Legal

CHAPTER

Legal

9 Margaret Phipps Brown Marshall University, WV, USA

INTRODUCTION Advances in technology occur so rapidly that it is difficult for the legal system to keep up. Legislation is quickly outdated when new devices and capabilities become available. Court decisions about search and seizure of digital data or involving the use of technology must rely on decisions made when the technology being analyzed was not available. The translation of legal precedent based on the real world often falls short in its application to the virtual world. The purpose of this chapter is to examine some areas where advances in technology employed by law enforcement become an issue in criminal prosecutions. First, some basic concepts of search and seizure will be described. Then, specific instances of technology and digital data will be addressed. Definitive case law regarding the most recent technology is not always available. The United States Supreme Court has decided a few cases that address the rapid expansion of technology and its use by law enforcement. In some instances, there is very little case law at all, even though the technology in question is widely used by law enforcement. Where there is case law, different courts may look at similar cases and rule differently. Where appropriate, existing legislation is addressed. In today’s world, the issue is not whether law enforcement officers can use technology to assist with investigations. The issue is whether a search warrant should have been obtained prior to the use of the pervasive and powerful technology available to law enforcement today, or whether the expectations of privacy within society have been diminished by this technology, such that search warrants are no longer feasible or necessary. The issue in future years may become whether the use of technology requires courts to reevaluate existing case law because of the tremendous potential for technology to invade the personal lives of individuals.

THE FOURTH AMENDMENT The Fourth Amendment to the United States Constitution protects individuals from unreasonable government search and seizure. Its provisions apply to states through the doctrine of selective incorporation (Mapp v. Ohio, 367 U.S. 643, 1961). The

133

134

CHAPTER 9  Legal

United States Supreme Court initially evaluated Fourth Amendment issues based on whether government agents had committed a physical trespass. Noting that the Fourth Amendment protects people, not places, the Court adopted a different test in Katz v. United States, where it held that “the Fourth Amendment protects people, not places” (Katz v. United States, 1967, p. 353). In Katz, the Court held that “the application of the Fourth Amendment depends on whether the person invoking its protection can claim a justifiable, reasonable expectation of privacy that has been invaded by government action” (Smith v. Maryland, 1979, p. 740). Justice Harlan, who concurred with the holding in Katz, explained that an expectation of privacy is established when an individual has “exhibited an actual (subjective) expectation of privacy” and “that expectation [is] one that society is prepared to recognize as ‘reasonable’ (Katz v. United States, 1967, p. 361). The expectation of privacy, then, is the beginning point of any analysis when there is a claim that the law enforcement use of technology has violated the Fourth Amendment. In another case, the Court held that a reasonable expectation of privacy must be more than a subjective expectation of not being discovered. To be recognized, a reasonable expectation of privacy must be the one that society is prepared to recognize (Rakas v. Illinois, 1978). The determination of whether a search warrant is necessary, then, will involve an analysis of two specific questions in the context of facts known to law enforcement: (1) Did the government act? and, if so, (2) Did the actions of the government violate a reasonable expectation of privacy? If the answer to either of these questions is negative, then a search warrant is not required. Generally, evidence seized in violation of the Fourth Amendment will be excluded from a criminal trial (Weeks v. United States, 1914; Mapp v. Ohio, 1961). Evidence discovered with the assistance of illegally obtained evidence, sometimes called derivative evidence or secondary evidence, will also typically be excluded from a criminal trial (Silverthorne Lumber Co. v. United States, 1920). These rules emphasize how important it is for law enforcement to comply with the requirements of the law when undertaking criminal investigations. That expectation of privacy is highest in one’s home (Katz v. United States, 1967). Law enforcement officers who enter a home without consent are searching the home in the Constitutional sense. Generally, law enforcement officers can be present outside the residence and may look into a residence from the street without violating the Fourth Amendment (LaFave, Israel, King, & Kerr, 2009). The United States Supreme Court explained it this way: “[w]hat a person knowingly exposes to the public, even in his own home or office, is not a subject of Fourth Amendment protection (United States v. Ross, 1982, p. 822). The Fourth Amendment privacy interest in one’s home extends to garages and outbuildings, as well, to the extent the occupant of the home can establish a reasonable expectation of privacy (LaFave et al., 2009). The area around a home, called curtilage, is protected by the Fourth Amendment. Two United States Supreme Court cases addressed how much protection curtilage receives. In each case, the Court affirmed warrantless searches by law enforcement agents who flew over the home of a suspect in publicly navigable air space were

The fourth amendment

affirmed, but the cases were decided on different grounds. In California v. Ciraolo (1986), police officers observed and photographed marijuana growing in the defendant’s back yard from a private plane flying at approximately 1,000 feet. The officers obtained a search warrant based on information from the aerial observation, found marijuana, and arrested the defendant. The Court held that society was not prepared to recognize that a defendant had a reasonable expectation of privacy in his back yard. In Florida v. Riley (1989), a police officer observed marijuana plants growing on the defendant’s property from a helicopter, flying at approximately 400 feet. The Court in Riley held that the defendant could not have reasonably expected his greenhouse would not be observed from the air. In both cases, the aerial observation of a defendant’s yard was deemed constitutional – in Ciraolo based on the second prong of the Katz reasonable expectation of privacy test and Riley based upon the first (subjective) prong of the Katz reasonable expectation of privacy test. The United States Supreme Court has held that the Fourth Amendment protects curtilage from physical intrusion by law enforcement officers without a search warrant (Florida v. Jardines, 2013). Open fields do not receive the same protection as homes and curtilage. The United States Supreme Court has held that there was no societal interest in extending Fourth Amendment protections to open fields. In Oliver v. United States (1984), law enforcement agents bypassed a No Trespassing sign on the defendant’s property and found marijuana growing in an open field on his property. The Court held that the defendant had no reasonable expectation of privacy in an open field. In Dow Chemical Co. v. United States (1986), the United States Supreme Court held that warrantless aerial photographs of open fields taken by Environmental Protection Agency investigators did not violate the Fourth Amendment. Closed containers are also protected by the Fourth Amendment. An individual may establish a reasonable expectation of privacy by placing material in a closed, opaque container (United States v. Chadwick, 1977; Robbins v. California, 1981). Computers have been described as virtual file cabinets, that is, closed container containing digital data in various forms. Most password protected computers are perceived as private areas, requiring a warrant or consent prior to a search in the absence of exigent circumstances. These physical constructs of search and seizure apply to digital evidence. Courts have analogized law enforcement accessing a computer to opening a sealed container to look around (United States v. David, 1991). In David, an FBI agent observed a defendant access his computer to see the defendant’s password. Later, access the defendant’s computer and found incriminating evidence on it. The United States District Court for the District of Nevada held that the defendant did not have a reasonable expectation of privacy as to the agent’s observation of the defendant’s password. However, the court held that the defendant did have a reasonable expectation of privacy in the contents of the computer and the agent’s warrantless access violated the defendant’s right to be free from unreasonable search and seizure. As a result, the government could not use the evidence retrieved from the defendant’s computer. Courts have analogized a computer to a file cabinet, which contains folders, documents, and other digital files and generally have held that a warrant is necessary

135

136

CHAPTER 9  Legal

before a law enforcement search can occur. However, when a defendant voluntarily discloses information stored on his computer, there is no reasonable expectation of privacy (United States v. Gorshkov, 2001). This is consistent with a United States Supreme Court ruling that “if police observe information protected by the Fourth Amendment, they can view it again without triggering the Fourth Amendment (Kerr, 2013, p. 400, citing Illinois v. Andreas, 1983). There are circumstances where law enforcement officers may not be required to obtain a warrant before seizing and/or searching a computer. Only a few will be discussed here, since numerous exceptions to the search warrant requirement do not apply to computer search and seizure. Where exigent circumstances exist, the United States Supreme Court has held that law enforcement officers may act immediately and without a warrant to preserve evidence (Cupp v. Murphy, 1973). The Court discussed exigent circumstances in another case. In Mincey v. Arizona (1978), the Court ruled that officers must obtain a search warrant prior to searching a crime scene, unless obtaining a warrant would result in the loss, destruction, or removal of evidence. In the context of computer search and seizure, the exigent circumstance doctrine may justify seizure of a computer to avoid destruction of evidence on the computer. It may not, however, justify a warrantless search of the computer, since the computer is no longer accessible to a suspect who would destroy evidence (United States v. Bradley, 2012). Once a computer has been seized based upon exigent circumstances, officers should obtain a search warrant promptly. In one case, the Eleventh Circuit Court of Appeals held that a 21 day delay before obtaining a search warrant was unreasonable (United States v. Mitchell, 2009). If a suspect provides voluntary consent to search a computer, a search warrant is not necessary. Courts will be concerned about whether the scope of voluntary consent includes the area within the computer where incriminating evidence was found (United States v. Al-Marri, 2002). Consent may be revoked and law enforcement will be bound by that revocation. Computer searches generally occur in two phases: (1) an image, or bitstream copy of the computer is made, then (2) the image is examined to determine whether there is evidence stored on the computer. Once the image has been created, it belongs to law enforcement. So, even if a computer must be returned to a suspect because consent has been revoked, the image can still be examined by a digital forensics expert, assuming a search warrant has been obtained (Kerr, 2013). It is possible to obtain consent to search from a third party, that is, someone other than the suspect who has authority over the property to be searched (United States v. Matlock, 1974). Third-party consent is most often obtained from a spouse, partner, or parent of a minor child (LaFave et al., 2009). When information or data have been shared by its owner with a third party, there is no longer a reasonable expectation of privacy. If the third party turns the same information over to law enforcement officials, there is no Fourth Amendment violation. However, it cannot exceed the scope of the original information by asking the third party to conduct any additional search without invoking Fourth Amendment protections (United States v. Jacobsen, 1984). Information openly

Search warrants

shared with the public via social media or otherwise has no Fourth Amendment protection (del Carmen, 2014). Individuals crossing an international border are subject to special rules that allow law enforcement agents to search their belongings without probable cause (United States v. Flores-Montano, 2004). Because computers have large capacity to carry significant amounts of data, the Ninth Circuit Court of Appeals has acknowledged that a forensic examination of a computer being carried across the Mexico–United States border is more intrusive than other searches. The court held, therefore, that a forensic examination of a computer crossing an international border must be supported by reasonable suspicion, a standard that is lower than the probable cause requirement for search warrants (United States v. Cotterman, 2013). The United States Supreme Court has held that probationers and parolees do not have a reasonable expectation of privacy. The Second Circuit Court of Appeals has held that it is permissible for a court to make a defendant submit to computer monitoring as a condition of probation (United States v. Lifshitz, 2004).

SEARCH WARRANTS The Fourth Amendment requires that search warrants be based upon probable cause and that search warrants particularly describe the evidence being sought and the premises to be searched. In general, applications for search warrants in digital data cases are very specific and longer than other search warrant applications (United States Department of Justice, 2009). Law in this area is far from settled. Courts have wrestled with questions of how much explanation is necessary to justify a computer search and how much specificity is required to authorize searching a computer once a search warrant has been obtained. Probable cause to search a computer is established when there is reason to believe that a suspect is in possession of incriminating evidence that can be found on a computer and that the computer is likely to be found in a particular location (United States Department of Justice, 2009). Computer search warrants authorize law enforcement officials to seize a computer and search it offsite (United States v. Schandl, 1991). When a search warrant authorized police to search for records or documents, the search warrant will generally cover seizure of a computer from the location of the search (People v. Gall, 2001). Once the computer has been seized, it is advisable to obtain a separate search warrant authorizing search of the computer. It is good practice for a computer search warrant to specify not only computers, but other storage media that might contain evidence (United States Department of Justice, 2009). A search warrant authorizing the search of a computer generally authorizes law enforcement officials to search all of the data on the computer, since evidence can be stored anywhere on a computer (United States v. Williams, 2010). The rapidly increasing capacity of personal computers and privacy or confidentiality of data have called into question whether restrictions should be placed on how extensive

137

138

CHAPTER 9  Legal

a computer search can be. Possible accommodation of these concerns includes ex ante restrictions placed by the issuing judge on the search or appointment of special master to review evidence prior to its release to law enforcement for use in criminal cases (Kerr, 2013). Search warrants must be executed promptly, usually within 10 days of issuance (Fed. R. Crim. Pro. 41). This requirement applies to seizure of the computer, not the physical search of computer data.

FEDERAL PRIVACY LEGISLATION There are three major pieces of federal legislation that apply to privacy. Each was ­enacted to supplement Fourth Amendment protections for electronic communications (Kerr, 2013). They are briefly described below. The Wiretap Act (2015), also known as Title III, prohibits the government and private individuals from intercepting the content of electronic communications (“content information”), including telephone calls and computer transmissions, in real time without a search warrant (18 U.S.C. §§ 2510-202). Search warrants under the Wiretap Act require more protections than the Fourth Amendment. They are often referred to as “super warrants” (Kerr, 2013). The Pen Register Statute (2015) regulates government access to pen register, or trap and trace devices (18 U.S.C. §§ 3121–3127). Pen registers recover in real time the phone number being dialed from a particular telephone or the email address to which emails are sent from a particular account (“noncontent information”). Under the statute, installing such a device requires a court order. Court orders are easier to obtain under the Pen Register Statute than under the Fourth Amendment or the Wiretap Act. To obtain a court order, the statute requires that the attorney general certify “that the information likely to be obtained is relevant to an ongoing criminal investigation being conducted” by a federal law enforcement agency. The Electronic Communications Privacy Act (2015) also referred to as the Stored Communications Act, governs access to electronically stored records (18 U.S.C. §§ 2701-2011). It regulates the ability of law enforcement officials to obtain content and noncontent information from Internet Service Providers. Depending upon the type of information sought, law enforcement officials may need a subpoena, a court order, or a search warrant.

DRONES Perhaps the most powerful technology available for tracking vehicles and individuals are unmanned aerial vehicles (UAVs), also referred to as drones. Drones are aircrafts that do not carry human operators. They are controlled either remotely or autonomously, based upon a preprogrammed flight path. They are small and large. They can be equipped with high-powered cameras, thermal scanners, license plate readers,

Drones

moving target indicators, laser radar (LADAR), light detection and ranging (LIDAR), and facial recognition software (Ahu, 2015). The use of surveillance drones by law enforcement has been analyzed by legal scholars (Ahu, 2015; Galizio, 2014; Koerner, 2015; McNeal, 2014; Morrison, 2015; Olivito, 2013; Thompson, 2013). However, few cases exist that have reviewed the use of drones by law enforcement. The FAA Modernization and Reform Act, enacted in 2012, is the first federal legislation to address drones. The Act calls for the Federal Aviation Agency (FAA) to integrate drones into the national airspace system by 2015. The Act also calls for the FAA to issue guidance regarding the operation of public drones to expedite the issuance of a certificate of authorization process. There is currently no federal legislation restricting law enforcement use of drones. A few states have enacted legislation restricting the law enforcement use of drones for surveillance. These statutes may require a search warrant based upon probable cause before a drone may be used to gather information as part of a criminal investigation. These statutes generally have exceptions to the warrant requirement that includes emergent circumstances (Ahu, 2015). The first known case where an arrest was assisted by drone surveillance is North Dakota v. Brossart (2012). In Brossart, the defendant, a farmer and landowner, found three cow–calf pairs loose on or near his property. When Brossart refused to return the cattle to the owner, the owner reported the matter to local law enforcement. Brossart was arrested. During the investigation, local law enforcement used a Border Patrol drone for warrantless surveillance of Brossart’s property. Photographic evidence from the drone was tendered by the State in Court against Brossart and other members of his family who had been arrested. State District Court Judge Joel Medd ruled the evidence was admissible and that “[t]here was no improper use of an unmanned aerial vehicle” (North Dakota v. Brossart, 2012). Brossart was convicted of preventing arrest, failing to comply with the estray law, and terrorizing. The North Dakota Supreme Court reversed the terrorizing conviction. The Court did not address the lower court’s finding with regard to the drone (North Dakota v. Brossart, 2015). In another case, an appellate court in New Mexico signaled its concerns about the use of drones for domestic surveillance. In New Mexico v. Davis (2014), the New Mexico State Police and the New Mexico National Guard implemented “Operation Yerba Buena” to find marijuana in Taos County, New Mexico. As part of the operation, a spotter helicopter alerted a ground team to investigate the defendant’s back yard, where officers found marijuana plants. The defendant was arrested and entered a conditional guilty plea to possession of marijuana, reserving the right to appeal the ruling of the trial court that the warrantless helicopter observation that led to his arrest was constitutional. The New Mexico Court of Appeals held that the New Mexico Constitution provided greater protection than the Fourth Amendment of the United States Constitution with respect to drone surveillance of a person’s home. At least one factor in the Court’s consideration was the likelihood that “ultra-quiet drones will soon be used … for domestic surveillance” (New Mexico v. Davis, 2014, p. 961). At least one scholar has suggested that the warrantless use of drones to gather information about the inside of a home is likely unconstitutional. However, if drones

139

140

CHAPTER 9  Legal

become so much a part of everyday life, it is possible that the warrantless use of drones by law enforcement to obtain information from inside a private residence would not violate an expectation of privacy (Ahu, 2015). The context of drone surveillance, the sophistication of the technology employed by law enforcement, and the duration of the surveillance are all significant factors in determining the constitutionality of drone surveillance in an individual case (Thompson, 2013).

TRACKING VEHICLES Use of technology to track vehicles is not new. In two cases that involve beepers attached to vehicles for the purpose of tracking the vehicle, the Court distinguished between tracking on public roads and tracking in private homes. In United States v. Knotts (1983), the Court held that vehicles may be constitutionally tracked while on public roads, due to the diminished expectation of privacy. The following year, the Court supplemented its ruling in Knotts from a case involving surveillance of a vehicle inside a private home. The Court held that such warrantless tracking violated the Fourth Amendment prohibition against unreasonable search and seizure (United States v. Karo, 1984). The Court has held that the warrantless use of a thermal scanner to determine whether marijuana was growing in a private residence was unconstitutional (United States v. Kyllo, 2001). In 2012, a unanimous Supreme Court held that police must obtain a search warrant before using a GPS device to track the movements of a car on public streets. The United States Supreme Court case of United States v. Jones left a significant question in its wake; however, that has not been resolved. In Jones, law enforcement officers obtained a search warrant to install a GPS tracking device on a car that belonged to Jones’s wife. After the search warrant had expired and outside the jurisdiction of the Court that issued the search warrant, officers attached the GPS tracking device to the car and tracked the car’s movements for 28 days. Based in part on evidence obtained from tracking the car, Jones was convicted of drug trafficking and conspiracy. Jones appealed based upon the warrantless tracking of the car (United States v. Jones, 2012). The majority of the justices held that installing a GPS unit on a car without a search warrant constituted a physical trespass, in violation of the Fourth Amendment. According to the majority opinion, authored by Justice Scalia, when the government placed the GPS unit on the suspect’s vehicle, it “physically occupied private property for the purpose of obtaining information” (United States v. Jones, 2012, p. 947). This constituted a search under the Fourth Amendment. Thus, a search warrant was required to authorize placement and use of the GPS unit. The Court expressly left open the question of whether acquiring vehicle location through electronic means would require a search warrant. The question left open in Jones is whether police would need a warrant to track cell phones (United States v. Jones, 2012). Justice Sotomayor’s concurring opinion observed that the technology used by law enforcement in the Jones case will be duplicated and enhanced, permitting extensive

Automated license plate readers

and inexpensive government monitoring of individuals. She suggested that such technology may require the Court to restructure the Katz reasonable expectation of privacy test to reflect societal concepts of privacy. The Jones decision would not apply to stolen vehicle recovery systems in many vehicles that allow law enforcement officers to track a vehicle, with the owner’s consent, if the vehicle is stolen. Theft recovery systems are available for other devices, including computers.

TRACKING CELL PHONES International Mobile Subscriber Identity (IMSI) catchers allow law enforcement to track the locations of cell phones (Van Brocklin, 2014). These devices impersonate a cell phone tower to allow law enforcement to intercept cell phone data, not including cell phone conversation content, without the knowledge of the cell phone user (Hansen, 2015). The most common trade name for these devices is “Stingray.” These devices permit law enforcement to locate a phone electronically, without the necessity of attaching a GPS unit or other equipment to the phone. At least 35 police departments own Stingray devices, but it is not clear how the devices are being used (Hansen, 2015). Case law on the warrantless use of these devices is limited. At least one court has approved the warrantless use of a Stingray (Wisconsin v. Tate, 2014); however, the United States Department of Justice has recently adopted guidelines that prohibit the warrantless use of a Stingray unless exigent circumstances exist. The position of the Department of Justice is not binding on state or local governments (Neil, 2015).

AUTOMATED LICENSE PLATE READERS Vehicles can also be tracked using automated license plate readers (LPRs). LPRs include high-powered video cameras and software. LPRs can capture images of and read license plates, and then determine where a vehicle has been stolen (Li, 2014). Digital images from LPRs include information about the vehicle’s make and model, driver and passenger(s), distinguishing features, and registration status (United States v. White, 2013). LRPs can also be used to track the location of a vehicle on public roads. A significant number of law enforcement agencies use LPR technology (Gierlack et al., 2014). One court found at a suppression hearing that “the technology utilized by the license [plate] reader is verifiable and acceptable technology” (United States v. White, 2012, p. 169). Several courts have examined cases where LPR technology provided the basis for a traffic stop, with apparent approval of LPR use (United States v. SegoviaAyala, 2015; New York v. Davila, 2010). One such case occurred in Georgia, when a police officer initiated a vehicle stop after the officer’s LPR indicated that the vehicle was known to have been driven by Enrique Sanchez, for whom there was an

141

142

CHAPTER 9  Legal

outstanding arrest warrant. The driver of the vehicle was Sanchez’s mother. The officer subsequently found marijuana in the vehicle and charged the driver with possession with the intent to distribute. On appeal, the Georgia Supreme Court upheld the stop, based on the LPR data, was reasonable and denied the motion by the defendant to suppress the evidence found in the vehicle (Rodriguez v. Georgia, 2014).

CELL PHONES The United States Supreme Court decided two cases in 2014 addressing the search of cell phones. In the cases, which were consolidated for review, the Court concluded that generally police may not search the contents of a cell phone without a search warrant. In Riley v. California (2014), the United States Supreme Court specifically held that a search warrant is required before the police may search digital information on a cell phone that has been seized from an individual at the time of arrest. Police in the Riley case had seized the defendant’s smartphone at the time he was arrested for possession of concealed and loaded firearms. The phone was searched for 2 h later, at the police station. That search led to Riley’s arrest for attempted murder and other charges. Riley was subsequently convicted based, in part, on evidence seized from the smartphone. In the companion case to Riley, United States v. Wurie (2014), a police officer on patrol observed the defendant make an apparent drug sale from a car. The defendant was subsequently arrested. At the police station, officers seized two cell phones from the defendant. On the basis of information received from one of the seized cell phones, police investigated and obtained a search warrant for the defendant’s home, where they seized 215 g of crack cocaine, and other evidence. Wurie was convicted of possession with the intent to distribute crack cocaine, distribution of crack cocaine, and being a felon in possession of a firearm and ammunition. In deciding the cases, the Court interpreted and applied the Fourth Amendment to the phone searches under the search incident to a lawful arrest doctrine (Chimel v. California, 1969), which provides that police are entitled to search the person of an individual incident to a lawful arrest to “discover and seize the fruits or evidences of crime” (Weeks v. United States, 1914, p. 392). The search incident to a lawful arrest may extend to the clothing of the arrestee and to the area in the immediately surrounding the arrestee (United States v. Robinson, 1973; Chimel v. California, 1969; Arizona v. Gant, 2009). The justification for the search incident to a lawful arrest doctrine is twofold: officer safety and the preservation of evidence. In Riley, the Court noted that both smartphones and flip phones are based on technology that was not conceivable when many Fourth Amendment cases were decided. According to the Court, neither the risk of harm to officers nor destruction of evidence applies to the vast amounts of digital data contained in cell phones. The Court noted that digital data cannot be used as a weapon against an arresting officer. Further, according to the Court, officers may examine the physical aspects of

Encryption

a cell phone at the time of arrest for any danger it may present. However, according to the Court, once the potential physical threat of the cell phone has been eliminated, data cannot endanger the officer or anyone else (Riley v. California, 2014). With regard to preventing the destruction of evidence, the Court considered the possibility of remote wiping and encryption of digital data. The Court noted that the danger of remote wiping can be eliminated by disconnecting a cell phone from the network by turning the phone off or removing the cell phone’s battery. If officers are concerned about encryption, the Court noted that officers can leave the cell phone on and store it in a Faraday bag, designed to prevent external signals from reaching the cell phone. The Court acknowledge that there may be situations in which emergent circumstances require officers to obtain information from a cell phone, and stated that officers may be justified under the exigent circumstances doctrine in searching the phone immediately at the scene of an arrest (United States v. Riley, 2014). According to the Court, arrestees have diminished privacy, but they do not sacrifice all of the protection afforded by the Fourth Amendment. The “immense storage capacity” of cell phones permits a search through volumes of information not typically available by searching physical items possessed by an arrestee (United States v. Riley, 2014, p. 17). In addition, cell phone searches often extend beyond the data stored on the cell phone to data not stored on the device itself, such as cloud data. So, cell phone searches are far more extensive than a physical search of the arrestee and physical items found on the arrestee at the time of the search (United States v. Riley, 2014). The Court held that “officers must generally secure a warrant before conducting” a cell phone search (United States v. Riley, 2014, p. 10). The Court acknowledged that its holding would affect the ability of law enforcement to address crime. However, because the quantity and quality of evidence available through the search of a cell phone so far exceeds the traditional boundaries of a search incident to a lawful arrest, the Court required a search warrant prior to a content of a cell phone in the absence of exigent circumstances.

ENCRYPTION Encryption encodes electronic information in such a way that users who do not have a password cannot access the information. Powerful encryption software is readily available over the Internet (Atwood, 2015). Encryption has the potential to protect data relevant to criminal investigations from the reach of law enforcement. Without a password, forensic examiners may not be able to decrypt data that has been encrypted. Court orders directing a suspect to hand over a password or to access the data without surrendering a password are not always effective. Suspects may elect to risk contempt sanctions rather than surrender incriminating evidence (Larkin, 2012). In some cases, it is possible to obtain a court order directing a suspect to decrypt electronic files. The key factor is whether law enforcement can establish its knowledge that incriminating evidence exists on the computer to be searched. Under the

143

144

CHAPTER 9  Legal

“foregone conclusion” doctrine, when law enforcement is aware of the existence and location of documents (i.e., when the existence and location of the documents are a “foregone conclusion”), a defendant can be compelled to disclose the data (United States v. Fisher, 1976; Atwood, 2015). The Court distinguished between compelling a suspect to hand over documents about which the government is aware from compelling a suspect to testify about the contents of the documents (United States v. Fisher, 1976). When the government cannot describe the documents sought with “reasonable particularity,” the United States Supreme Court has held that the government cannot use compel a suspect to produce documents (United States v. Doe, 1984; United States v. Hubbell, 2000, p. 30). In at least one case, this principle has been held to apply to digital data (United States v. Kirschner, 2010). In 2012, the Tenth Circuit Court of Appeals let stand a ruling from the District Court for the District of Colorado that required the defendant to produce the unencrypted contents of her laptop computer United States v. Fricosu, 2012). In this case, law enforcement had intercepted a telephone conversation between the suspect and her fiancé, who was incarcerated. In the conversation, the suspect referred to incriminating documents located in an encrypted portion of the hard drive of one of her computers. The government sought a search warrant to search the laptop computers, which the government had already seized legally, and a court order that the suspect produce the unencrypted contents of the seized computers. The District Court granted the government’s request, finding that the government already knew of the existence of incriminating documents located on the suspect’s computer. Therefore, compelling the suspect to decrypt the data did not compel the suspect to reveal whether the documents existed, only to provide the documents. The Court reasoned that this requirement did not violate the Fifth Amendment. The Tenth Circuit refused the suspect’s appeal (United States v. Fricosu, 2012). In another 2012 case, the Eleventh Circuit Court of Appeals reversed a District Court contempt of court conviction after a suspect refused the Court’s order to produce decrypted hard drives before the grand jury. In that case, the government sought to search the hard drives from the suspect’s two laptop computers and five external hard drives, which had been lawfully seized pursuant to a search warrant following an investigation into child pornography. The computers and external hard drives were protected with a commercial encryption program. A grand jury issued a subpoena for the defendant to appear and produce the decrypted hard drives. A forensic expert testified that it was possible the hard drives in question contained no data. The District Court held the suspect in contempt of court and he was incarcerated (In re: Grand Jury Subpoena Duces Tecum Dated March 25, 2011, 2012). On appeal, the Eleventh Circuit held that requiring the suspect to decrypt and product the contents of the hard drives triggered Fifth Amendment protection against selfincrimination. The Court reasoned that, because the government did not know that ­incriminating evidence existed on any of the hard drives, compelling a suspect to d­ ecrypt the hard drives violated his Constitutional right to be free from self-­incrimination (In re: Grand Jury Subpoena Duces Tecum Dated March 25, 2011, 2012). There are options available to law enforcement to obtain password information outside the Court system. First, law enforcement officers who seize computers should include passwords as items to be seized in search warrants and should be alert

Encryption and cell phones

for passwords recorded near a computer subject to seizure. In addition, investigating officers can ask suspects for their password.

ENCRYPTION AND CELL PHONES Scholars are attempting to resolve privacy issues related to the competing interests of the public to privacy and the interests of law enforcement in furthering criminal ­investigations. There is not yet consensus about where the line should be drawn (Kerr, 2014a; Kerr, 2014b; Kerr, 2014c). The decision by Apple and Google to encrypt smartphone data from law ­enforcement inspection impedes criminal investigations (Vance, 2015). According to Apple’s website, iPhones using iOS 8.0 or later versions will be protected by a password, “which Apple does not possess” (Apple Government Information Requests, 2015). Other mobile devices by Apple, such as iPads and iPods, are included in this policy. So, even with a search warrant, law enforcement officers will not be able to extract data from iDevices directly (in law enforcement laboratories) or indirectly (from Apple, following a search warrant). The consequence to law enforcement is the loss of significant and relevant information in criminal investigations (Vance, 2015). One important distinction is that between an iPhone device and the iCloud. ­Apple’s new policy does not alter the ability of law enforcement officials to obtain user data from an iCloud account by serving a search warrant on Apple. However, there are limitations as to the amount of data available in iCloud accounts. In most cases, an iCloud account will not contain all of an iPhone’s data. First, an iPhone is not connected to WiFi, it cannot store to the iCloud, so the most recent activity on an iPhone may not be stored in an iCloud account. Second, iPhone users are not required to obtain and use iCloud accounts. Finally, iCloud offers five gigabytes of free storage space, compared with storage space on an iPhone, typically 16, 64, or 128 gigabytes. One final problem is that, while deleted data from an iPhone may be recoverable, deleted data from an iCloud account is not recoverable (Apple Legal Process Guidelines, 2015). There is no United States Supreme Court ruling on the matter, but it appears that there may be no viable legal way to compel a suspect to provide his or her password for an iPhone (Atwood, 2015). Case law provides that a suspect cannot be compelled to provide his or her password to law enforcement when disclosure would violate the suspect’s right to be free from self-incrimination (U.S. Constitution, Amendment V; In re Grand Jury Subpoena Duces Tecum, 2012). Courts have held that defendants may be required to decrypt their computers password (In re Grand Jury Subpoena to Sebastien Boucher, 2009; In re The Decryption of a Seized Data Storage System, 2013; Massachusetts v. Gelfgatt, 2014). Using the same arguments the government used in computer cases, it may be possible to obtain a court order that would compel a suspect to unlock his or her iPhone. However, if there is incriminating evidence on an iPhone, the suspect/owner may elect to face contempt of court charges for failing to comply with the court order to unlock the phone for law enforcement rather than complying with the court order.

145

146

CHAPTER 9  Legal

THE INTERNET OF THINGS The Internet of Things refers to ubiquitous presence of electronic sensors in devices such as smartphones, vehicles, household appliances, home security systems, healthcare devices, and fitness monitors. These sensor-based devices generate detailed information about individuals engaged in everyday activities (Peppet, 2014). As with all things digital, these devices have legitimate applications and they are subject to security breaches. The possible loss of privacy through breach of these systems is substantial. Computer scientists have examined the concept of “sensor fusion,” the combination of data from multiple sources enabling a comprehensive description of individuals far beyond what could be constructed by looking at separate sources of information (Peppet, 2014). Regulation of the Internet of Things will likely focus on privacy rights of individuals (Weber, 2015; Peppet, 2014).

THE DARK WEB The Deep Web is that portion of the Internet not accessed by conventional search engines, such as Google and Bing, which may only access less than 20% of information available on the Internet. The Dark Web is that part of the Internet intentionally hidden from conventional search engines because it is used for criminal purposes, including the sale of illegal drugs and child pornography. Dark Web sites also offer such services as murder for hire, terrorism, and money laundering. The primary currency in Dark Web sales is Bitcoins, an online currency unregulated by a bank or other authority (Alhogbani, 2014). Bitcoin is designed to provide anonymity to its user. Some Dark Web sites employ the Onion Router (“Tor”), a project developed by the United States Navy as a means of providing secure government communications. The name refers to the layers a user may go through to disguise the user’s identify (NPR, 2014). Tor is complex software that it is very difficult to track web-based communications. It has become freely available to users, some of whom use the program to avoid network surveillance. One example of a Dark Web site is the Silk Road. The Silk Road was launched in February, 2011 as a Tor-hidden service that supplied illegal drugs, including heroin, cocaine, and LSD, to its customers. Silk Road was developed and run by Ross William Ulbricht, also known as “Dred Pirate Roberts,” or “DPR.” (Weiser, 2015). Silk Road has been described as the “eBay of illicit drugs” (Martin, 2014). Silk Road involved several thousand seller accounts and more than 100,000 buyer accounts, generating over 1.5 million transactions. Evidence at Ulbricht’s trial indicated that Silk Road had generated more than $213 million in revenues between January, 2011 and October, 2013, when Ulbricht was arrested by the FBI (Weiser, 2015). Prosecutors in Ulbricht’s trial were able to trace millions of dollars in Bitcoin payments from Silk Road back to Ulbricht’s computer (Bitcoin fallacy, 2015). In February, 2015, Ulbricht, who was 31 years old at the time, was convicted of seven counts, including distribution of narcotics on the Internet and engaging in a

References

continuing criminal enterprise (Weiser, 2015). In May, 2015, Ulbricht was sentenced to life in prison without the possibility of parole and ordered to forfeit $183 million. Ulbricht’s conviction is currently being appealed.

MALWARE Businesses have experienced a form of malware called “ransomware.” In these cases, malicious code prevents access to computer data and criminals demand ransom to free the data. Approximately 30% of ransomware victims pay to regain their data. Small and medium-sized business are more likely to fall victim to this form of attach because they are less likely to use email security (Simon, 2015).

LOOKING AHEAD Given the ubiquitous nature of technology, it is likely regulation will increase. If history is any indicator, technology will advance at a rate far faster than legislative bodies or courts can keep up. New legislation would be expected to address privacy concerns and attempt to preserve individual privacy from interception by government agencies and private entities. The private sector will respond with the production of alternatives designed to protect individuals’ privacy. As with the Apple policy, this private action to protect privacy will make the job of law enforcement more difficult. Developers of privacy technology may become reluctant witnesses in criminal prosecutions. It is reasonable to predict that law enforcement agencies will continue to employ technology in investigations. And, defendants will continue to challenge the use of technology by law enforcement on Fourth Amendment grounds. Courts will continue to apply the law to new questions prompted by advances in technology. The larger issue legally may arise in the Constitutional concept of a reasonable expectation of privacy. It is possible the United States Supreme Court will be forced to reconsider the Katz test and redefine what is covered by the Fourth Amendment, and how that protection will be enforced. The questions will focus on the need for balance between the need for information to address crime and the need for privacy. These questions will not be easily resolved.

REFERENCES Ahu, T. M. (2015, Winter). Drone regulations and the Fourth Amendment rights: the interaction of state drone statutes and the reasonable expectation of privacy. 48 Colum. J. L. & Soc. Probs., 265. Alhogbani, A. (2014). Going dark: Scratching the surface of government surveillance. 23 CommLaw Conspectus 469. Apple Legal Process Guidelines (2015). https://www.apple.com/privacy/docs/legal-processguidelines-us.pdf, p. 9.

147

148

CHAPTER 9  Legal

Apple Government Information Requests (2015). https://www.apple.com/privacy/governmentinformation-requests/ Arizona v. Gant, 556 U.S. 332 (2009). Atwood, J. R. (2015). The encryption problem: Why the courts and technology are creating a mess for law enforcement. 34 St. Louis U. Pub. L. Rev, 407. Bitcoin fallacy led to Silk Road founder’s conviction. (2015, Feb. 5). CNN. http://money.cnn. com/2015/02/05/technology/security/bitcoin-silk-road/ California v. Ciraolo, 476 U.S. 207 (1986). Chimel v. California, 395 U.S. 752 (1969). Cupp v. Murphy, 412 U.S. 291 (1973). del Carmen, R. V. (2014). Criminal procedure: law and practice (9th ed). Belmont, CA: Wadsworth. Dow Chemical Co. v. United States, 476 U.S. 227 (1986). Electronic Communications Privacy Act, 2015, 18 U.S.C. §§ 2701-2011. FAA Modernization and Reform Act, 49 U.S.C. §§331–335 (2012). Fed. R. Crim. Pro. 41. Florida v. Jardines, 569 U.S. 1 (2013). Florida v. Riley, 488 U.S. 455 (1989). Galizio, G. J. (2014). A digital albatross: Navigating the legal framework of domestic police drone technology versus privacy rights in Massachusetts and beyond. 20 Suffolk J. Trial & App. Adv., 117. Gierlack, K., Williams, S., LaTourrette, T., Anderson, J. M., Mayer, L. A., & Zmud, J. (2014). ­License plate readers for law enforcement: Opportunities and Obstacles. RAND Corporation. http://www.rand.org/content/dam/rand/pubs/research_reports/RR400/RR467/RAND _RR467.pdf. Hansen, M. (2015, Aug. 24). Police increasingly using stingray cell phone tracking technology to solve routine crimes. ABA Journal Tech Monthly. http://www.abajournal.com/news/ article/police_increasingly_using_stingray_cellphone_tracking_technology_to_solve_r/ Illinois v. Andreas, 463 U.S. 765. (1983). In re Grand Jury Subpoena Duces Tecum Dated March 25, 2011, 670 F.3d 1335. (11th Cir. 2012). In re Grand Jury Subpoena to Sebastien Boucher, 2009 U.S. Dist. LEXIS 13006 (D. Vt. Feb. 19, 2009). In re The Decryption of a Seized Data Storage System, Order Granting Ex Parte Request for Reconsideration of the United State’s Application Under the All Writs Act, No. 13-M-449 (E.D. Wisc. May 21, 2013). Katz v. United States, 389 U.S. 347 (1967). Kerr, O. S. (2013). Computer crime law (3d ed). St. Paul, MN: West Publishing. Kerr, O. (2014a, Sept. 19). Apple’s Dangerous Game, The Volokh Conspiracy https://www. washingtonpost.com/news/volokh-conspiracy/wp/2014/09/19/apples-dangerous-game/ Kerr, O. (2014b, Sept. 22), Apple’s Dangerous Game, part 2 The Strongest Counterargument, The Volokh Conspiracy https://www.washingtonpost.com/news/volokh-conspiracy/ wp/2014/09/22/apples-dangerous-game-part-2-the-strongest-counterargument/ Kerr, O. (2014c, Sept. 22) Apple’s Dangerous Game, part 3 Where do you draw the line, and what’s the privacy tradeoff? https://www.washingtonpost.com/news/volokh-conspiracy/ wp/2014/09/22/apples-dangerous-game-part-3-where-do-you-draw-the-line-and-whats -the-privacy-tradeoff/ Koerner, M. R. (2015). Drones and the Fourth Amendment: Redefining expectations of privacy. 64 Duke L.J. 1129.

References

LaFave, W. R., Israel, J. H., King, N. J., & Kerr, O. S. (2009). Principles of criminal procedure: Investigation (2d ed). St. Paul, MN: West Publishing. Larkin, J. E. D. (2012). Compelled Production of Encrypted Data, 14 Vand. J. Ent. & Tech. L., 253. Li, V. (2014, Oct). Law enforcement’s latest highway tech speeds up info-gathering, but critics say it violates privacy. 100 ABA Journal, 1. Mapp v. Ohio, 367 U.S. 643 (1961). Martin, J. (2014). Lost on the Silk Road: Online drug distribution and the ‘cryptomarket.’ 14 Criminology & Criminal Justice, 3, 351–367. Massachusetts v. Gelfgatt, 11 N.E. 3d 605 (MA, 2014). McNeal, G. (2014, November). Drones and aerial surveillance: Considerations for legislators. Center for Technology Innovation at Brookings. Mincey v. Arizona, 437 U.S. 385 (1978). Morrison, C. M. (2015). Note and Comment: Dr. Panopticon, or, how I learned to stop worrying and love the drone. 27 J. Civ. Rts. & Econ. Dev., 747. Neil, M. (2015, Sept. 4). DOJ says using stingrays to intercept cellphone calls requires warrant, unless exception applies. ABA Journal Tech Monthly, http://www.abajournal.com/ news/article/doj_says_warrant_needed_to_use_stingrays_to_intercept_cellphone_calls_ unles/?utm_source=maestro&utm_medium=email&utm_campaign=tech_monthly. New Mexico v. Davis, 321 P.3d 955 (2014). New York v. Davila, 27 Misc.3d 921; 901 N.Y.S.2d 787 (2010). North Dakota v. Brossart, 32-2011-CR-00049, 00071 (Nelson County, N.D., August 1, 2012). https://www.nacdl.org/uploadedFiles/files/news_and_the_champion/DDIC/Brossart%20 Order.pdf. North Dakota v. Brossart, 858 N.W. 2d 275 (2015). NPR Staff (May 25, 2014). ”Going Dark: The Internet Behind The Internet”. Retrieved 5 October 2015. Oliver v. United States, 466 U.S. 170 (1984). Olivito, J. (2013). Beyond the Fourth Amendment: Limiting drone surveillance through the Constitutional right to informational privacy. 74 Ohio St. L. J.(4), 670. Pen Register Statute, 2015 18 U.S.C. §§ 3121-3127. People v. Gall, 30 P.3d 145 (Colo. 2001) (en banc). Peppet, S. R. (2014). Regulating the Internet of Things: First steps toward managing discrimination, privacy, security, and consent. 93 Texas L. Rev., 85. Rakas v. Illinois, 439 U.S. 129 (1978). Riley v. California, 573 U.S. ___, 134 S. Ct. 2473 (2014). Robbins v. California, 453 U.S. 420 (1981). Rodriguez v. Georgia, 295 Ga. 362; 761 S.E.2d 19 (2014). Silverthorne Lumber Co. v. United States, 251 U.S. 385 (1920). Simon, R. (2015, April 16). Wall Street Journal, Eastern edition, p. B.1. Smith v. Maryland, 442 U.S. 735 (1979). Thompson, R. M., II (2013, April 3). Drones in domestic surveillance operations: Fourth Amendment implications and legislative responses. Congressional Research Service. U.S. Constitution, amendment V. United States Department of Justice (2009). Search and seizing computers and obtaining electronic evidence in criminal investigations. http://www.justice.gov/sites/default/files/ criminal-ccips/legacy/2015/01/14/ssmanual2009.pdf United States v. Al-Marri, 230 F. Supp.2d 535 (S.D.N.Y. 2002). United States v. Bradley, 488 Fed. App’x 99 (6th Cir. 2012).

149

150

CHAPTER 9  Legal

United States v. Chadwick, 433 U.S. 1 (1977). United States v. Cotterman, 709 F.3d 952 (9th Cir. 2013). United States v. David, 756 F. Supp. 1385 (D. Nev. 1991). United States v. Doe, 465 U.S. 605 (1984). United States v. Fisher, 425 U.S. 391 (1976). United States v. Flores-Montano, 541 U.S. 149 (2004). United States v. Fricosu, 841 F. Supp.2d 1232 (D. Colo. 2012); app. denied, Fricosu v. United States, 2012 U.S. App. LEXIS 3561 (10th Cir. Colo., Feb. 21, 2012). United States v. Gorshkov, 2001 U.S. Dist. LEXIS 26306.(W.D. Wash. May 23, 2001). United States v. Hubbell, 530 U.S. 27 (2000). United States v. Jacobsen, 466 U.S. 109 (1984). United States v. Jones, 565 U.S. ___, 132 S. Ct. 945 (2012). United States v. Karo, 468 U.S. 705 (1984). United States v. Kirschner, 823 F. Supp. 2d 665 (E.D. Mich. 2010). United States v. Knotts, 460 U.S. 276 276 (1983). United States v. Kyllo, 533 U.S. 27 (2001). United States v. Lifshitz, 369 F.2d 173 (2d Cir. 2004). United States v. Matlock, 415 U.S. 164 (1974). United States v. Mitchell, 565 F.3d 13247 (11th Cir. 2009). United States v. Robinson, 414 U.S. 218 (1973). United States v. Ross, 456 U.S. 798 (1982). United State v. Schandl, 947 F.2d 462 (11th Cir. 1991). United States v. Segovia-Ayala, No. 14-cf-00167(01), 2015 U.S. Dist. LEXIS 21375 (W.D. La. Jan. 23, 2015). United States v. White, 504 Fed. Appx. 168 (3d Cir. Nov. 15, 2012). United States v. White, 2013 U.S. Dist. LEXIS 155407 (E.D. Pa. Oct. 30, 2013). United States v. Williams, 592 F.3d 511 (4th Cir. 2010). United States v. Wurie, 573 U.S. __, 134 S. Ct. 2473.(2014). Van Brocklin, V. (2014, Aug. 20). Cell phone tracking by police: 2 key court decisions explained. http://www.policeone.com/legal/articles/7481685-Cell-phone-tracking-by-police-2-keycourt-decisions-explained/. Vance, Jr., C. R. “Going dark: encryption, technology, and the balance between public safety and privacy,” written testimony before the United Senate Committee on the Judiciary, Washington, DC, 7/8/2015. Weber, R. H. (2015). Internet of things: privacy issues revisited. 31 Computer Law & Security Review, 618. Weeks v. United States, 232 U.S. 383. (1914). Weiser, B. (2015, Feb. 4). Man behind Silk Road website is convicted on all counts. New York Times. Wiretap Act, 2015 18 U.S.C. §§ 2510-202. Wisconsin v. Tate, 357 Wis.2d 172; 849 N.W.21d 798. (2014).