The Fourth Amendment protects individuals from unreasonable searches and seizures.
Two primary requirements are necessary for Fourth Amendment protections to apply:
Is government action involved?
Does the person affected have a reasonable expectation of privacy in the place to be searched or thing to be seized?
In most circumstances, government action is implicated when a government official conducts a search. Generally speaking, the Fourth Amendment’s limitations do not apply to searches by private parties unless those searches are conducted at the direction of the government.
Private parties who independently acquire evidence of a crime may turn it over to law enforcement. (Law enforcement may replicate a private search, but may not exceed the scope of that search without a warrant or exception to the warrant requirement.)
For example, if an employee discovers contraband files on a computer that is being repaired in a shop, the employee’s subsequent release of information to law enforcement does not violate the Fourth Amendment. In such a case, law enforcement may examine anything that the employee observed.
The Fourth Amendment applies when the searched party has an actual expectation of privacy in the place to be searched or thing to be seized, and then only if it is an expectation that society is prepared to recognize as reasonable.
Some courts treat a computer as a”closed container” for Fourth Amendment purposes. In some jurisdictions, looking at a computer’s subdirectories and files is akin to opening a closed container.
If the Fourth Amendment is implicated in the search at issue, then generally law enforcement must obtain a warrant unless an exception to the warrant requirement applies.
There are several well-recognized exceptions to securing a warrant. Although the following is not an exhaustive list, the examples provide an idea of how the common exceptions apply to the search and seizure of digital evidence.
a. Consent.
Consent is a valuable tool for an investigator. It can come from many sources, including a log-in banner, terms-of-use agreement, or company policy. Some considerations include:
(1) Like a shared apartment, a computer can have multiple users. Consent by one user is always sufficient to authorize a search of that person’s private area of the computer, and in most instances is sufficient to authorize a search of the common areas as well. Additional consent may be needed if an investigator encounters password-protected files. Also, a parent in most cases can consent to a search of a minor child’s computer.
(2) Consent can be limited by subject matter, duration, and other parameters. Consent can be withdrawn at any time (see appendix C for a sample consent form).
(3) The general rule is that a private-sector employer can consent to a search of an employee’s workplace computer. The r ules are more complicated when the employer is the government.
To prevent the destruction of evidence, law enforcement can seize an electronic storage device. In certain cases in which there is an immediate danger of losing data, law enforcement may perform a limited search to preserve the data in its current state. Once the exigent circumstances end, so does the exception.
The need to protect the safety of law enforcement or to preserve evidence can justify a full search of an arrestee and a limited search of the arrest scene. This search incident to arrest can include a search of an electronic storage device, such as a cell phone or pager, held by the subject.
The inventory search exception is intended to protect the property of a person in custody and guard against claims of damage or loss. This exception is untested in the courts, so it is uncertain whether the inventory search exception will allow law enforcement to access digital evidence without a warrant.
The plain view doctrine may apply in some instances to the search for and seizure of electronic evidence. For plain view to apply, law enforcement must legitimately be in the position to observe evidence, the incriminating character of which must be immediately apparent. Law enforcement officials should exercise caution when relying on the plain view doctrine in connection with digital media, as rules concerning the application of the doctrine vary among jurisdictions.
If the Fourth Amendment is implicated in a search and none of the search warrant exceptions applies, law enforcement should obtain a search warrant. Generally, the same warrant rules apply when preparing and executing a search warrant for digital evidence as in other investigations. Law enforcement should consider the following when preparing and executing a search warrant for electronic evidence:
Describing property.
If the evidence sought is the computer itself (and the hardware is an instrumentality, a fruit of the crime, or contraband), then the warrant should describe the computer as the target of the search.
If the evidence sought is information that may be stored on digital media, then the warrant should describe what that evidence is and request the authority to seize it in whatever form (including digital) it may be stored. This includes requesting authority to search for evidence of ownership and control of the relevant data on the media.
In some cases, a search of an electronic storage device can require significant technical knowledge and should be conducted by appropriate personnel who are supplied with a copy of the search warrant to ensure that the search is within its scope.
In the course of conducting a search, law enforcement may discover passwords and keys that could facilitate access to the system and data. Law enforcement may also find evidence of a crime that is outside the scope of the search warrant. In such an event, the police should obtain another warrant to expand the scope of the search.
In some cases, it might be impractical to search the device onsite. If a device is to be searched offsite, law enforcement should consider adding language to the warrant affidavit that justifies its removal.
If a device is removed for an off-scene search, the search should be completed in a timely manner. Law enforcement may consider returning copies of noncontraband seized data, even if they are commingled with evidence of a crime, to accommodate a reasonable request from suspects or third parties.
In some instances, law enforcement may have reason to believe that the place to be searched will contain information that is considered”privileged” under statute or common law (e.g., the office of a lawyer, health professional, or member of the clergy).
Before drafting a warrant and conducting the search, law enforcement MUST take care to identify and comply with the legal limitations that the jurisdiction may impose.