Archive | Border Search Exception

Cert Petition in Cotterman v. United States

I’ve blogged a lot about the Ninth Circuit’s computer search decision in United States v. Cotterman, and I thought I would flag the cert petition that Cotterman filed on August 5th. Taken in isolation, the cert petition that was filed normally would be denied. But this case may be different for the reason I discussed in my most recent Cotterman post:

DOJ may be waiting for Cotterman’s petition. Recall that DOJ lost the big issue [before the en banc Ninth Circuit] but technically won the case — on a ground it refused to argue — raising the Camreta question of whether it could bring a petition seeking review of the CA9 opinion. In contrast, Cotterman lost and has said he would seek Supreme Court review; his due date for a petition is in August. If Cotterman files, DOJ can then take a position and perhaps not oppose Cotterman’s petition. That could trigger Supreme Court review without DOJ having to get into the Camreta issue.

It will be interesting to see DOJ’s response. At the time Cotterman came down, on March 8, I figured that DOJ would welcome Supreme Court review. Perhaps that’s correct. At the same time, with the flurry of recent news about NSA surveillance programs leading to significant push back against the Administration’s position, I’m not sure DOJ will think it a good time to ask the Justices to decide how the Fourth Amendment applies to searching physical computers at the border. (There’s no direct doctrinal connection, to be clear, but the atmospherics can make a difference.)

Thanks to reader @johnhawkinson for sending on the petition. [...]

Continue Reading 0

What is the Ninth Circuit’s Standard for Border Searches Under United States v. Cotterman?

Last Friday the Ninth Circuit decided United States v. Cotterman, a case on the border search exception to the Fourth Amendment. The en banc court held that manually searching for files through a computer is allowed at the border, but that “forensic examination” at the border requires reasonable suspicion. As the Court put it, “a manual review of files on an electronic device” is permitted without reasonable suspicion but “application of computer software to analyze a hard drive” is not.

In Cotterman, the agents followed a law enforcement common procedure for searching the computer: They made an image of the hard drive and then used the popular forensic software EnCase to search the image. According to Footnote 8, the EnCase program “exhibit[s] the distinctive features of computer forensic examination.” Those distinctive features are listed as the following:

The program copied, analyzed, and preserved the data stored on the hard drive and gave the examiner access to far more data, including password-protected, hidden or encrypted, and deleted files, than a manual user could access.

Here it is helpful to reintroduce the distinction I have written about often between virtual and physical approaches to computer searches:

Digital evidence searches generally occur at both a “logical” or “virtual” level and a “physical” level. The distinction between physical searches and logical searches is fundamental in computer forensics: while a logical search is based on the file systems found on the hard drive as presented by the operating system, a physical search identifies and recovers data across the entire physical drive without regard to the file system.

Most users think of computer searches as occuring at the virtual level, because that’s the user experience. But computer forensic software works at the physical level: it treats the hard drive as a physical device that

Continue Reading 0

En Banc Ninth Circuit Holds That Computer Forensic Searches Are Like “Virtual Strip Searches” And Require Reasonable Suspicion At the Border

Today the Ninth Circuit handed down its long-awaited en banc decision in United States v. Cotterman, a case on the lawfulness of searching a computer at the border. (My prior posts are here, here, here, and here.) Today the Ninth Circuit announced a special rule for computer searches: Although a “review of computer files” can occur without reasonable suspicion, the “forensic examination” of a computer at the border requires reasonable suspicion because it is “akin to reading a diary line by line looking for mention of criminal activity—plus looking at everything the writer may have erased.” Here’s the key part of the analysis:

The relevant inquiry, as always, is one of reasonableness. But that reasonableness determination must account for differences in property. Unlike searches involving a reassembled gas tank, or small hole in the bed of a pickup truck, which have minimal or no impact beyond the search itself—and little implication for an individual’s dignity and privacy interests—the exposure of confidential and personal information has permanence. It cannot be undone. Accordingly, the uniquely sensitive nature of data on electronic devices carries with it a significant expectation of privacy and thus renders an exhaustive exploratory search more intrusive than with other forms of property.

After their initial search at the border, customs agents made copies of the hard drives and performed forensic evaluations of the computers that took days to turn up contraband. It was essentially a computer strip search. An exhaustive forensic search of a copied laptop hard drive intrudes upon privacy and dignity interests to a far greater degree than a cursory search at the border. It is little comfort to assume that the government—for now—does not have the time or resources to seize and search the millions of devices that accompany the millions

Continue Reading 0

Ninth Circuit En Banc Argument in United States v. Cotterman

Back in 2009, I first blogged about an interesting Fourth Amendment case, United States v. Cotterman, applying the border search exception to the Fourth Amendment to the search and seizure of computers. In the case, agents seized a computer at the Mexico-Arizona border and wanted to search it under the border search exception to the Fourth Amendment. The computer was password-protected and the agents apparently didn’t have a trained analyst nearby to break past the password-protection to search the computer. So the agents let the computer owner go on into the U.S. and drove the computer to to a government forensic analyst in Tucson 170 miles away. The analyst in Tucson searched the computer two days later and found child pornography.

The question in this case is whether the agents complied with the Fourth Amendment. And more broadly, it considers the limits to the scope of of the border search exception as it applies to computers. An earlier Ninth Circuit decision allowed a brief look in a computer at the border. But does the border search exception allow a thorough forensic examination of the computer, which might take a lot of time and might have to occur away from the border where the forensic analyst is located? The district court said “no”, and the panel decision said “yes.” You can read my post on the district court decision here, and my post on the Ninth Circuit panel decision here. Now we’re before the en banc court. You can watch the en banc argument here, and I found a liveblog report of it here.

I found the oral argument pretty unsatisfying, so I thought I would blog some thoughts on the issues beyond what I have written in my prior posts. I think there [...]

Continue Reading 0