pageok
pageok
pageok
Fourth Amendment Puzzle:
Here is an interesting legal question for readers interested in the Fourth Amendment. It involves a fact pattern that has started to come up quite often in the last year or two, but that no court has yet addressed. It's pretty puzzling, too, and it has lots of police officers and prosecutors unsure of what to do. I'd be interested in readers' thoughts on it. (Warning: Long and rather technical post ahead.)

  Here's the problem. Imagine that the police believe that there is evidence of crime on a suspect's computer, but they lack probable cause to obtain a warrant to search it. The police ask the suspect if he will consent to allow the police to search the computer for evidence. The suspect agrees, and gives the police his computer to be searched. A few days later, the suspect talks to an attorney and the attorney advises the suspect to revoke his consent and demand the return of the property. The lawyer (or the suspect) calls the police and withdraws consent to search the computer.

  In cases of traditional physical evidence, the law here is very clear. The basic Fourth Amendment rule is that the police can conduct a search if someone with common authority over the computer consented, but that they have to stop their search if and when the consent is revoked. Given that rule, it's clear that any search of the defendant's actual computer would have to stop when the suspect withdraws his consent.

  But here's the twist. It turns out that the first step a computer forensic analyst takes when seeking to retrieve evidence from a hard drive is to create a "bitstream copy" or "image" of the computer hard drive. The "image" is an exact copy of the hard drive that copies every one and zero on the drive. It is created for reasons of evidentiary integrity; searching a computer drive can alter the data it contains, so analysts copy the originial and do all of the analysis on the image copy. After the drive has been imaged, there are two copies of the data, not one: one copy of data on the defendant's property and another copy on the government's machine.

  Now, back to our hypothetical. It turns out that a suspect often withdraws his consent after the computer has been imaged, but before government has begun to search the image. (This is common because imaging can be done in a few hours, but most government forensic labs have long waiting lists for the actual analysis.) So here's the big question: When the suspect withdraws his consent, does the withdrawal of consent also apply to the image? Can the police search the imaged copy, or will searching the imaged copy without a warrant violate the Fourth Amendment? In doctrinal terms, does a defendant retain a legitimate expectation of privacy in the image, and if so, does his common authority to regulate consent to search the original apply equally or differently to the copy?

  I think there are two ways of looking at the problem. On one hand, you could say that the image is like a photograph taken during a search. The image is the government's own copy of what the government software "saw" when it looked through the suspect's computer. In that case, you might say that the image belongs to the government, and the suspect can no longer withdraw his consent to the search. Having obtained the initial consent to search the computer, they can search the image after consent has been revoked.

  On the other hand, you could say that the image is actually just as private as the original version of the data. What matters is the data, and it makes no sense to say that the government has "seen" the data when no search has actually occurred. The imaging software copied the private file but never exposed the data, and the copy is no different from the original. In that case, all of the data continues to belong to the suspect, and the defendant's withdrawal of consent applies equally to the original hardware and the image.

  So which is right? For reasons I explain in this forthcoming article (see section II), I think the latter view is probably right. The right to search the image should track the right to search the original, and a withdrawal of consent to search the latter should also apply to the former. Still, it's a pretty difficult question, as the answer hinges on how you address all sorts of tricky questions concerning what it means to search and seize digital evidence. One interesting variable: does the answer depend on the exact language of the consent agreement? I can imagine a court saying that a defendant's withdrawal of consent is binding on a search of the image if the defendant agreed generally to allow the government to search his computer, but that the withdrawal is not binding on the search of the image if the defendant agreed specifically to allow the government to create an image. On the flip side, if I were a defense attorney in a case raising such issues I would argue that the imaging itself is beyond the scope of the consent, and thus any data from the image must be suppressed.

  I have enabled comments. As I noted above, this issue has begun to come up a lot recently, and it's only a matter of time before the courts start confronting it.
toot (mail):
Given that the government continues its analysis of the image that it has made, how would it be able to establish in court that the image is a bona fide one if the original is back in the hands of the suspect?
6.13.2005 1:15pm
OrinKerr:
Toot,

The usual practice is for the government to retain the defendant's computer so it can establish the authenticity of the image if challenged in court; keeping the computer permits the government to establish chain of custody.
6.13.2005 1:19pm
MJ (mail):
I respectfully don't think that this is a particularly thorny issue. At the time the police make the copy, they were lawfully permitted to do so. Once consent is revoked, yes, they must cease any search of the computer's hard drive, but the copy of the computer's hard drive already lawfully existed. The defendant has no standing to object to the search of property that belongs to the police department.

Otherwise, a defendant could consent to a search of his apartment, during which time the police lawfully take photographs, make hand-written notes, and collect forensic evidence, after which time they transport the film and material to the lab, only to have the defendant then revoke consent. Are the police then barred from processing the evidence they lawfully collected? From writing reports about what they saw? It's the department's film, it's the department's fingerprint tape and powder, and they gained access to these items by the defendant's consent. The defendant has no more control (for purposes of the Fourth Amendment) over these items then he would over observations the police made, photographs they took or notes that they wrote down.

The defendant has no Fourth Amendment standing to object to whatever the police do with the copy of his hard drive.
6.13.2005 1:22pm
Jerry (www):
Would copyright play into the decision? If this were a private citizen being loaned a computer, the image would change, on returning the computer, from a legal backup to an illegal copy... the purpose of the copy has changed. When made, the copy was made specifically to keep a safe version archived; once the original is returned, the copy, if kept, is kept to keep a separate version for use in addition to the original by someone completely unconnected to the original's owner.

Is there any case law on private written materials being photocopied and then returned because permission to search has been revoked? I.e., if I give the police permission to search my diary, and they photocopy the whole thing, and then I revoke permission and they return my diary, do they have to return or destroy the photocopies also? What about audio recordings?

Jerry
6.13.2005 1:33pm
billb:
Suppose instead that I have a filing cabinet that the police believe contains incriminating documents. I initially give my consent, and they take it away and xerox the entire contents. Later, after consulting my lawyer, I withdraw my consent and demand the return of my cabinet and it's contents. Do they get to keep the xerox copies?

This situation is exactly the same as if it had been my computer, that it is or was not in common practice is immaterial. What if it was my diary that they wanted to search, and they photocopied it first? Maybe that's happened somewhere, and we can have a look at the case law?

Also, how does the demand for the return of the property grok with your assertion that the police would keep it to preserve the chain of evidence?
6.13.2005 1:35pm
billb:
Apparently Jerry and I were separated at birth.
6.13.2005 1:36pm
Ken:
Professor Kerr, perhaps the photograph is an inapt analogy. Unlike the photo, the bitstream copy is meaningless without analysis (beyond mere eye-balling). With the photo, you saw what you saw when you took the picture, and the photo is only evidence of what you already saw/know. I therefore think the disk-image is better compared to a bodily sample (blood, DNA, urine etc.).

For obvious reasons different privacy concerns are raised by the highly personal bodily sample, some of which relate only to manner of collection and others to the use of the information contained therein. But since we assume consent to the original collection (of both the bitstream and the bodily sample), the analogy is along the following lines:

In both cases, the state has collected what is in essence coded information. there is no doubt that the collection was lawful, but relied on the consent of the person. The consent is withdrawn after collection but before analysis.

That being said, I agree with your view that the withdrawal of an ordinary consent to search ought to apply to both the original and the copy. I do think that the variable you highlighted, whether the terms of the original consent permitted a copy, ought to govern the legality of retaining and examining the copy.

The specificity of the terms of consent are important. For example, imagine a suspect in a motor vehicle accident consents to the use of his blood for the purposes of measuring his BAC (he knows he was not drinking). If his consent is limited to that purpose, (at least in Canada) this cannot be used as a consent to run his DNA through open sex assault cases. (A more open-ended consent, such as "to use your blood for investigations" might). While this is obviously -not- analogous to the question you pose, it demonstrates that consents can be limited in scope and purpose, and of course some of this limits may be implied (and others explicit).

Where a search relies on consent for its lawfulness, the onus is (and ought to be) on the state to make the person aware of the nature of the search, and to secure an informed consent to the search that will actually be conducted (in this case, making a bit-for-bit copy).

Shameless plug: for those interested in the Canadian law of search and seizure, see my co-authored text: Understanding Section 8: Search, Seizure, and the Canadian Constitution, Susanne Boucher and Kenneth Landa (Toronto: Irwin Law, 2005).
6.13.2005 1:40pm
Ugh (mail):
Why can't the government argue that the imaging constituted the search, and therefore its too late for any objection? Is it any less a search just because a human hasn't looked at it yet?
6.13.2005 1:42pm
Jimbo (mail):
MJ hits the nail on the head. It seems a good analogy to hard drive imaging is the photography of a suspect's apartment. One could easily argue that if the police had taken photographs during a consented search, but before they were developed or analyzed the suspect removed consent, the police could still develop and analyze the photographs and use them in their investigation. The hard drive image is only slightly more sophisticated, but the same principle of acccess already granted to previously private data applies.
6.13.2005 1:45pm
OrinKerr:
I have found no cases involving withdrawal of consent to search photocopied documents. (Normally you don't need to photocopy a document to look at it, so it's not surprising that no cases involving such facts exist.)

In addition, it's not clear that physical copying and digital copying are necessarily equivalent for Fourth Amendment purposes. Physical copying involves human exposure but digital copying does not. This would seem to be an important distinction, as human exposure is usually the key to eliminating a reasonable expectation of privacy.

There's an interesting question lurking here: when software scans through data, does the software "see" in a sense relevant to the Fourth Amendment?
6.13.2005 1:46pm
Reed S.:
Surely this has already been addressed in the case when audio or video tapes of criminal activity *made by the suspects* have been taken?
6.13.2005 1:48pm
LTEC (mail) (www):
The concerns of MJ in a traditional setting have parallels in our digital setting.

Orin seems to be assuming that in examining a hard disk, at any point in time, some of it can be said to have been examined and the rest can be said not to have been examined. This is very far from correct, and there is no way we can make sense of such a distinction. As (only) one example: if a particular encrypted file has been found and is believed to be important, can the police continue to work on it after the computer has been returned?
6.13.2005 1:51pm
OrinKerr:
LTEC,

I don't understand. Can you elaborate?
6.13.2005 1:54pm
nc litigator (mail):
Interesting question, so I will de-lurk and add my 3 cents . . .

I think courts should/will extend 4th Am protection to the duplicate image of the hard drive. The duplicate is, for all intents and purposes, the same as the original. Indeed, the owner should not care if he got the original or 'duplicate' back as long as the government does not retain any copy. The property is not the physical computer/hard drive at all, but the data.

We can't clone cars or apartments, so we haven't run into this exact problem before. The property in which the owner should have a reasonable expectation of privacy is the data, regardless of where it is stored (unless posted wholesale on the internet!). Just because data can be easily duplicated does not mean it should receive less protection. The concept of a "duplicate" for electronic data, thus leading legal minds to ask whether a justification for treating it differently can be crafted, needs to be discarded.

MJ submitted a thoughtful post, but my problem with his analogy is that the the 'duplicate' is not the same as photographs, handwritten notes, or forensic evidence.

Whenever someone can rescind their consent, you better begin the search in earnest to find another justification for the search. Find some illegal mp3s on the computer or prove the owner bought stuff online without paying state sales tax or something . . .

As for the copyright questions, this situation reminds me of cases where a party mistakenly turns over atty-client privileged documents in response to a document request. I could make as many copies as I like, but if the disclosing party asks for 'em back, I can't only return the original.
6.13.2005 2:01pm
LTEC (mail) (www):
Elaborating on my previous comment:

I assume that Orin would agree that after returning a computer, the police could "keep" some of the information discovered. For instance, they could keep (a copy of) a letter describing the planning of a criminal act. On the other hand, they would not be permitted to keep the entire sequence of 0's and 1's.

My concern is that there is a continuum between these two extremes, and I don't see any way of making a distinction between information and bits. My example of a an encrypted letter that appears to be important is about half-way between the two extremes.
6.13.2005 2:09pm
Eyal:
Imagine for a second that the conclusion is that a withdrawal of consent means the gov't can't search the copy. Next imagine a piece of software which can do the search unsupervised. Assume a similar fact pattern, but the search software has been unleashed on the data, and finished its work, but no one has yet seen its report.

Do the authorities now not have the right to review the report?
6.13.2005 2:15pm
Hanah Volokh (mail) (www):
Orin: I agree with your comment above that the interesting question is whether computer software can be said to "see" evidence in a Fourth Amendment sense.

It doesn't take much of a stretch of imagination to consider a future world where all kinds of police activities are undertaken by computers without direct human control. Imagine, for instance, a parking meter that can detect, when time runs out, whether a car is still parked in front of it and automatically issue a parking ticket. Or an autonomous robot that roams around a rock concert detecting drugs. Do these devices "see" illegal activity the same way a police officer walking down the street does?
6.13.2005 2:20pm
Aultimur:
If I loaned my computer to an ordinary person, copyright limits their ability to make copies. Why shouldn't that contribute to my reasonable expectation of what the police can do? That would comport with Prof. Kerr's thoughts on the specificity of the consent agreement.
6.13.2005 2:20pm
Weisenheimer (mail):
Consult an intellectual property expert to resolve this. Everything on the computer belongs to Microsoft®, they would claim, so authorities need to obtain Microsoft's permission and pay an additional license fee.
6.13.2005 2:30pm
OrinKerr:
As far as I am aware, copyright law has never been held to have any relevance to any aspect of Fourth Amendment law.
6.13.2005 2:30pm
ed in texas (mail):
OK, remove the computer from the argument. Conditions of situation being the same, let's say that the evidence techs find some organic object that can be made to test for possibly incriminating DNA, but tests will take several weeks. -?- Or, going further, that a DNA sample is undergoing PCR (amplifing and copying the DNA to make the sample large enough to be testable)(but before the actual DNA tests) when permission is revoked. -?-
Sounds like a job for ActivistJudge (tm).(joke)
6.13.2005 2:31pm
OrinKerr:
I should elaborate a bit on that last point, perhaps. Government agencies *have* worried about whether creating the image implicates copyright law, and in particular whether creating the image falls under the fair use doctrine. But copyright law does not seem to impact whether copying is within the scope of consent, or whether an expectation of privacy is "reasonable" in a constitutional sense.

If this seems odd, note that whether a person has a "reasonable expectation of privacy" in information has very little (or even nothing) to do with whether a reasonable person would expect to keep it a secret. The phrase "reasonable expectation of privacy" is a term of art, and in general cannot be understood by ruminating on the nature of what seems reasonable or the nature of privacy.
6.13.2005 2:36pm
Daniel Newby (mail):
Surely there are precedents from photography. Suppose the materials being examined were color photographic negatives. The normal course of investigation might well involve sending them to a lab to make positive prints. If consent for search is withdrawn before the positives get back from processing, what should be done with them?
6.13.2005 2:36pm
Hal Horton:
I see this as similar to a scenario where police obtain consent to search a camera (the film kind) and as part of the search send the film to a lab to be developed. After the film has been developed, but before police have examined the photos, consent is withdrawn. Would police be required to turn over the developed photos as well as the negatives?
6.13.2005 2:41pm
OrinKerr:
Daniel Newby,

I have looked for such cases and have not found any. If you know of some, please let me know.

There *are* cases on whether a defendant loses a reasonable expectation of privacy in his photos when he sends film to be developed, but the analysis and results in these cases are all over the map. Some say that by exposing your negatives to human manipulation, you lose your REP. Others say you don't.
6.13.2005 2:42pm
theDA (mail):
i think the best anaology might be the defendant's consent/revoking to dna testing. he consents to the government testing a hair strand. after the government plucks his hair and leaves the labratory he withdraws his consent.

in this case, the hair sample is useless unless decoded.

theDA
6.13.2005 2:43pm
Anthony (www):
I think Ken's analogy to bodily fluids is apt - the information is there, but requires analysis. I also think nc litigator's analogy to accidentally turning over privileged attorney-client information - all copies must be returned on demand.

Ultimately, I think the issue should be referred to state legislatures (and Congress, for Federal cases) to decide, before the courts have to.
6.13.2005 2:44pm
OrinKerr:
TheDA,

It's an interesting analogy -- I'm not sure it's so similar, but it is interesting. At the same time, I'm not aware of any cases involving revocation of consent re DNA. Are you?
6.13.2005 2:47pm
Rywill (mail):
I'm surprised that the photocopied documents issue hasn't come up. Although copying may not be technically necessary, in my experience it's common, especially if there's a large volume of documents. A typical fact pattern might be: there's an initial warrant search or a grand jury SDT; prosecutor later decides he or she wants more documents; subject agrees to voluntarily turn those over (rather than being served with a new warrant or SDT). In that case, the prosecutor will often gets boxes and boxes of consensually provided copied documents, and they can't go through them all right away. If the subject revokes consent before the documents are reviewed, what then?

Another fact pattern that might give some guidance: what if agents or officers conduct a consent search and copy or photograph documents that are in a foreign language, and the subject revokes consent before the documents are translated? Could there be cases like that out there? What about cases with 24/7 electronic surveillance (like most of the FISA surveillance cases)--if the time period of the wiretap order runs out and certain intercepts exist only as machine-captured recordings, unreviewed by any human, doesn't the government still get to review them?
6.13.2005 2:48pm
JMN (mail):
I think the original comment by toot is actually quite relevant. Professor Kerr's response was that the government typically retains the defendant's computer "so it can establish the authenticity of the image if challenged in court; keeping the computer permits the government to establish chain of custody."

So what good would the image be without the original? If evidence is found on the image, why could the defendant not argue that the image was flawed in some way or that the data was inserted later? I doubt that making two images -- one to examine and one to preserve as an "original" -- would even solve this problem.
6.13.2005 2:55pm
theDA (mail):
prof kerr:

i do not know if there are any cases in which the defendant withdrew his dna testing consent. but when i get back from court this afternoon, i will be looking. i am interested.

theDA
6.13.2005 2:56pm
Dan D.:
A bit off topic, but if its not too late to put in corrections, you may want to look at page 47 of your linked article.

The second paragraph starts "None of these assumptions are valid for physical evidence."

Unless I'm reading it wrong, I think you meant "for digital evidence".
6.13.2005 3:02pm
MJ (mail):
Interesting dicussion, but I think that too many lawyers are conflating too many areas of law into this scenario. Copyright and legal ethics/privilege/work product are inapplicable here: This is a straight Fourth Amendment question. I would frame the question this way:

Does a person have a reasonable expectation of privacy in an item/information from an item that they voluntarily turn over to the police during the course of a criminal investigation?

The answer there has to be "No." If you submit any item voluntarily to the police, you have certainly run the risk that it will be copied and/or tested, thus you have waived any reasonable expectation of privacy in those copies/tests. To relinquish your consent after lawful copies of it have been made is too little, too late for Fourth Amendment purposes. You are now attempting to exert a privacy interest in an item already created by the police with your consent. The police have done exactly what you consented (should have known you were consenting) to. A defendant's standing to then object to what the police do with their lawfully created copies is wholly absent.
6.13.2005 3:11pm
OrinKerr:
MJ,

Does your view hinge on exactly what you consented to? Let's say I allow the police to take away my computer and "search" it. Does imaging the entire computer necessarily fall within the scope of that consent? Or would you agree that there is a preliminary scope of consent question concerning the creation of the image?
6.13.2005 3:20pm
MJ (mail):
Orin,

If there were limiting instructions as to the scope of the consent (i.e. you can do X but you can't do Y) then there is an argument that the police exceeded the scope of the consent.

However, if the defendant in the hypo turns over the computer to the police with the gneric undestanding/consent that the police will "search the computer for evidence" - I don't see any argument that he then has any reasonable expectation of privacy as to how the computer will be searched, copied, tested, photographed ect...

There is absolutely nothing less private than consenting to your belongings being searched for evidence by the government. Thus, there can't be any legitimate expectation of privacy as to what the police will do prior to revoking consent (again, for Fourth Amendment purposes only - I'm not a copyright or IP lawyer).

It really is the same thing as giving the police consent to search your bedroom, then revoking consent AFTER they find marijuana in your underwear drawer, on the ground that you didn't think they'd look THERE.

That's how I see it - prior to revoking your consent - all expectation of privacy is waived when you turn an item over to the government to be searched for evidence.
6.13.2005 3:51pm
Shannon Love (mail) (www):
I don't think non-tech types appreciate that copying is the fundamental operation in all digital technology. When you access a web page, play a DVD or read information off a hard drive, you are actually making a copy of the information in the original source. Routinely, this copy is discarded when no longer needed so it creates the illusion that one is looking at a unique piece of information like a sheet of paper.

I don't think that the analogy with photos or notes holds. Photos and notes are information about other objects, not perfect duplicates of the objects themselves. Copied digital information is identical to the original information. The copy will function in all ways like the original.

If the purpose of the legal standard is to interrupt the state's access to the information without further permission from the owner, then the image copy must be erased. If the purpose is merely to return the hardware and information back to the owner then there is no need to erase the copy.
6.13.2005 3:56pm
Michael:
MJ's original analogy to photos/notes taken and nc litigator's analogy to atty-client privilege-protected materials are both flawed.

The photograph analogy is flawed because photographs cannot be used to re-create a perfect duplicate of the original. A photograph of a locked drawer generally cannot be used to determine its contents.

If the police had taken photos/notes of atty-client privileged material, they would have to return those notes and photos as well, right? Yet they would not have to do so for normal cases of revoked consent, because privileged items are different from normal items originally given with consent. Privileged items would be much closer (if not considered exactly the same as) items given/taken without proper consent. If the police illegally steal something of yours and start searching it, they would have to return it and destroy all notes/photographs/etc. associated with it... right?

I think the best analogies brought up so far are to other cases in which an image is taken: photocopies, tape recordings, CDs, blood, and photo negatives. I would add to that list any other sort of digital memory (like flash memory from a camera) and any device with a hard drive (like an iPod)

It's also worth noting that blood and photocopies are not perfect copies like one would get from a digital transfer. While the DNA information in the blood is the same in 10 cells or 10,000, there are other things floating around in the bloodstream such that a larger sample would provide more information about the person (albeit information the investigators might not care about, like viral infections or white blood cell count, etc.). For photocopies, the image quality decreases slightly and information like fingerprints/oils/hairs/spilled drinks/type of ink/etc. on the original documents would be lost. Copies of VHS and audio tapes are likewise usually imperfect (unless the crime labs have much better equipment than a normal family VCR).

Addressing MJ's second post: "You are now attempting to exert a privacy interest in an item already created by the police with your consent. The police have done exactly what you consented (should have known you were consenting) to. A defendant's standing to then object to what the police do with their lawfully created copies is wholly absent."

The thorniness of this question stems from whether the image is a separate item, or whether it is part of the same "computer" item. For one item to encompass another is not unusual: the computer contains lots of items inside (drives, memory, motherboard, etc.).

To my mind, Orin's question comes down to: should the information contained inside the hard drive itself be considered _part_ of the computer such that making copies does not divorce it from still being "part" of the computer?

And I think this is where the seemingly-unrelated field of copyright law comes in, and why some people are turning to it for guidance.
6.13.2005 4:03pm
nc litigator (mail):
MJ said:

Does a person have a reasonable expectation of privacy in an item/information from an item that they voluntarily turn over to the police during the course of a criminal investigation?

Well, if the answer is "no", then folks should not be able to rescind consent, regardless of what the item is. You certainly waive your privacy when you consent to a search, but the idea that someone CAN rescind suggests that the expectation of privacy can continue if the search hasn't yielded anything noteworthy by the time consent is withdrawn.

I think judges would most likely conclude that the imaging of the computer itself is a prelude to the search, like booking a car into police custody, rather than part of the search itself. Consenting to the "search" should, absent clarification, apply to copying and analyzing every bit of accessible data. Once the consent is withdrawn (if permitted), the data must be returned. If reports have already been generated, or the child porn or whatever has already been found on the hard drive, it's too late to withdraw consent.

I don't see the atty-client privileged document scenario as especially relevant (though I mentioned it); my point was simply that everyone recognizes in that instance that a copy is identical to the original. No judge is going to let me get away with saying "but I made a copy! that's not protected!" In my opinion, the 'copy' of the data is indistiguishable from the original, so the way i think these cases should come out follows naturally.

MJ considers the data copy as something separate from the original. In that view, the copy should be fair game to analyze once the original is returned. His theory is certainly worthy of consideration.

What if what the party consented to search was a single folder on his computer, and the investigator simply logged onto the suspect's computer and emailed himself the folder. Is that now a 'copy' so that the suspect cannot withdraw consent? Or, what if the folder he consented to search did not even reside on his home computer, but actually existed on some server out on the internet accessible only by password? Even the suspect himself could not use the folder unless he 'copied' it to his home machine.
6.13.2005 4:05pm
Former Kerr Student:
I'm glad you occasionally come out on the side of the computer owner now that you're not paid to find reasons for federal agents to search without warrants.
6.13.2005 4:24pm
Public_Defender:
This thread has interesting analogies on both sides. Another one is the practice of attorneys to return privileged information to the opposing side. Generally, if an opposing attorney (or the client) sends me something privileged, it's my duty to return it or destroy it. I'm not allowed to keep a copy when I do so.

In practice, I might let the prosecutors know that if they play hardball with me on the hard drive copy, I'll play hardball back when (not if) I get information that they consider privileged in another case.
6.13.2005 4:27pm
MJ (mail):
NC,

Yes, you can recind your consent so that FURTHER invasion of your privacy does not occur, but you have thoroughly waived your expectation of privacy to anything within the scope of that consent which has occurred BEFORE revocation. That's the issue. The copying has already occurred, how does one now bootstrap an expectation of privacy onto the now product of a consented to search?

It IS the equivalent of giving consent to search your blood, then revoking the consent once the blood is in the lab. The search, for Fourth Amendment purposes, has already occurred when the blood was drawn, with the defendant's consent. The search of the computer occurred when the hard drive was copied, the copy is the evidence obtained in the search. In either case, there is no 4th Am. expecation of privacy in the product of that search which is in police custody.
6.13.2005 4:28pm
WB (mail):
I think that this theme comes out somewhat in the comments thread, but I don't think that this is such a tough question (though I disagree with your preliminary opinion).

As with blood, fingerprints, objects, et cetera, a computer hard drive is information collected from a search that has no value until it has been "processed" somehow. If a suspect gives police permission to dust his apartment for fingerprints, then withdraws consent, the police must leave the apartment, but are they forbidden from "processing" the fingerprints they have already taken by comparing them to other fingerprints they may have from a crime scene, or running them through a database?

I think that, as with any other kind of search, if a suspects consents to a search for a few hours, and then revokes that consent, the suspect runs the risk that in those few hours he/she may have given law enforcement all of the information that they need to convict/investigate further/whatever.

A rule forbidding police from processing whatever information they already have from a suspect is not required by the Constitution, in my opinion.
6.13.2005 5:18pm
Daran (mail):
Assuming no encryption, it would be trivial to run a script to search the disk for selected keywords. If the scripts lists or prints the names of the files that contained the keywords, would this constitute enough analysis in order to be allowed to continue with further analysis?
6.13.2005 5:45pm
Former forensic investigator:
Suppose that the courts do rule that where analysis of copied data is not yet done when consent is withdrawn, then the analysis cannot be done. Would not police departments react by changing their protocol: do an immediate (as quickly as possible) initial analysis to try to find a minimal amount of evidence; use that initial analysis to justify keeping their entire digital copy of a hard drive; and finish the analysis (discovering additional evidence) when time and resources permit? Would not such a revised protocol essentially make the court rulings moot?

Also, I doubt very much that a defense lawyer could convince a jury (or judge) that the initial copy of a hard drive is of questionable veracity, even though the police no longer have the hard drive. That (master) copy (#1) should be on a write-once (CD-ROM or DVD-R) medium. Moreover, copies (#2, maybe #3) are made from that master copy (again, write-only), and those are the only ones used in the analysis. Copy #1 should be immediately locked away after copy #2 (and possibly #3) is made. So the defense attorney would have to successfully argue that the police (a) are lying about when the master copy was created and (b) are lying about having locked that copy away (with all of the attendant safeguards). [Also, good practices call for giving a (read-only) copy to the defense attorney; the sooner this is done, the narrower the window where the police can (in theory) have added to or otherwise modified what they claim to have copied from the hard drive. It is even possible - though it seems pointless, given the above - to envision a third-party depository that gets a copy as soon as possible, and can attest to how little time elapsed between seizure of the computer and the copy being put into the depository.]
6.13.2005 6:22pm
Splunge (mail):
I'm not a lawyer, and furthermore doubt that nice logic and elegant argument have more than a trivial long-term impact on the social contract.

From that highly empirical point of view, I'd say it's best, medium-term, if the Courts do routinely allow suspects to revoke consent and have their computer returned and all copies destroyed. Preferably under byzantine and frequently changing rules.

The reason is simple, and is in close analogy to the careful use of antibiotics to prevent development of resistant pathogens. Encrypting files on a computer in such a way that it is not even theoretically possible to extract their content is fairly easy, and getting easier all the time. If the Courts allow expansive police powers to search computers, the result will simply be that no one trusts the law to protect his data, and everyone with minimal competence who has anything to hide, or even just keep private (e.g. the Congressmen with a fetish for, not child pornography, but quite legal if devastatingly embarassing adult gay porn), is going to encrypt it unbreakably.

The result of this, in turn, will be to render the computer search worthless for any suspect of any competence. It will only be useful for catching idiot criminals. Of course, it's of some use to do so, but society benefits rather more from catching criminals of higher skill.

If instead the Courts carve out a broad legal protection for computer searchs, this paranoia will be less likely to be triggered, and the computer search will remain a somewhat viable tool for catching non-idiot criminals, simply because few ordinary citizens have enough experience with the law to be able to guess correctly when they are inside the legal umbrella. Human nature suggests the optimism required for individuals to engage in criminal enterprise will encourage them to guess that they are inside the umbrella when they are not, fairly routinely.

Although, I have to say, I strongly suspect the era in which files on a computer are not routinely encrypted will last about as long as the era in which automobiles did not routinely have ignition locks with keys. Like maybe 10 years. So this debate is likely to be moot just about the time it gets settled.
6.13.2005 6:23pm
Reid Palmeira (mail):
A search on a computer is a search for information. You don’t look for the physical presence of a unique firearm; you look for the digital presence of a piece of information that, by its nature, is replicable. It would seem then, that it is the information, not the physical copy (which may exist on a number of different physical media) that is the property of the suspect. In the same way that software computer code, digital photographs, written sheet music and a host of information are information property owned by the individual, the storage media may belong to government or the suspect, but regardless of that, the information stored on it is the sole property of the suspect.
A Xerox copy of an incriminating document is just as valid as the original one because of the information it contains, not because of who owns the paper it was printed on or the machine it was produced by. Withdrawal of the consent would therefore apply to the image as well as the original. Fourth Amendment privacy expectations hold because it is the unique information, not the physical media it is stored on that is important.
What I would find difficult to answer is if the machine is shared among a number of different people. Should the existence of a user account under my name on a particular machine and my subsequent approval for a search, allow the police to search files under any other private user folders?
6.13.2005 6:26pm
Bill (www):
The following situation seems analogous: a person consents to submit a sample for voluntary DNA testing. After the sample (blood or what have you) is taken, but before any analysis of the sample occurs, the person withdraws consent for the testing.

It would seem to me that both questions should be answered the same way.
6.13.2005 6:38pm
billb:
Former forensic investigator:

Imaging a computer to a CD (850 MB max) or a DVD (say 9GB dual layer)? Are you kidding me? :) Try several dozen DVDs or several hundred CDs! The 250GB USB hard drive sitting next to my laptop (40 GB) would be quite a pain to image to those kinds of removable media, especially since imaging implies copying the empty parts of the disk as well the full parts (i.e. a complete copy of all the 1s and 0s on the disk).

I think the process would have to include imaging to a big hard drive and then splitting into separate files to be burned to write-once media. I don't know how that plays into the legal arguments, but that's the only feasible method.
6.13.2005 8:08pm
Half Sigma (www):
If you foolishly give the police permission to search through your house and take pictures, it's too bad if you change yoru mind later, the police still have the pictures.

It's implied that giving the police permission to take your computer is giving them permission to take a "picture" of your hard drive.
6.13.2005 8:46pm
Dan Simon (www):
I agree completely with "Splunge" that all the Fourth Amendment legalese being thrown around here is really just window dressing for--and serves mainly to obstruct and obfuscate--a pure public policy debate about which treatment of copied data by law enforcement officials would make for a better society. (Personally, I have no doubt about the answer to that question--but then, I'm not an American.)

I disagree with "Splunge", though about the likely effect of allowing the police to search copies of seized electronic media after having returned the originals. In fact, the plethora of massively publicized cases of criminals nailed as a result of wiretapped telephone conversations or seized email messages has not provoked criminals to encrypt all their telephone conversations or email. There are many reasons for this: cryptography is in practice a huge hassle to use; its use is often conspicuous, and thus carries its own risk of arousing suspicion; and criminals are criminals in part because they tend to underestimate their odds of getting caught, and therefore are more inclined to take such risks as communicating in plaintext. These factors are likely to discourage criminals from routinely using encryption to store their data as well.
6.13.2005 8:50pm
Scott Clair (mail):
Prof. Kerr:

I think the mirror-image copy has to be treated the same as if the computer itself were seized by consent. So if a suspect revokes consent, the gov't must stop the search.

None of the useful analogies referred to above, photos, DNA, urine, quite holds when comparing to the bit-by-bit capture of a mirror-image copy. I think, but haven't researched in awhile, that from an evidentiary standpoint at trial a forensic expert may testify about information gained from the image copy regardless of whether the hard-drive itself is available.(I.e. no best evidence objection). In short, the image copy is the hard drive as it existed at the time the image was taken. Also, since a search of the hard-drive itself may change the files of the hard drive, a mirror image copy is pretty much mandatory from a forensics standpoint.

As a practical matter, the consent should be considered revoked because part of the reason to allow a mirror-image copy is to allow the owner/user of the computer to continue to use it while cooperating with law enforcement. It seems unlikely that someone would turn over their computer to law enforcement (especially businesses), who may take awhile to search the computer, if they would be deprived of its use for more than the relatively brief amount of time it takes to make a mirror-image copy.
6.13.2005 10:26pm
John Armstrong (mail):
I think it's pretty clear-cut to me that anyone preferring the former option has no clue what information is, or that it has become separate from medium.

Here's a parallel case where it's important to track medium and message separately: internet file-sharing. If the police take the position that they made a copy of the bitstream which just happens to be searchable as if it were the original hard disk drive, then I take the position that I merely make copies of a bitstream which just happens to play "You Can't Always Get What You Want" when I run it through an mp3 player.

That is, the first position is tantamount to saying that information is completely secondary to medium, and that laws (and rights and privileges) only apply to media. Good for Napster.
6.13.2005 10:51pm
Lee Kane (mail):
A police officer takes a digital picture of a man's computer which appears to be splattered with blood or some other evidence, with the man's permission. The camera is not an SLR--meaning what you see through the glass viewfinder is different from the actual picture taken. Before the police officer can download and view the photograph the man withdraws his permission. Must the photo be returned or destroyed?

To LTEC's point -- no digital image (whether it be data or visual) can ever be said to be "seen" by human eyes, though it can be examined. For example, in offloading a digital picture from a camera it is possible--sometimes even necessary--to reformat the image with a different compression, thus altering the actual 1's and 0's that comprise the image--physically (or electronically) transforming it--while not substantially changing how it "appears" to human eyes.

Am I wrong? No "image" of a hard-drive in fact exactly mirrors the original. Data is organized on the disk according to the computer's OS, its available space and its disc optimization protocols. Copying the disk brings over the information but alters the exact manner in which the data is organized, depending on the environment into which it is copied.
6.13.2005 10:58pm
Lee Kane (mail):
John Armstrong -- say Brian Eno sends one of his CDs to Napster and says--go ahead and check it out; make all the copies you like for free. I waive my rights. Napster distributes copies of the CD to music lovers all over the world via its digital network. Before anyone can actually hit play and start listening, Brian Eno decides to invoke his copyright protections and demands everyone with a copy of the CD send him $19.95 or destroy the copy immediately. Do the music lovers all over the world have to do it?
6.13.2005 11:08pm
mrsizer (www):
John Armstrong made my point, but I'd like to add a bit (with the disclaimer that I'm not a lawyer nor do I play one on TV)...

Making a copy of an CD and keeping it after selling the CD is illegal. It doesn't matter if I ever listen to the copy or not.

Therefore, what if the image contains nothing incriminating but does contain a lot of legal CD copies (ripping CDs I have purchased is legal). Are the police then in violation of copyright law? Even if the image just sits in a vault somewhere? Is there some expansion of "fair use" into "seized"? Granted that it would be silly to prosecute, but nonetheless...

Lee: In the "normal user" scenario, you are correct. When you copy something from one computer to another it gets reorganized. However, it is very possible (and common) to take exact "snapshots" of a disk. And "exact" means just that: exact - down to each bit and its location.
6.13.2005 11:24pm
billb:
mrsizer:

I wouldn't go so far as to say that making an absolutely exact copy is feasible. Modern hard drives do crazy things like using a pool of extra blocks to hide the bad ones, etc. You can come pretty close to getting an exact copy of a hard drive, but not all the way there. You'll certainly get all the bits, and they'll be in the right order, but I wouldn't say you'd have the exact locations _on_the_drive_itself_.
6.14.2005 12:30am
Reid Palmeira (mail):
There are two ineffectively answered questions here though 1. as was noted by a few different people, should the use of encryption be seen by courts as evidence of criminal intent see link here and 2. on a communal machine, or a machine administered by multiple users, should permissions for a search granted by one user, allow police to search through all other user's private folders and data. In windows for example, each user has a "My Documents" folder. outside of machine administrators, no one is allowed to see any other user's files. Thus there is inherent privacy. If userA allows police to search a machine, should that search extend to the files in userB's folders?
6.14.2005 2:24am
John Armstrong (mail):
Lee Kane -- It's a hairy point, but it gets cleared up a bit if we assume that Eno waives his rights in a way that can be altered after the fact. Once we assume that, the RIAA surely would say yes, the people must pay or destroy their copy. The same sort of thing goes for software, the other major informational commodity.

Back in the halcyon days when most software came on floppies and many personal computers didn't have more than rudimentary hard drives (my old PC -- an actual IBM model 5150 -- had none at all), making backups wasn't only a safe move, it was essential. You got your floppy and made a copy (allowed by the license) so you didn't have to risk the original getting mangled every time you used it. Of course, if you sold, lost, or destroyed the original, you legally had to destroy the copy. In theory if someone saw you using a backup and you couldn't produce the original it was a prima facie case of piracy.

In short: you have license to produce and keep a copy, and if the situation changes -- you lose the original or Eno changes his mind -- you no longer have that license.

Ultimately, the discussion is going to be a toss-up until a general realization is made that information exists -- independently of its medium, no less -- and doesn't behave the same way physical goods do. There's a whole body of law (and parallel bodies of philosophy and economics) that's largely unwritten as yet to pin down how to deal with information on its own terms rather than through crude analogies with physical goods or by dealing with its medium.
6.14.2005 5:39am
James on the west coast:
Professor Kerr:

Your law review article, as far as I can tell, does not deal with consent.

It seems to me that the core question is: What does "consent" mean? You are dealing with the consent exception to the 4th Amendment requirement for a search warrant. In turn, the scope of the consent exception is truncated by the withdrawal of consent.

What difference does it make whether the copy is a Xerox or a cloned hard drive? That is: Does consent extend to the consent to copy? If so, does the withdrawal of consent extend to the impermissibility of reading a copy made with consent? Those are the only questions.

Using your eyes to read a Xerox previously unseen in an evidence box (for example) is no different from using technology to read a hard drive previously unreadable. In both cases you are getting information from a copy which, until looked at or downloaded, contained unknown information. What is the fine point? A Xerox is almost exactly the same as an original; a clone is exactly the same. So?
6.14.2005 8:13am
Timothy K. Morris:
Interesting question. Even coming from a prosecution background, I'm of two minds about the correct outcome. However, I am of one mind about going into the office this afternoon and revising the consent to search form we use for computer searches.
6.14.2005 9:29am
jallgor (mail):
As some posts have mentioned, this question would seem to come up with regard to any piece of physical evidence that is susceptible to copying; photos, papers, audio and video tapes. Why is the computer any different? What is the current rule with regard to a videotape that the government copies or papers that have been Xeroxed? That should be the rule for imaged computers.
6.14.2005 10:04am
nc litigator (mail):
i agree with jallgor that if there is already a rule for physical evidence susceptible to copying, it should apply to computers. However, video tapes, audio tapes, etc., can be reviewed much more quickly than an entire computer hard drive. If a suspect hands over some surveillance camera video tape, the police will want to watch it. They won't have to wait 3 days for some geek to duplicate it before they even pop it in a VCR.
6.14.2005 10:32am
John Armstrong (mail):
jallgor -- you're absolutely right that such a policy on photocopies, and copies of audio- and videotapes should extend to computer media. On the other hand, I'm (philosophically) opposed to police being allowed to look at photocopies they made of a subject's files if the subject can and does rescind his permission for the search. Information doesn't track the medium.

I actually disagree that photographs are the same. They're more like notes -- incredibly detailed notes -- that the police take. In particular, they aren't identical to the search area, but merely a description of the surface. You can't pick up a blanket in a photograph, nor can you turn around to see what's casting that shadow. A photograph is new information, which the police own and can do what they will with.
6.14.2005 2:17pm
Mark Eckenwiler:
At least one federal court has decided that while the government must return photocopies made after the owner demands the return of the voluntarily supplied paper originals, the government has no such obligation with respect to copies made prior to the demand for return. See Mason v. Pulliam, 402 F. Supp. 978 (N.D. Ga. 1975).

More specifically, the court opines (in dicta) that even if the government used a high-speed copying system to duplicate the papers -- without having an agent read them -- it could still retain and use the copies, so long as they were made before revocation of the owner's consent.
6.14.2005 4:27pm
Lee Kane (mail):
John Armstrong --Information as property in the way physical objects are property has, for me, some problems, sharing flaws with the notion of intellectual property, to which it is closely related (if not exactly the same). Intellectual property, for example, has been recognized to exist in the U.S. in the form of copyright and patents--but it is a special right granted by the state to advance state interests such as economic activity and creativity among the citizenry. It is not an eternal right to own the "property" in the way a piece of land or one's kidney can be owned. Both patents and copyrights expire--again, though for different reasons, in order to promote the state interests of economic activity and creativity among the citizenry.

It seems to me that information is also a special right that may be regulated in ways different than the right to one's own kidney or real estate.

I believe this to be proper since both information and intellectual property almost invariably incorporate the uncompensated work, thinking and efforts of multitudes living and dead--and it is improper to arbitrarily assign ownership without limit to the last person to touch and transform it.
6.14.2005 9:44pm
John Armstrong (mail):
I ran this by a FOAF who works in computer forensics. Our discussion hinged on "what does a search warrant 'really' cover?" Does it cover the physical disk or the information contained thereon. In the first case, making a copy is just that, making a copy. The copies can be searched even if the original can no longer be. In the second case (the position I take), the disk image constitutes the exact same information, with the exact same rights attached.

His experience is that at least roughly a search warrant covers physical search while a subpoena covers information (real lawyers, please verify since this smells a bit fishy to me). That is, it may well be that a more appropriate (from an information-theoretic point of view) course would be to subpoena the data on the hard drive rather than to issue a search warrant for it.

Either way, from what I can tell the courts have not split this essential hair: when searching a suspect's computer are they searching the information or its medium? Up until very recent years the two went hand-in-glove, and most people (and almost all people old enough to set such policies) don't even realize that they're coming apart.
6.15.2005 1:09am
John Armstrong (mail):
Lee Kane -- you're very right that the notion of information in-and-of itself has some (okay, many) loose ends. As I said, there are parallel bodies of philosophy and economics still unwritten.

Richard M. Stallman resolves your specific points by saying that "information wants to be free" -- ownership is impossible. I don't think that extreme is accurate, and I'm sure he'd be dismayed at the consequence here: that the information is fair game with or without a warrant. The underlying philosophical question is unresolved, so I don't think there can yet be a definitive answer to Kerr's question.
6.15.2005 1:19am
Arthur Dent:
A couple comments that may help illuminate the arguments:

The article at p. 32 references a "scary scenario" implication of the author's framework—of government mirroring all data without it being a "search" so that it may be analyzed and later. The article then counters that spectre by arguing that officers will typically need a warrant to get at the electronic media's physical location so that warrants will inhibit the "scary" outcome.

I'll suggest a scenario that appears to me consistent with the author's framework that some may find "scary." The government essentially exercises a general warrant during customs border searches, which require neither a warrant or any level of suspicion to search cargo (there is a reasonable suspicion standard for intrusive searches of the person, such as strip searches).

Under the proposed "exposure based search" customs could conduct a border search (that the Supreme Court reiterated last term in Flores-Montano that the government has plenary authority to conduct of merchandise) to image all digital media as it crosses the border—your work product, holiday snaps, e-mail, everything. Border officials could then store that data indefinitely, awaiting the time when usefulness in criminal investigation may arise—or offer the intelligence community access to such information for them to view under those agencies' own authorities.

Consider it a kind of border search TiVo, time shifting the actual seizure to when that border search of your computer may really come in handy.

A couple courts that have addressed border and extended border searches of ordinary documents suggest that when border authorities make a copy, it is a seizure. Those cases might be worth footnoting in this portion of the article. See United States v Cardona, 769 F.2d 925 (9th Cir. 1985); Heidy v. United States, 681 F. Supp. 1445 (C.D.Cal. 1988). The Heidy case also suggests that the First Amendment may be the problem with a broader interpretation of access to "intellectual content" ("information"?) rather than the Fourth Amendment. Maybe that's the more appropriate constitutional limit.

I suspect that courts may find the analogy from the "sneak and peak" and other warrant cases cited at p. 31 of the article more persuasive to limit the potential outcome regarding border searches above, but I think the issue is far from clear and the article is a helpful addition to the relative dearth of commentary.
6.15.2005 11:10pm