Fed Ct: A cell phone is not a container (i.e. conventional wardrobe), but Narnia (the magical wardrobe); police need a warrant to enter the portal

[[  The case is United States v. Mayo, No. 2:13-CR-48 (D. Vt. Nov. 6, 2013). (the link here is to the order denying suppression - more on that below).

Defendant's Motion to Suppress
Government's Opposition to MTS
Def. Response to Gov't Opposition to MTS
Def. Post-Suppression Hearing Memo
Gov't Post- Suppression Hearing Memo
Def.'s Supplemental Filing re: the Katzin decision ]]

****
A Vermont Federal District Court, by rejecting the idea that cell phones are "containers" under the Fourth Amendment, took a noticeable step away from the judicial propensity to force today's technology into property-based notions of the Fourth Amendment (see, e.g., the constable in Jones) in a misguided attempt to address emerging technology. While law will never keep pace with technology's march onward, and at times we must rely on the open texture of the law (see H.L.A. Hart), it is always refreshing to see the judiciary recognize that strained reverse engineering of anachronistic precedent must yield when the prevailing analogy becomes unmoored from the underlying legal issue. The court held that warrantless searches of cell phones, incident to arrest or under the automobile exception to the Fourth Amendment, were unconstitutional.

The court recognized, in reaching its holding, that the amount of information a cell phone could contain is limitless, taking into consideration that cell phones can now access/store information in the cloud (vastly expanding their on-board/physical storage capabilities); that alone, the court noted, was sufficient to distinguish a cell phone from a container. The end result:

the Court chooses to adopt a bright-line rule here: cell phones properly seized pursuant to the search-incident-to-arrest exception or the automobile exception cannot be searched without a warrant. Case-by-case analysis is not appropriate in this context, and the Government has not demonstrated any reason that such a warrant requirement would be unduly burdensome.  As a result, the Court hereby holds that law enforcement must obtain a warrant before performing such searches in the future.
…
…the Fourth Amendment requires that law enforcement obtain a warrant before performing a forensic search of lawfully seized cell phones.

The court's reasoning  (quoted at length because it is fascinating, both in a legal and literary sense):

The physical containers at issue in Robinson and Belton, and, indeed, even the cell phones in Finley, could not begin to approximate the amount of information that may be stored on a cell phone today. The Government states again and again in its briefings and at the hearings that the only difference between cell phones and conventional containers is that cell phones are “capable of storing large amounts of information.” Gov’t Post- Hr’g Mem. Mot. Suppress 13. The Government posits that this capability does not justify any differentiation between cell phones and traditional containers, but, in the Court’s view, this is precisely the factor that makes all the difference. The container analogy fundamentally fails to address the magnitude of modern cell phone storage capacity. Furthermore, it fails to consider the fact that many modern smartphones can access the Internet, opening up limitless additional storage. Because of these capabilities, modern cell phones can no longer fit comfortably within the Supreme Court’s original conception of a “container.” ... 

Several courts have recognized the storage capacity of modern cell phones as a basis for refusing to permit a warrantless search.  Most notably, the First Circuit recently determined that the search-incident-to-arrest doctrine “does not authorize the warrantless search of data on a cell phone seized from an arrestee’s person.” Wurie, 728 F.3d at 13. A significant concern underlying the First Circuit’s decision was the amount of information that would be accessible via a cell phone search. Id. at 9 (noting that individuals today “store much more personal information on their cell phones than could ever fit in a wallet, address book, briefcase, or any of the other traditional containers that the government has invoked”); see also Park, 2007 WL 1521573, at *9 (suppressing evidence from a warrantless search of defendant’s cell phone and analogizing modern cell phones to computers); State v. Smith, 920 N.E.2d 949, 954 (Ohio 2009) (“Even the more basic models of modern cell phones are capable of storing a wealth of digitized information wholly unlike any physical object found within a closed container. We thus hold that a cell phone is not a closed container for purposes of a Fourth Amendment analysis.”). 

The Government, in its continued attempt to downplay the quantity of information available on a cell phone, argues that the amount of data available should not matter because exceptions to the warrant requirement have been applied to large vehicles and motor homes. Gov’t Post-Hr’g Mem. 13 (citing California v. Carney, 471 U.S. 386, 388-89 (1985) (applying the automobile exception to a motor home); United States v. Gagnon, 373 F.3d 230, 240 (2d Cir. 2004) (tractor-trailer); United States v. Cruz, 834 F.2d 47 (2d Cir. 1987) (tractor-trailer truck)). This analogy demonstrates the Government’s misconstruction of the problem: the issue is not how large the container is, but that in the context of cell phones there is no limit to what the purported “container” may contain. See Schlossberg v. Solesbee, 844 F. Supp. 2d 1165, 1169 (D. Or. 2012) (finding that warrantless search of a digital camera violated the Fourth Amendment in part because “the storage capability of an electronic device is not limited by physical size as a container is”). Because modern cell phones can connect to the Internet, their storage capacity is nearly infinite. A tractor-trailer may be much larger than a sedan, but it still has tangible confines. A cell phone, by contrast, has no defined boundaries. Thus, allowing warrantless searches of cell phones pursuant to the search-incident-to-arrest exception would provide law enforcement with a giant exception to the warrant requirement without any limiting principles. 

Consider, for purposes of illustration, C.S. Lewis’s famous wardrobe. See C.S. Lewis, The Lion, the Witch, and the Wardrobe (1950). There is no question that the search-incident-to-arrest doctrine extends to a conventional wardrobe (in the unlikely event that one is found in a vehicle or on an arrestee). While this would be a search much more intrusive than Robinson’s cigarette pack, it still fits within the container doctrine because it has easily discernible limits: the container is large, but it is contained. Contrast this with the eponymous cabinetry in The Lion, the Witch, and the Wardrobe. Because the magical wardrobe is also a container, the Government would argue that it also fits within Robinson and Belton. However, this particular wardrobe also serves a second function. It opens up to another world, and because of this, it ceases to be merely a container—it is also a portal. Today’s cell phones, with their capacity to reach the Internet, the cloud, and to store millions of documents and photographs, can no longer analogize to a run- of-the-mill wardrobe. Instead, they are also a portal: a portal to the vast cosmos of the Internet. ... If the container rule were to apply to such a portal, a container search of Lewis’s wardrobe would extend to all of Narnia. But where a physical object is a portal to another world, there is a critical difference between a search of the object and a search of the worlds “contained” within the object. 

Thus, it is simply inappropriate to analogize cell phones to cigarette packs, purses, and address books; the more apt comparison is to computers. . . . Courts have consistently found analogies between computers and conventional containers to be problematic. For example, the Tenth Circuit found that “analogies to closed containers or file cabinets may lead courts to ‘oversimplify a complex area of Fourth Amendment doctrines and ignore the realities of massive modern computer storage.’” United States v. Carey, 172 F.3d 1268, 1275 (10th Cir. 1999) (quoting Raphael Winick, Searches and Seizures of Computers and Computer Data, 8 Harv. J.L. & Tech. 75, 104 (1994))(further citations omitted). 

The Government alternately seeks to justify the warrantless cell phone search as a container search under the automobile exception (as distinct from the vehicular prong of the search- incident-to-arrest doctrine). Gov’t Opp’n 7–8. However, the container rule under the automobile exception does not compel a different conclusion. The automobile exception allows law enforcement to search a vehicle and its contents that may conceal the objects of a search without a warrant so long as there is probable cause. Wyoming v. Houghton, 526 U.S. 295, 301 (1999) (quoting Ross, 456 U.S. at 823) (finding that the automobile exception “justifies the search of every part of the vehicle and its contents that may conceal the object of the search”). Several district courts have found that this exception extends to the warrantless search of a cell phone found in a vehicle searched with probable cause, so long as there is probable cause to believe the phone contained evidence of a crime. (citations omitted) 

These courts, like the courts in the search-incident-to- arrest context, all found that the searches were constitutional by analogizing cell phone searches to container searches. (citations omitted). Because the Court finds that this container analogy is no longer workable, the automobile exception does not require a different analysis. Instead, cell phones seized pursuant to the automobile exception, like those under the search-incident-to-arrest doctrine, are also properly analogized to computers, not containers. 

Not only have cell phones outgrown the original conception of a conventional container under the search-incident-to-arrest and automobile exceptions, but warrantless cell phone searches also can no longer be justified by the rationales underlying these exceptions. In Wurie, the First Circuit found that the Government could not demonstrate that warrantless cell phone searches are “ever necessary to protect arresting officers or preserve destructible evidence.” Wurie, 728 F.3d at 13 (citing Chimel, 395 U.S. at 763).
…
Wurie’s concern with “general evidence-gathering” is plainly applicable to this case. The search of Mayo’s cell phones was very invasive and performed without any limitations on law enforcement. Furthermore, it was not justified by the rationales underlying the search-incident-to-arrest and automobile exception doctrines. In fact, the Government has not demonstrated that such intrusive warrantless searches are ever necessary absent exigent circumstances. The search-incident-to- arrest exception “derives from interests in officer safety and evidence preservation.” Gant, 556 U.S. at 338 (citing Robinson, 414 U.S. at 230–234; Chimel, 395 U.S. at 763). Similarly, the automobile exception is rooted in the need to preserve evidence. See Ross, 456 U.S. at 806-07 (noting that in the automobile context, “immediate intrusion is necessary if police officers are to secure . . . illicit substance[s]”). Obviously, officer safety considerations are not implicated here. However, the Government has not demonstrated that such searches are necessary for evidence preservation either. 

In the past, courts have allowed warrantless cell phone searches because they found it necessary to allow police officers to search a cell phone based on the need to preserve evidence. (citations omitted). However, once law enforcement has seized and secured a cell phone, the risks regarding evidence preservation diminish. While courts have voiced concerns about the danger that internal data could be remotely erased, see Flores-Lopez, 670 F.3d at 807-08, there are simple methods available to protect a seized cell phone from remote modification. For example, in Vermont, it is state law enforcement’s practice to turn seized smartphones to “airplane” mode to disconnect them from outside interference, or to place them in a device that protects the phone from outside disruption. Suppression Hr’g Tr. 11:25-12:6, 13:14-20, Sept. 30, 2013. Thus, the Government has not shown that evidence preservation considerations justify the warrantless search of a seized cell phone.
Moreover, the Government has not demonstrated that it would be an undue hardship for federal law enforcement to obtain a warrant before performing forensic analysis on a cell phone. Indeed, this is already standard operating procedure for Vermont state law enforcement.  

…Thus, the Court finds that Mayo’s Fourth Amendment rights were violated when law enforcement searched his phone without a warrant.

For those who read the foregoing language as a slam dunk, I suggest you hold your applause. While the court announced a prophylactic rule for the future, the defendant here was torpedoed by the Good Faith Exception (despite an admirable attempt to avail himself of the recently published Katzin opinion from the Third Circuit - see more Cybercrime Review posts, here: Katzin Coverage). The court's reasoning on the Good Faith argument:

... the Third Circuit declined to apply the good faith exception where police relied on out-of- circuit precedent. Katzin, 2013 WL 5716367, at *16-17. Mayo cites Katzin to argue that the good faith exception should not apply in this case because there is no on-point authority from the Supreme Court or the Second Circuit. 

In Katzin, however, there was a significant circuit split on the issue in question. . . .Thus, law enforcement would not have been able to reasonably rely on out-of-circuit precedent, as there was no consensus. In other words, the law could easily be characterized as the type of “unsettled” law contemplated by Justice Sotomayor’s concurrence. In this case, by contrast, there was no circuit split as of March 2013; all of the circuits to address the issue had permitted such searches. While there was no binding Second Circuit authority, law enforcement acted reasonably in reliance on a general out-of-circuit consensus. Because Katzin is distinguishable from this case, the Court finds that application of the good faith exception remains appropriate.

I questioned this type of argument in a previous post (see here: OH App Ct: Warrantless GPS tracking OK despite no precedent; My take on the "good" left in the good faith exception), so I won't belabor the point further, except to say that I take issue with out-of-circuit precedent providing sufficient "cover" to allow Fourth Amendment protections (or, if you please, Fourth Amendment restrictions on permissible law enforcement methods) to rise or fall with assurances that law enforcement understood existing non-precedential law and decided to act based on such notions instead of shooting from the hip.

Again, stripped of all of the rhetoric, I find this opinion important because it advances a conception of technology I have repeatedly argued for - one that sheds physical analogies that are ill suited to cyberspace and analogies which, standing alone, call for further judicial acknowledgment, or legislative action to ameliorate the growing distance between law and technology.

Read More

Former Romney/Ryan intern charged with cyberstalking and internet extortion denied bail

In United States v. Savader, 13-MJ-359 (E.D.N.Y. May 7, 2013), Magistrate Judge Gary R. Brown denied bail to Adam Savader because of the nature of his crimes (cyberstalking and internet extortion) and due to the "weaponized" nature of the cache of compromising pictures the defendant possesses. The court's reference to weaponization derived from the fact that the images of the 15 victims were in cloud storage, and thus "the cache of compromising photos, [could] be accessed from any Internet- enabled device on the planet," allowing Savader to perpetrate additional crimes or antagonize his victims further.

The Savader case was well publicized when it hit the news; see:

Politico, Adam Savader, ex-Romney intern, arrested for blackmail
New York Daily News, Former Romney campaign intern busted in nude-pics blackmail scheme

From the Politico article (to summarize):

A former intern for the 2012 Republican presidential ticket of Mitt Romney and Paul Ryan and for Newt Gingrich’s presidential campaign was charged with cyberstalking young women and blackmailing them into sending nude photos in federal court on Tuesday.
Adam Savader, a 21-year-old from Great Neck, N.Y., obtained nude photos of 15 different women and threatened to publish the photos unless the women sent him even more naked pictures, according to a criminal complaint. Some of the victims were Savader’s high school and college classmates.

The complaint was originally under seal, but was unsealed on April 23, 2013 by order of the court. The complaint plus additional documents from the E.D. of Michigan (where the charges were filed), can be viewed here:

Savader Docs (Complaint, Arrest Warrant, Docket, etc.)

While Savader was charged in Michigan, he lives in New York, hence the reason why the detention order (and reasoning) emanated from the Eastern District of New York. In beginning his determination, the EDNY Magistrate considered whether it was even proper to make a bail determination in New York instead of Michigan. In the end, the court held that the amended Rules of Criminal Procedure allowed the court to proceed, and indeed it makes sense to hold a bail hearing in the defendant's home district, where Savader could more easily provide information relevant to the bail hearing; namely, his community ties, etc.

As to the merits, the court noted that the case "present[ed] novel factual issues as well as the kind of legal challenges that often arise when applying traditional legal concepts to cases emanating from digital technology." I think that is the interesting part of this otherwise routine part of criminal procedure. What should the standard be for individuals charged with internet crimes, where access to a computer might be the only thing needed to perpetrate additional crimes, modify evidence, or in this case, antagonize victims further with compromising photos?

In this case, the court referred to it as a close call, but ended up siding with detention. I don't necessarily agree it was close. As the court noted: there were 15 victims, the defendant showed some acumen for technology (not enough to know Google Voice numbers can be tied to your IP address...), and the defendant held specific animus for some of the victims. Moreover, because the fruits of his alleged crimes were stored out on the internet, the temptation for him to access that material (for any reason at all, nefarious or otherwise), might have been too great (notwithstanding his family's assurances otherwise).

I will note that I think the analysis regarding bail should be different in hacking cases, where systems have been adequately secured and there is no further chance the defendant could reoffend. However, here, I don't think you can convincingly argue future crime/tampering/sexual gratification related to the cache of material is a non-issue.

Because I haven't seen much related to bail considerations for electronic crimes, I reproduce in full the court's reasoning, below:

Because the offenses charged do not appear to constitute crimes of violence as defined in the Bail Reform Act, see 18 U.S.C. §3156,3 the Government is limited to seeking detention under § 3142(f)(2)(B), to the extent it can establish that the defendant “presents a serious risk that [he] . . . will . . . threaten, injure, or intimidate, or attempt to threaten, injure, or intimidate, a prospective witness.” Thus, the determination turns on whether the defendant may attempt to threaten or intimidate potential witnesses, which, in this case, means the complaining victims. 

Precise prediction of future human conduct represents an impossible task. Here, however, we can look at several indicators. First is the defendant’s capacity to threaten or intimidate the victims, both identified and unidentified. According to the Government’s proffer, agents uncovered evidence of an Internet cloud storage account that included files bearing names of the victims, presumably containing the photograph files used as part of the extortion. Notwithstanding the seizure of computer hardware from the defendant, the existence of this cloud storage suggests that, based on the information currently available, the defendant has possession of the cache of compromising photos, which can be accessed from any Internet- enabled device on the planet. Though electronic files do not generally constitute dangerous materials, in the context of this highly-unusual case, the defendant effectively “weaponized” these items, presenting a significant risk. Given the defendant’s demonstrated facility with computer technology, it would be all but impossible to fashion terms and conditions that would eliminate defendant’s access to these materials. Hence, like an individual with access to a secret cache of weapons, the defendant certainly maintains the capacity to intimidate or further injure the victims until these materials can be definitively located and secured. 

The second factor is the defendant’s willingness to employ these materials to cause further harm to the victims. Of course, that he has done so in the past is one consideration. At the hearing, his counsel argued, persuasively, that the defendant would be a fool to violate a court directive contained in a release order, as it would mean almost certain return to jail. In addition, the mere exposure of the scheme may well make the defendant reticent to engage in additional similar conduct. As Justice Brandeis famously observed, “Sunlight is said to be the best of disinfectants; electric light the most efficient policeman.” However, the Government has presented evidence showing that this defendant – largely for reasons that are as yet undiscovered – maintained an animus against some of these victims for many years. Though the defendant is now 21, he has managed to hold a grudge against several victims since high school. This demonstrated drive on the part of the defendant forces me to conclude that there remains a serious risk that he will attempt to intimidate or further injure the victims, as long as those photos remain in his control. 

Having concluded there is such a risk, the question is whether there are conditions which can remediate that risk. The Court notes that, at the bail hearing, defendant demonstrated substantial ties to the community. A large number of family members appeared at the bail hearing, representing three generations of his family, all of whom appeared willing and eager to assist in ensuring that the defendant will not engage in further wrongful conduct. According to his attorney, family members were willing to accompany him to school, attend classes with him, and take any other steps necessary to secure his release. Because of the unique circumstances of this case, I find that this support, though an important consideration, cannot overcome the serious risk of danger to the victims. As such, I directed the defendant be detained pending removal to the Eastern District of Michigan. 

That said, I note that this was a close call, which could have easily resulted in a different outcome. As described above, these decisions must be made with deference to the charging district, which will have access to better information concerning the status of the compromising photographs, input from the victims, and the nature of the evidence. That court, therefore, will be in a far better position to evaluate the risk presented by the defendant, and should accord little weight to this determination.

Read More

Featured Paper: Cloud Computing Security and Privacy

Cloud computing has been viewed by many as the next inevitable step towards a more efficient system for information management and storage. However, as our dependence on cloud computing continues to grow, many have started to examine the privacy, security, and legal ramifications that such a system creates. The Center for Applied Cybersecurity Research (CACR), located at Indiana University, has recently released a new white paper, Cloud Computing Security and Privacy, that examines the privacy and security risks associated with cloud dependence, as well as what should be done to create more secure and sustainable cloud-computing systems. The white paper was authored by Drew Simshaw, former information security fellow at CACR and current project manager and policy analyst with the Center for Law, Ethics, and Applied Research (CLEAR) in Health Information. I highly recommend taking a look at this white paper if you at all involved in cloud computing. The abstract appears below:

As the world’s data increase at unfathomable rates, individuals and organizations are seeking more convenient and cost effective ways to store and manage it. Many are turning to the cloud, recognizing its benefits, but failing to understand how it actually works. To confirm that cloud computing is no longer a fringe IT issue, one need look no further than President Obama’s re-election campaign, which was successful thanks in no small part to its utilization of Amazon’s cloud platform for a massive voter database. As cloud computing use continues to increase, security and privacy issues, as evidenced by recent events, should be considered so individuals and organizations can decide how best to store and manage their data. Although these events shed some light on measures that can be taken to reduce risk, they also demonstrate that bigger thinking is needed when it comes to improving security and privacy in the cloud. Therefore, as opportunity in the cloud expands and the stakes continue to rise, individuals, organizations, and cloud service providers must bear in mind the following security and privacy issues:

• Creating a Bigger Target for Hackers
• Government Access to Data in the Cloud
• Data Access and Control in the Cloud
• Cloud Service Outages and Human Error
• Authentication
• Encryption

In addition to being a guest author at Cybercrime Review, Andrew Proia is a research assistant to Professor Fred Cate, Director of the Center for Applied Cybersecurity Research. Andrew is also set to become a CACR Post-Doctoral fellow in information security law & policy later this year. All opinions expressed by the author are solely in his individual capacity.

Read More