When the government seeks to establish probable cause that evidence or contraband is inside a home, it sometimes has to deal with concerns of “staleness.” Staleness refers to the possibility that evidence or contraband previously located in the home is no longer there, because over time evidence can be moved or destroyed. In today’s opinion in United States v. Seiver, Judge Posner argues that concerns over staleness are rarely relevant in cases involving digital evidence. The issue arose in a child pornography case, in which the defendant argued that evidence of child pornography receipt and possession had become “stale” because seven months had passed before the warrant was obtained. Posner rejected the argument:
When you delete a file, it goes into a “trash” folder, and when you direct the computer to “empty” the trash folder the contents of the folder, including the deleted file, disappear. But the file hasn’t left the computer. The trash folder is a waste paper basket; it has no drainage pipe to the outside. The file seems to have vanished only because the computer has removed it from the user interface and so the user can’t “see” it any more. Virginia M. Kendall & T. Markus Funk, Child Exploitation and Trafficking 275-76 (2012); United States v. Flyer, 633 F.3d 911, 918 (9th Cir. 2011); United States v. Gourde, 440 F.3d 1065, 1071 (9th Cir. 2006) (en banc). But it’s still there, and normally is recoverable by computer experts until it’s overwritten because there is no longer unused space in the computer’s hard drive.
“Staleness” is highly relevant to the legality of a search for a perishable or consumable object, like cocaine, but rarely relevant when it is a computer file. Computers and computer equipment are “not the type of evidence that rapidly dissipates or degrades.” United States v. Vosburgh, 602 F.3d 512, 529 (3d Cir. 2010). Because of overwriting, it is possible that the deleted file will no longer be recoverable from the computer’s hard drive. And it is also possible that the computer will have been sold or physically destroyed. And the longer the interval between the uploading of the material sought as evidence and the search of the computer, the greater these possibilities. But rarely will they be so probable as to destroy probable cause to believe that a search of the computer will turn up the evidence sought[.]
Computer procedures such as “defragmenting,” “wiping,” and creating “garbage files” can make deleted computer files very difficult or even impossible to recover. Lange & Nimsger, supra, at 221-24. And encryption may hide files remaining on the hard drive so effectively as to thwart their recovery by computer experts. Kendall & Funk, supra, at 167. Software that wipes the hard drive or overwrites deleted files with garbage data can be bought on line. But it appears that few consumers of child pornography (the producers may be more savvy) understand well enough how their computer’s file system works to grasp the importance of wiping or overwriting their deleted pornographic files or encrypting them securely if they want to avoid leaving recoverable evidence of child pornography in their computer after they’ve deleted it. Anyway this way of thwarting a search has nothing to do with staleness. A child pornographer who wants to render computer files nonrecoverable will first download those he wants to keep to a DVD, which can be hidden outside his home, and then either destroy the computer and get a new, “clean” one, or take steps to assure the complete overwriting of the contents of his hard drive. Nevertheless, despite the availability of software for obliterating or concealing incriminating computer files, the use of such software “is surprisingly rare.” Kendall & Funk, supra, at 276.
No doubt after a very long time, the likelihood that the defendant still has the computer, and if he does that the file hasn’t been overwritten, or if he’s sold it that the current owner can be identified, drops to a level at which probable cause to search the suspect’s home for the computer can no longer be established. But seven months is too short a period to reduce the probability that a computer search will be fruitful to a level at which probable cause has evaporated. . . .
The most important thing to keep in mind for future cases is the need to ground inquiries into “staleness” and “collectors” in a realistic understanding of modern computer technology and the usual behavior of its users. Only in the exceptional case should a warrant to search a computer for child pornography be denied on either of those grounds (there are of course other grounds for denial). But future changes in computer technology may alter this conclusion, and judges as well as law enforcers must be alert to that possibility as well.
I think that’s basically right, especially with the caveat at the end. These are questions of general practice that hinge on prevailing technologies and social norms, and they can and likely will vary over time.
Thanks to Colin Watson for the link.