1st Circuit holds that cell phone searches incident to arrest violate the 4th Amendment

In United States v. Wurie, No. 11-1792 (1st Cir. 2013), the First Circuit held that the search of a cell phone incident to arrest categorically violates the Fourth Amendment. As a result, the court reversed the defendant's motion to suppress, vacated the conviction, and remanded the case.

While performing routine surveillance, a Boston police officer observed a man conducting what appeared to be a drug sale. The man was then stopped, and crack cocaine was found in his pocket. He was arrested, and upon arriving at the police station, two cell phones were confiscated from his person.

The phone soon thereafter received several calls, each displaying "my house" on the screen as the incoming caller. Police opened the call log and obtained the phone number for "my house." The number was entered into an online white pages directory, and officers then went to that location to "freeze" it while a search warrant was obtained. A large amount of drugs were seized from the home.

Before trial, the defendant moved to suppress the evidence obtained from his person and home, and the district court held that "[t]he search of Wurie's cell phone incident to his arrest was limited and reasonable." On appeal, the defendant reasserted his motion.

Having not yet dealt with the issue, the First Circuit extensively evaluated the potential effect of making cell phones searchable under the search incident to arrest exception. Here are a couple excerpts:

• [Data stored on a phone] is the kind of information one would previously have stored in one's home and that would have been off-limits to officers performing a search incident to arrest.
• Just as customs officers in the early colonies could use writs of assistance to rummage through homes and warehouses, without any showing of probable cause linked to a particular place or item sought, the government's proposed rule would give law enforcement automatic access to "a virtual warehouse" of an individual's "most intimate communications and photographs without probable cause" if the individual is subject to a custodial arrest, even for something as minor as a traffic violation.

As to whether the search was necessary to prevent destruction of evidence on the phone by remote wiping, the court discussed three methods for preserving the data and concluded:

Indeed, if there is a genuine threat of remote wiping or overwriting, we find it difficult to understand why the police do not routinely use these evidence preservation methods, rather than risking the loss of the evidence during the time it takes them to search through the phone. Perhaps the answer is in the government's acknowledgment that the possibility of remote wiping here was "remote" indeed.

Ultimately, the First found it necessary to create a uniform rule governing the search of cell phones incident to arrest, holding that "[a]llowing the police to search that data without a warrant any time they conduct a lawful arrest would, in our view, create 'a serious and recurring threat to the privacy of countless individuals.'"

The court did leave open the possibility for using the exigent circumstances exception in order to search a cell phone without a warrant, for example when there is a "compelling need to act quickly" such as to "locate a kidnapped child or to investigate a bombing plot or incident."

In a dissent, Judge Howard suggested a variety of reasons why the majority was incorrect, including that the caller from "my house" might have otherwise destroyed evidence in the home.

Read More

"Closer call": 1st Cir. upholds pre-Jones GPS tracking for 11 days under Good Faith exception

In United States v. Sparks, No. 11-1134 (1st Cir. March 26, 2013), the First Circuit upheld the denial of suppression of GPS tracking evidence which occurred over the course of eleven days, citing the Good Faith exception articulated in Davis. The GPS installation and tracking were pre-United States v. Jones.

There are a few interesting things about this holding:

1. Associate Justice (Ret.) Souter sat by designation for the case

2. The court relied on precedent from the 80s (Knotts) and 70s (Moore) to justify the holding; both cases involved beepers

3. The opinion stated the decision wasn't perfunctory, but was "certainly a closer question in this circuit than in those that had directly addressed the propriety of warrantless GPS tracking prior to Jones."

4. Orin Kerr's piece on the Volokh Conspiracy got a reference in a footnote (#1) - Does Fourth Amendment Standing Work Differently for Jones Trespass Searches, Traditional Katz Searches, and Long-term Katz Searches?

The court's reasoning, in short:

The closer question is whether Knotts clearly and expressly authorized the subsequent monitoring of the GPS tracker for eleven days. Like the officers in Knotts, the FBI agents in this case used an electronic tracking device to follow the movements of a car. But they did two things differently: they used a GPS unit instead of a beeper, and they tracked the car for eleven days instead of a number of hours. Do either of these differences place the agents' conduct beyond the scope of what Knotts clearly permitted? 

On this record, we think the fact that the device was a GPS tracker rather than a beeper does not render Knotts inapplicable. Certainly, a GPS tracker is more capable than a beeper, "but nothing inheres in the technology to take it out of Knotts's holding."

... 

That brings us to the duration of the monitoring: eleven days here, versus less than a day in Knotts-- not a trivial difference. But Knotts gave scant reason to think that the duration of the tracking in that case was material to the Court's reasoning. Rather, the Court appeared to apply a blanket rule that "[a] person traveling in an automobile on public thoroughfares has no reasonable expectation of privacy in his movements from one place to another"; no such expectation attaches to information that is, like one's public movements, "voluntarily conveyed to anyone who wanted to look."460 U.S. at 281. Knotts did note that abusive "dragnet type" surveillance might be governed by "different constitutional principles," id. at 284, but there was no suggestion in the Knotts opinion that this rather brusque dismissal of the defendant's Orwellian warnings imposed a concrete temporal limitation on the case's apparently unqualified holding. Indeed, at the time of the search in this case, Knotts was widely and reasonably understood to stand for the proposition that the Fourth Amendment simply was not implicated by electronic surveillance of public automotive movements, because the latter was merely a more efficient "substitute . . . for an activity, namely following a car on a public street, that is unequivocally not a search within the meaning of the amendment."

Recognize that the court had to appeal to Knotts and Moore because conceding that those two cases do not allow prolonged GPS monitoring would require getting into the thornier argument of whether precedent outside the circuit (holding such monitoring was constitutionally sound) could be relied on by law enforcement and thus allow the Davis Good Faith exception argument.

Considering that most other courts have upheld pre-Jones GPS tracking under Davis, the holding isn't all together surprising. But, if you have spent a lot of time talking about the anachronism of law when it comes to technology, hearing GPS and "beeper" together again is worth the read (and the shudder). To quote Renee Hutchins, we are still "Tied up in Knotts."

Read More

Tech Check: 1st Circuit errs in description of file hashing

In United States v. Farlow, 2012 U.S. App. LEXIS 11121 (1st. Cir. Jun. 1, 2012) the 1st Circuit erred in its description of how changing a file affects its hash value.  Judge Thompson stated:

The problem for Farlow is that we have rejected the idea that government agents should so narrowly restrict their searches of digital devices. "When searching digital media for 'chats' and other evidence of enticement" -- like the bodybuilder image -- "government agents cannot simply search certain folders or types of files for keywords." Crespo-Rios, 645 F.3d at 43 (emphasis added). The same goes for other specific identifying information -- like hash values. This is because computer files are highly manipulable. Id. at 43-44. A file can be mislabeled; its extension (a sort of suffix indicating the type of file) can be changed; it can actually be converted to a different filetype (just as a chat transcript can be captured as an image file, so can an image be inserted into a word-processing file and saved as such). See id. Any of these manipulations could change a document's hash value. And in any event a limited hash-value search would not have turned up any chat transcripts (which, again, can be saved as image files) or other evidence of Farlow's New York crimes. The government therefore reasonably executed a broad search that fell within the scope authorized by the valid warrant it obtained.

The highlighted/bolded portion is not in fact, completely true. It is true that capturing a chat transcript as an image, or placing it in a different document does change the hash value. But, merely changing the name of a file, or changing its extension using regular file operations does not change that file's hash value. A friendly example of that on OS X:

And for clarity's sake, a duplicate test on Windows, using "hashtest2.txt" from the OS X machine as a starting point. I have copied the file and renamed it, as well as copied it and changed the extension:

Notice that the hash never changes, from OS X to Windows. It remains eb1a3227cdc3fedbaec2fe38bf6c044a.

I point this out merely to prevent this erroneous statement from being perpetuated. I do not think, on the whole, that it really makes too much difference in the case itself. I'm open to opinions otherwise.

As a caveat, let me also note that changing a file extension can also occur through a program (i.e. MS Paint) whereby one file format is converted to another (png to jpg, for example), and that would change the hash value. I think the words in this decision are just a little unclear and ambiguous.

Read More

1st Cir. affirms restitution order to CP series victim "Vicky"

The First Circuit held that a distributor of child pornography may be ordered to pay restitution to the child victim portrayed in those images (United States v. Kearney, 672 F.3d 81 (1st Cir. 2012)).

Federal courts have long disagreed as to the requirements of a restitution order under 18 U.S.C. § 2259 for child pornography. These cases often concern a distributor of a pornography series (referred to by aliases such as "Amy" or "Vicky"), and the issues the court must address are (1) whether the child portrayed in the images is a victim, and (2) whether the defendant proximately caused the victim's damages. Decisions on these issues have resulted in a circuit split (read more here, here, and here), and the Supreme Court has denied cert on the issue (discussed here). However, it is important to note that the Fifth Circuit, which is the odd man out, recently decided to rehear its case on the subject en banc (United States v. Unknown (In re Unknown), 2012 U.S. App. LEXIS 1514 (5th Cir. 2012) (vacating Paroline)).

In Kearney, the First Circuit addressed these issues in a child pornography possession and distribution case involving the "Vicky" series. The court first found that "Vicky is plainly a victim of Kearney's crimes" as "[t]he  pornography's continued existence causes the child victims continuing harm by haunting the children in years to come." On the probable cause issue, the court held:

We hold that the proximate cause requirement was satisfied here, because Kearney's actions resulted in identifiable losses as outlined in the expert reports and Vicky's victim impact statements. ... We do not suggest that in all instances where there is a victim within the meaning of the statute, the victim is entitled to restitution....

The court also upheld the calculation of the restitution amount of $3,800, "which was arrived at by averaging the awards Vicky had received in thirty-three other restitution cases, after discarding the highest and lowest values awarded."

Read More

First Circuit vacates CP convictions after FBI agent makes improper statements

The First Circuit recently reversed a child pornography conviction after admission of improper testimony. United States v. Vázquez-Rivera, 665 F.3d 351 (1st. Cir. 2011). The FBI had conducted a chatroom operation, posing as a 14-year-old girl. After sending video to the "girl" of a man (no face identifiable) masturbating, the FBI tracked the IP address back to the home of the defendant. Over 100 images of child pornography were found on the home computer, which was apparently accessible by seven people.

The first issue on appeal was whether test FBI Agent Segarra's testimony was improper overview testimony. Such testimony is usually presented "early during trial to describe the government's general theory of the case." The problem is when the witness provides an overview of the entire investigation "including aspects ... the witness did not participate in, before the government has presented evidence." However, the court found that the agent's testimony was not improper overview because the agent was the "penultimate witness on the first day of a five-day trial and, as such, did not "preview" the government's case."

On the stand, Segarra was asked to identify the person who was found to have been using the screen name at issue, and she responded with the defendant's name. The admission of this statement was plain error because it addressed the ultimate issue before the jury. Only circumstantial evidence existed to show a connection between the defendant and the chats. Further, the testimony was based "on the overall investigation rather than her personal observations." Here's the exchange:

Q: And just to make -- to clarify, IncestoPR is the same person as Secreto, correct?
A: Correct.
Q: And Secreto is the same person at Bienhotpr@hotmail.com?
A: Correct.
Q: And throughout your investigation, who did you identify that person to be?
. . . .
A: We identified him as William Vazquez-Rivera.

The court also addressed the specific wording of the testimony by Segarra: "we ended up identifying [the subject] as William Vazquez Rivera." This statement is also improper because it involves the opinion of other unidentified officers and because it declares the defendant to have "sent the illicit material and was therefore guilty."

She also testified regarding the video that has been sent. The defendant was wearing pajama pants in the video and was wearing those same pants the day that Segarra and others arrived at the defendant's home to execute a search warrant. Because she connected the pants to identify the defendant as the same person in the video, this testimony was improper.

This goes on and on with various other statements made by the agent, and the court strikes each down as improperly admitted. The court found that the "repeated and extensive use of improper testimony may have influenced the jury" and because the evidence was not "sufficiently compelling to assuage this concern," the conviction should be vacated.

Read More

1st Circuit handles issues of required knowledge and jurisdiction in CP case

In United States v. Salva-Morales, 660 F.3d 72 (2011), released today by the First Circuit, the court analyzed two important issues: (1) whether a defendant must have actual knowledge of child pornography and (2) how to prove interstate or foreign commerce. A total of 176 images of child pornography were found on the defendant's two computers.

Salva-Morales did not testify, but several witnesses claimed he was not the sole user of the computer. A fornesics examine testified that "one hard drive indicated that twenty-two different users had saved files to it and that it was impossible to tell conclusively from the forensic data on the drives who had saved the pornographic files." The government, however, presented evidence to show that he was often alone in his business when the files were accessed. The court acknowledged that the evidence in this case was not as strong as is typically, but the case was nonetheless sufficient.

The question that the court struggled with was jurisdiction. According to statute, "The matter containing the visual depiction described above has either to have been (1) “mailed, or ... shipped or transported in interstate or foreign commerce,” or (2) “produced using materials which have been mailed or so shipped or transported, by any means including by computer....” 18 U.S.C. § 2252(a)(4). There was no great evidence to prove the files were transmitted through the Internet, though Kazaa was installed in the computer. The court noted "that the defendant need not know of the nexus so long as it exists."

The interesting argument in the case came from the government's backup argument on jurisdiction. Because the hard drives containing the images were both manufactured in Singapore, they suggested that copying images to them or from one to the other satisfied the transportation in foreign commerce requirement. The court acknowledged this argument, but refused to rule on it because the jurisdictional issue had already been decided.

Read More