL, or is this your preference?
8.27.2009 1:17am
Brian K (mail):
Someone hiding a threat in a folder called "My Pictures" (assuming the threat didn't involve a picture) is as unusual as someone hiding ammunition in their rectum. There's simply no reason to search there.

i don't think this is true at all. if i'm doing something illegal, hacking into other computers for example, i'm not going to store all of the files in a folder marked "illegal hacking files". i'll instead store it in a folder named "boring school stuff" or "pictures of grandma in a bikini" or something mundane. just ask any male college student where they store their porn. i doubt most of them keep it in a folder named "porn"...it'll be too easy for someone at there computer to accidentally find.
8.27.2009 1:28am
Lokkju:
Oren and other 's talking about files:

You seem to be making an assumption (re: "My Documents/Pictures" and the like) that the file system's representation of organization has anything to do with the data on disk; the contents of that data; or the location of that data.

That is a huge fallacy, and I really can't go into why, other than to say that the organizational structure and location of data (what is commonly called a filesystem) is just a specific area of data on a hard drive, in a known or computed location. You could easily have a text document, that in terms of actual storage on disk, is spread between 15, 20, or more places. Next to one of those places could be an image. Next to another could be a video, or parts of video, image, or other document data - there is no way to know, except to either look; or to trust the filesystem's representation of the data/ And you should never really trust a filesystem's representation of data; it is too easy to hide or obscure things.
8.27.2009 2:52am
David Schwartz (mail):
Brian K: As I said, if there was some specific reason to think that someone on the premises might have the ammunition hidden in their rectum, then it's reasonable to search there. Similarly, if there's a reason to think the expected evidence might be hidden in an innocuous folder, it's reasonable to search in innocuous folders.

I would think law enforcement would prefer a regime where the threshold for searching for the evidence you really want is low in exchange for protections against exposing private information inadvertently stumbled on. If police and law enforcement oppose such rules, it is strong indication that their real motives for warrants are the hopes of stumbling on evidence for which they do not have probable cause.

In any event, I think your argument is self-defeating. If a person expects the warrant, they can just as well encrypt the data or otherwise make it inaccessible to law enforcement totally. So you also cut against the expectation that the evidence will be there at all.

If the police want to strip search everyone on the premises in a search for illegal ammunition, we might reasonably suspect they're really looking for drugs. So we might strike a reasonable deal with them -- you can perform the more invasive search, but in exchange you most give up the ability to use the evidence for other crimes and protect the privacy of those searched. Otherwise, you don't get to strip search.

This especially applies in the computer context where the government will ask for techniques that are easier for it to perform (copy the whole hard disk and take it to a lab rather than search on the premises) but also have greater collateral risks to privacy. I think it's quite reasonable to let the government do the search the convenient way, but in exchange they give up the extra information they wouldn't have if they did it the harder way. Otherwise, make them do it the hard way.

Privacy is that important, especially when we're talking the privacy of totally innocent (of any of the crimes the warrant intentionally relates to) third parties. (As was the case in this case.)
8.27.2009 2:55am
Ken Arromdee:
I'm saying that there are cases on whether and when the police can strip search individuals for evidence when they execute a warrant. See, e,g., Williams v. Kaufman County, 352 F.3d 994 (5th Cir. 2003). Maybe I am insufficiently academic in my approach, but I just think we would do better by looking at the cases.

That isn't a link and I can't get to it. Why not just answer the question instead?

(And to avoid nitpicking over words, let's phrase it this way: if the police have a warrant for ammunition, can they search anything at all bigger than a bullet--body cavities, smashing all appliances, killing the family pet--solely on the grounds that ammunition can fit inside?)
8.27.2009 8:18am
pintler:

Someone hiding a threat in a folder called "My Pictures" (assuming the threat didn't involve a picture) is as unusual as someone hiding ammunition in their rectum. There's simply no reason to search there.


If that theory catches on, I'm moving all my threats to 'My Pictures'.

I'll risk leaving the ammo in the cabinet for now, though.

Seriously - I don't see how you can use a directory structure to guide/limit a search. I have never used any of the default ('My Documents', 'My Pictures', etc) directories - I lay out a structure that works for me. People don't hide rifles in cereal boxes because they can't, but if hiding the cooked books from searchers is as simple as renaming MyDocs/Financial/Cooked.xls to FamilyFotos/YellowStone08/OldFaithful.png, people will do it.
8.27.2009 8:23am
dangerous lack of something something:
Please note that most pictures on a computer will have a thumbnail created by the system when the image is first accessed. If you are looking through a Downloads folder for a particular spreadsheet and the folder also contains CP jpegs, you will likely see the thumbnail picture.

Considering that many of these computer crime cases involve "finding" CP while looking for something else, this is something specific that should be addressed - if you see the thumbnail, what are you supposed to do with it, if it looks like CP or evidence of a murder, etc?
8.27.2009 9:52am
ReaderY:
There would seem to be a difficulty with the plain view doctrine as traditionally defined in a world where absolutely everything is in plain viev and therefore any execution of a search always consists of going through absolutely everything until one finds whatever one wants. In such a world, applying the plain view doctrine makes every search a general warrant because warrant text nominally narrowing the search's scope has no functional impact on the warrant's actually execution procedure or what searchers are permitted to retrieve.

I would tend to agree that technology change has upended traditional 4th amendment considerations and has rendered the the plain view doctrine obsolete in much the same way that the invention of the telephone was found to have rendered previous location-focused distinctions obsolete in Katz.

However, I would also tend to agree that a Court of Appeals has no authority to overrule decisions of the Court of Appeals simply because it thinks them obselete. Were the Supreme Court to do what the 9th Circuit wants, it might encourage future rebellions. The Supreme Court might do better vacating and remanding to the 9th Circuit with a terse message it instructing it to apply its precedents, and then taking a case from a circuit court of appeals which has been willing to follow the law in order to decide the question.

The North Carolina Supreme Court, faced with a Court of Appeals that had just claimed authority to abolish the torts of alienation of affection and criminal conversation over state Supreme Court decisions holding them to be good law, issued such a terse message in Canon v. Miller, 313 N.C. 324, 327 S.E.2d 888 (1985).
8.27.2009 10:26am
ReaderY:
Sorry, no authority to overrule decisions of the U.S. Supreme Court.

The better course would be to apply precedent, then add an appendix explaining why the court thinks the precedent obsolete and asking the U.S. Supreme Court to take the case and review it.
8.27.2009 10:32am
ReaderY:
An example of the latter is Perkins v. North Carolina, 234 F.Supp. 333 (1964), upholding a 20-30 year prison sentence for consensual crime against nature despite a disparity in prison sentences with the accomplice receiving only 5-7 years, with an appendix directed to the legislature listing various crimes with lower maximum prison sentences (second degree murder, rape, robbery, etc.), and asking the legislature if this crime was really more serious than these. The North Carolina legislature responded in 1965 by lowering the maximum sentence from 60 years to 10 years and abolishing the 5-year mandatory minimum.
8.27.2009 10:45am
Oren:
Lokkju, I've written my own FAT12 filesystem for a CS class -- I know what it does. In a functional sense, however, the data on the hard drive can be properly conceptualized as divided into discrete files instead of as a large block device.

As I understand it, the law treats things as they work, not at some trivial level. "Gee your honor, if you start reading at offset 0x2b400 it's child porn, but if you start at offset 0x4a000, it's just junk." is not a valid defense.
8.27.2009 11:28am
Oren:



Considering that many of these computer crime cases involve "finding" CP while looking for something else, this is something specific that should be addressed - if you see the thumbnail, what are you supposed to do with it, if it looks like CP or evidence of a murder, etc?

Apply for a second warrant at your soonest convenience.
8.27.2009 11:29am
Oren:

There would seem to be a difficulty with the plain view doctrine as traditionally defined in a world where absolutely everything is in plain viev and therefore any execution of a search always consists of going through absolutely everything until one finds whatever one wants. In such a world, applying the plain view doctrine makes every search a general warrant because warrant text nominally narrowing the search's scope has no functional impact on the warrant's actually execution procedure or what searchers are permitted to retrieve.

Well said.
8.27.2009 11:30am
Mark W (mail):
Just wondering about this case - I am not a lawyer - but I was wondering if it was pertinent that the government seized information/evidence relating to the guilt of someone who was not the original subject. Specifically, they were searching for evidence that Barry Bonds committed perjury, but they took evidence that indicated that A-Rod and David Ortiz had used steroids.

Does part of the plain view search allow for collecting evidence of those not named in the warrant?
8.27.2009 11:32am
Sparky:
Am I the only one who thinks Chief Judge Kozinski might have a, shall we say, personal reason for being sensitive about overly broad computer searches?
8.27.2009 12:00pm
glasnost:
Orin,

You've not only confused me, but used an approach to law that I find methodologically insupportable.


However, I still think it violates the fourth amendment to make the search unreasonably intrusive or destructive absent unusual probable cause that justifies it.



Cites please.


What the heck is this? Oren is just restating the 9th's circuit's own justification for its rules. The 9th circuit doesn't need cites to interpret the meaning and applicability of the fourth amendment. Interpreting said meaning and applicability is its *job*. Now, it should not ignore precedent from the Supreme Court that disagrees, but from what you've posted, as far as I can tell there isn't any beyond the "plain view" doctrine - and this whole argument is about what is or is not "plain view".

The whole point of the fourth amendment is to limit the government's ability to search whatever they want. If, in an electronic environment, the government can search all the info on your computer while searching for *anything* on your computer, the fourth amendment has been functionally eliminated for everything electronically stored.

The plain view exception is for things that are 'immediately obvious' that they are a crime, found without taking any actions beyond what was neccessary to implement the original probable cause search.

Copying all the data from a hard drive and rummaging through it back at HQ indiscriminately is nothing like seeing cocaine on the table at someone's house. It's more like using a search warrant to load everything someone owns onto a truck, bringing it back to HQ, and putting every square inch of all property to months-long forensic analysis for evidence of any crime.



Secondly, Orin - please try to remember that laymen with an interest in the law also read this blog. Don't just dismiss an argument by saying "see Case X". I'm interested enough in law to read your summaries, but not to spend hours hunting through massive data libraries for random cases and then reading 100-page legalese decisions. If you argue by saying "See Case X", you should at least describe the gist of the argument made there, or I, for one, will disregard it. It becomes an appeal to authority, a basic logical fallacy.
8.27.2009 12:01pm
glasnost:
What is even more confusing about this argument is that your article, unless I seriously misunderstand, is worried about the same problem that the 9th is worried about, and advcoates ending the plain view exception. So why is it, that when the 9th Circuit effectively ends the plain view exception, that you seem so startled, alarmed, and negatively critical?

Isn't it a perfectly good argument that the 9th is really ending the perversion of the plain view argument beyond the Supreme Court's intent by law enforcement, rather than the plain view argument itself?

Alternatively, isn't there a good argument that in 1970s, when the plain view document was made, the electronic realm's differences, simply by looking at chronology, were impossible to consider at that time? In that case, this judgement on the applicability of that doctrine in a new domain is *extremely* appropriate for the 9th circuit.

As long as Scalia flips - isn't he a constitutional originalist? - this should be able to get 5 votes. Dissenters are Thomas, Roberts, Alito, and Breyer.
8.27.2009 12:06pm
jccamp (mail):
Oren -

"It is a trivial matter to "grep" the contents of a hard drive for a particular string that one is looking for. In your hypothetical, you can grep for the account number and look at the content of only such files that have at least one match. "

I guess that was my point. If, upon opening only those files which meet some initial match, the investigator finds evidence of crime but which was not specified by the original warrant, why would he/she be precluded from obtaining a new warrant based on this observation? Isn't that what the 9th has just done?

"As to image files, following your logic here would implicate every file on the system since arbitrary data can be hidden in any file -- thus, in your hypothetical, the government could inspect every executable, sound file, movie file, library file and so forth because they *could* contain evidence of financial crimes. "

Sorry, guess I was not very clear. My thought here was that such would not be allowable unless and until the investigator could articulate a specific basis for thinking, as in our example say, that financial data would be included in a graphics file, or so other non-intuitive chain. I think one of the better known cases of this genre has to do with investigators searching a computer for evidence of drug dealing, and discovering child porn, ostensibly via a thumbnail which was "plain view."

However, I also think that a search of a computer these days in hardly ever done in this fashion, i.e. someone actually sitting at the keyboard and selecting files and viewing them. Typically, the hard drive is mirrored, scanned and predictive search engines used. I was suggesting that the complete mapping and listing of the contents was what lead to the suggestion that the "plain view" exception was turning into a everyday occurrence, by choice and design, and was what lead to this rather ridiculous ruling from the CCA. But maybe I misunderstood the HLR article cited by the OP.
8.27.2009 12:26pm
David Schwartz (mail):
However, I still think it violates the fourth amendment to make the search unreasonably intrusive or destructive absent unusual probable cause that justifies it.

Cites please.
If this isn't common sense, I don't know what is. But the most obvious cite is Ybarra v. Illionis.
8.27.2009 12:58pm
pintler:

Lokkju, I've written my own FAT12 filesystem for a CS class -- I know what it does. In a functional sense, however, the data on the hard drive can be properly conceptualized as divided into discrete files instead of as a large block device.

As I understand it, the law treats things as they work, not at some trivial level. "Gee your honor, if you start reading at offset 0x2b400 it's child porn, but if you start at offset 0x4a000, it's just junk." is not a valid defense.


Not a computer forensics expert, but if searchers typically search for fragments of deleted files, etc, then I would think the distinction is less clear.
8.27.2009 1:18pm
Bob Tufts (mail):
The government was searching for 10 names under the warrant. They took not just 100, but a computer that had th enames of numerous people who had taken employee assistance program tests. What recourse do they have against the government?

The government (especially Jeff Novitzky - also SF DA Nedrow) played fast and loose with the warrants in this case - going around Judge Illston's rulings and finding a friendly judge at the very moment one of their warrants is being challenged in another court.

I'm not a lawyer, but all I see is a massive government operation of abuse of the law, courts and power simply to slime Barry Bonds because the perjury case is weak and they want revenge in the court of public opinion.
8.27.2009 1:27pm
einhverfr (mail) (www):
Also siding with David Schwartz here, I would expect a search that was unreasonable in any way (particularly if unreasonably intrusive or destructive) to be Unconstitutional simply because the 4th Amendment standard is reasonableness.

The question though here is what "unreasonable" would mean in that case. There seems to be a long line of cases which suggest, for example, that when a car or business is searched that individuals which happen to be in the business or car but are not named on the warrant cannot be searched under that warrant. Ybarra v. Illinois was interestingly based on one of Justice Jackson's opinions (United States v. Di Re). I am wondering if Orin Kerr seems to think these have been overruled.

From Justice Jackson's opinion:

The Government says it would not contend that, armed with a search warrant for a residence only, it could search all persons found in it. But an occupant of a house could be used to conceal this contraband on his person quite as readily as can an occupant of a car. Necessity, an argument advanced in support of this search, would seem as strong a reason for searching guests of a house for which a search warrant had issued as for search of guests in a car for which none had been issued.


In essence I don't think Justice Jackson, and the majority in Di Re saw any significant difference between searching persons in a house and persons in a car, or that search powers (either via warrant or warrant exceptions) would be sufficiently contageous as to allow searching of persons who happen to be within areas described in the warrant where no other grounds allowed for them to search.

However, I think a lot of this gets back to the problems of particularity though in computer searches. I think that a lot of the doctrines COULD be applied. For example:

1) Plain view exception: This could be limited to what is IMMEDIATELY APPARENT on the desktop without any intervention by officer when computer is not listed on warrant. I.e. screen savers obstruct plain view.

2) When a computer is searched there might be particularity requirements. However, when searching for financial data, file names and other non-content information might be considered to be "in plain view" but it might not allow content-related data to be searched without being sufficiently particular. Nor would swap space be initially searchable unless specifically covered under the warrant.

In short I am thinking about boxes inside boxes and what is "inside" in one context might be "outside" in another.

The thing is, the tools I work with to investigate rootkits, etc. are EVEN MORE INTRUSIVE than I suspect OK expects. I can look not just for deliberately hidden or deleted information but also what sorts of activity the computer was doing prior to being shut down (I can look inside memory pages that were swapped to disk and not overwritten later to construct a partial picture of what the computer was doing, what files were open, etc. prior to shutdown).

Most people have absolutely no idea what sorts of information the hard drive contains, and it isn't just limited to files which have, at one point, been saved to it.
8.27.2009 1:34pm
rstacy:
Although Comprehensive Drug Testing is ostensibly a Rule 41 case, I was struck by the lack of attention the opinion paid to the mandatory language of the rule. Under the opinion, a magistrate can find that probable cause exists, yet deny a warrant if it does not contain the laundry list of conditions set forth in the opinion. Under Rule 41(d)(1), however, "After receiving an affidavit . . . a magistrate judge . . . must issue the warrant if there is probable cause to search for and seize a person or property . . . ." (emphasis added). At least as I read the Rule, a magistrate "must" issue the warrant if he/she finds PC; there is no language in the Rule allowing a magistrate to impose additional requirements on the government once the PC finding is made.

Re: Stiller's comment above re: Grubbs, I don't think the analogy holds here. Grubbs concerned anticipatory warrants, cases in which PC does not exist unless and until the specified condition is satisfied (ex: agents see the target bring the package containing child pornography into his house). Grubbs allows a magistrate to use conditions to determine whether a search is permitted at all; it is not a open grant of discretion for a magistrate to impose his/her own conditions as to how the search will be carried out.
8.27.2009 2:01pm
Stiller:

Grubbs allows a magistrate to use conditions to determine whether a search is permitted at all.


So a search is conditioned on only reviewing the 10 customer files on the server where probable cause exists but not the records of the other 1000 customers, where there is none.
8.27.2009 4:54pm
David Schwartz (mail):
In this particular case, the primary issue should have been the government's outrageous conduct, which it was. There wasn't probable cause to invade the privacy interest of players not named in the warrant, and the government trampled on that privacy interest in violation of the fourth amendment (and there are least two cites in this thread to establish that this is the law). Probable cause is specific to each privacy interest that the warrant breaches.

The court's proposed future remedy, however, seems right to me only if Congress decides to make that the law. Otherwise, the remedy has to be after the right is violated.
8.27.2009 6:05pm
Oren:

Not a computer forensics expert, but if searchers typically search for fragments of deleted files, etc, then I would think the distinction is less clear.

The data is still organized into distinct chunks, even if those chunks are stored on a block device.
8.27.2009 8:35pm
OrinKerr:
If this isn't common sense, I don't know what is. But the most obvious cite is Ybarra v. Illionis.

??
8.28.2009 1:32am
David Schwartz (mail):
Perhaps you could be a bit more verbose. But Ybarra v. Illinois, as I read it, says that a warrant must have probable cause for each privacy interest it invades.
8.28.2009 1:45am
einhverfr (mail) (www):
Oren

The data is still organized into distinct chunks, even if those chunks are stored on a block device.


So an officer is looking through a filing cabinet for evidence of drug dealing. He sees two folders, one is marked "N. Accounting" and the other is marked "porn." He opens up the N. Accounting to find it is full of materials relating to the sales of narcotics.

If he opens up the "porn" folder and finds out it is child pornography, does that fall inside the plain view exception? I would assume so, but I don't formally know.

The problem here is that the hard drive can be seen as a filing cabinet. Those discrete chunks require further analysis to determine what they are. This involves opening them up and looking at them, either through human means or via automatic tools. Either way they are already being opened and searched.
8.28.2009 1:11pm
einhverfr (mail) (www):
David Schwartz:

In particular both Ybarra and Di Re hold that separate analysis exists for an individual searched when premises are searched.

I.e. a Terry frisk in Ybarra was proper, but opening the container found in his pocket was even though he was on the premises, was not authorized by the warrant.

In Di Re, the police had probable cause to search a car and one suspect in a car, but erred in searching a second occupant in the car.

These suggest that, unless these cases have been overturned, that one can't strip search all occupants in a building merely because you have an warrant to search a building for ammunition.
8.28.2009 6:56pm
David Schwartz (mail):
einhverfr: Which answers this case -- there was no probable cause to invade the privacy of the players not listed in the warrant.
8.28.2009 7:45pm

Post as: [Register] [Log In]

Account:
Password:
Remember info?

If you have a comment about spelling, typos, or format errors, please e-mail the poster directly rather than posting a comment.

Comment Policy: We reserve the right to edit or delete comments, and in extreme cases to ban commenters, at our discretion. Comments must be relevant and civil (and, especially, free of name-calling). We think of comment threads like dinner parties at our homes. If you make the party unpleasant for us or for others, we'd rather you went elsewhere. We're happy to see a wide range of viewpoints, but we want all of them to be expressed as politely as possible.

We realize that such a comment policy can never be evenly enforced, because we can't possibly monitor every comment equally well. Hundreds of comments are posted every day here, and we don't read them all. Those we read, we read with different degrees of attention, and in different moods. We try to be fair, but we make no promises.

And remember, it's a big Internet. If you think we were mistaken in removing your post (or, in extreme cases, in removing you) -- or if you prefer a more free-for-all approach -- there are surely plenty of ways you can still get your views out.