Tenth Circuit Denies Rehearing in United States v. Andrus:
Back in April, I blogged about the Tenth Circuit's very interesting 2-1 decision in United States v. Andrus, a Fourth Amendment case involving third party consent to search a computer. My post, "Virtual Analogies, Physical Searches, and the Fourth Amendment," is here. Yesterday the Tenth Circuit denied rehearing in the case in an order you can view here. There were several votes for rehearing -- Judges Kelly, Lucero, McConnell and Holmes, in addition to Judge McKay on the original panel -- but not quite enough.

  The two judges in the original panel majority (Murphy and Gorsuch) did add a "note" in the order denying rehearing to clarify that the decision was intended to be very narrow:
  In denying rehearing, however, the panel majority notes that its opinion is limited to the narrow question of the apparent authority of a homeowner to consent to a search of a computer on premises in the specific factual setting presented, including the undisputed fact that the owner had access to the computer, paid for internet access, and had an e-mail address used to register on a website providing access to the files of interest to law enforcement.
  Among the questions not presented in this matter, and for which there is no factual development in the record, are the extent of capability and activation of password protection or user profiles on home computers, the capability of EnCase software to detect the presence of password protection or a user profile, or the degree to which law enforcement confronts password protection or user profiles on home computers.

Dave N (mail):
I suspect that out of a sense of modesty, OK did not mention that his law review article, Searches and Seizures in a Digital World, 119 Harv. L. Rev. 531 (2005), was cited as a source by the majority. (Slip op. p. 13).

There is a profound problem with this opinion--the court glosses over the fact that the EnCase program bypassed Andrus' password protection--which should assuredly act as a "lock."

The majority states at p. 18 fn 6:
Although the district court did not make any factual findings as to whether the computer was password protected, there is evidence in the record suggesting the presence of a password. . . . Determining whether a password was actually in place,however, is unnecessary for analyzing Dr. Andrus' apparent authority, since the password would not have been obvious to the officers at the time they obtained consent and commenced the search.

Say what? if the EnCase program bypasses passwords, this reasoning is analogous to the police being given consent and then using a skeleton key to turn a lock before determining if a door was locked in the first place.

I found this sentence (at p. 20) particularly unpersuasive: "Andrus' argument presupposes, however, that password protection of home computers is so common that a reasonable officer ought to know password protection is likely."

Give me a break. The officers were using a program designed to BYPASS password protection--certainly an useful tool if a computer is being searched pursuant to a warrant. Thus, the officers had to know that there was a reasonable probability that a password would be required, particularly if contraband was being hidden on the computer. Additionally, since at least Windows 98, Microsoft has made password protected user accounts a default. In other words, Microsoft offers you the ability to create a password. You have to consciously decide you don't want one.

If the computer was password protected and Dr. Andrus did not have the password, then he clearly lacked apparent authority to consent--and the police search should have been suppressed as exceeding the scope of Dr. Andrus' authority to consent.

Judge McKay's dissent is spot on. Too bad it is not the majority opinion.
8.25.2007 2:31pm
I'm not a lawyer, but doesn't a homeowner have the right to consent to the search of anything in his home? In this case, if the father had told the police they were welcome to open his son's locked closet, wouldn't the police have the right to do that? Doesn't the parent's ownership of the computer trump any privacy expectation of the son, even if he isn't a minor?
8.28.2007 6:41pm