Initial Reactions to Riley v. California

Yesterday, the Supreme Court unanimously ruled that police must obtain a warrant prior to searching the cell phones of the people they arrest in Riley v. California. In an opinion widely heralded as a resounding victory for privacy in the digital age, Chief Justice Roberts wrote:

Our answer to the question of what police must do before searching a cell phone seized incident to an arrest is accordingly simple—get a warrant.

Much has already been written about the landmark decision. Here are some initial reactions to Riley from the law and technology community:

• Orin Kerr on the significance of Riley and his six key takeaways from the opinion
• Marcy Wheeler on surveillance and the interplay between Riley and U.S. v. Jones 
• Reporters Committee for Freedom of the Press on the impact of the decision for journalists
• Sarah Jeong on the Supreme Court's understanding (or lack thereof) of technology
• Adam Liptak on the Supreme Court, technology, and privacy
• Matt Kaiser on the potential impact of Riley on search warrants to ISPs
• Jay Stanley on how things could have turned out in Riley had the government won
• Julian Sanchez on a Fourth Amendment loophole closed (bonus: Jay Z-inspired lede)
• Josh Stearns on why Riley is a win for press freedom
• Nilay Patel on the Supreme Court's major technology rulings
• Jennifer Granick on the most important takeaway from Riley: digital is different
• Farzaan Ijaz and Amie Stepanovich on a step in the right direction by the Supreme Court
• Marc Rotenberg and Alan Butler on the Fourth Amendment in the digital age
• Kyle Graham on how Riley won't change much in the field
• Paul Bernal on what courts in the European Union can learn from Riley
• Stephen Schulhofer on how Riley may impact warrantless surveillance and the third party doctrine
• The Onion on how ordinary Americans are reacting to Riley

Twitter also weighed in on the case. Below are some thoughts on Riley in 140 characters or less: 

After today's Sup Ct. ruling: Getting the list of #s you've called from your phone, warrant. Getting them from your phone company, subpoena.
— Christopher Soghoian (@csoghoian) June 25, 2014

Did SCOTUS just implicitly validate the "mosaic" theory? pic.twitter.com/SkV21d9uQp
— Hanni Fakhoury (@HanniFakhoury) June 25, 2014

"Get a warrant." Noted hippies, @EFF, @ACLU, and the Chief Justice
— emptywheel (@emptywheel) June 25, 2014

Serious question: does the @EFF cell phone sticker saying "I do not consent to the search of this device" now carry a bit of legal weight?
— Trevor Timm (@trevortimm) June 25, 2014

Kudos to @OrinKerr for getting cited not once but twice in Riley, the new SCOTUS cell phone search case!
— jennifer granick (@granick) June 25, 2014

Riley ruling is really, REALLY important in light of Atwater v. Lago Vista. https://t.co/fAojepiZSP
— Julian Sanchez (@normative) June 25, 2014

Given what Riley says about the cloud, a cautious DHS border agent would stop searching the social media accounts of seized cell phones asap
— Catherine Crump (@CatherineNCrump) June 25, 2014

I will continue to update this post with additional writings as they are published. If I have missed any, please comment here or reach out to me on Twitter @natnicol.

This post was updated on June 26, 2014 at 1:59 p.m. MDT, and again at 2:21 p.m. MDT.
This post was updated on June 27, 2014 at 1:15 p.m. MDT.

Read More

Student's suit for forced Facebook disclosure survives motion to dismiss; court finds reasonable expectation of privacy in Facebook messages

In R.S. v. Minnewaska Area Sch. Dist. No. 2149, 2012 U.S. Dist. LEXIS 126257 (D. Minn., Sept. 6, 2012), a federal district court refused to dismiss the case of a 12-year-old against a Minnesota school district for allegedly punishing her for statements made on her Facebook wall and forcing her to disclose her Facebook password to search through her profile.  The case involves multiple causes of action, most of which survived the motion to dismiss, including the First and Fourth Amendment claims.

A summation of the facts can be found here: Minnesota girl alleges school privacy invasion, and here:
12-year-old sues school district over Facebook profile search and with a hat tip to the Student Press Law Center, the original complaint can be found here and its article here.

While the court only has one side of the story, currently, the facts are pretty favorable for the plaintiff as described. In quick summary, it does not appear that her comments meet the requirements of Tinker to regulate student speech, nor did the school have a compelling reason to search her Facebook account.

Addressing the Fourth Amendment claim, the court first noted the distinction between Facebook wall posts (which would receive less protection depending on the settings) and messages, and ultimately held that with respect to the student's messages and profile information:

Based on Plaintiffs' complaint, at least some of the information and messages accessed by the school officials were in R.S.'s exclusive possession, protected by her Facebook password. R.S. controlled those items until she involuntarily relinquished her password. As with a private letter, the content of R.S.'s electronic correspondence was available only to her and her correspondent. The Court concludes, based on established Fourth Amendment precedent, that R.S. had a reasonable expectation of privacy to her private Facebook information and messages.

The court went on to explicitly equate Facebook messages with email, stating that "[t]he Court agrees that one cannot distinguish a password-protected private Facebook message from other forms of private electronic correspondence."

Finally, the court detailed the contours of school searches - that reasonableness in that context is determined under a lower standard due to the school environment - balancing the students reasonable expectation of privacy against the "substantial interest of teachers and administrators in maintaining discipline in the classroom and on school grounds." T.L.O. The court found nothing on the school's side of the scale to justify the search. The courts stated:

Based on the facts alleged in the complaint, the school officials had reason to believe that R.S. may have had a sex-related discussion with a classmate. Both R.S. and her classmate had already admitted as much to the school officials prior to the search. Plaintiffs contend that such an out-of-school discussion, even a "naughty" one, broke no law or school policies. 

At this stage, based on the facts alleged in Plaintiffs' complaint, the Court cannot disagree. It is difficult for the Court to discern what, if any, legitimate interest the school officials had for perusing R.S.'s private communications. . . . the school officials had no reason to believe that the search would return evidence of illegal behavior or violations of school policy. At this stage, there is no discernible school interest against which to balance R.S.'s reasonable expectation of privacy. 

I have to say, I am very interested to see the outcome of this case. I think the Fourth Amendment details are fascinating and I have paid close attention to First Amendment cases dealing with out-of-school speech so I'm hooked there, too.

If you are looking to brush up on recent school speech cases dealing with electronic speech and school intervention, look no further than the decisions of Layshock and J.S., recent cases from the Third Circuit which are laid out nicely in this student piece from the B.C. Law Review site by Paul Easton: SPLITTING THE DIFFERENCE: LAYSHOCK AND J.S. CHART A SEPARATE PATH ON STUDENT SPEECH RIGHTS.

Read More

Seventh Circuit holds warrantless search of digital storage devices after private "search" did not violate Fourth Amendment

In Rann v. Atchinson, __ F.3d __ (7th Cir. 2012), the Seventh Circuit held that a law enforcement search of two digital storage devices for child pornography which were handed over by the defendant/offender's wife and daughter, respectively, did not violate the Fourth Amendment. The defendant was arguing ineffective assistance of counsel (by way of federal habeas), based on his lawyer's failure to attempt to suppress the child pornography evidence obtained from the digital devices when the police searched them without a warrant.

After the victim (age 15) reported sexual assault by her biological father to the police and was interviewed, she returned home and obtained a digital camera memory card and returned it to the police. The card contained images of her own sexual assault. Subsequent to this, the mother of the victim turned in a zip disk with additional images of her daughter being sexually assaulted, along with images of her other daughter being assaulted as well. According to the police, neither individual was prompted to bring these digital devices to them, nor were any law enforcement offers present when each individual retrieved the devices.

The defendant's main contention was that:

when the police searched the digital storage devices and viewed the images on them, they exceeded the scope of the private search conducted by [the victim] and her mother. Since the subsequent search by the police exceeded the scope of the initial private search, so his argument runs, the police needed a warrant to “open” the digital storage devices and search them because the record contains no evidence that [the victim] or her mother knew the digital storage devices contained images of child pornography prior to the police viewing. Since the police did not obtain a warrant prior to opening the digital storage devices and viewing the images, he claims their doing so constituted an unconstitutional warrantless search in violation of the Fourth Amendment.

Now, I'm going to stop here for a second. The court states that the defendant and mother conducted a "private search."  By this, I would argue, one would assume that such a search would include viewing the files on the digital devices to determine if they did in fact contain child pornography. However, there is no indication anywhere in this case that such a search took place. Granted, there is an assumption made that they would not have turned in the devices if they did not know there was CP on the devices, but I just want to point out that nowhere is there evidence that either individual described to the police what exactly was on the devices (or described a single picture contained on them).

Back to the case - the court states that private searches are not subject to the Fourth Amendment, and police do not need to "avert their eyes" to the evidence obtained from such searches. However, police cannot exceed the scope of the original private search to obtain evidence. The standard from Jacobsen relating to private searches is "individuals retain a legitimate expectation of privacy even after a private individual conducts a search, and 'additional invasions of privacy by the government agent must be tested by the degree to which they exceeded the scope of the private search.'"

The question of how to handle police searches of digital devices searched privately, first, was one of first impression for the court. However, the court adopted the Fifth Circuit's approach in Runyan, a 2001 case with similar factual circumstances. Runyan held that "a search of any material on a computer disk is valid if the private party who conducted the initial search had viewed at least one file on the disk." The Fifth Circuit "analogiz[ed] digital media storage devices to containers" and "ruled that 'police exceed the scope of a prior private search when they examine a closed container that was not opened by the private searches unless the police are already substantially certain of what is inside that container based on the statements of the private searches, their replication of the private search, and their expertise.'" In Runyan, multiple digital devices were turned over to the police, not all of which had been looked at by the personal who was the "private searcher," so only those devices that the searcher had looked at one or more files on, were admitted.

Here, the court held that the victim and mother essentially had to know what was on the disks when they turned them in, and thus the police could be substantially certain what they contained. The court held this over the objection of the defendant that there was no direct evidence of this, and it was purely conjecture:

[The defendant] argues that the Illinois Appellate Court relied on conjecture when it found that [the victim] and her mother knew the contents of the devices they delivered to the police, pointing to the Illinois Appellate Court's finding that “[a]lthough no testimony exists regarding how the images on the zip drive came to be there, it seems highly likely that [the victim's] mother [compiled] the images on the zip drive herself, downloading them from the family computer.” Rann argues that this is conjecture, yet he offers nothing but conjecture and speculation in its place.

The court justified its holding by stating that "the contrary conclusion—that [the victim] and her mother brought digital media devices to the police that they knew had no relevance to [the victim's] allegations—defies logic."

The court went on to state that:

even if the police more thoroughly searched the digital media devices than S.R. and her mother did and viewed images that S.R. or her mother had not viewed, per the holding in Runyan, the police search did not exceed or expand the scope of the initial private searches. Because S.R. and her mother knew the contents of the digital media devices when they delivered them to the police, the police were “substantially certain” the devices contained child pornography.

I've seen some chatter on Twitter that this case is #Troubling. I agree and disagree. I disagree, in that Easterbrook wrote this opinion, in a typical judicially restrained manner - cabining it to the particular circumstances of this case, and especially to the fact that the victim and the mother only turned in two devices, both of which were assumed to have CP (whereas in Runyan, many devices were turned in, in a sort of "grab bag" of evidence.")

I agree that it is troubling because I can't see how you can use the analogy of a container with respect to digital devices. Sure, it is easy when it comes to camera memory cards, but how about hard drives? If the wife had turned in the entire computer hard drive, could the police have searched the entire thing, if she said she had opened a single picture and found CP?

Another very good point to be made in regards to this case is this - what would have been so challenging about getting a warrant to search these devices, based on the information provided by the mother and victim?

Lastly, I put "search" in the title in quotations, and had an aside above about the lack of explicit evidence of the mother or victim viewing the files on the digital device because I think a flaw in the case is the absence of any elaboration on how turning those devices in was the search.

Read More

Federal court holds that 15-month delay in reviewing electronic evidence was an unlawful seizure

In what I would call a very significant case, a New York federal court has held that failure to examine a defendant's imaged hard drive within 15-months after it was obtained was an unlawful seizure in violation of the Fourth Amendment. In United States v. Metter, 2011 U.S. Dist. LEXIS 155130 (E.D.N.Y. 2012) the government imaged over 60 hard drives as part of a criminal investigation into securities fraud, yet held on to the images and failed to actually do anything with them for over 15 months. The defendant argued that "the government's significant delay in conducting off-site searches of the imaged evidence merits blanket suppression of all seized and imaged evidence as routine delays of this duration would eviscerate the Fourth Amendment's privacy protections." While treading very cautiously, the court ultimately held that such delay, especially due to the amount of irrelevant, yet highly personal information that could be on a computer hard drive, was an unreasonable seizure.

At the outset, the court noted that the defendant's argument raised "an interesting issue of first impression in this Circuit that may impact electronic discovery in future criminal investigations and cases: How long may the government retain seized and imaged electronic evidence before conducting a review of that evidence to determine whether any of it falls outside the scope of a search warrant?" (This is indeed an interesting question. Think, for example, of evidence collected from a murder scene. The officers may take pictures, blood swipes, fingerprints, etc., but they cannot bag up the entire site or completely capture it for future use. That is the case with imaging a defendant's hard drive, though - essentially the evidence (relevant or irrelevant) lasts forever; it can be revisited ad nauseum, and consequently raises a plethora of Fourth Amendment concerns. Ultimately, and because of this evidentiary effect, this ends up as a case where the court was forced to treat electronic evidence different from physical evidence because of the fundamental difference in nature and kind between the two.)

The court went on to note that courts have long recognized that searches (typically of papers) will inevitably involve reviewing documents that are outside of the scope of the search because it is impossible to conduct a search otherwise; pragmatically, there are "tactical difficulties" in cabining a search when you don't know what you will find, or where "it" will be found, per se.  This recognition has been extended to computers, but:

Computers and electronic information present a more complex situation, given the extraordinary number of documents a computer can contain and store and the owner's ability to password protect and/or encrypt files, documents, and electronic communications. As a result, the principle of permitting law enforcement some flexibility or latitude in reviewing paper documents just described, has been extended to computerized or electronic evidence. Courts have applied the principles recognized in Andresen "in analyzing the method used by the police in searching computers and have afforded them leeway in searching computers for incriminating evidence within the scope of materials specified in the warrant."

Thus, courts look to the heart of the Fourth Amendment for the lawfulness of the search - was it "reasonable?"

The court recognized that the warrants issued in this case (there were multiple, spanning both homes and offices), were facially valid, sufficiently particular, and clearly defined the scope of each search. Additionally, the police acted reasonably in executing the searches, and promptly returned the hard drives back to the owners after they were imaged. Thus, the crux of the case does not involve a failure of the warrants themselves, or the procedure in which they were executed on-scene, but the process involved afterwards.


The court pointed out that delays of several months have been found to be reasonable - there may be law enforcement delays, an ongoing investigation, etc., but that there was a lack of precedent on the ceiling of this temporal question - when did a delay become presumptively unreasonable. While not actually answering that question, or establishing a black-letter rule, the court stated that:

The parties have not provided the Court with any authority, nor has the Court found any, indicating that the government may seize and image electronic data and then retain that data with no plans whatsoever to begin review of that data to determine whether any irrelevant, personal information was improperly seized. The government's blatant disregard for its responsibility in this case is unacceptable and unreasonable.

The court dismissed the government's argument that because they returned the original hard drives they were not really violating any privacy. I find this argument to be almost laughable - why does having a copy of a personal document lessen its embarrassing or incriminating nature? The court found this a "distinction without a difference."

Notably, the defendant's counsel had also notified the court that the government was willing to provide copies of these hard drives to attorneys of other defendant's involved in the fraudulent scheme, upon request. While this might have been helpful in a discovery sense, the failure to triage these hard drives for irrelevant information was damning. Ultimately, the court stated:

The government's retention of all imaged electronic documents, including personal emails, without any review whatsoever to determine not only their relevance to this case, but also to determine whether any recognized legal privileges attached to them, is unreasonable and disturbing. Moreover, the government repeatedly asserted its intent to release indiscriminately the imaged evidence to every defendant, prior to conducting any review to determine if it contained evidence outside the scope of the warrants. The Court agrees with Defendant that the release to the co-defendants of any and all seized electronic data without a predetermination of its privilege, nature or relevance to the charged criminal conduct only compounds the assault on his privacy concerns. It underscores the government's utter disregard for and relinquishment of its duty to insure that its warrants are executed properly.

After holding the government's actions in contravention of the Fourth Amendment, the court wrestled with the remedy. Did such process "deserve" complete suppression of all evidence - a remedy quite harsh to a case built around such evidence. The court ultimately decided complete suppression was warranted:

The Court has not reached this conclusion lightly. However, the Court cannot, in the interest of justice and fairness, permit the government to ignore its obligations. Otherwise, the Fourth Amendment would lose all force and meaning in the digital era and citizens will have no recourse as to the unlawful seizure of information that falls outside the scope of a search warrant and its subsequent dissemination. 

The impact of this case is wide-reaching for law enforcement - essentially they must do something with seized evidence in a reasonable amount of time. This raises a series of questions:

1. What must law enforcement do to prevent suppression if the amount of time grows - merely do a keyword search, or fully triage and redact irrelevant evidence?
2. We know 15 months is too long, but what about 10, 12 or 8 months? Another line drawing problem is born.
3. How does this decision affect law enforcement timetables for existing and future investigations, and what if any impact will it have as more cases involve electronic evidence and case loads and backups increase?
4. What will the impact of this decision be on general electronic discovery as it relates to passing unredacted/reduced electronic evidence to co-defendants, since such discovery implicates privacy concerns due to the nature of hard drives and the "intermixing" of relevant and irrelevant evidence?

Read More