Digital Archaeology (2014)

3. Search Warrants and Subpoenas

One of the motivating factors of the Revolutionary War was the general warrant. England maintained the philosophy that a man’s house was his castle and that a government official could not search without a warrant. Unfortunately, it was far too easy for representatives of the English Crown in Colonial America to get a warrant, and then the warrant was a writ of assistance, more commonly known as a general warrant. With such a warrant in hand, the official could ransack a person’s home looking for anything and everything that may have been of interest to the official. After America successfully seceded from British control, one of the first things our founding fathers did was establish in the Bill of Rights language specifically prohibiting unreasonable search and seizure. These rights were defined in the Fourth Amendment to the Constitution.

Unless otherwise stated in the warrant, the document must be exercised in “normal business hours,” and the executor of the warrant must announce his or her presence. Exceptions to these rules are the no-knock warrant and the after-hours warrant. These will be discussed in further detail later in this chapter.

Laws governing the acquisition and execution of search warrants have evolved and expanded over the years. It seems each year a new challenge to Fourth Amendment interpretation reaches the courts. In the wake of 9/11, it became even more difficult for average investigators to understand their own rights and responsibilities as the Patriot Act expanded some of the government’s right to act. Add to this the fact that different courts have interpreted the Fourth Amendment in different ways, and it is understandable that it gets so confusing.

Distinguishing between Warrants and Subpoenas

What is the difference between a search warrant and a subpoena? While both perform similar functions, they are quite different in scope and in execution. A search warrant is an order issued by a judge that gives government officials express permission to enter a specifically defined property with the intent of searching the premises for evidence of a specific crime. To convince a judge that a warrant is in order, an investigator must show two things. First there must be probable cause. Probable cause consists of a statement (an affidavit) filed by the government first stating that it believes with reasonable certainty that a crime has been committed, is being committed, or is about to be committed, and second, explaining in as much detail as possible what evidence already exists that such a crime exists.

Along with probable cause, the request for a warrant must fulfill particularity requirements. This fascinating phrase simply means that the request must identify with reasonable accuracy precisely what location is to be searched, what materials or evidence are being sought, and what may and may not be seized. Traditional search restrictions require that officers search only in places defined by the warrant, looking for items that fall within the descriptive parameters of the warrant, and they can look only in spaces that could conceivably hold the object being sought. In other words, if an investigator is looking for a stolen car, he may not look in the driver’s jewelry box.

When a warrant is issued, it is done so by a judge, at the request of a government official or agency. It is not necessary for the target of the search to be present or to even be aware that the warrant is being requested. More often than not, the person or persons subject to the search first learn of the warrant when it is handed to them. The warrant will occur whether the victim likes it or not. There is no challenge for a warrant presented at the door. It gives the government permission to enter.

A subpoena is an order to appear before the court or an order to produce documents or other evidence as defined in the subpoena. A subpoena can be issued that demands both the presence of the person and that the person bring materials with him or her. This type of subpoena is known as a subpoena duces tecum. The Latin phrase means “to bring with you under penalty of punishment.” Unlike a warrant, the target of a subpoena can respond with a motion to quash the subpoena. If the motion is successful, the order is rescinded. Valid reasons for quashing a subpoena include (Portman and Jacobs 1998)

• Insufficient time to respond to the demands listed.

• Subpoena calls for the disclosure of protected information.

• Compliance places an undue burden on the recipient.

• Compliance requires that the recipient travel excessive distance.

• Subpoena requests information not relevant to the matter of litigation.

• Information requested is readily available from other sources.

Subpoenas can be issued by either federal or state courts. A state subpoena cannot be enforced upon an individual who resides in another state and is not a party of the litigation. A federal subpoena is valid regardless of where it is issued or where it is enforced within the legal jurisdiction of United States government.

What Is a Search and When Is It Legal?

Throughout the remainder of this chapter and elsewhere in the book, the words search and seizure will be used repeatedly. The definition of what constitutes a search is a fairly broad interpretation. Most case law interprets any entrance into a home or office as a search, whether the investigator actively “looks” for something or not. USLegal defines a search as an examination of a person’s body, his or her property, or any area that another reasonable person would consider private (USLegal 2010). Therefore, examining a person’s telephone constitutes a search. Simply looking through the window of a private home or office is “searching” the place.

The U.S. v. Carey (1999) police officers executed a warrant to search a computer for evidence of drug trafficking. While performing the search, the officers came across a large number of images they considered to be child pornography. Using a doctrine known as “plain view,” they extended their search to include child pornography and charged Carey with possession of such materials. The plain view doctrine states that items seen in the course of an investigation that exist in plain view can be examined without need for a search warrant. On appeal, the court disagreed with this interpretation, saying that the files were only evident as pornographic in nature if opened. The images were excluded as evidence, and the pornography charges didn’t stick.

Seizure is the physical acquisition and confiscation of items found during the search. It can also refer to the detention of a person. Typically, warrants issued by the court grant both the right to search a person or property and the right to seize any evidentiary materials found. The permission to search granted within the warrant may be somewhat generic, identifying no more than an address and whether to search the entire premises or just specific areas of the property. The instructions as to what may be seized by the search team are generally more specific.

The question of when it is legal is more difficult to answer. Clearly, any time a duly appointed justice of a state or federal court issues a warrant to perform the search, the search as defined in the warrant is legal. If the search exceeds the scope of the warrant, then it becomes an illegal search. Also, if the search is performed by a private citizen who is not acting as an agent of the government, there is no Fourth Amendment protection against the results of the search. There may be other legal remedies that the victim of the search may pursue. That is a matter for that person to discuss with a competent attorney. However, the court is unlikely to disallow the evidence found under constitutional grounds.

Just because a warrant isn’t issued, that does not necessarily mean that a search conducted without one is illegal. There are several circumstances where warrantless searches are allowed by law. To be illegal under any circumstances, a search must violate “a person’s reasonable expectation of privacy” (DOJ 2008). Reasonable expectation of privacy is determined by two factors:

• Does the subject’s behavior indicate an expectation of privacy?

• Is that expectation one that society is prepared to accept as reasonable?

How does a person’s behavior indicate his or her expectation? A person running naked down the street certainly has no cause to complain if people point and laugh. That same person in the privacy of his shower most certainly does. This is an exaggerated example, but it makes the point. That is where society’s acceptance comes into play. The man running down the street is something that the average citizen considers a bit strange. Society does not expect him to assume his public display is an invasion of his privacy, even if in his own mind he thinks he’s on a private beach. Unfortunately, most situations are not so easily determined. As DOJ points out, there is no bright line that defines privacy. A few examples of situations where a person can expect privacy are defined in the following decisions:

• Payton v. New York, 445 U.S. 573 (1980): Privacy inside a person’s home is guaranteed, even in the process of making an arrest. A warrantless arrest is specifically unconstitutional.

• Katz v. United States, 389 U.S. 347 (1967): Privacy inside a closed telephone booth is assumed because the closed door of the booth gives the person a reasonable expectation of privacy.

• United States v. Ross, 456 U.S. 798 (1982): Privacy of the contents of opaque containers is different from the privacy (or lack thereof) in an automobile. A closed container within the automobile is not subject to search without a warrant even if reasonable cause opens the door to an automobile search. This closed container clause has been interpreted to include computers, computer media, and other items that must be mounted on a system before they can be viewed (see below).

• United States v. Barth, 26 F. Supp. 2d 929 (1998): Privacy of the contents on a computer’s hard drive is essentially the same as that of a closed container.

• United States v. Reyes, 922 F. Supp. 818 (1996): Privacy of the contents of a paging device is essentially the same as that of a closed container.

Conversely, courts have also made some notable decisions about where a reasonable expectation of privacy does not exist:

• Oliver v. United States, 466 U.S. 170 (1984): Activities conducted in an open field dispel any reasonable expectation of privacy, as anyone—not just legal authorities—can view their activities.

• California v. Greenwood, 466 U.S. 35 (1988): Garbage deposited outside of a person’s property has been left exposed to the view of anyone who looks.

• Rakas v. Illinois, 439 U.S. 128 (1978): Privacy does not exist inside of a stranger’s house entered with intent to commit robbery. Constitutional protection enjoyed by the owner does not vicariously pass on to an intruder.

• United States v. David, 756 F. Supp. 1385 (1991): A password openly displayed on a computer monitor falls under the plain view exception.

• United States v. Lyons, 992 F.2d 1029 (1993): Privacy of the contents of a computer the individual has stolen does not pass from the owner to the thief.

As mentioned in Chapter 1, “The Anatomy of a Digital Investigation,” the digital forensic investigator has a more complex formula for searches. The warrant that allows the search of the premises may specify that all computing devices, communication devices, and so forth may be seized. However, after transporting these devices back to the lab for examination, it is equally necessary to have a warrant that identifies what information stores may be searched. A key example is when a warrant is issued to search for information regarding financial fraud of some sort. If, during the course of the search, evidence is uncovered that suggests another crime—such as the distribution of child pornography—a new and separate warrant must be issued.

Any rights to privacy regarding stored electronic information can be relinquished when control of the device or of the data is relinquished to a third party. An individual who brings a computer in for service runs the risk that the repair technician might stumble across evidence of criminal behavior. If that person reports the evidence to authorities, who subsequently obtain a search warrant, there is no recourse against the repairman. Data that is copied to a CD and shipped across the country remains private as long as it is in transit. Once the recipient takes control, the rights of the original sender can vary, depending on circumstances. If circumstances dictate that the “sender” retains control of the “package,” then expectation of privacy is retained. United States v. Most (1989) allowed that when a person leaves a closed plastic bag with a third party, intending to retrieve it in the near future, then the expectation of privacy is retained. Conversely, in United States v. Horowitz (1986), an e-mail message that had arrived at its destination did not afford privacy protection to the original sender of the message.

Aside from the “expectation of privacy” issue, there are other exceptions that allow a warrantless search. These will be discussed later in this chapter.

Basic Elements of Obtaining a Warrant

First and foremost—only a judge can issue a search warrant. It can be a federal, state, or territorial judge, or it can be a U.S. magistrate judge. The warrant can be issued only to a legally authorized law enforcement official. To obtain a warrant, a law enforcement official will file a written statement called an affidavit that must show

• Probable cause

• Particularity of place

• Particularity of items to be searched

When considering the warrant, a judge can refuse to issue on the basis of any one or more of these requirements. Probable cause was covered in detail in Chapter 2, “Laws Affecting Forensic Investigations.” To recap, it basically says that the requestor has a reason to suspect that a crime has been committed, is being committed, or is about to be committed and that evidence of such crime exists at the place to be searched. Federal warrant requirements are spelled out in Title 18, Part II, Chapter 205 – Searches and Seizures.

Special circumstances may prevent an official from being able to provide an affidavit in a timely manner. Rule 41b of the Federal Rules of Evidence (DOJ 2008) also allows a judge, at his or her discretion, to issue a warrant based on sworn testimony or by recorded testimony. When an applicant is requesting a warrant based on sworn testimony, the judge must place the applicant under oath and make a verbatim recording of the testimony given.

Once issued, a warrant is good for only a limited period of time. Unless otherwise specified, Federal Rules of Evidence specifies a default expiration of ten days from the date of issuance. In addition to the particularity issues mentioned previously, the warrant will also specify a magistrate judge to whom the warrant must be returned once it has been executed.

The officer executing the warrant must record the exact time and date the warrant was carried out. If any items are seized during the search, the target of the warrant must be provided a copy of an inventory of everything taken. Another copy of this inventory must accompany the warrant when it is returned to the court. Whoever carries out the warrant must issue a receipt for all items seized along with the inventory.

A defendant who is subject to a search and seizure action initiated by a legally executed warrant has no recourse against the search. However, the defendant may have counsel present during the search. If there is any reason to suspect that the warrant was issued improperly, the defendant can issue a motion to suppress any evidence uncovered by the search.

No-Knock Warrants

Unless otherwise stated, an officer executing a search or arrest warrant must abide by the knock and announce rule. According to this general rule, when executing a warrant, the officer should knock, announce the intention of the search team, and allow residents of the location being searched time to respond to the knock. The Supreme Court identified key advantages of knock and announce in Hudson v. Michigan (2006) as protecting the safety of the officers against defensive reaction by the defendants and protecting property from damage. Justice Scalia noted in his opinion, “Until a valid warrant has issued, citizens are entitled to shield their persons, houses, papers, and effects” (Hudson v. Michigan 2006). His opinion recognizes the fact that, lacking knowledge of a pending warrant being legally served, residents of the building may proactively defend their position.

The courts recognize that sometimes circumstances require that suspects not be notified of a pending search. If there is reason to believe that suspects may aggressively repel a search, that the subjects of the search are likely to escape, or that evidence is likely to be destroyed in the time it takes for officers to wait for a response, the courts may issue a no-knock warrant. This gives officers serving a warrant specific permission in writing to break down the door and enter unannounced. Generally speaking, in order to obtain a no-knock warrant, officers requesting the document must show reasonable suspicion that one of the aforementioned conditions exists.

In cases where digital information is a primary target of the search, there may be reason to believe that the suspect may employ a “kill switch.” This colorful term refers to any mechanism, hardware or software, that can quickly and effectively destroy data stored on a system. No-knock warrants are frequently requested under such circumstances.

After-Hours Warrants

Rule 41 of the FRCP states that warrants are to be executed during “normal daytime hours” unless otherwise specified; 41a(2) specifies daytime hours as being between 6:00 a.m. and 10:00 p.m. local time. The same exceptions that allow a no-knock warrant can be applied to after-hours warrants. If any one of the three exigent circumstances exists, a judge may issue a warrant that can be executed at any time of the day or night.

Sneak and Peek Warrants

FRCP specifies that those with an interest in a property that is the subject of a search should be notified of the government’s intent to perform said search. The Patriot Act of 2001 provided law enforcement with a new tool called the delayed notice. Under Title 18, Part 1, Chapter 121, § 2705, the court can order notification of a search delayed by up to 90 days. It lists the following circumstances as reasonable cause to issue such a delay:

• Endangering the life or physical safety of an individual

• Flight from prosecution

• Destruction of or tampering with evidence

• Intimidation of potential witnesses

• Otherwise seriously jeopardizing an investigation or unduly delaying a trial

What the rule basically says is that, under such a warrant, a government agent may surreptitiously enter the premises to be searched and conduct the search without the knowledge of the individuals under scrutiny.

Under the conditions of a sneak and peek warrant, officers may not seize any material evidence. However, if the judge issuing the warrant determines that there is reasonable necessity for seizure, he or she may issue an order allowing an exception. If such an exception is issued, the officers executing the search may be permitted to surreptitiously copy documents or computer files.

Section 206 of the Patriot Act modified earlier interpretations of sneak and peak by authorizing government officials to solicit third-party assistance in tracking down information about a suspect. Specifically, it empowers a warrant to authorize the search of third-party records for information even when there is no specifically identified person named as the target of the search. This allows the investigator to attempt to track communications by unknown parties who are regularly changing their telephone numbers or taking other evasive action to avoid detection by government authorities. The growing popularity of and ease of access to cheap, prepaid throwaway telephones mounts a strong case for this statute.

The Plain View Doctrine

Earlier in the chapter, I mentioned that one long-standing exception to the requirement for a warrant is the plain view doctrine. In general searches, the doctrine provides that evidence may be seized without a warrant whenever evidence of an incriminating nature is clearly evident and the officers invoking plain view are in the process of executing a legally issued warrant for a search or arrest when the evidence is found. In other words, if a police officer has a warrant to search a house for controlled substances and there is a video involving child pornography playing when they enter, the pornography can be seized. Additionally, the “plain view” evidence can be used as a probable cause for issuing a new warrant to search for child pornography.

When used in reference to computer searches, plain view can get a bit more confusing. File names, techniques for hiding files, and other technological issues mean that a thorough search mandates opening—or at least examining—any file that is even remotely suspicious. Therefore, it is not unusual that a search legally authorized by one warrant opens, for plain view, evidence of another crime not authorized by the warrant. In theory, when this happens, the investigator should immediately stop the search and wait to see if a new warrant will be issued based on evidence found.

Opponents of plain view computer searches complain that lack of specific guidance regarding plain view doctrine with respect to computer searches has led to too many investigators abusing the privilege. Long after sufficient evidence has been found to support the crime under investigation, they continue to probe, “fishing” for evidence of other crimes.

It is not uncommon for a judge to require investigators to submit a search protocol in potentially tricky situations. A search protocol is a statement that identifies the processes and procedures that the investigator will use and what precautions will be taken to limit the search to incriminating or exculpatory evidence related to the suspected crime. Any deviations from the approved protocol would have to be submitted and approved before allowed.

The problem with that approach is that the investigator has no way of knowing in advance what steps will be required. If the suspect is using encryption, that will change the situation. What methods has the suspected used to hide or disguise files? What outside influences will come into play?

In 2009, the U.S. Court of Appeals for the Ninth Circuit filed an en banc opinion in the case of U.S. v. Comprehensive Drug Testing (2009) in which it issued instructions for all judges presiding in the circuit to stop issuing warrants involving computer searches unless the government gives up its right to the plain view doctrine. If the investigator requesting the warrant refused to waive the doctrine, the judge was to do one of two things. He or she could refuse to issue the warrant—regardless of the circumstances justifying said warrant. Or the warrant could be issued with the provision that a third party separate “seizable from nonseizable data under the supervision of the court.”

Needless to say, reaction to that ruling was mixed. In an article posted on the Alameda County’s District Attorney’s Office, the author (unidentified) stated,

Moreover, it demonstrates an almost paranoidal obsession with computer privacy. And it is hard to avoid the conclusion that it was driven largely by the recent embarrassing revelations concerning the contents of the home computer of the judge who wrote the opinion. In fact, while the judge was adjudicating this appeal, a panel of federal judges was investigating his use of the computer at the request of the Supreme Court. As a result, the judge was publicly rebuked for “exhibiting poor judgment.” (Office of the District Attorney, Alameda County 2009)

Within three months, the Ninth Circuit decision was challenged. As of this writing the dust has not yet settled.

The Warrantless Search

The concept of the warrantless search has been an issue of contention since the Bill of Rights first made its way into our Constitution. For well over a century, it was basically a nonissue. No warrant—no search. In 1914, the Supreme Court instituted the exclusionary rule (Weeks v. U.S. 1914), which states that any evidence collected by federal agents as a result of an illegal search cannot be used against the defendant in court. Prior to this decision, evidence collected illegally could be used as evidence, but the defendant could pursue charges against those who carried out the search.

Since the 1914 decision specifically named federal agents in its decision, for many years, officers involved in a federal investigation would enlist the assistance of local law enforcement officers to “collect” evidence, which they would turn over to federal agents for use. This changed in 1961 when the court decided in Mapp v. Ohio (1961) that the exclusionary rule applied to all government agents, regardless of their level of jurisdiction.

However, the courts in other decisions have maintained the government’s rights to perform searches and seizures without first obtaining a warrant under certain circumstances. Among these mitigating circumstances are

• Searches incident to arrest

• Searches with consent

• Special needs searches involving public employees

All of these exceptions can be applied to physical searches as well as digital investigations. However, some circumstances arise in cases involving digital data that do not arise in more conventional searches.

Searches Incident to Arrest

Arresting officers have the right to search a suspect at the scene of the arrest without first obtaining a warrant. This is allowed in order to protect the arresting officers, and any bystanders in the area, from being harmed by a weapon the arrestee might have concealed, and in order to prevent the destruction of evidence. This search is limited to the person being arrested and the immediate area over which the suspect might have reasonable and immediate control. The limitations to this exception were decided in Chimel v. California (1969).

Prior to Chimel, the case that most frequently dictated warrantless search incident to arrest was Weeks. While in the 1914 case, the court did overturn a decision on the basis of evidence obtained with no warrant at all, it basically condoned the search of a suspect being legally arrested. In the landmark decision, the court wrote, “While an incidental seizure of incriminating papers, made in the execution of a legal warrant, and their use as evidence, may be justified, and a collateral issue will not be raised to ascertain the source of competent evidence” (Weeks 1914).

Terry v. Ohio (1968) further defined the concept of warrantless searches, extending the option to situations where the suspect might not necessarily be the subject of an arrest. In this decision, the court questioned the meaning of the word “reasonable” in the Fourth Amendment restriction against unreasonable searches and seizures. The case came about when Cleveland detective Martin McFadden observed two “suspicious characters” passing the same location several times, and then pausing to engage in brief conversations. Suspecting that the two were about to commit a robbery, McFadden approached the men to question them. During the engagement, he patted one of the men down and discovered a concealed firearm. The defense for the suspects claimed that their Fourth Amendment rights were violated by an unreasonable search without a warrant.

The Supreme Court, under Chief Justice Earl Warren, determined that there are certain circumstances where probable cause allows for a search to be conducted without a warrant. Four reasons were listed:

• A law enforcement officer’s personal observations

• Reliable hearsay

• Behavior fitting a criminal profile

• Unprovoked flight

Unprovoked flight seems as though it would need little explanation. It did require a Supreme Court decision to clarify the intent of the law. Illinois v. Wardlow (2000) was one case that determined what constituted unprovoked flight. In this case, the suspect, Wardlow, fled when he witnessed multiple police cars approaching him. Officers pursued him, and when they caught up, searched him and found a concealed weapon. In this case, the Supreme Court determined that flight in a high crime area did not necessarily provide the reasonable cause for police to search. The decision did confirm that Wardlow’s Fourth Amendment rights had not been violated but that his mere flight from the sight of a police officer did not constitute suspicious behavior.

It is also against the law for law enforcement to use racial profiling in lieu of criminal profiling. Performing random searches on individuals with Arabic features is not legal, even if there has been “reliable hearsay” of a terrorist threat involving Arab nationals.

Searches with Consent

In the event that someone with the authority to do so gives consent for government officials to search a specific area, evidence located during the search can be deemed admissible even in the absence of a warrant. Issues that might arise under these circumstances include

• Person giving consent might not have authority.

• Prosecution must be able to prove that the consent was voluntary.

• Officials performing the search must comply with any restrictions placed on the scope of the search by the person granting permission.

• The person granting consent may revoke that consent at any time, without notice.

A common question that arises any time a consent-to-search issue is contested is “Who has the authority to give consent?” The answer to this question varies greatly with the circumstances, and any time there is doubt, an investigator should do one of two things. The safest option is to obtain a search warrant. This completely sidesteps the consent issue since, with the warrant, no consent is required. The second option is to let your legal counsel make the decision. There have been some court decisions that lend general guidelines in three categories of consent:

• Personal property

• Private sector organizations

• Public sector organizations

Each of these issues has specific questions that will be asked and conditions that must be met to constitute a legal consent to search.

Personal Property

When searching a private residence, there are two conditions the court may consider when deciding whether there was legal consent to search the premises or computer systems. Actual authority to consent occurs when the target of the search is directly owned and controlled by the person giving the consent, or when an individual has expressly been authorized by the owner to give consent. As an example, Joe Citizen is the only resident at 2 Mockingbird Lane, and when the police knock on the door, he says he has nothing to hide and lets them in, giving the officers permission to look around. Additionally, someone with power of attorney to settle an estate would have actual authority to grant permission for a search.

The second set of circumstances is more complicated. That is apparent authority to consent. Apparent authority occurs when the person giving the consent has the genuine appearance of having the authority. This can happen when the person actually believes he or she has the right to give permission, and when the officers conducting the search have no reason to suspect this is not the case. Examples of this concept would be the owner of a house who has an adult offspring still living at home or two adults sharing a residence with common control. Both situations have examples in case law.

Schneckloth v. Bustamonte (1973) was a Supreme Court case that formalized the principle that a search without warrant was valid in the presence of voluntary consent. United States v. Matlock (1974) prompted a more granular definition of the principle. Matlock concerned a case of cohabitation by two adults. The defendant was arrested on the front lawn of the house he shared with Gayle Graff (and others). Arresting officers did not ask the suspect which room he occupied, nor did they request his permission to search the premises. The search was accomplished on the permission of Ms. Graff. In this decision the court determined that since statements made by Graff to the police indicated that she and Matlock were married, they had reasonable cause to assume she had the authority to grant permission to search the quarters they jointly shared. It has even been decided that a guest in a house has apparent authority to consent to search an area where visitors would normally be received, provided that guest can demonstrate that he or she has been given access to the house in the owner’s absence (People v. Ledesma 2006).

In the event that two cohabitants of a residence have equal authority to grant or refuse permission, the situation gets complicated as well. In the absence of one or more of the cohabitants, those present may grant permission to search. Another offshoot of Matlock was that the court decided that the absent cohabitant did not have the right to revoke permission, stating that “mutual use of the property carries with it the risk that one of the occupants might permit a search of the common areas” (U.S. v. Matlock 1974).

However, in the presence of all cohabitants of equal authority, if even one of those residents objects to the search, apparent authority is not likely to be recognized by the courts. Georgia v. Randolph (2006) addressed this issue. In doing so, the court itemized several circumstances where permission may be assumed:

• A recognized hierarchy (e.g., an adult caretaker with a noncompetent ward)

• Objection of an absent cohabitant

• Reasonable fear for the safety of someone inside the premises

• The victim of domestic violence while the victim collects his or her belongings

• Reasonable fear that evidence may be destroyed

In general, parents have actual authority to give permission to search rooms occupied by their children. They cannot, however, grant permission to search an area that is under exclusive control of the child. An example of exclusive control would be a girl’s jewelry box that has been locked by the child. Even in the case of adult-aged children, the parents have actual authority in situations where the child does not pay rent for the room. In the event that the child does pay rent, the relationship shifts from parent/child to landlord/tenant, and as long as the rent is not in arrears, the tenant relationship assumes priority (People v. Oodham 2000).

Private Sector Organizations

Two apparently conflicting principles come into play when considering who has consent to search a computer owned by a corporation or nongovernment nonprofit entity. The first of these is the fact that even though they do not own the space they occupy or the computers they work on, and even though they share this space with other people, workers still can express a reasonable expectation of privacy. This issue was addressed as early as 1968 in Mancusi v. DeForte. In this decision Justice Harlan wrote, “It seems clear that if DeForte had occupied a ‘private’ office in the union headquarters, and union records had been seized from a desk or a filing cabinet in that office, he would have had standing” (Mancusi v. DeForte 1968).

However, in most circumstances, the employer has a broader authority to consent to the search of any area or computer owned or controlled by the organization. This right becomes virtually indisputable in the presence of a published employee guideline or log-on banner that expressly states that the company reserves the right to monitor activity on their premises. United States v. Ziegler affirmed the company’s right to search its own computers in 2006. Judge Diarmuid F. O’Scannlain wrote in his opinion for the Ninth Circuit, “Employer monitoring is largely an assumed practice, and thus we think a disseminated computer-use policy is entirely sufficient to defeat any expectation that an employee might nonetheless harbor” (United States v. Ziegler 2001).

For an outsider obtaining permission to search the computers or premises of a private organization, it is essential that the permission be obtained from someone who actually has the right to grant such permission. In some cases, it is clear. Other situations require careful thought. Officers of the organization, such as the president or CEO, a branch manager, or someone with assigned authority over the premises, can be perceived as having ostensible authority. This phrase defines the effect that someone in charge has on others, particularly those unfamiliar with the organization. An officer informed by such a person that he or she was in charge and could present reasonable evidence thereof would have no reason to believe otherwise. A receptionist would not have ostensible authority—nor would a man in coveralls cleaning the ashtrays. However, a self-assured woman with a nametag sporting the title “Manager” would convey such authority.

Public Sector Organizations

Public employees enjoy even less protection against warrantless searches than do private sector employees. There does not need to be any evidence of misdeeds on the part of the person being investigated. The government has the right to enforce a special needs search on any employee’s computer at any time. This means that the reason for the search is to fulfill some specific need by the government. All that needs to be demonstrated is that

• The search is work related, and not intended to collect evidence for a crime, and

• The search is justifiable in its inception and permissible in its scope.

The guidelines for such a search are laid out in U.S. v. Simons, 206 F3d 392 (2000). In this case, a government employee was already suspected of storing pornographic images on a work computer. In the ensuing search, investigators found evidence of child pornography. Since the original search was work related and justifiable, the evidence of criminal activity was admissible in court.

Subpoenas

A subpoena does not give the bearer any right to search a person or location (except as an inspection). Nor does it allow the bearer to seize any material evidence. It can do one of two things:

• Command a person to appear (either with or without requested physical evidence)

• Command a person or organization to surrender or allow to be examined tangible evidence as defined by the order

The Federal Rules of Civil Procedure outline how subpoenas are issued, served, and executed. In order to be legal, a subpoena must identify the court that issued it. Somewhere on the document it must clearly identify the title of the action requiring the evidence, the court in which the action is being heard, and the action number assigned. The document must clearly state where the person is to appear (if relevant), what evidence must be presented (if relevant), and the time and date that the action is taking place.

To be legal, a subpoena must be served. That means it must be delivered by hand. The person serving the subpoena cannot be a party to the action and must be over the age of 18 years. In the event that the subpoena requires the production of documents or other tangible evidence, then notice must be served allowing time to produce that evidence.

When requesting that a subpoena be served on another party, the requestor must take reasonable steps to assure that there is no undue financial or other burden placed on the person asked to appear or produce. If a subpoena is requesting the production of documents, then if the presence of an individual is also required, that must be stated separately. Once presented with a subpoena, the recipient has the right to file an objection and request that the order be quashed.

Only the issuing court may quash a subpoena. There are some situations where the court is required to quash a subpoena and other times when it may be permitted to, should it so desire. It must quash a subpoena if the recipient can demonstrate any of the following:

• Does not allow a reasonable time to comply

• Requires someone who is not a party to the action to travel more than 100 miles

• Requires the disclosure of privileged information

• Subjects the person to undue burden (a judgment of the court)

The court is permitted (but not required) to quash a subpoena if it

• Requires the person affected to provide trade secrets, confidential information, or other potentially sensitive information

• Requires the person affected to disclose an unretained expert’s opinion or information that does not describe specific occurrences in dispute and results from the expert’s study that was not requested by a party

• Requires someone who is not a party to the action to incur substantial expense to travel to the location

As an alternative to quashing a subpoena, a judge may also propose alternative conditions, based on the respondent’s objections. The judge may take this action if the issuing party does two things:

• Shows that that the testimony or material evidence is critical to the proceedings and cannot otherwise be obtained with undue hardship

• Provides reasonable compensation for the subpoenaed party

Assuming all requirements for a subpoena have been met, and all objections addressed, if the subpoena is continued by the court, failure to comply can result in the subpoenaed party being held in contempt of court.

Chapter Review

1. You have just been served with a writ ordering you to appear before the court, bearing a particular set of documents. What type of document did you receive?

2. The order you received gives you only three days to locate and prepare more than a hundred files. Your document imaging specialist is on vacation, and you have not been able to contact her. What option do you have in order to keep from violating the court order?

3. Discuss how a computer system compares to a sealed container in the eyes of the court when executing a warrant. Under what conditions can you search and/or seize such a container?

4. Describe in your own words the concept of particularity, and identify the two forms that it takes.

5. A warrant has been issued to search the premises of a suspected narcotics trafficker. Those tasked with executing the warrant have been authorized to delay notifying the subject of the warrant for seven days. What type of warrant is this?

Chapter Exercises

1. Locate online a sample affidavit requesting a search warrant to be issued. As of this writing, such a sample exists at www.quatloos.com/jan0303nealsearchaffidavit.pdf. Fill out your own affadavit requesting a warrant to search the computer systems and premises of Billy Bob Drayton of 12 Redneck Lane in Brokaw, Alaska. You suspect him of possessing several terabytes of illegal music downloads.

2. Research at least one court case in which evidence was challenged as fruits of an illegal search, where the investigators claimed protection under the plain view doctrine. Was the evidence allowed or not? Explain the reasoning behind the decision.

3. Describe in your own words the difference between actual authority and apparent authority. Locate a case in which apparent authority was exercised.

References

California v. Greenwood, 466 U.S. 35 (1988).

Chimel v. California, 395 U.S. 752 (1969).

Georgia v. Randolph, 547 U.S. 103 (2006).

Hudson v. Michigan, 547 U.S. 586 (2006).

Illinois v. Wardlow, 528 U.S. 119 (2000).

Katz v. United States, 389 U.S. 347 (1967).

Mancusi v. DeForte, 392 U.S. 364 (1968).

Mapp v. Ohio, 367 U.S. 643 (1961).

Office of the District Attorney, Alameda County. 2009. Recent case report: U.S. v. Comprehensive Drug Testing, Inc. Point of View Online. http://le.alcoda.org/publications/point_of_view/files/CompHealth.pdf (accessed February 10, 2009).

Oliver v. United States, 466 U.S. 170 (1984).

Payton v. New York, 445 U.S. 573 (1980).

People v. Ledesma, 39 Cal. 4th 657 (2006).

People v. Oodham, 81 Cal. App. 4th 1 (2000).

Portman, R., and J. Jacobs. 1998. Responding to third-party subpoenas. www.thefreelibrary.com/Responding+to+third-party+subpoenas-a020519358 (accessed February 1, 2010).

Rakas v. Illinois, 439 U.S. 128 (1978).

Schneckloth v. Bustamonte, 412 U.S. 218 (1973).

Terry v. Ohio, 392 U.S. 1 (1968).

U.S. Department of Justice. 2008. Federal rules of evidence. Washington, DC.

U.S. v. Carey, 172 F.3d 1268 (10th Cir. 1999).

U.S. v. Comprehensive Drug Testing, Inc., 579 F3d 989 (2009).

U.S. v. Simons, 206 F3d 392 (2000).

U.S. v. Ziegler, 497 F3d 890 (2001).

United States v. Barth, 26 F. Supp. 2d 929 (1998).

United States v. David, 756 F. Supp. 1385 (1991).

United States v. Horowitz, 806 F.2d 1222 (1986).

United States v. Lyons, 992 F.2d 1029 (1993).

United States v. Matlock, 415 U.S. 164 (1974).

United States v. Most, 876 F.2d 191 (1989).

United States v. Reyes, 922 F. Supp. 818 (1996).

United States v. Ross, 456 U.S. 798 (1982).

USC Title 18, Part 1, Chapter 121, § 2705.

USC Title 18, Part II, Chapter 205.

USLegal (2010). Search law and legal definition. http://definitions.uslegal.com/s/search/ (accessed February 4, 2010).

Weeks v. United States, 232 U.S. 383 (1914).