Digital Ubiquity and the Fourth Amendment

Moreover, the increasing prevalence of cloud computing has further complicated the scope of privacy interests associated with a digital data device, as vast quantities of personal data are now accessible via remote servers often run by third-party providers. See, Com. v. Stem, 96 A.3d 407 (Pa. Super. Ct. 2014) (citing Riley to conclude a warrantless search of a cell phone was unconstitutional; later expressing qualms about the warrantless search of data located in the cloud). Data stored in the cloud can be accessed unbeknownst to the user, which creates further hurdles in an attempt to redress any invasion of privacy occurring as a result of access to the data. In the past, any remote search of a container, such as a purse, was necessarily limited to the size of the container. With respect to even the most limited digital storage devices, this is hardly so.

In light of Riley, this article focuses on how and when law enforcement can utilize the “fruits” of a warrantless search of a digital storage device. It deals specifically on how lower courts have applied Riley to other Fourth Amendment exceptions, including: the Sixth Circuit exercising a more exacting standard when construing the “private search” exception; the lessening of judicial deference to a governmental invocation of the “border search” exception; and the incorporation of the Riley holdings into a case involving the use of a bank card by an individual detained by airport security.

Effect on Other Exceptions

'Private Search' Exception

The analysis in Riley, which considerably reframed how courts must approach Fourth Amendment searches in the technological age writ large, has caused lower courts to reassess the continuing viability of other exceptions to the Fourth Amendment. For instance, in U.S. v. Lichtenberger, No. 14-3540, — F.3d —- (6th Cir. 2015), the Sixth Circuit issued an opinion in late-May of this year that attempted to interpret the “private search” exception in light of Riley.

This exception permits the government to effectuate a warrantless search of items after such item has been previously searched by a private individual. Logically, once a private search of an item has occurred, “the frustration of the original expectation of privacy” has occurred, thereby permitting the government to thereafter search the no longer private information. See, U.S. v. Jacobson, 466 U.S. 109 (1984) (origination of this doctrine). Put another way, the government may now search the item without a warrant, but the search is expressly limited in scope to the initial private search.

In Lichtenberger, the defendant's girlfriend hacked into his computer and uncovered a number of illicit images of children. She contacted the police, and thereafter, an officer saw some of that evidence, including photographs that may have not been viewed during the initial private search. Based on this, the officer obtained a warrant for the laptop and its contents, which led to the filing of child pornography charges against the defendant. Prior to trial, the defendant filed a motion to suppress the evidence derived from a search of the laptop on the grounds that the officer's search violated the Fourth Amendment. The District Court granted the motion, and declined to adopt the government's argument that the private search doctrine applied. The Sixth Circuit too rejected the government's invocation of the private search exception, and thus concluded that the officer's search, as it was broader than the initial private search, did violate the defendant's Fourth Amendment rights.

Whether the subsequent governmental search falls under the purview of the exception depends on the “virtual certainty” that this search will produce viable evidence so as to mitigate any attendant interests the defendant has in maintaining privacy in areas yet untouched. The Lichtenberger court found that the holdings in Riley regarding the unique risks associated with the search of modern electronic devices to be dispositive in concluding that the officer did not possess the requisite virtual certainty. It first noted that, as espoused in Riley, “the nature of the electronic device [insofar as it is a repository for various types of data in vast amounts that correspond to a lengthy swath of time] greatly increases the potential privacy interests at stake.” Most important though, the virtual certainty has become more exacting, as a brief search through the defendant's PC could yield not only pertinent evidence, but also evidence unrelated to the crime alleged, including the most private sorts of images, bank statements, or Internet search histories. In the instant case, there was also confusion over whether the officer viewed the same incriminating photographs that had been viewed initially by the defendant's girlfriend. Ergo, the virtual certainty of the officer was insufficient to justify the search.

'Border Search' Exception

The Riley holdings also recently prompted a federal court to reconsider the applicability of the “border search” exception. See, United States v. Kim, 1:13-cr-00100-ABJ, — F. Supp. 3d —-, 2015 WL 2148070 (D.D.C. 2015). In short, this exception permits warrantless searches at the border arising “out of the sovereign's right and need to protect its territorial integrity and national security.” U.S. v. Ramsey, 431 U.S. 606 (1977) (observing that searches at the border are reasonable simply by virtue of the fact that they occur at the border, as such place is the initial barrier designed to protect national sovereignty). In Kim, the government conducted a warrantless search of the defendant's laptop prior to his departure from the United States. The laptop was then shipped to a forensic specialist who imaged the hard drive and used specialized software and keywords to search the files therein.

After the search uncovered incriminating e-mails indicating that the defendant may have violated export control and trade embargo laws with Iran, the defendant moved to suppress this evidence on grounds that the search of the laptop ran afoul of the Fourth Amendment. The government responded by invoking its plenary authority pursuant to the border search exception to search the laptop, which it characterized as a container. The court questioned the credulousness of the government's argument. In citing to Riley, the likening of a computer to a searchable container, such as a box or luggage, was now simplistic and borderline specious. Thus, “in applying the Riley framework,” the heightened privacy interests intrinsic to laptops and other digital data service devices a fortiori outweighed the attenuated national security concerns associated with border security, even notwithstanding the court's earlier acknowledgment that the government's interest in preventing the entry of unwanted persons and effects is “at its zenith at the international border.” Kim, infra.

Such a conclusion was likely easier for the court to reach after a realization that the capacity of “even the most basic laptops” to retain files, metadata and deleted material, means that it cannot be treated like a handbag or other container simply because one can “put things in it and then carry it onto a plane.” This fundamental distinction has unmoored the traditional balance between the weighing of privacy of a suspect and the interests in effective law enforcement decidedly in favor of the former.

One caveat: The court in Kim discussed at length the absence of cognizable national security concerns, as evidenced by the absence of information that criminal activity was in progress. Specifically, the seized computer remained unopened until it was transferred 150 miles from the border, and it was retained for a limited period of time. This indicated that there was little ongoing threat to national security that would ordinarily necessitate or justify a warrantless search at the border. Thus, it remains to be seen if the border search exception would be rejected in a case in which the national security concerns elucidated by the government were both exigent and tethered to a less attenuated rationale for the de jure invasive search of a personal digital device.

'Third-Party Consent' Exception

Notwithstanding the two exceptions covered above, the Riley holdings have not heretofore disturbed the justification for and applicability of the “third-party consent” exception to the Fourth Amendment warrant requirement. This exception permits law enforcement to engage in a warrantless search of premises or effects upon consent of a third party that possesses common authority over or sufficient relationship to the effects to be searched. See, United States v. Matlock, 415 U.S. 164 (1974). A recent case in the Southern District involved the defendant averring that this exception should be reconsidered in light of an “intervening change of controlling law” resulting from the conclusions in Riley. See, U.S. v. Yudong Zhu, 41 F. Supp. 3d 341 (S.D.N.Y 2014).

In Zhu , the defendant was charged with a variety of white-collar crimes based upon evidence acquired from a warrantless search of his computer. However, this FBI search was granted by the consent of the defendant's employer, New York University. Irrespective of such consent, the defendant moved for reconsideration under Local Rule 6.3 in light of Riley. This was rejected. As the exceptions are predicated on separate justifications, it did not follow necessarily that Riley obviated the rationale behind the “third-party consent” exception, even though higher privacy interests were appurtenant to a laptop, as with a cell phone. Rather, the properly granted consent of the third-party to a warrantless search of the defendant's laptop, no matter how voluminous and illustrative the data contained therein, did not implicate the governmental interests at issue in Riley. The dispositive factor is that while one exception involves a non-consensual search, while the other does not, and therefore the latter implies a voluntary relinquishing of at least part of a privacy interest at the outset.

Put more simply, according to the Zhu court, third-party approbation of a warrantless search of a device prevails, no matter how many private texts, photos and browsing history the device may contain.

Riley and ATM Money

A federal court in Minnesota recently held that the Riley distinction in privacy interests altered the legal calculus when a government agent forces a detainee to acquire money remotely by way of a bank card she possessed at the time of detention. See, Edwards v. U.S., 57 F. Supp. 3d 938 (D. Minn. 2014). In Edwards, the plaintiff was detained at a Minneapolis airport upon arriving from Nigeria. Immigration officials then requested the plaintiff withdraw $1,200 from an ATM in order to purchase an expedited return flight to Nigeria. After the official in question was informed by airline personnel that such funds were not required to remove the plaintiff from the United States, he allegedly retained the $1,200. She also alleged that she has never recovered the funds.

Among other causes of action, the plaintiff sued for conversion. The government in turn claimed sovereign immunity under the “detention of goods” exception. See, 28 U.S.C. '2680. This exception immunizes government officials from liability for injuries resulting from negligence in handling property in their possession. See also, Kosak v. United States, 465 U.S. 848 (1984) (exception bars claims for damages resulting from the seizure and subsequent damage to petitioner's art). The circumstances surrounding the taking, rather than its permanent or temporary nature, is the sine qua non in determining whether the exception applies. Specifically, if the goods seized are part of an ongoing investigation, immunity forecloses any legally redressable objection.

The immigration official seized money from the plaintiff located not physically on her person (in her wallet or pocket, for example), but via a bank card, which was thereafter used to access the money electronically. Therefore, the acquisition of the money required a second step, as in Riley, where the phone was used as a conduit to seize electronically stored data in the device. That the money seized was not physically present on the person, but instead only an item that could be used as an instrumentality to obtain the money was present during the search, led the court to conclude that the seizure could not arise from the detention or overarching investigation so as to trigger the exception. Rather, the use of the card at the ATM was considered an independent activity subsequent to the initial detention. Ergo, the government's motion to dismiss the conversion claim was denied.

Conclusion

As Riley and its progeny epitomize, Fourth Amendment jurisprudence has been permanently altered as a result of the proliferation of data storage devices, namely smart phones and PCs. After all, some of the most forceful language from the majority opinion in Riley elucidates why a search of a purse versus an examination of a hard drive is an irreconcilable dissimilarity. The implications for privacy interests and law enforcement prerogatives are now continuously subject to rapid revision. Some exceptions to the Fourth Amendment warrant requirement remain unchecked, while others appear anachronistic. The exceptions contingent on the consent or prior search of a device remain largely intact, as whether by choice or not, one's privacy interests in personal information, no matter how damning or testimonial, is diminished once it has been divulged to someone other than law enforcement. However, even when such interest is weakened, the breadth and depth of information that can be gleaned from a cursory glance at contacts, messages, files, and metadata, even during an ostensibly targeted search as in Lichtenberger, warrants a reassessment of law enforcement rights to this information, even after it is no longer technically private.

What is most apparent is that privacy interests associated with these devices have been reappraised, and subsequently heightened. As the Chief Justice opined in Riley, modern cell phones are hardly “just another technological convenience,” and in fact could contain and reveal “the privacies of life.” Accordingly, such gateways to the most intimate components of one's life must be evaluated with a greater emphasis on retaining that privacy, even at the expense of the ability of law enforcement to combat crime. Precisely how much such ability will be constricted remains largely uncertain, but the trend heretofore has favored the accused, even in milieus in which governmental interests are reiterated to be at their apogee.

Richard Raysman is a Partner at Holland & Knight. Peter Brown is the principal at Peter Brown & Associates and a member of this newsletter's Board of Editors. They are co-authors of Computer Law: Drafting and Negotiating Forms and Agreements (Law Journal Press).

Pick up pretty much any 21st century smart phone, tablet or PC, and in minutes, a treasure trove of information about its owner can be uncovered. Missives to a significant other, photos from summer vacation, browsing history that spans years; all of this information, generally considered of the most intimate nature, is easily accessible with even a rudimentary technical knowledge of the device's operating system. Needless to say, unwanted disclosure of such information can be highly damaging.

Perhaps in no situation can such disclosure be as injurious as when the recipient of the information is a representative of law enforcement. Given the protection from an unreasonable search and seizure enumerated in our constitution that give ballast to notions of privacy and autonomy, questions have arisen as to when a law enforcement search can square with these rights, particularly when it is effectuated without the imprimatur of a warrant. That the aforementioned devices now function as virtual warehouses of information has exacerbated the tension between effective policing and privacy rights deemed inseparable from the notion of ordered liberty.

The Supreme Court confronted this tension in its previous term, and came down decidedly in favor of the privacy interests in Riley v. California, 134 S. Ct. 2473 (2014). Chief Justice John Roberts, in writing for a unanimous court, held that because “cell phones differ in both a quantitative and qualitative sense from other objects” kept on an arrestee's person, greater privacy interests are potentially impinged by the search of a cell phone. Accordingly, Fourth Amendment analysis must be sculpted in a way so as to recognize that a search incident to an arrest can now reveal exponentially more personal, and often incriminating, information.

Moreover, the increasing prevalence of cloud computing has further complicated the scope of privacy interests associated with a digital data device, as vast quantities of personal data are now accessible via remote servers often run by third-party providers. See, Com. v. Stem, 96 A.3d 407 (Pa. Super. Ct. 2014) (citing Riley to conclude a warrantless search of a cell phone was unconstitutional; later expressing qualms about the warrantless search of data located in the cloud). Data stored in the cloud can be accessed unbeknownst to the user, which creates further hurdles in an attempt to redress any invasion of privacy occurring as a result of access to the data. In the past, any remote search of a container, such as a purse, was necessarily limited to the size of the container. With respect to even the most limited digital storage devices, this is hardly so.

In light of Riley, this article focuses on how and when law enforcement can utilize the “fruits” of a warrantless search of a digital storage device. It deals specifically on how lower courts have applied Riley to other Fourth Amendment exceptions, including: the Sixth Circuit exercising a more exacting standard when construing the “private search” exception; the lessening of judicial deference to a governmental invocation of the “border search” exception; and the incorporation of the Riley holdings into a case involving the use of a bank card by an individual detained by airport security.

Effect on Other Exceptions

'Private Search' Exception

The analysis in Riley, which considerably reframed how courts must approach Fourth Amendment searches in the technological age writ large, has caused lower courts to reassess the continuing viability of other exceptions to the Fourth Amendment. For instance, in U.S. v. Lichtenberger, No. 14-3540, — F.3d —- (6th Cir. 2015), the Sixth Circuit issued an opinion in late-May of this year that attempted to interpret the “private search” exception in light of Riley.

This exception permits the government to effectuate a warrantless search of items after such item has been previously searched by a private individual. Logically, once a private search of an item has occurred, “the frustration of the original expectation of privacy” has occurred, thereby permitting the government to thereafter search the no longer private information. See, U.S. v. Jacobson, 466 U.S. 109 (1984) (origination of this doctrine). Put another way, the government may now search the item without a warrant, but the search is expressly limited in scope to the initial private search.

In Lichtenberger, the defendant's girlfriend hacked into his computer and uncovered a number of illicit images of children. She contacted the police, and thereafter, an officer saw some of that evidence, including photographs that may have not been viewed during the initial private search. Based on this, the officer obtained a warrant for the laptop and its contents, which led to the filing of child pornography charges against the defendant. Prior to trial, the defendant filed a motion to suppress the evidence derived from a search of the laptop on the grounds that the officer's search violated the Fourth Amendment. The District Court granted the motion, and declined to adopt the government's argument that the private search doctrine applied. The Sixth Circuit too rejected the government's invocation of the private search exception, and thus concluded that the officer's search, as it was broader than the initial private search, did violate the defendant's Fourth Amendment rights.

Whether the subsequent governmental search falls under the purview of the exception depends on the “virtual certainty” that this search will produce viable evidence so as to mitigate any attendant interests the defendant has in maintaining privacy in areas yet untouched. The Lichtenberger court found that the holdings in Riley regarding the unique risks associated with the search of modern electronic devices to be dispositive in concluding that the officer did not possess the requisite virtual certainty. It first noted that, as espoused in Riley, “the nature of the electronic device [insofar as it is a repository for various types of data in vast amounts that correspond to a lengthy swath of time] greatly increases the potential privacy interests at stake.” Most important though, the virtual certainty has become more exacting, as a brief search through the defendant's PC could yield not only pertinent evidence, but also evidence unrelated to the crime alleged, including the most private sorts of images, bank statements, or Internet search histories. In the instant case, there was also confusion over whether the officer viewed the same incriminating photographs that had been viewed initially by the defendant's girlfriend. Ergo, the virtual certainty of the officer was insufficient to justify the search.

'Border Search' Exception

The Riley holdings also recently prompted a federal court to reconsider the applicability of the “border search” exception. See, United States v. Kim, 1:13-cr-00100-ABJ, — F. Supp. 3d —-, 2015 WL 2148070 (D.D.C. 2015). In short, this exception permits warrantless searches at the border arising “out of the sovereign's right and need to protect its territorial integrity and national security.” U.S. v. Ramsey, 431 U.S. 606 (1977) (observing that searches at the border are reasonable simply by virtue of the fact that they occur at the border, as such place is the initial barrier designed to protect national sovereignty). In Kim, the government conducted a warrantless search of the defendant's laptop prior to his departure from the United States. The laptop was then shipped to a forensic specialist who imaged the hard drive and used specialized software and keywords to search the files therein.

After the search uncovered incriminating e-mails indicating that the defendant may have violated export control and trade embargo laws with Iran, the defendant moved to suppress this evidence on grounds that the search of the laptop ran afoul of the Fourth Amendment. The government responded by invoking its plenary authority pursuant to the border search exception to search the laptop, which it characterized as a container. The court questioned the credulousness of the government's argument. In citing to Riley, the likening of a computer to a searchable container, such as a box or luggage, was now simplistic and borderline specious. Thus, “in applying the Riley framework,” the heightened privacy interests intrinsic to laptops and other digital data service devices a fortiori outweighed the attenuated national security concerns associated with border security, even notwithstanding the court's earlier acknowledgment that the government's interest in preventing the entry of unwanted persons and effects is “at its zenith at the international border.” Kim, infra.

Such a conclusion was likely easier for the court to reach after a realization that the capacity of “even the most basic laptops” to retain files, metadata and deleted material, means that it cannot be treated like a handbag or other container simply because one can “put things in it and then carry it onto a plane.” This fundamental distinction has unmoored the traditional balance between the weighing of privacy of a suspect and the interests in effective law enforcement decidedly in favor of the former.

One caveat: The court in Kim discussed at length the absence of cognizable national security concerns, as evidenced by the absence of information that criminal activity was in progress. Specifically, the seized computer remained unopened until it was transferred 150 miles from the border, and it was retained for a limited period of time. This indicated that there was little ongoing threat to national security that would ordinarily necessitate or justify a warrantless search at the border. Thus, it remains to be seen if the border search exception would be rejected in a case in which the national security concerns elucidated by the government were both exigent and tethered to a less attenuated rationale for the de jure invasive search of a personal digital device.

'Third-Party Consent' Exception

Notwithstanding the two exceptions covered above, the Riley holdings have not heretofore disturbed the justification for and applicability of the “third-party consent” exception to the Fourth Amendment warrant requirement. This exception permits law enforcement to engage in a warrantless search of premises or effects upon consent of a third party that possesses common authority over or sufficient relationship to the effects to be searched. See, United States v. Matlock, 415 U.S. 164 (1974). A recent case in the Southern District involved the defendant averring that this exception should be reconsidered in light of an “intervening change of controlling law” resulting from the conclusions in Riley. See, U.S. v. Yudong Zhu, 41 F. Supp. 3d 341 (S.D.N.Y 2014).

In Zhu , the defendant was charged with a variety of white-collar crimes based upon evidence acquired from a warrantless search of his computer. However, this FBI search was granted by the consent of the defendant's employer, New York University. Irrespective of such consent, the defendant moved for reconsideration under Local Rule 6.3 in light of Riley. This was rejected. As the exceptions are predicated on separate justifications, it did not follow necessarily that Riley obviated the rationale behind the “third-party consent” exception, even though higher privacy interests were appurtenant to a laptop, as with a cell phone. Rather, the properly granted consent of the third-party to a warrantless search of the defendant's laptop, no matter how voluminous and illustrative the data contained therein, did not implicate the governmental interests at issue in Riley. The dispositive factor is that while one exception involves a non-consensual search, while the other does not, and therefore the latter implies a voluntary relinquishing of at least part of a privacy interest at the outset.

Put more simply, according to the Zhu court, third-party approbation of a warrantless search of a device prevails, no matter how many private texts, photos and browsing history the device may contain.

Riley and ATM Money

A federal court in Minnesota recently held that the Riley distinction in privacy interests altered the legal calculus when a government agent forces a detainee to acquire money remotely by way of a bank card she possessed at the time of detention. See, Edwards v. U.S., 57 F. Supp. 3d 938 (D. Minn. 2014). In Edwards, the plaintiff was detained at a Minneapolis airport upon arriving from Nigeria. Immigration officials then requested the plaintiff withdraw $1,200 from an ATM in order to purchase an expedited return flight to Nigeria. After the official in question was informed by airline personnel that such funds were not required to remove the plaintiff from the United States, he allegedly retained the $1,200. She also alleged that she has never recovered the funds.

Among other causes of action, the plaintiff sued for conversion. The government in turn claimed sovereign immunity under the “detention of goods” exception. See, 28 U.S.C. '2680. This exception immunizes government officials from liability for injuries resulting from negligence in handling property in their possession. See also, Kosak v. United States, 465 U.S. 848 (1984) (exception bars claims for damages resulting from the seizure and subsequent damage to petitioner's art). The circumstances surrounding the taking, rather than its permanent or temporary nature, is the sine qua non in determining whether the exception applies. Specifically, if the goods seized are part of an ongoing investigation, immunity forecloses any legally redressable objection.

The immigration official seized money from the plaintiff located not physically on her person (in her wallet or pocket, for example), but via a bank card, which was thereafter used to access the money electronically. Therefore, the acquisition of the money required a second step, as in Riley, where the phone was used as a conduit to seize electronically stored data in the device. That the money seized was not physically present on the person, but instead only an item that could be used as an instrumentality to obtain the money was present during the search, led the court to conclude that the seizure could not arise from the detention or overarching investigation so as to trigger the exception. Rather, the use of the card at the ATM was considered an independent activity subsequent to the initial detention. Ergo, the government's motion to dismiss the conversion claim was denied.

Conclusion

As Riley and its progeny epitomize, Fourth Amendment jurisprudence has been permanently altered as a result of the proliferation of data storage devices, namely smart phones and PCs. After all, some of the most forceful language from the majority opinion in Riley elucidates why a search of a purse versus an examination of a hard drive is an irreconcilable dissimilarity. The implications for privacy interests and law enforcement prerogatives are now continuously subject to rapid revision. Some exceptions to the Fourth Amendment warrant requirement remain unchecked, while others appear anachronistic. The exceptions contingent on the consent or prior search of a device remain largely intact, as whether by choice or not, one's privacy interests in personal information, no matter how damning or testimonial, is diminished once it has been divulged to someone other than law enforcement. However, even when such interest is weakened, the breadth and depth of information that can be gleaned from a cursory glance at contacts, messages, files, and metadata, even during an ostensibly targeted search as in Lichtenberger, warrants a reassessment of law enforcement rights to this information, even after it is no longer technically private.

What is most apparent is that privacy interests associated with these devices have been reappraised, and subsequently heightened. As the Chief Justice opined in Riley, modern cell phones are hardly “just another technological convenience,” and in fact could contain and reveal “the privacies of life.” Accordingly, such gateways to the most intimate components of one's life must be evaluated with a greater emphasis on retaining that privacy, even at the expense of the ability of law enforcement to combat crime. Precisely how much such ability will be constricted remains largely uncertain, but the trend heretofore has favored the accused, even in milieus in which governmental interests are reiterated to be at their apogee.

Richard Raysman is a Partner at Holland & Knight. Peter Brown is the principal at Peter Brown & Associates and a member of this newsletter's Board of Editors. They are co-authors of Computer Law: Drafting and Negotiating Forms and Agreements (Law Journal Press).