Back in 2009, I first blogged about an interesting Fourth Amendment case, United States v. Cotterman, applying the border search exception to the Fourth Amendment to the search and seizure of computers. In the case, agents seized a computer at the Mexico-Arizona border and wanted to search it under the border search exception to the Fourth Amendment. The computer was password-protected and the agents apparently didn’t have a trained analyst nearby to break past the password-protection to search the computer. So the agents let the computer owner go on into the U.S. and drove the computer to to a government forensic analyst in Tucson 170 miles away. The analyst in Tucson searched the computer two days later and found child pornography.
The question in this case is whether the agents complied with the Fourth Amendment. And more broadly, it considers the limits to the scope of of the border search exception as it applies to computers. An earlier Ninth Circuit decision allowed a brief look in a computer at the border. But does the border search exception allow a thorough forensic examination of the computer, which might take a lot of time and might have to occur away from the border where the forensic analyst is located? The district court said “no”, and the panel decision said “yes.” You can read my post on the district court decision here, and my post on the Ninth Circuit panel decision here. Now we’re before the en banc court. You can watch the en banc argument here, and I found a liveblog report of it here.
I found the oral argument pretty unsatisfying, so I thought I would blog some thoughts on the issues beyond what I have written in my prior posts. I think there are really three distinct issues: (1) Could the computer be stopped and searched at the border without reasonable suspicion, (2) Does it make any difference that the computer was brought to and searched in Tucson rather than at the border, and (3) How much delay is permitted in searching a computer seized at the border under the border search doctrine. I understand from the argument that the defendant is not actually raising (1), and instead is conceding that the answer is “yes.” As for (2), I can’t see how the location of the forensic search makes any difference. It makes no difference to the owner where the computer is taken. And as Chief Judge Kozinski notes at the 46 minute mark, it would make the Fourth Amendment a game if you created a legal rule that suspects could get more protections by just picking a border crossing where there is no expert who could search their particular computer. So I think the really interesting question is (3): How much time can the government take to search the computer?
This is a very interesting question because of some somewhat unique characteristics of the computer forensic process. In a typical case involving a temporary seizure of packages or other movable property, officers seize property and hold it because they need a warrant to search it. In those cases, courts assess the reasonableness of the warrantless seizure based on whether the officers had reason to think the property held evidence and whether they made the necessary steps to get a warrant with reasonable speed. There are a lot of cases on what reasonableness means in that setting. See LaFave, et. al., 2 Criminal Procedure Sec. 4.2(b) (describing cases). A delay to search a computer under the border search exception is quite different, howwver. Agents aren’t holding the computer while they get a warrant authorizing the search. Rather, the delay is caused entirely by practical concerns: the need to bring the computer to the expert or the expert to the computer, the wait given the forensic expert’s likely back log of computers to search, and the time it takes to search the computer. How do you determine the reasonableness of that net amount of time?
In the physical world, we have a sense of how long a search should take. Depending on what the police are looking for and how many agents they have, searching a room might take a few minutes; searching a small house might take an hour or two. There’s some variation, but at least we mostly know the order of magnitude. Computers are different. A computer storage device can have an extraordinary amount of information on it. There are some shortcuts to find information, but whether they’ll work depends on each case. As a result, it’s impossible to say how long it should take to search a computer properly. Every case is different, and how long a search takes depends on how thoroughly agents think they need to look in that case:
According to Mark Pollitt, former Director of the FBI’s Regional Computer Forensic Laboratory Program, analysis of a computer hard drive takes as much time as the analyst has to give it. If the case is unusually important or the nature of the evidence sought dictates that a great deal or a specific type of evidence is needed, the analyst may spend several weeks or even months analyzing a single hard drive. If the case is less important or the nature of the case permits the government to make its case more easily, the investigator may spend only a few hours. For an analyst, determining which approach to take usually requires consultation with both the warrant and the case agent. The forensic analyst ordinarily needs to know not only what kinds of searches the warrant permits as a matter of law, but also the type and amount of evidence needed as a practical matter to prove the government’s case in court.
Searches and Seizures in a Digital World, 119 Harv. L. Rev. 531, 543-4 (2005).
Given these difficulties, I think that developing a doctrine for the reasonableness of the time of a seizure at the border is pretty complicated, or at least rather novel. The delay question came up in passing in Footnote 3 of United States v. Flores-Montano. But I don’t know of any other caselaw on it, and the issue in Flores-Montano was delay while the suspect was stuck waiting for his property rather than delay while the suspect was permitted to enter the country. Arguably that’s a pretty different issue. My own view is that the Ninth Circuit doesn’t need to create a complete reasonableness framework in Cotterman to solve that case: The delay was only two days, which is pretty quick under the circumstances. So I would say that the two delay was reasonable and there was no Fourth Amendment violation. But the outer bounds of how much delay is reasonable presents some really intriguing questions.