Featured Paper: Domestic Drone Use and the Mosaic Theory

From Sean Sullivan at UNM Law School. The article can be found here: Domestic Drone Use and the Mosaic Theory.

Abstract:

The use of unmanned aerial drones - operated by remote pilots and capable of conducting pinpoint strikes on targets around the world - has revolutionized the fight against terrorism. Within the past few years, however, drones have also been used for domestic security and law enforcement purposes, and such local use is likely to expand in the near future. Whether the government’s use of emerging, sophisticated technologies comports with the 4th Amendment’s protection against unreasonable searches and seizures has confounded the courts, and there are growing concerns that traditional 4th Amendment analyses are no longer workable in the context of modern technologies. In U.S. v. Jones (2011), the Supreme Court applied a relatively new doctrine, the “mosaic theory,” in determining whether the government’s use of technology, in this case a G.P.S. tracking system, was consistent with fundamental 4th Amendment protections. 

This paper explores whether the “mosaic theory,” laid out by legal scholar Orin Kerr and espoused by the Court in Jones, can be applicable to 4th Amendment challenges to domestic drone use. This paper first explains the extent to which drones are already operational domestically, and briefly discusses proposals to expand their domestic capabilities; second, provides a brief overview of the traditional 4th Amendment analyses in the realm of emerging technologies, with an eye toward determining whether the “property-driven” or “reasonable expectation of privacy” doctrines are no longer applicable to such sophisticated technologies; third, discusses the Jones case as well as the “mosaic theory” in order to provide a solid foundation from which to draw conclusions about its applicability to domestic drone use; and fourth, analyzes a particular type of domestic drone use under the “mosaic theory” rubric, and determines whether it is an appropriate framework to ensure 4th Amendment protections in the context of emerging technologies going forward. 

The domestic uses of drones are increasing and have been largely overlooked by the public. At the same time, the courts are struggling with how to check such use against the constitutional right to be free from unreasonable searches and seizures. An appropriate analytical framework is needed to assist the courts in ensuring that the government’s domestic use of drones does not infringe on the people’s well-established civil liberties before drones become an even more ubiquitous part of the domestic American experience or facilitate the creation of a perpetual “nanny state” under the guise of providing national security.

Read More

Court holds reasonably logical assumption insufficient to apply inevitable discovery rule

In a profession where reasonably logical leaps are normative, the prosecution in North Carolina was asked to push such prescriptions.

 In State v. Wells, 2013 N.C. App. Lexis 121, the appellate court held that a mere logical assumption that evidence would have eventually been discovered is insufficient to trigger an exception to the exclusionary rule for evidence derived from an unconstitutional search or seizure.  

The defendant was convicted for soliciting a child by a computer and attempted indecent liberties with a child.

During the trial, the defendant moved the court to suppress certain statements he made to the police upon arrest and to suppress evidence retrieved from his laptop computer.

On the day the defendant was arrested, detectives initially went to the defendant’s house only to find that he was not home. They also executed a search warrant authorizing the seizure of computers from the defendant’s residence.  However, upon arrival, the detectives did not find any evidence.

After contacting the defendant’s place of employment, a firehouse, the defendant opted to turn himself in to avoid been arrested at work. 

In custody, the defendant was read his Miranda rights. Detectives were able to get the defendant to admit that he owned a Dell laptop and that the laptop was located on his bed at the fire station. However, detectives were only able to elicit these statements after telling the defendant that if he were cooperative, they would inform the court and the district attorney about his cooperation. Based on the information the defendant provided, the police seized the defendant’s laptop from the fire station.

While the court granted defendant’s motion regarding his statements on the grounds that they were involuntary as they resulted from a promise, hope or reward, the court denied the motion to suppress evidence retrieved from the defendant’s laptop computer. 

On appeal, the appellate court reversed this decision. The court stated that although it was logical to assume that the police would have eventually searched the fire station for evidence, there was no evidence in the record to support this assumption apart from conclusory statements made by counsel.

I am  uneasy with such nitpicking.  Since a personal laptop was involved, there was no doubt that the police officers were eventually going to search his work place, the last known destination he was at before he was taken into custody. The facts of this case were sufficient to trigger the inevitable discovery doctrine. 

 Any future consequential concerns the appellate court had are remedied by the very nature of the doctrine itself.  It is generally accepted that inevitable discovery is to be determined on a case-to-case basis. 

The court ordered a new trial.  What a waste of the judicial system’s already strained resources. 

Read More

District court case provides road-map for what not to do under the Fourth Amendment

In Hatfield v. McDaniel, 2012 U.S. Dist. LEXIS (M.D. Ala. October 19, 2012), the court allowed the plaintiff's case alleging violations of section 1983 resulting from two illegal searches to proceed. The defendants were law enforcement officers and state/local entities that were party to the alleged Fourth Amendment violations.

This is the closest case I've ever seen of what not to do under the Fourth Amendment:
1.  Facially invalid searchwarrant - check
2.  Search of computer (pursuant to facially invalid search warrant), which was allowed within 10 days, executed 1 year later - check
3.  Failure to stop a search upon the owner's revocation of consent - check

Hatfield owned a car stereo store which occasionally accepted trade-in merchandise. He was careful, however, not to accept stolen goods. When a car stereo was brought in that he believed was stolen, he refused to accept it, and an officer showed up shortly after to take custody of the stereo and arrest the individual trying to trade it in. At that time, Hatfield asked the officer to take a look at a rifle he had received as a trade-in, because he was unsure if that was stolen, too. It turns out that it was.

The officers decided, based on the stolen merchandise they had found so far, that it would be prudent to go through all of Hatfield's inventory to check for other stolen merchandise. Hatfield agreed. The officers began the search, and a little while later, a drug dog showed up (his name was Hobbs - he was not a party to the action). At that point Hatfield removed consent for the search. The officers told him he could do it the hard way, or the easy way. Hatfield chose the hard way, which involved his arrest for the stolen rifle, and the police obtaining a warrant from a judge to continue to search. However, instead of waiting until the warrant arrived, there was evidence that the search continued at Hatfield's store. Error #1.

At some point during the search, Hatfield's girlfriend told officers there was child pornography on his computer. They drafted a facially invalid warrant, based on only her statement and no other evidence - they did not even include in the warrant a statement regarding her veracity or the basis for her claim. Error #2.

They then executed the facially invalid search warrant for Hatfield's computer, and seized it. The warrant gave the police 10 days to do so. Then, 1 year later, they actually searched the computer and found child pornography. (In my opinion, Error #3 - the court held otherwise).

Prior to trial, Hatfield moved to suppress all of the evidence obtained after he revoked consent, and the court granted the motion. This included the seizure of the computer. So, all charges were dropped. Hatfield then sued the police, the city, and individual officers for Section 1983 violations related to the search. The defendants moved for summary judgment, arguing qualified immunity applied. However, the court disagreed.

As to the search after consent was revoked, the court cited Arizona v. Hicks as controlling, and stated the following:

The controlling precedent, then, shows that an officer moving a box in Powerhouse Audio, even if only a few inches, and then inspecting it constituted a search (even if that search revealed nothing of great value). Accordingly, on summary judgment, Lieutenant McDaniel and Officer Furlong, who allegedly participated in that warrantless search, are not entitled to invoke the defense of qualified immunity as a shield to Mr. Hatfield's Fourth Amendment claim against them. (emphasis added)

The court then went on to analyze the search/seizure of the computer. Hatfield argued that the search warrant had not been executed within the defined term of 10 days, because the computer wasn't actually searched within that period. The court disagreed (which I think, personally, was erroneous). The court held that execution of the warrant occurred within 10 days because the seizure occured within 10 days. The court reached that conclusion as follows:

While it is undisputed that Sergeant Graves did not search the computer until nearly a year after the warrant was issued, it does not necessarily follow that the warrant was not executed within the ten-day limit. Although the term "execute" is undefined in § 15-5-12, usage of the term suggests a search warrant is executed when the described property is physically seized and taken into police custody. In the context of electronically stored information, that would mean the warrant is executed when the computer is seized, not when the files are accessed. 

With respect to the warrant to search the computer, the court held that it lacked even "a hint" of probable cause and was therefore facially invalid. The court explained:

. . . in light of controlling precedent, the affidavit fails to establish even probable cause to believe there would be pictures of children, pornographic or otherwise, on Mr. Hatfield's computer. The only fact supporting such a conclusion is the statement of an unidentified woman at the scene, because the affidavit did not reveal Ms. Neal's identity but only referred to her as "a person that was at the store." . . . It is well settled law that a statement from an anonymous source may establish probable cause for a search warrant, but only so long as "given all the circumstances set forth in the affidavit . . . , including the 'veracity' and 'basis of knowledge' of persons supplying hearsay information, there is a fair probability that contraband or evidence of a crime will be found in a particular place." Illinois v. Gates, 462 U.S. 213, 238, 103 S. Ct. 2317, 76 L. Ed. 2d 527 (1983). But here the only fact tending to establish probable cause is the anonymous statement, and there is absolutely nothing in the affidavit supporting the veracity or basis of knowledge of the woman who made it. . . .The statement here lacks even a conclusory assurance of reliability and credibility, so it could not have provided probable cause for a search warrant.

Moreover, the warrant was "so lacking in indicia of probable cause as to render official belief in its existence unreasonable." The court rejected a last ditch argument that the officer's conduct was based on the collective knowledge of law enforcement:

Even assuming Sergeant Graves had access to the collective knowledge of law enforcement, Mr. Hatfield's evidence shows his computer was searched pursuant to a facially void warrant. That conduct, if established at trial, constitutes a violation of clearly established law, and Sergeant Graves is therefore not entitled to invoke the defense of qualified immunity.

Total fail - check.

Read More

When does one start to have a legitimate privacy interest in one’s phone records?

In McGreal v. AT & T Corp., 2012 WL 4356683 (N.D. Ill. Sept. 24, 2012), a federal district court held that a phone owner did not have standing to bring a Fourth Amendment unreasonable search and seizure violation as she did not have a legitimate expectation of privacy in the previous owner’s usage records of the phone.

The plaintiff alleged a Fourth Amendment unreasonable search and seizure violation against the Village of Orland Park and some of its employees (The Village defendants). In October 2010, the Village of Orlando Park requested a subpoena for the phone records at issue during the arbitration of the plaintiff’s son’s termination as an Orland Park police officer. The subpoena was issued for the months of February and March of 2010. The phone number for which the subpoena was issued belonged to the plaintiff’s son from May 2009 through March 26, 2010. When the plaintiff’s son was ordered to produce his phone records for February and March 2010, he was unable to provide them because he closed the phone account on March 26, 2010 and transferred it to the plaintiff.

At trial, the plaintiff argued that her status as owner of the cell phone number when the subpoena was issued gave her ownership of the entire record associated with the number.

The District Court dismissed the defendant’s argument and noted that the subpoena mostly sought after “records that were created . . .  before her ownership of the number.” The court stated that for one to have a legitimate privacy interest as to confer standing to object to a search and seizure, one must have some amount of possession and control over the “object” of the search. The court frowned against the transfer of ownership by the plaintiff’s son to the plaintiff and deemed it a bad faith attempt to evade production of the records.

It is not exactly clear how much weight the court gave to the factual circumstances that surrounded the termination and transfer of the phone account. In the absence of bad faith, one may wonder if the holding would be the same.

While the court held that the plaintiff did not have standing to bring a search and seizure violation in regards to the entire phone record, the court held that the plaintiff did have standing pertaining to the phone records of March 26, 2010 through March 31, 2010. This was a period where she had ownership and complete dominion of the phone record. Thus, the Village defendants’ motion to dismiss the Fourth Amendment violation claim for lack of standing was granted in part and denied in part. 

Read More

In Paypal DDOS case, government reprimanded for failure to analyze and return data in a timely fashion

If you recall, I wrote earlier about the E.D.N.Y holding that the government's failure to examine data after 15-months was a seizure under the Fourth Amendment - see: Federal court holds that 15-month delay in reviewing electronic evidence was an unlawful seizure. Well, it appears the government continues to have issues in this regard.

In United States v. Collins, 2012 U.S. Dist. LEXIS 111583 (N.D. Cal. Aug. 8, 2012), the government's motion to reconsider an order to return evidence was denied. The evidence was data that "fell outside the scope of the 27 warrants by which over 100 of the defendants'computers and other digital devices (including storage media) were seized."

The defendant, Collins, is part of a large group of people that were rounded up last year after the DDOS attack on Paypal. The attack was allegedly perpetrated by Anonymous, and used the Low Orbit Ion Cannon to achieve its goal. You can see the DOJ announcement, here: Prosecution of Internet Hacktivist Group "Anonymous," and some of the proceedings of the case, here (including a description of what allegedly occurred, and the criminal charges).

The facts are somewhat similar to Metter (the case my article above is on), in that in an extraordinary amount of time the government failed to deal with seized data. In the courts words:

almost a year and a half after presenting the warrants, the government has yet to take any meaningful steps to isolate non-targeted from targeted data

The government's arguments for reconsideration of the order on March 16, 2012 (nearly 5 months ago, and many months after the original seizure) are that:

(1) identifying non-targeted data might be difficult; (2) certain non-targeted data might be useful in understanding data that is clearly targeted; and (3) disaggregating non-targeted from targeted data might be unduly burdensome and expensive; (4) allowing only the defendants to keep a complete copy of the seized data might deprive the government the ability to challenge exculpatory non-targeted data and thus would be unfair.

The court was unconvinced by the governments justifications, and essentially chided the government for arguing a position that would essentially allow them to keep data they were not authorized to seize (possibly indefinitely) and which would nullify the government's pledge in search warrants to return such data. In the courts words:

If separating non-targeted data from targeted data and devices lawfully retained as criminal instrumentalities is too hard here, it presumably is too hard everywhere. In what case where a storage device is seized lawfully could a defendant or other subject of a search warrant ever secure return of data that the government had no right to take? Just about every storage device can be searched more easily with automated scripts than manually. Just about every storage device has non-targeted data that might prove useful to understanding the data that was targeted. Just about every storage device has deleted files in unallocated space. If the government's argument were accepted here, so that it need not return even one bit of data that is clearly outside the scope of the warrant, the court thus would render a nullity the government's pledge in just about every search warrant application it files in this district that it will return data that it simply has no right to seize. 

To me, it's hard not to wonder if there is a systemic problem going on with how the government is handling cybercrime cases and the plethora of evidence that they tend to produce - according to this transcript, there were at least 9 terabytes of data that had to be analyzed.  That is certainly a lot of data, but as the court in Metter stated, there has to be a line drawn somewhere when retention of data transforms from investigatory to a violation of the Fourth Amendment.

Read More

Federal court holds that 15-month delay in reviewing electronic evidence was an unlawful seizure

In what I would call a very significant case, a New York federal court has held that failure to examine a defendant's imaged hard drive within 15-months after it was obtained was an unlawful seizure in violation of the Fourth Amendment. In United States v. Metter, 2011 U.S. Dist. LEXIS 155130 (E.D.N.Y. 2012) the government imaged over 60 hard drives as part of a criminal investigation into securities fraud, yet held on to the images and failed to actually do anything with them for over 15 months. The defendant argued that "the government's significant delay in conducting off-site searches of the imaged evidence merits blanket suppression of all seized and imaged evidence as routine delays of this duration would eviscerate the Fourth Amendment's privacy protections." While treading very cautiously, the court ultimately held that such delay, especially due to the amount of irrelevant, yet highly personal information that could be on a computer hard drive, was an unreasonable seizure.

At the outset, the court noted that the defendant's argument raised "an interesting issue of first impression in this Circuit that may impact electronic discovery in future criminal investigations and cases: How long may the government retain seized and imaged electronic evidence before conducting a review of that evidence to determine whether any of it falls outside the scope of a search warrant?" (This is indeed an interesting question. Think, for example, of evidence collected from a murder scene. The officers may take pictures, blood swipes, fingerprints, etc., but they cannot bag up the entire site or completely capture it for future use. That is the case with imaging a defendant's hard drive, though - essentially the evidence (relevant or irrelevant) lasts forever; it can be revisited ad nauseum, and consequently raises a plethora of Fourth Amendment concerns. Ultimately, and because of this evidentiary effect, this ends up as a case where the court was forced to treat electronic evidence different from physical evidence because of the fundamental difference in nature and kind between the two.)

The court went on to note that courts have long recognized that searches (typically of papers) will inevitably involve reviewing documents that are outside of the scope of the search because it is impossible to conduct a search otherwise; pragmatically, there are "tactical difficulties" in cabining a search when you don't know what you will find, or where "it" will be found, per se.  This recognition has been extended to computers, but:

Computers and electronic information present a more complex situation, given the extraordinary number of documents a computer can contain and store and the owner's ability to password protect and/or encrypt files, documents, and electronic communications. As a result, the principle of permitting law enforcement some flexibility or latitude in reviewing paper documents just described, has been extended to computerized or electronic evidence. Courts have applied the principles recognized in Andresen "in analyzing the method used by the police in searching computers and have afforded them leeway in searching computers for incriminating evidence within the scope of materials specified in the warrant."

Thus, courts look to the heart of the Fourth Amendment for the lawfulness of the search - was it "reasonable?"

The court recognized that the warrants issued in this case (there were multiple, spanning both homes and offices), were facially valid, sufficiently particular, and clearly defined the scope of each search. Additionally, the police acted reasonably in executing the searches, and promptly returned the hard drives back to the owners after they were imaged. Thus, the crux of the case does not involve a failure of the warrants themselves, or the procedure in which they were executed on-scene, but the process involved afterwards.


The court pointed out that delays of several months have been found to be reasonable - there may be law enforcement delays, an ongoing investigation, etc., but that there was a lack of precedent on the ceiling of this temporal question - when did a delay become presumptively unreasonable. While not actually answering that question, or establishing a black-letter rule, the court stated that:

The parties have not provided the Court with any authority, nor has the Court found any, indicating that the government may seize and image electronic data and then retain that data with no plans whatsoever to begin review of that data to determine whether any irrelevant, personal information was improperly seized. The government's blatant disregard for its responsibility in this case is unacceptable and unreasonable.

The court dismissed the government's argument that because they returned the original hard drives they were not really violating any privacy. I find this argument to be almost laughable - why does having a copy of a personal document lessen its embarrassing or incriminating nature? The court found this a "distinction without a difference."

Notably, the defendant's counsel had also notified the court that the government was willing to provide copies of these hard drives to attorneys of other defendant's involved in the fraudulent scheme, upon request. While this might have been helpful in a discovery sense, the failure to triage these hard drives for irrelevant information was damning. Ultimately, the court stated:

The government's retention of all imaged electronic documents, including personal emails, without any review whatsoever to determine not only their relevance to this case, but also to determine whether any recognized legal privileges attached to them, is unreasonable and disturbing. Moreover, the government repeatedly asserted its intent to release indiscriminately the imaged evidence to every defendant, prior to conducting any review to determine if it contained evidence outside the scope of the warrants. The Court agrees with Defendant that the release to the co-defendants of any and all seized electronic data without a predetermination of its privilege, nature or relevance to the charged criminal conduct only compounds the assault on his privacy concerns. It underscores the government's utter disregard for and relinquishment of its duty to insure that its warrants are executed properly.

After holding the government's actions in contravention of the Fourth Amendment, the court wrestled with the remedy. Did such process "deserve" complete suppression of all evidence - a remedy quite harsh to a case built around such evidence. The court ultimately decided complete suppression was warranted:

The Court has not reached this conclusion lightly. However, the Court cannot, in the interest of justice and fairness, permit the government to ignore its obligations. Otherwise, the Fourth Amendment would lose all force and meaning in the digital era and citizens will have no recourse as to the unlawful seizure of information that falls outside the scope of a search warrant and its subsequent dissemination. 

The impact of this case is wide-reaching for law enforcement - essentially they must do something with seized evidence in a reasonable amount of time. This raises a series of questions:

1. What must law enforcement do to prevent suppression if the amount of time grows - merely do a keyword search, or fully triage and redact irrelevant evidence?
2. We know 15 months is too long, but what about 10, 12 or 8 months? Another line drawing problem is born.
3. How does this decision affect law enforcement timetables for existing and future investigations, and what if any impact will it have as more cases involve electronic evidence and case loads and backups increase?
4. What will the impact of this decision be on general electronic discovery as it relates to passing unredacted/reduced electronic evidence to co-defendants, since such discovery implicates privacy concerns due to the nature of hard drives and the "intermixing" of relevant and irrelevant evidence?

Read More