------------------------------------------------------------
This document was obtained under the Freedom of Information
Act by the Electronic Privacy Information Center in November
1994 and scanned in by the Bureau of National Affairs. It is
not copyrighted and may be freely distributed.
A analysis of this document is available from EPIC at
cpsr.org /cpsr/privacy/epic/guidelines_analysis.txt. EPIC,
with the cooperation of the Bureau of National Affairs, is
making the guidelines available electronically. The
document is available via FTP/Gopher/WAIS/listserv from the
EPIC online archive at cpsr.org
/cpsr/privacy/epic/fed_computer_siezure_guidelines.txt. A
printed version appears in the Bureau of National Affairs
publication, Criminal Law Reporter, Vol. 56, No. 12
(December 21 1994).
-------------------------------------------------------------
US Department of Justice
Criminal Division
Office of Professional Development and Training
-------------------------------------------------------------------
Federal Guidelines For Searching And Seizing Computers
-------------------------------------------------------------------
JULY 1994
PREFACE
These Guidelines are the product of an interagency group,
informally
called the Computer Search and Seizure Working Group. Its members
were
lawyers, agents, and technical experts from the Federal Bureau
of
Investigation; the United States Secret Service; the Internal
Revenue
Service; the Drug Enforcement Administration; the United States
Customs
Service; the Bureau of Alcohol, Tobacco, and Firearms; the United
States
Air Force; the Department of Justice; and United States Attorneys'
offices. Most of us have consulted widely within our own agencies
to find
the diversity of opinion on these topics. Our object was to offer
some
systematic guidance to all federal agents and attorneys as they
wrestle
with cases in this emerging area of the law. These Guidelines
have not
been officially adopted by any of the agencies, and are intended
only as
assistance, not as authority. They have no regulatory effect,
and confer
no right or remedy on anyone. Moreover, the facts of any particular
case
may require you to deviate from the methods we generally recommend,
or
may even demand that you try a completely new approach.
Many of our recommendations must be tentative, because there
is often so
little law directly on point. As the law develops and as technology
changes (thereby altering or even transforming our assumptions),
the
Working Group may well find itself a Standing Committee with
open
membership.
If you have any comments, corrections, or contributions, please
contact
Marty Stansell-Gamm at the Computer Crime Unit, General Litigation
Section, Department of Justice (202-514-1026). As you confront
these
issues in your practice, we will be eager to hear about your
experience
and to assist in any way we can.
Scott C. Charney, Chief, Computer Crime Unit
Martha J. Stansell-Gamm
Computer Crime Unit
Chair, Computer Search and Seizure Working Group
General Litigation and Legal Advice Section Criminal Division
Department
of Justice
TABLE OF CONTENTS
INTRODUCTION ...................................................1
I. KEY TERMS AND CONCEPTS
A. DEFINITIONS ................................................
3
B. LIST OF COMPUTER SYSTEM COMPONENTS .........................
5
C. DETERMINING THE COMPUTER'S ROLE IN THE OFFENSE .............
7
II. GENERAL PRINCIPLES
A. SEARCH WARRANTS ............................................
9
B. PLAIN VIEW .................................................
9
C. EXIGENT CIRCUMSTANCES ......................................
9
D. BORDER SEARCHES ............................................
12
E. CONSENT SEARCHES . . . . . . . . . . . . . . . . . . . . .
. 13
1. Scope of the Consent ....................................
13
2. Third-Party Consent ......................................14
a. General Rules ........................................ 14
b. Spouses . . . . . . . . . . . . . . . . . . . . . . . 17
c. Parents . . . . . . . . . . . . . . . . . . . . . . . 17
d. Employers .. . . .. . . .. . . .. . . . .. . . . .. . 18
e. Networks: System Administrators ...................... 22
F. INFORMANTS AND UNDERCOVER AGENTS ...........................
24
[page ii]
III. SEIZING HARDWARE
A. THE INDEPENDENT COMPONENT DOCTRINE .........................
25
B. HARDWARE AS CONTRABAND OR FRUITS OF CRIME ..................
26
1. Authority for Seizing Contraband or Fruits of Crime .....
26
2. Contraband and Fruits of Crime Defined ..................
27
C. HARDWARE AS AN INSTRUMENTALITY OF THE OFFENSE ..............
28
1. Authority for Seizing Instrumentalities .................
28
2. Instrumentalities Defined ...............................
28
D. HARDWARE AS EVIDENCE OF AN OFFENSE .........................
30
1. Authority for Seizing Evidence ..........................
30
2. Evidence Defined ........................................
30
E. TRANSPORTING HARDWARE FROM THE SCENE .......................
31
IV. SEARCHING FOR AND SEIZING INFORMATION
A. INTRODUCTION ...............................................
35
B. INFORMATION AS CONTRABAND ..................................
36
C. INFORMATION AS AN INSTRUMENTALITY ..........................
36
D. INFORMATION AS EVIDENCE ....................................
37
1. Evidence of Identity ....................................
38
2. Specific Types of Evidence ..............................
39
a. Hard Copy Printouts .................................. 39
b. Handwritten Notes .................................... 40
E. PRIVILEGED AND CONFIDENTIAL INFORMATION ........... ..
. . . 40
1. In General ..............................................
40
a. Doctors, Lawyers, and Clergy ......................... 41
b. Publishers and Authors ............................... 41
2. Targets .................................................
42
3. Using Special Masters ...................................
43
[page iii]
F. UNDERSTANDING WHERE THE EVIDENCE MIGHT BE: STAND-ALONE
PCs, NETWORKS AND FILE-SERVERS, BACKUPS, ELECTRONIC BULLETIN
BOARDS, AND ELECTRONIC MAIL................................ 43
1. Stand-Alone PCs.........................................
43
a. Input/Output Devices: Do Monitors, Modems, Printers,
and Keyboards Ever Need to be Searched? ............................
44
b. Routine Data Backups.................................. 46
2. Networked PCs........................................... 46
a. Routine Backups ..................................... 48
b. Disaster Backups..................................... 49
G. SEARCHING FOR INFORMATION ..................................
49
1. Business Records and Other Documents ....................
49
2. Data Created or Maintained by Targets ...................
50
3. Limited Data Searches ...................................
51
4. Discovering the Unexpected ..............................
53
a. Items Different from the Description in the Warrant .. 53
b. Encryption ........................................... 54
H. DECIDING WHETHER TO CONDUCT THE SEARCH ON-SITE OR TO
REMOVE HARDWARE TO ANOTHER LOCATION ........................
55
1. Seizing Computers because of the Volume of Evidence .....
56
a. Broad Warrant Authorizes Voluminous Seizure of Document. 56
b. Warrant is Narrowly Drawn but Number of Documents to be
Sifted through is Enormous ........................... 58
c. Warrant Executed in the Home ......................... 59
d. Applying Existing Rules to Computers ................. 60
2. Seizing Computers because of Technical Concerns ........
61
a. Conducting a Controlled Search to Avoid Destroying Data
61
b. Seizing Hardware and Documentation so the System Will Operate
at the Lab ................................................ 62
I. EXPERT ASSISTANCE ..........................................
63
1. Introduction ............................................
63
2. Finding Experts .........................................
64
a. Federal Sources....................................... 65
b. Private Experts....................................... 66
(1) Professional Computer Organizations............... 66
(2) Universities...................................... 67
(3) Computer and Telecommunications Industry Personnel 67
(4) The Victim ....................................... 67
3. What the Experts Can Do .................................
68
a. Search Planning and Execution ........................ 68
b. Electronic Analysis .................................. 68
[page iv]
c. Trial Preparation .................................... 69
d. Training for Field Agents ............................ 70
V. NETWORKS AND BULLETIN BOARDS
A. INTRODUCTION .....................................................
71
B. THE PRIVACY PROTECTION ACT, 42 U.S.C. 2000aa ................72
1. A Brief History of the Privacy Protection Act .............72
2. Work Product Materials ....................................73
3. Documentary Materials .....................................77
4. Computer Searches and the Privacy Protection Act ..........78
a. The Reasonable Belief Standard .........................79
b. Similar Form of Public Communication ...................82
c. Unique Problems: Unknown Targets and Commingled Materials
...83
5. Approval of Deputy Assistant Attorney General Required ....84
C. STORED ELECTRONIC COMMUNICATIONS ..................................85
Vl. DRAFTING THE WARRANT
A. DRAFTING A WARRANT TO SEIZE HARDWARE .............................
91
B. DRAFTING A WARRANT TO SEIZE INFORMATION ..........................
92
1. Describing the Place to be Searched ...........................
92
a. General Rule: Obtain a Second Warrant ......................
93
b. Handling Multiple Sites within the Same District ...........
93
c. Handling Multiple Sites in Different Districts .............
94
d. Information at an Unknown Site .............................
95
e. Information/Devices Which Have Been Moved ..................
96
2. Describing the Items to be Seized .............................
97
3. Removing Hardware to Search Off-Site: Ask the Magistrate for
Explicit
Permission.....................................................
99
4. Seeking Authority for a No-Knock Warrant .....................
100
a. In General ................................................
100
b. In Computer-Related Cases .................................
101
[page v]
VII. POST-SEARCH PROCEDURES
A. INTRODUCTION .....................................................103
B. PROCEDURES FOR PRESERVING EVIDENCE ........................
104
1. Chain of Custody ....................................... 104
2. Organization ........................................... 104
3. Keeping Records ........................................ 105
4. Returning Seized Computers and Materials ............... 105
a. Federal Rules of Criminal Procedure: Rule 41(e) ..... 106
b. Hardware ............................................ 109
c. Documentation ....................................... 110
d. Notes and Papers .................................... 110
e. Third-Party Owners .................................. 111
VIII. EVIDENCE
A. INTRODUCTION ..............................................
113
B. THE BEST EVIDENCE RULE ....................................
114
C. AUTHENTICATING ELECTRONIC DOCUMENTS .......................
115
1. "Distinctive" Evidence ...............................
116
2. Chain of Custody ....................................... 119
3. Electronic Processing of Evidence ...................... 120
D. THE HEARSAY RULE ..........................................
122
IX APPENDICES
APPENDIX A: SAMPLE COMPUTER LANGUAGE FOR SEARCH WARRANTS ......
125
1. Tangible Objects .................................... 125
a. Justify Seizing the Objects ...................... 125
b. List and Describe the Objects .................... 126
(1) Hardware . . . . . . . . . . . . . . . . . ...... . 127
(2) Software ..................................... 127
(3) Documentation . . . . . . . . . . . . . . ...... . 128
(4) Passwords and Data Security Devices .......... 128
[page vi]
2. Information: Records, Documents, Data ............... 128
a. Describe the Content of Records, Documents, or other
Information ... 129
b. Describe the Form which the Relevant Information May Take
........ 130
c. Electronic Mail: Searching and Seizing Data from a BBS Server
under 18 U.S.C. .................................................131
(1) If All the E-Mail is Evidence of Crime ............... 131
(2) If Some of the E-Mail is Evidence of Crime ........... 132
(3) If None of the E-Mail is Evidence of Crime ........... 132
d. Ask Permission to Seize Storage Devices when an Off-Site Search
is Necessary . . . . . . . . . . . . . . . . . . . . . . . .
. .. . .133
e. Ask Permission to Seize, Use, and Return Auxiliary Items,
as
Necessary ...........................................................134
f. Data Analysis Techniques ..................................
135
3. Stipulation for Returning Original Electronic Data ..............
135
APPENDIX B: GLOSSARY ...............................................
139
APPENDIX C: FEDERAL EXPERTS FOR COMPUTER CRIME INVESTIGATIONS.......
143
APPENDIX D: COMPUTER SEARCH AND SEIZURE WORKING GROUP ...............145
APPENDIX E: STATUTORY POPULAR NAME TABLE.............................153
APPENDIX F: TABLE OF AUTHORITIES ..................................
155
Cases ... . . . . . . . . . . . . . . . . . . . . . . 155
Statutes . . . . . . . . . . . . . . . . . . . . . . . 162
Federal Rules ..........................................162
Federal Regulations ....................................163
Legislative History . . . . . . . . . . . . . . . . . . 163
Reference Materials ....................................164
[page a]
INTRODUCTION
As computers and telecommunications explode into the next
century,
prosecutors and agents have begun to confront new kinds of problems.
These Guidelines illustrate some of the ways in which searching
a
computer is different from searching a desk, a file cabinet,
or an
automobile. For example, when prosecutors must interpret Rule
41 (which
requires that the government obtain a search warrant in the district
where the property to be searched is "located"), applying
it to searches
of physical items is usually uncomplicated. But when they must
try to
"locate" electronic data, the discussion can quickly
become more
metaphysical than physical.
Even so, it is important to remember throughout the process that
as
dazzling and confounding as these new-age searches and seizures
may be,
they are in many essential ways just like all other searches.
The cause
must be just as probable; the description of items, just as particular.
The standard investigative techniques that work in other cases
(like
finding witnesses and informants) are just as valuable in computer
cases.
The evidence that seals a case may not be on the hardware or
software,
but in an old-fashioned form: phone bills, notes in the margins
of
manuals, or letters in a drawer.
The sections that follow are an integration of many legal sources,
practical experiences, and philosophical points of view. We have
often
had to extrapolate from existing law or policies to try to strike
old
balances in new areas. We have done our best to anticipate the
questions
ahead from the data available today. Even so, we recognize that
rapid
advances in computer and telecommunications technologies may
require that
we revisit these Guidelines,~perhaps in the near future. In the
meantime,
as law struggles to catch up to technology, it is important to
remember
that computer cases are just like all others in one respect at
least:
under all the "facts and circumstances," there is no
substitute for
reasonable judgment.
[no page 2] [page 3]
I. KEY TERMS AND CONCEPTS
Searching and seizing computers raises unique issues for law
enforcement
personnel. Before addressing these issues, however, it is important
to
have a basic understanding of key terms and fundamental concepts
that
will influence the government's search and seizure decisions.
This
section describes these central terms and concepts. A more complete
glossary can be found at APPENDIX B, p. 139.
A. DEFINITIONS
When people speak of searching or seizing computers, they
usually are not
referring only to the CPU (Central Processing Unit). After all,
a
computer is useless without the devices that allow for input
(e.g., a
keyboard or mouse) and output (e.g., a monitor or printer) of
information. These devices, known as "peripherals,"'
are an integral part
of any "computer system."
Failure to more specifically define the term "computer"
may cause
misunderstandings. Having probable cause to seize a "computer"
does not
necessarily mean there is probable cause to seize the attached
printer.
Therefore, we need to be clear about our terms.
1. Hardware -- "The physical components or equipment
that make up a
computer system...." Webster's Dictionary of Computer Terms
170 (3d ed.
1988). Examples include keyboards, monitors, and printers.
2. Software -- "The programs or instructions that tell
a computer what to
do." Id. at 350. This includes system programs which control
the internal
operation of the computer system (such as Microsoft's Disk Operating
System, "MS-DOS," that controls
_________________________
1 Peripheral equipment means "[t]he input/output units
and auxiliary
storage units of a computer system, attached by cables to the
central
processing unit." Webster's Dictionary of Computer Terms
279 (3d ed.
1988).
[page 3]
IBM-compatible PCs) and applications programs which enable
the computer
to produce useful work (e.g., a word processing program such
as
WordPerfect).
3. Data -- "A formalized representation of facts or concepts
suitable for
communication, interpretation, or processing by people or by
automatic
means." Id. at 84. Data is often used to refer to the information
stored
in the computer.
4. Documentation -- Documents that describe technical specifications
of
hardware components and/or software applications and how to use
them.
5. Input/Output (I/O) Device -- A piece of equipment which
sends data to,
or receives data from, a computer. Keyboards, monitors, and printers
are
all common I/O devices.
6. Network -- "A system of interconnected computer systems
and
terminals." Id. at 253.
7. System Administrator (or System Operator, "sysop")
-- The individual
responsible for assuring that the computer system is functioning
properly. He is often responsible for computer security as well.
For search and seizure purposes, unless the text specifically
indicates
otherwise, the term "computer" refers to the box that
houses the CPU,
along with any internal storage devices (such as internal hard
drives)
and internal communications devices (such as an internal modem
or fax
card). Thus, "computer" refers to the hardware, software,
and data
contained in the main unit. Printers, external modems (attached
by cable
to the main unit), monitors, and other external attachments will
be
referred to collectively as "peripherals" and discussed
individually
where appropriate. When we are referring to both the computer
and all
attached peripherals as one huge package, we will use the term
"computer
system." "Information" refers to all the information
on a computer
system, including both software applications and data.
It is important to remember that computer systems can be configured
in an
unlimited number of ways with assorted input and output devices.
In some
cases, a specific device may have particular evidentiary value
(e.g., if
the case involves
[page 5] a bookie who prints betting slips, the printer may
constitute
valuable evidence); in others, it may be the information stored
in the
computer that may be important. In either event, the warrant
must
describe, with particularity, what agents should search for and
seize.
B. LIST OF COMPUTER SYSTEM COMPONENTS
The following is an abridged list of hardware components which
may play a
role in a criminal offense and, therefore, be subject to search
and
seizure under warrant. For a more extensive list, see the "GLOSSARY"
at
APPENDIX B, p. 139. It is important to remember that electronic
components are constantly changing, both in nature and in number,
and no
list can be comprehensive.
Device Name Description
CPU: The central processing unit.
Hard Disk Drive: A storage device based on a fixed, permanently
mounted disk drive. It may be either internal or external. Both
applications and data may be stored on the disk.
Floppy Disk Drive: A drive that reads from or writes to floppy
diskettes. Information is stored on the diskettes themselves,
not on the
drive.
Mouse: A pointing device that controls input. Normally, the
user points
to an object on the screen and then presses a button on the mouse
to
indicate her selection.
Modem: A device allowing the computer to communicate with
another
computer, normally over standard telephone lines. Modems may
be either
external or internal.
[page 6] Fax Peripheral: A device, normally inserted as an
internal card,
that allows the computer to function as a fax machine.
CD ROM: CD ROM stands for Compact Disk Read-Only Memory. CD
ROMs store
and read massive amounts of information on a removable disk platter.
Unlike hard drives and diskettes, CD ROMs are read-only and data
cannot
be written to the platter.
Laser Disk: Similar to a CD ROM drive but uses lasers to read
and
write information.
Scanner: Any optical device which can recognize characters
on
paper and, using specialized software, convert them into digital
form.
Printer: A number of technologies exist, using various techniques.
The most common printers are:
1. Dot matrix - characters and graphics are created by pins
hitting the
ribbon and paper;
2. Laser - electrostatically charges the printed page and
applies toner;
3. Ink jet - injects (sprays) ink onto the paper;
4. Thermal - a hot printer head contacts special paper that
reacts to
heat;
5. Band - a rotating metal band is impacted as it spins;
6. Daisy wheel - a small print wheel containing the form of
each
character rotates and hits the paper, character by character;
[page 7]
7. Plotter - moves ink pens over the paper surface, typically
used for
large engineering and architectural drawings.
C. DETERMINING THE COMPUTER'S ROLE IN THE OFFENSE
Before preparing a warrant to seize all or part of a computer
system and
the information it contains, it is critical to determine the
computer's
role in the offense. First, the computer system may be a tool
of the
offense. This occurs when the computer system is actively used
by a
defendant to commit the offense. For example, a counterfeiter
might use
his computer, scanner, and color printer to scan U.S. currency
and then
print money. Second, the computer system may be incidental to
the
offense, but a repository of evidence. For example, a drug dealer
may
store records pertaining to customers, prices, and quantities
delivered
on a personal computer, or a blackmailer may type and store threatening
letters in his computer.
In each case, the role of the computer differs. It may constitute
"the
smoking gun" (i.e., be an instrumentality of the offense),
or it may be
nothing more than an electronic filing cabinet (i.e., a storage
device).
In some cases, the computer may serve both functions at once.
Hackers,
for example, often use their computers both to attack other computer
systems and to store stolen files. In this case, the hacker's
computer is
both a tool and storage device. Whatever the computer's role
in each
case, prosecutors must consider this and tailor warrants accordingly.
By understanding the role that the computer has played in
the offense, it
is possible to focus on certain key questions:
Is there probable cause to seize hardware?
Is there probable cause to seize software?
Is there probable cause to seize data?
[page 8]
Where will this search be conducted? Is it practical to search
the
computer system on site, or must the examination be conducted
at a field
office or laboratory?
If agents remove the system from the premises to conduct the
search, must
they return the computer system, or copies of the seized data,
to its
owner/user before trial?
Considering the incredible storage capacities of computers,
how will
agents search this data in an efficient, timely manner?
Before addressing these questions, it is important to recognize
that
general Fourth Amendment principles apply to computer searches,
and
traditional law enforcement techniques may provide significant
evidence
of criminal activity, even in computer crime cases. Therefore,
we begin
with a brief overview of the Fourth Amendment.
[page 9]
II. GENERAL PRINCIPLES
A. SEARCH WARRANTS
There is, of course, "a strong preference for warrants,"
and courts will
scrutinize a warrantless search. Indeed, as the Supreme Court
indicated
in United States v. Leon, 468 U.S. 897, 914 (1984), a warrant
can save a
search where probable cause is doubtful or marginal. Most searches
of
computer systems will be pursuant to warrant, but the recognized
exceptions to the warrant requirement apply equally to the search
and
seizure of computers.
B. PLAIN VIEW
Evidence of a crime may be seized without a warrant under
the plain view
exception to the warrant requirement. To rely on this exception,
the
officer must be in a lawful position to observe the evidence,
and its
incriminating character must be immediately apparent. See Horton
v.
California, 496 U.S. 128 (1990). For example, if agents with
a warrant to
search a computer for evidence of narcotics trafficking find
a long list
of access codes taped to the computer monitor, the list should
also be
seized.
C. EXIGENT CIRCUMSTANCES
"When destruction of evidence is imminent, a warrantless
seizure of that
evidence is justified if there is probable cause to believe that
the item
seized constitutes evidence of criminal activity." United
States v.
David. 756 F. Supp. 1385, 1392 (D. Nev. l991).2 If a target's
screen is
displaying evidence
-------------------------- 2 See also United States v. Talkington,
875
F.2d 591 (7th Cir. 1989) (warrantless entry to residence and
seizure of
counterfeit money was justified since agents knew that (1) the
suspects
had previously discussed burning money; (2) there was a fire
in the
backyard: and (3) the agents were confident that residents were
not
having a cookout.
[page 10]
which agents reasonably believe to be in danger, the "exigent
circumstances" doctrine would justify downloading the information
before
obtaining a warrant. For example, agents may know that the incriminating
data is not actually stored on the suspect's machine, but is
only
temporarily on line from a second network storage site in another
building, city, or district. Thus, even if the agents could secure
the
target's computer in front of them, someone could still electronically
damage or destroy the data -- either from the second computer
where it is
stored or from a third, unknown site. Of course, when agents
know they
must search and seize data from two or more computers on a wide-area
network, they should, if possible, simultaneously execute separate
search
warrants. (See "Describing the Place to be Searched,"
infra p. 92.) But
sometimes that is not possible, and agents must then analyze
the
particular situation to decide whether the "exigent circumstances"
exception applies. In computer network cases, as in all others,
the
answer is absolutely tied to the facts.
In determining whether exigent circumstances exist, agents
should
consider: (1) the degree of urgency involved, (2) the amount
of time
necessary to obtain a warrant, (3) whether the evidence is about
to be
removed or destroyed, (4) the possibility of danger at the site,
(5)
information indicating the possessors of the contraband know
the police
are on their trail, and (6) the ready destructibility of the
contraband.
United States v. Reed, 935 F.2d 641, 642 (4th Cir.), cert. denied,
112 S.
Ct. 423 (1991).
Under the "exigent circumstances" exception to the
warrant requirement,
agents can search without a warrant if the circumstances would
cause a
reasonable person to believe it to be necessary. The Supreme
Court has
upheld warrantless entries and searches when police officers
reasonably
believe that someone inside needs "immediate aid,"
Mincey v. Arizona, 437
U.S. 385, 392~-93 (1978), or to prevent the destruction of relevant
evidence, the escape of a suspect, or the frustration of some
other
legitimate law enforcement objective. United States v. Arias,
923 F.2d
1387 (9th Cir.), cert. denied, 112 S. Ct. 130 (1991). The officer's
fears
need not be correct so long as they are reasonable. See United
States v.
Reed, supra (proper inquiry is what objective officer could reasonably
believe).
[page 11]
Recognizing the strong preference for warrants, courts have
suppressed
evidence where the officers had time to get a warrant but failed
to do
so. United States v. Houle, 603 F.2d 1297 (8th Cir. 1979). Some
courts
have even ruled that exigent circumstances did not exist if the
law
enforcement officers had time to obtain a warrant by telephone.
United
States v. Patino, 830 F.2d 1413, 1416 (7th Cir. 1987)(warrantless
search
not justified when officer had adequate opportunity to obtain
telephone
warrant during 30-minute wait for backup assistance; not permissible
for
agents to wait for exigency and then exploit it), cert. denied,
490 U.S.
1069 (1989).
Additionally, while exigencies may justify the seizure of
hardware (i.e.,
the storage device), this does not necessarily mean that they
support a
warrantless search. In United States v. David, 756 F. Supp. 1385
(D. Nev.
1991), the court held that although the agent was correct to
seize the
defendant's computer memo book without a warrant (because the
agent saw
him deleting files), the agent should have gotten a search warrant
before
re~accessing and searching the book. The court held the exigencies
allowed the agent to take the computer memo book but, once taken,
there
was time to get a warrant to look inside. Therefore, the seized
evidence
had to be suppressed. Id. at 1392.
This holding is, of course, analogous to cases which address
other kinds
of containers. In the David case, the computer book itself was
not
contraband, instrumentality, fruit, or evidence of crime. It
was,
instead, a small file cabinet, a locked box, a container of data.
The
agent was not interested in the hardware but in the information
inside.
As the cases make clear, authority to seize a container does
not
necessarily authorize a warrantless search of the container's
contents.
See Texas v. Brown, 460 U.S. 730, 750 (1983)(Stevens, J.,
concurring)(plain view justified seizure of party balloon but
additional
justification was required to open balloon without warrant).
Courts have
suppressed warrantless searches when the defendant still had
a reasonable
expectation of privacy in the contents of the container. See
United
States v. Turk, 526 F.2d 654 (5th Cir.)(although seizure of tape
was
proper, playing taped conversation of private telephone communication
was
not), cert. denied, 429 U.S. 823 (1976); Blair v. United States,
665 F.2d
500 (4th Cir. 1981).
Agents must always remember, however, that electronic data
is perishable.
Humidity, temperature, vibrations, physical mutilation, magnetic
fields
created by passing a strong magnet over a disk, or computer commands
(such as "erase *.*" or "format") can destroy
data in a matter of
seconds. [page 12]
Thus, the exigent circumstances doctrine may justify a warrantless
seizure in appropriate cases.
D. BORDER SEARCHES
The law recognizes a limited exception to the Fourth Amendment's
probable
cause requirement at the nation's borders. Officials may search
people
and property without a warrant and without probable cause as
a condition
of crossing the border or its "functional equivalent."
United States v.
Ramsey, 431 U.S. 606 (1977), cert. denied, 434 U.S. 1062 (1978).
Both
incoming international baggage (United States v. Scheer, 600
F.2d 5 (3d
Cir. 1979) and incoming international mail at the border are
subject to
search without a warrant to determine whether they contain items
which
may not lawfully be brought into the country. Border searches
or
international mail searches of diskettes, tapes, computer hard
drives
(such as laptops carried by international travelers), or other
media
should fall under the same rules which apply to incoming persons,
documents, and international mail.
On the other hand, the border search exception to the warrant
requirement
probably will not apply to data transmitted electronically (or
by other
non-physical methods) into the United States from other countries.
For
example, if an individual in the United States downloads child
pornography from a foreign BBS, a warrantless search of his home
computer
could not be supported by the border search exception. In such
cases, it
is difficult to find a "border" or its functional equivalent
as data
travels over international telephone lines or satellite links.
What seems
clear, however, is that once data has been received by a computer
within
the United States, that data resides in the country and has passed
beyond
the border or its functional equivalent. Because the justification
for
the border search exception is grounded on the sovereign's power
to
exclude illegal articles from the country, that exception no
longer
applies once such articles (in this case electronic data) have
come into
the country undetected.
[page 13] E. CONSENT SEARCHES
Agents may search a place or object without a warrant or,
for that
matter, without probable cause, if a person with authority has
consented.
Schneckloth v. Bustamonte, 412 U.S. 218, 219 (1973). This consent
may be
explicit or implicit. United States v. Milan-Rodriguez, 759 F.2d
1558,
1563-64 (11th Cir.)(telling police where to find a key constitutes
implicit consent to a search of the locked area), cert. denied,
474 U.S.
845 (1985), and cert. denied, 486 U.S. 1054 (1988).
Whether consent was voluntarily given is a question of fact
which the
court will decide. United States v. Scott, 578 F.2d 1186, 1189
(6th
Cir.), cert. denied, 439 U.S. 870 (1978). The burden is on the
government
to prove that the consent was voluntary, United States v. Price,
599 F.2d
494, 503 (2nd Cir. 1979), and, in making its decision, the court
will
consider all the facts surrounding the consent. Schneckloth,
supra, at
226-7; United States v. Mendenhall, 446 U.S. 544, 557-8 (1980).
See
generally United States v. Caballos, 812 F.2d 42 (2d Cir. 1987).
While no
single aspect controls the result, the Supreme Court has identified
the
following important factors: the age of the person giving consent;
the
person's education, intelligence, mental and physical condition;
whether
the person was under arrest; and whether he had been advised
of his right
to refuse consent. Schneckloth, supra, at 226.
In computer crime cases, several consent issues are likely
to arise.
First, did the scope of the search exceed the consent given?
For example,
what if a target consents to a search of his machine, but the
data is
encrypted? Does his consent authorize breaking the encryption
scheme?
Second, who is the proper party to consent to a search? Does
a system
administrator have the authority to consent to a search of a
file server
containing the files of all the system users?
1. Scope of the Consent
A person who consents to a search may explicitly limit this
consent to a
certain area. United States v. Griffin, 530 F.2d 739, 744 (7th
Cir.
1976). When the limits of the consent are clearly given, either
at the
time of the search or even afterwards, agents must respect their
bounds.
In Vaughn v. Baldwin,
[page 14]
950 F.2d 331 (6th Cir. 1991), the plaintiff dentist had voluntarily
turned over records to the IRS. The IRS agent kept the records
for months
and refused several informal requests for their return. Plaintiff
then
formally, in writing, revoked his consent to the IRS, which still
kept
the records to make copies. Finally, plaintiff sued and the IRS
returned
the originals but kept the copies. The court found that the IRS
had
violated the Fourth Amendment. Although the IRS was entitled
to copy the
records while they lawfully had them, they could not keep the
records
once plaintiff revoked his consent. Moreover, considering the
long period
of time that the IRS held the documents, the court rejected the
argument
that once the plaintiff demanded return of his documents the
government
should be entitled to retain them for a reasonable period for
copying.
Consent may also be limited implicitly. In United States v.
David, 756 F.
Supp. 1385 (D. Nev. 1991), the court held that while the defendant
had
consented, pursuant to a cooperation agreement, to share some
of the
information contained in his hand-held computer memo book, his
attempt to
prevent agents from seeing the file password constituted a limit
on his
consent. Although the agent did nothing wrong by leaning over
defendant's
shoulder to watch him enter the password, the government clearly
exceeded
the implicit limits of David's consent when agents used the password
to
read the whole computer book without David's permission. For
a more
extensive discussion of encryption issues, see, infra p. 54.
2. Third-Party Consent
a. General Rules
It is not uncommon for several people to use or own the target
computer
equipment. If any one of those people gives permission to search
for
data, agents may generally rely on that consent, so long as that
person
has authority over the computer. In these cases, all users have
assumed
the risk that a co~-user might not just discover everything in
the
computer but might also permit law enforcement to discover the
"common
area" as well.
[page 15]
In United States v. Matlock, 415 U.S. 164 (1974), the Supreme
Court
stated that one who has common authority over premises or effects
may
consent to a search even if the absent co-user objects. In an
important
footnote, the Court said that "common authority" is
not a property law
concept but
rests rather on mutual use of the property by persons generally
having
joint access or control for most purposes, so that it is reasonable
to
recognize that any of the co-inhabitants has the right to permit
the
inspection in his own right and that the others have assumed
the risk
that one of their number might permit the common area to be searched.
Id. at 171 n.7.
Extending this analysis, a third party with common authority
may consent
even if he is antagonistic toward the defendant. One could even
argue
that sharing access to a common premises with an unsympathetic
person
would objectively increase the risk of disclosure, and thus reasonable
expectations of privacy actually diminish. This is especially
true where
the consenting individual agrees to a search of common premises
to
exculpate himself from the defendant's criminal activity. See
3 W.
LaFave, Search and Seizure: A Treatise on the Fourth Amendment
8.3(b) at
244-45 (2d ed. 1987). See also United States v. Long, 524 F.2d
660 (9th
Cir. 1975) (wife in fear of her husband could still consent to
a search
of the jointly owned house even though she had moved out and
he had
changed the locks).
Where two or more people enjoy equal property rights over
a place, they
may still have exclusive, private zones within the shared premises.
Housemates with separate bedrooms, spouses with private areas
or
containers, and housemates with separate directories on a shared
computer
may reasonably expect to own that space alone. But when do these
individual expectations overcome another's common authority over
premises
or property? Although there is no bright line test, courts will
generally
regard a defendant's claims of exclusive control in this situation
with
some skepticism. See Frazier v. Cupp, 394 U.S. 731, 740 (1969).
Even so, courts may honor claims to privacy where the defendant
has taken
some special steps to protect his personal effects from the scrutiny
of
others, and others lack ready access. 3 W. LaFave, supra 8.3(f),
at
259-60. In United States v. Block, 590 F.2d 535 (4th Cir. 1978),
the
Fourth Circuit
[page 16]
held that a mother's authority to permit police officers to
inspect her
23-year-old son's room did not include his locked footlocker
in the room.
The court stated that the authority to consent to search
cannot be thought automatically to extend to the interiors
of every
discrete enclosed space capable of search within the area....
Common
experience .... teaches all of us that the law's "enclosed
spaces"--
mankind's valises, suitcases, footlockers, strong boxes, etc.
-- are
frequently the objects of his highest privacy expectations, and
that the
expectations may well be at their most intense when such effects
are
deposited temporarily or kept semi-permanently in public places
or in
places under the general control of another.
Id. at 541.
In a footnote, however, the Block court noted that not every
"enclosed
space" within a room is exempt from the reach of the authorized
search
area. A rule of reason applies, one that considers the circumstances
"indicating the presence or absence of a discrete expectation
of privacy
with respect to a particular object: whether it is secured, whether
it is
commonly used for preserving privacy, etc." Id. at n.8.
Cf. United States
v. Sealey, 830 F.2d 1028, 1031 (9th Cir. 1987) (spousal consent
valid
because sealed containers were not marked in any way that would
indicate
defendant's sole ownership). Thus, creating a separate personal
directory
on a computer may not sufficiently mark it as exclusive, but
protecting
that separate directory with a secret password may "lock
the container."
In that event, if law enforcement analysts search the directory
by
breaking the password (because the co-user who consented to the
search
did not know that password), a court would probably suppress
the result.
Matlock did not address whether a consent search is valid
when police
have reasonably, but mistakenly, relied upon the consent of someone
who
appeared to have common authority over the premises, but in fact
did not.
In Illinois v. Rodriguez, 497 U.S. 177 (1990), however, the Supreme
Court
held that a consent search is valid when police are reasonable
in
thinking they have been given authorized consent. The Court cautioned,
however, that police cannot simply rely upon someone at the scene
who
claims to have authority if the surrounding circumstances indicate
otherwise. If such authority is unclear, the police are obligated
to ask
more questions. Determining who has power to consent is an objective
exercise, the Court stated, and the test is whether the
[page 17]
facts available to the police officer at the moment would
warrant a
person of reasonable caution to believe that the consenting party
had
authority over the premises. Id. at 2801.
b. Spouses
Under the Matlock "common authority" approach, most
spousal consent
searches are valid. Although spouses who create exclusive areas
may
preclude their partners from consenting to a search, that circumstance
will be unusual. Indeed* spouses do not establish "exclusive
use" just by
being the only one who uses the area; there must be a showing
that the
consenting spouse was denied access. 3 W. LaFave, supra p. 11,
8.4(a),
at 278. In United States v. Duran, 957 F.2d 499, 504-5 (7th Cir.
1992),
for example, the defendant and his wife lived on a farm with
several
outbuildings. The wife consented to the search of a building
which she
believed defendant used as a private gym, but the police found
marijuana
plants inside. The court emphasized the presumption that the
entire
marital premises are jointly held and controlled by the partners,
and
said this presumption can be overcome only by showing that the
consenting
spouse was actually denied access to the area in question.
With spouses, as with roommates, the Rodriguez "reasonable
belief" rule
(supra p. 16) allows investigating agents to draw reasonable
conclusions,
based upon the situation they encounter, about who has authority
to
consent. In the absence of objective evidence to the contrary,
agents
will be reasonable in presuming that spouses have authority to
consent to
a search of anything on the marital property. Illinois v. Rodriguez,
supra.
c. Parents
In some recent computer crime cases the perpetrators have
been relatively
young and, even if no longer legally minors, have resided with
their
parents. Under the Matlock rationale, it is clear that parents
may
consent to a search of common areas in the family home. Additionally,
with regard to minor children, the courts have found parents
to hold
superior rights in the
[page 18]
home and "even rather extraordinary efforts by the child
to establish
exclusive use may not be effective to undermine the parents'
authority
over their home, including rooms occupied by the child."
3 W. LaFave,
supra p. 15, 8.4(b), at 283. Therefore, if parents consent to
a search
and seizure of floppy disks or passwords locked in the minor
child's
room, that consent should be upheld.
The issue becomes more complicated, however, when the sons
and daughters
who reside with their parents are adults. In these situations,
courts may
reach the opposite result when, as a practical matter, the adult
child
has established an exclusive area in the home that the parents
have
respected. Id. at 285. See discussion of United States v. Block,
supra p.
15.
d. Employers
Employers may be either public (i.e., government) or private.
The
distinction is important because government employers, unlike
private
employers, are bound by the Fourth Amendment. In construing the
reach of
the Fourth Amendment into the workplace, the Supreme Court has
held that
government employers may search employee offices, without either
a
warrant or the consent of the employee, when the search is administrative
in nature; that is, it is work-related (e.g., the supervisor
needs to
find a case file) or involves work-related misconduct. O'Connor
v.
Ortega, 480 U.S. 709 (1987).
The Court found that government employees can have a reasonable
expectation of privacy even though the physical area is owned
by the
government. Id. at 717 (specifically rejecting a contention made
by the
Solicitor General that public employees can never have a reasonable
expectation of privacy in their place of work). The realities
of the
workplace, however, suggest that an employee's expectation of
privacy
must be reduced to the degree that fellow employees, supervisors,
subordinates, guests, and even the general public may have access
to that
individual's work space. Recognizing that government agencies
could not
function properly if supervisors had to establish probable cause
and
obtain a warrant whenever they needed to look for a file in an
employee's
office, the Supreme Court held that two kinds of searches are
exempt.
Specifically, both (1) a non-investigatory, work-related intrusion
and
(2) an investigatory search for evidence of suspected work-related
employee misfeasance are permissible without a warrant and should
be
judged by the standard of reasonableness. Id. at 725-6.
[page 19]
Even so, the court made clear that "[n]ot everything
that passes through
the confines of the business address can be considered part of
the
workplace context...." Id. at 717. For example, the contents
of an
employee's purse, briefcase, or closed luggage do not lose their
private
character just because the employee has brought them to work.
Thus, while
the circumstances may permit a supervisor to search in an employee's
desk
for a work-related file, the supervisor usually will have to
stop at the
employee's gym bag or briefcase. This analysis may have interesting
implications for "containers" like floppy disks, which
certainly may be
either work-related or private, depending on the circumstances.
It will
probably be reasonable for employers to assume that floppy disks
found at
an office are part of the workplace, but there may be cases where
a court
will treat a floppy disk as if it were a personal container of
private
items.
Of course, there may be some government agencies where employees
do
consent (either expressly or tacitly) to searches of even private
parcels
because of the nature of the job. For example, employees with
security
clearances who work with classified material may expect that
their
purses, briefcases, and other bags may be inspected under certain
circumstances. The factual variations on this "reasonable
expectation"
theme are endless, and are tied absolutely to the details of
each case.
The O'Connor Court did not address the appropriate standard
to be applied
when a government employee is being investigated for criminal
misconduct
or breaches of other non-work-related statutory or regulatory
standards.
Id. at 729. In a case involving employee drug testing, at least
one court
has noted, in dicta, that "[t]he government may not take
advantage of any
arguably relaxed `employer' standard for warrantless searches....when
its
true purpose is to obtain evidence of criminal activity without
complying
with the more stringent standards that normally protect citizens
against
unreasonably intrusive evidence-gathering." National Federation
of
Federal Employees v. Weinberger, 818 F.2d 935, 943 n.12 (D.C.
Cir. 1987).
Therefore, it would appear that whenever law enforcement is conducting
an
evidence-gathering search, even if the search is to take place
at a
government office, agents must either obtain a warrant or fall
within
some generally recognized exception to the warrant requirement.
Appropriate consent from a third party is, of course, one of
those
exceptions.
Generally speaking, an employer (government or private) may
consent to a
search of an employee's computer and peripherals if the employer
has
[page 20]
common authority over them. Agents and prosecutors must consider
whether,
under the facts, the employee would expect privacy in those items
and
whether that expectation would be objectively reasonable. Relevant
factors include whether (1) the area/item to be searched has
been set
aside for the employee's exclusive or personal use (e.g., does
the
employee have the only key to the computer or do others have
access to
the data); (2) the employee has been given permission to store
personal
information on the system or in the area to be searched; (3)
the employee
has been advised that the system may be accessed or looked at
by others;
(4) there have been past inspections of the area/item and this
fact is
known to the employee; and (5) there is an employment policy
that
searches of the work area may be conducted at any time for any
reason.
And when the employer is the federal government, another factor
is (6)
whether the purpose of the search was work-related, rather than
primarily
for law enforcement objectives. See generally O'Connor, 480 U.S.
at 717
(employee's expectation of privacy must be assessed in the context
of the
employment relationship).
There are currently no cases specifically addressing an employer's
consent to search and seize an employee's computer (and related
items).
But there are cases that discuss searches of an employee's designated
work area or desk. For example, the Seventh Circuit has upheld
the search
of a hotel room that served as a welfare hotel's business office
after
the hotel owner consented. United States v. Bilanzich, 771 F.2d
292 (7th
Cir. 1985). The room searched was used by the defendant/manager
of the
hotel for hotel business, the hotel's books were stored there,
and the
room was also used by doctors and welfare officials when they
visited
residents. The manager kept the key to the room. In affirming
the
manager's theft and forgery convictions (based in large part
on documents
seized from the business office/hotel room), the Seventh Circuit
found
that the hotel owner had the requisite control over and relationship
to
the business office to consent to its search. The court rejected
the
manager's argument that she had sole control over the business
office
because she generally had the key, finding that the owner could
request
access to the room at any time, that the room was shared with
others
(visiting physicians and welfare officials), and that the items
sought
were business records (e.g., welfare checks that the manager
had forged).
Thus, the manager did not have exclusive control over the area
nor was it
for her personal use. In addition, the purpose of the search
was
"employment related," since the manager was defrauding
the employer and
the customers.
[page 21]
In United States v. Gargiso, 456 F.2d 584, 587 (2d Cir. 1972),
the Second
Circuit upheld the search of a locked, wired-off area in the
basement of
a book company -- a search to which the highest official of the
book
company then on the scene (the company's vice president) had
consented.
The defendant, an employee of the book company, objected to the
search.
Both the defendant and the vice president had supervisory authority
over
the area searched, and both also had keys to the area, as did
other
company personnel. The court found that the vice president's
control over
the area was equal to that of the employee's, making the consent
effective. The vice president had sufficient control over the
area to
permit inspection in his own right and the employee had assumed
the risk
that the vice president would do so.
In Donovan v. A.A. Beiro Construction Co.. Inc., 746 F.2d
894, 900 (D.C.
Cir. 1984), the D.C. Circuit found the D.C. Government's consent
to a
search conducted by OSHA inspectors of a D.C. construction site
effective
against one of the contractors. The site was a large, multi-employer
area
surrounded by a chain link fence with no interior fences separating
the
various contractors' work areas. There was considerable overlap
and
interaction among the various contractors and their employees.
The Court
found that the defendant/contractor had no reasonable expectation
of
privacy in the area searched, because it was a common construction
site
shared by many. Thus, the defendant/contractor had assumed the
risk that
anyone with authority at the site would permit inspection of
the common
construction area.
In an earlier case, United States v. Blok, 188 F.2d 1019 (D.C.
Cir.
1951), the D.C. Circuit affirmed the reversal of a petty larceny
conviction of a government employee, finding that the search
of the
employee's desk violated the employee's right of privacy. The
court found
that the employee had exclusive use of the desk and a reasonable
expectation of privacy in it. Her employer's consent to a police
search
of the desk did not make the search reasonable. There was no
policy
putting employees on notice that they should not expect privacy
in their
desks. Nor was the search conducted by the employer for employment
purposes (e.g., searching for a file). "It was precisely
the kind of
search by policemen for evidence of a crime against which the
constitutional prohibition was directed." Id. at 1021 (quoting
the
district court). Thus, the employer's consent was ineffective
because the
area searched was for the employee's exclusive and personal use
(factor
number 1 above); the
[page 22]
purpose of the search was not work-related (factor number
6 above); and
there was no policy putting the employee on notice that her desk
might be
subject to search (factors number 3 and 5 above). Significantly,
the
O'Connor Court cited Blok with approval. O'Connor, 480 U.S. at
719.
e. Networks: System Administrators
Case law demonstrates that the courts will examine the totality
of the
circumstances in determining whether an employee has a reasonable
expectation of privacy or whether an employer shares authority
over the
employee's space and can consent to a search. But applying this
employer-consent case law to computer searches can become especially
troublesome when the employee's computer is not a stand-alone
container,
but an account on a large network server. The difficulty is a
practical
one. In the physical world, individuals often intuitively understand
their rights to control physical space and to restrict access
by others
because they can observe how everyone uses the space. For example,
with
filing cabinets, employees can see whether they are located in
private
areas, whether others have access, whether the cabinets are locked,
and
who has the keys. While explicit company policies certainly help
to
clarify the situation, employees can physically observe company
practices
and will probably conclude from their observations that certain
property
is or is not private.
By contrast, in an electronic environment, employees cannot
"see" when a
network administrator, supervisor, or anyone else accesses their
data.
They cannot watch the way people behave with data, as they can
with a
file cabinet, and deduce from their observations the measure
of privacy
they ought to expect. As a practical matter, system administrators
can,
and sometimes do, look at data. But when they do, they leave
no physical
clues which would tell a user they have opened one of his files.
Lacking
these physical clues, some users who are unfamiliar with computer
technology may falsely but honestly believe that their data is
completely
private. Will the courts hold this false belief to be one that
society is
prepared to recognize as reasonable? Will the courts still find
it
reasonable, even when a user knows that there are such people
as system
administrators who are responsible in some fashion for operating
and
securing the entire network? If so, do users who actually understand
the
technology and the scope of a system operator's access to data
[page 23] have a lesser expectation of privacy and fewer Fourth
Amendment
protections than users who are not so well informed? And what
happens in
the years ahead as our population becomes increasingly computer
literate?
Of course, these search and seizure questions are not limited
to
computer networks in the workplace. Universities, libraries,
and other
organizations, both public and private, may operate computer
networks on
which users store data which they consider private--either partly
or
completely. If those networks provide services to the public,
they will
be controlled by the provisions of 18 U.S.C. 2702, which limits
the
situations in which a service provider may release the contents
of
qualifying electronic mail. (For a detailed discussion of this
statute,
see "STORED ELECTRONIC COMMUNICATIONS," infra p. 85.)
But for material
which falls outside this statute, the Fourth Amendment analysis
discussed
above will still apply.
Prosecutors who face these issues at trial should be ready to
argue that
reasonable network users do, indeed, understand the role and
power of
system operators well enough to expect them to be able to protect
and
even restore their files. Therefore, absent some guarantees to
the
contrary, reasonable users will also expect system administrators
to be
able to access all data on the system. Certainly, if the system
has
published clear policies about privacy on the network or has
even
explained to users that its network administrators have oversight
responsibility and control, this will support the position that
a system
operator's consent to a search was valid. But if the network
and its
users have not addressed these issues and the situation is ambiguous,
the
safest course will be to get a warrant. (Of course, if the system
administrator does have authority to access and produce a user's
files
and simply will not do it on request, agents should use a subpoena.)
If agents choose to apply for a warrant and are concerned that
a
target/user will delete his data before they can execute the
search, the
agents should consider asking a cooperating system operator to
make and
keep a backup of the target's data, which they can later procure
under
the warrant or subpoena. The circumstances of each case will
dictate the
wisest approach, but agents and prosecutors should explore all
these
questions before they just ask a system administrator to produce
a user's
files. [page 24]
F. INFORMANTS AND UNDERCOVER AGENTS
As in other types of investigations, it is often helpful to use
informants or undercover agents to develop evidence. In some
cases, of
course, they may be of limited value (e.g., a case involving
a lone
hacker). Additionally, as a matter of policy, there may be restrictions
on the type of undercover activities in which agents may engage.
For
example, the FBI does not access bulletin boards simply to view
board
activities when there is no reason to believe the board is involved
in
criminal activity.
Generally speaking, however, the law allows informers to read
material
on electronic bulletin boards if they have the sysop's permission,
explicit or implicit, to access the material on the board. Many
BBSs, for
example, have parts of the board which are open to the public
and which
require no password or identification for access. Other boards
may have
isolated directories, known as sub-boards, that are open only
to paying
subscribers or trusted members, and those individuals must identify
themselves with passwords. Some sysops will ask newcomers to
"introduce"
themselves and will verify the new user's name, address, and
other
information before granting access with a password. These introductions
should follow the same rules that undercover work has traditionally
observed. Law enforcement agents need not identify themselves
as such,
but they must confine their activities to those that are authorized:
they
should not break into sections of the board for which they have
not been
given access. Indeed, the Ninth and Tenth Circuits have both
written, in
dicta, that an undercover participant must adhere scrupulously
to the
scope of a defendant's invitation to join the organization. United
States
v. Aguilar, 883 F.2d 662, 705 (9th Cir. 1989), cert. denied,
498 U.S.
1046 (1991); Pleasant v. Lovell, 876 F.2d 787, 803 (10th Cir.
1989).
Thus, an informant or undercover agent must not exceed his authorized
access, and having been granted access to some "levels"
of the board does
not give him permission to break into others.
[page 25]
III. SEIZING HARDWARE
Depending on the facts of the case, the seizure of computer hardware
itself can be justified on one of three theories without regard
to the
data it contains: (1) the hardware is itself contraband; (2)
the hardware
was an instrumentality of the offense; or (3) the hardware constitutes
evidence of an offense. Of course, in many cases, hardware may
be
seizable under more than one theory. For example, if a hacker
uses his
computer to insert viruses into other systems, his computer may
constitute both an instrumentality of the offense and evidence
admissible
in court.
As noted above under Definitions, (supra p. 2), hardware is defined
as
the physical components of a computer system such as the central
processing unit (CPU), keyboard, monitor, modem, and printer.
A. THE INDEPENDENT COMPONENT DOCTRINE
We must highlight once again that computer systems are really
a
combination of connected components (often by wire but increasingly
by
wireless means). To say that the government has probable cause
to seize a
"computer" does not necessarily mean it has probable
cause to seize the
entire computer system (i.e., the computer and all connected
peripheral
devices). Indeed, each component in a computer system should
be
considered independently.
In a strictly corporeal world, this doctrine is easy to understand
and
apply. For example, suppose a defendant stole a television and
placed it
on a television stand that he lawfully owned. Agents with a warrant
for
that television would not seize the stand, recognizing that the
two items
are easily separable and that there is, simply put, no justification
for
taking the stand.
With computers, the roles of the different attached components
are not
always separable and it is more difficult to think in such concrete
terms. For example, agents with a warrant to seize a target's
workstation
may discover that the workstation is nothing more than a dumb
terminal,
and that all the evidence is in the server to which the dumb
terminal is
connected by wire.
[page 26]
Nonetheless, it is simply unacceptable to suggest that any
item
connected to the target device is automatically seizable. In
an era of
increased networking, this kind of approach can lead to absurd
results.
In a networked environment, the computer that contains the relevant
evidence may be connected to hundreds of computers in a local-area
network (LAN) spread throughout a floor, building, or university
campus.
That LAN may also be connected to a global-area network (GAN)
such as the
Internet. Taken to its logical extreme, the "take it because
it's
connected" theory means that in any given case, thousands
of machines
around the world can be seized because the target machine shares
the
Internet.
Obviously, this is not the proper approach. The better view is
to seize
only those pieces of equipment necessary for basic input/output
(i.e.,
the computer itself, plus the keyboard and monitor) so that the
government can successfully execute the warrant. When agents
prepare
warrants for other devices, they should list only those components
for
which they can articulate an independent basis for search or
seizure
(i.e., the component itself is contraband, an instrumentality,
or
evidence). Certainly, the independent component doctrine does
not mean
that connected devices are exempt; it only requires that agents
and
prosecutors articulate a reason for taking the item they wish
to seize.
For example, if the defendant has sent letters to the White House
threatening the President's life, agents should explain, as a
basis for
seizing the target's printer, the need to compare its type with
the
letter. Additionally, there may be other times when the government
should
seize peripherals that do not contain evidence but, again, there
must be
a separate basis for the seizure. See, e.g., "Seizing Hardware
and
Documentation so the System Will Operate at the Lab," infra
p. 62.
B. HARDWARE AS CONTRABAND OR FRUITS OF CRIME
Federal Rule of Criminal Procedure 41(b)(2) authorizes warrants
to seize
"contraband, the fruits of crime, or things otherwise criminally
possessed." The rationale behind such seizures is to prevent
and deter
crime. See Warden v. Hayden, 387 U.S. 294, 306 n.11 (1967). Often
the
fruits of crime and
[page 27]
objects illegally possessed will also constitute evidence
of a crime, so
that they also can be seized to help apprehend and convict criminals
(see
infra p. 30).
2. Contraband and Fruits of Crime Defined The fruits of crime
include
property obtained by criminal activity, United States v. Santarsiero,
566
F. Supp. 536 (S.D.N.Y. 1983) (cash and jewelry obtained by use
of a
counterfeit credit card), and contraband is property which the
private
citizen is not permitted to possess, Warden v. Hayden, supra;
Aguilar v.
Texas, 378 U.S. 108 (1964) (narcotics). Even plans to commit
a crime may
constitute contraband. Yancey v. Jenkins, 638 F. Supp. 340 (N.D.
Ill.
1986).
Of course, many objects which are fruits of crime or illegally
possessed
are innocent in themselves and can be possessed by at least certain
persons under certain conditions. See, e.g. United States v.
Truitt, 521
F.2d 1174, 1177 (6th Cir. 1975) (noting that a person legally
can possess
a sawed-off shotgun if it is properly registered to its owner,
though its
lawful possession is rare). A court reviewing a seizure under
Rule
41(b)(2) will examine whether the circumstances would have led
a
reasonably cautious agent to believe that the object was a fruit
of crime
or was illegally possessed. For example, the seizure of jewelry
as a
fruit of crime in Santarsiero was upheld because a reliable informant
had
told officers that the suspect had boasted of using counterfeit
credit
cards to purchase jewelry. 566 F. Supp. at 544-45.
Certainly, there are instances where computer hardware and software
are
contraband or a fruit of crime. For example, there have been
several
recent cases involving the theft of computer equipment. Additionally,
hackers have been known to penetrate credit reporting companies,
illegally obtain credit card numbers, and then order computer
equipment
with these illegal access devices. In such cases, the equipment
that they
receive is a product of the fraud and should be seized as such.
[page 28]
C. HARDWARE AS AN INSTRUMENTALITY OF THE OFFENSE
1. Authority for Seizing Instrumentalities
Federal Rule of Criminal Procedure 41(b)(3) authorizes warrants
to seize
the instrumentalities of crime; that is, "property designed
or intended
for use or which is or has been used as the means of committing
a
criminal offense." The historical justification for the
government's
ability to seize instrumentalities of crime is the prevention
of their
use to commit future crimes. See Warden v. Hayden, 387 U.S. 294,
306 n.11
(1967); United States v. Boyette, 299 F.2d 92, 98 (4th Cir.)
(Sobeloff,
C.J., dissenting), cert. denied, 369 U.S. 844 (1962).
2. Instrumentalities Defined
An instrumentality of an offense is any machinery, weapon, instrument,
or other tangible object that has played a significant role in
a crime.
See, e.g., United States v. Viera, 569 F. Supp. 1419, 1428 (S.D.N.Y.
1983) (sophisticated scale used in narcotics trafficking and
black light
used in counterfeiting currency). Where the object itself is
innocent in
character, courts will assess its role in the crime to determine
whether
it was an instrumentality. Compare United States v. Markis, 352
F.2d 860,
864-65 (2d Cir. 1965) (telephone used to take bets by operators
of
illegal wagering business was an instrumentality because it was
integral
to the criminal enterprise), vacated without opinion, 387 U.S.
425
(1967), with United States v. Stern, 225 F. Supp. 187, 192 (S.D.N.Y.
1964) (Rolodex file was not instrumentality where it contained
names of
individuals involved in tax fraud scheme). As stated by the Southern
District of New York:
Not every article that plays some part in the commission of
the alleged
crime is a means of committing it. .... Although it is not necessary
that the crime alleged could not have been committed but for
the use of
the article seized, after a consideration of all the circumstances
it
must appear that the article played a significant role in the
commission
of the crime alleged.
[page 29]
Stern, 225 F. Supp. at 192 (emphasis in original).
Before the Supreme Court's decision in Warden v. Hayden, 387
U.S. 294
(1967), courts held that seizable property included instrumentalities,
but did not include mere evidence. See generally 3 Wright &
Miller,
Federal Practice and Procedure: Criminal 2d 664 (1982). In practice,
however, judges were reluctant to suppress useful pieces of evidence
at
trial, preferring instead to interpret the term "instrumentality"
broadly
enough to encompass items of evidentiary value. For example,
the district
court in United States v. Robinson, 287 F. Supp. 245 (N.D. Ind.
1968),
upheld the seizure of the following items, all of which connected
the
defendant to the murder of a federal narcotics agent, as
"instrumentalities" of the crime and not "mere
evidence": a pair of
shoes, a shirt, a jacket, handkerchiefs, spent shell casings,
and wet
washcloths. Such legal gymnastics were abandoned when the Supreme
Court
held, in Hayden, that the Fourth Amendment principally protected
privacy
rights, not property rights, and secured "the same protection
of privacy
whether the search is for 'mere evidence' or for fruits,
instrumentalities or contraband." Hayden, 387 U.S. at 306-07.
Although items that are evidence of crime may now be seized along
with
instrumentalities, fruits, and contraband, this historical perspective
is
important for understanding why some early decisions may have
categorized
evidentiary items as instrumentalities. Moreover, the distinction
between
"an instrumentality" and "mere evidence"
remains critical in computer
crime cases because it may determine the government's ability
to seize
hardware. If a computer and all its peripherals are instrumentalities
of
a crime, the warrant should authorize the seizure of these items.
But if
we are seeking the computer only for the documents (mere evidence)
it
contains, it may be more difficult to justify the seizure or
retention of
hardware.
Applying the independent component doctrine to the rule permitting
seizure of instrumentalities will, in most cases, not be difficult.
For
example, if an individual engaging in wire fraud printed out
thousands of
phony invoices on his home computer, it would be reasonable to
take the
computer, monitor, keyboard, and printer. If the individual
electronically mailed these invoices to his victims, it would
also be
appropriate to seize his external modem (if the modem were internal
it
would, of course, be seized when the agents took the computer
itself).
If, instead of using electronic mail, he used a conventional
fax machine,
it would be reasonable to seize the fax as it, too would have
played a
significant role in the commission of the offense.
[page 30]
D. HARDWARE AS EVIDENCE OF AN OFFENSE
1. Authority for Seizing Evidence
In 1972, Federal Rule of Criminal Procedure 41(b) was amended
to
authorize seizing "mere evidence" of a crime. In relevant
part, the Rule
now states: "A warrant may be issued under this rule to
search for and
seize any (1) property that constitutes evidence of the commission
of a
criminal offense...."
2. Evidence Defined
A physical item is evidence if it will aid in apprehending or
convicting
a person who has committed a crime. The evidence seized need
not be
admissible at trial.
Courts will evaluate a seizure under this test according to what
a
reasonable person would believe under the circumstances, and
law
enforcement officers will not be judged after-the-fact on how
helpful the
seized evidence actually was in apprehending or convicting a
suspect. See
Andresen v. Maryland, 427 U.S. 463, 483 (1976) (holding that
the "trained
special investigator reasonably could have believed" the
seized evidence
could be used to show criminal intent); United States v. Truitt,
521 F.2d
1174, 1176-78 (6th Cir. 1975) (holding that a reasonably cautious
police
officer could have believed under the circumstances that a sawed-off
shotgun, although legal if registered, was incriminating evidence).
Of course, simply because an item is "evidence of a crime"
does not mean
that other restrictions may not apply. Law enforcement officials
should
be aware of other limits imposed by the Constitution, statutes,
and
regulations upon the seizure of evidence. See, e.g., Guidelines
on
Methods of Obtaining Documentary Materials Held by Third Parties,
28
C.F.R. 59.1-.6 (governing the application for search warrants
for
documentary evidence held by non-suspect third parties).
[page 31]
Although computers commonly contain evidence, sometimes they
are
evidence. If an extortionist sent a letter to his victim with
unique
print characteristics (e.g., the top half of the letter "W"
was missing),
his daisy~wheel printer would constitute evidence which could
be seized.
E. TRANSPORTING HARDWARE FROM THE SCENE
Whether a computer is seized as contraband, an instrumentality,
or
evidence, it is important to transport it properly. With some
simple
computers, moving the equipment is a straightforward proposition.
But
computer systems are becoming so increasingly complex and diverse
that it
is harder than ever for technically untrained agents to avoid
mistakes.
These Guidelines cannot possibly substitute for the expertise
that comes
from special training courses in seizing, searching, and preserving
electronic evidence. Indeed, the discussion that follows is meant
only as
introduction and orientation to these issues, and not as a comprehensive
guide to all the technical contingencies which may arise during
a search.
The team for a computer-related search should, if possible, include
at
least one technically trained agent to act as a leader in these
areas.
Clearly, as complex computer systems become increasingly common,
law
enforcement agencies will need more trained agents at almost
every crime
scene. In the meantime, the following discussion may help prosecutors
and
investigators to anticipate the problems which can confront them.
First, agents must protect the equipment from damage. Second,
to the
extent they are transporting information storage devices (e.g.,
hard
drives, floppy disks), improper handling can cause loss of data.
Third,
it may be impossible to make the system work in the field office,
laboratory, or courtroom if the seizing agents did not carefully
pack and
move the computer system so that it can be successfully reassembled
later.
Before the search begins, the search leader should prepare
a detailed
plan for documenting and preserving electronic evidence, and
should take
time to carefully brief the entire search team to protect both
the
identity and integrity of all the data. At the scene, agents
must
remember to collect traditional types of evidence (e.g., latent
fingerprints off the keyboard) before touching anything. They
must
remember, too, that computer data can be destroyed by strong
magnetic
fields. (Low density magnetic media is more susceptible to such
[page 32]
interference than high density media.) Last, some computer
experts will
not examine evidence if anyone else has already tried to search
or
manipulate the data. Their chain-of-custody and integrity-of-evidence
procedures will not allow them to examine the computer if its
original
crime-scene seal has been broken.
The agents executing the actual search must take special precautions
when
disassembling and packing computer equipment. This careful approach
protects not only the hardware items, but also the integrity
and
accessibility of the data inside. Before disconnecting any cables,
it is
helpful to videotape or photograph the site (including the screen,
if
possible, and all wiring connections) and prepare a wiring schematic.
This will document the condition of the equipment upon the agents'
arrival and show how the system was configured. Agents should
disconnect
all remote access to the system (e.g., unplug the telephone cord,
not the
power cord, from the modem) and disconnect network cables from
the
servers so that no one can alter or erase information during
the search.
Investigators need to accurately label each cable and the device
and port
to which the cable connects before disconnecting anything. It
is a good
idea to attach tags at every connection point on every cable
to record
all relevant information. It is especially important to label
every
vacant port as "vacant" so that there is no confusion
later. (If vacant
ports are not labeled, it is impossible for an expert to tell
whether the
unlabeled port was in fact vacant, or whether an important label
simply
fell off.) Once this is done, agents are ready to disassemble,
tag and
inventory the equipment.
Investigators must determine which drives, disks, and other
magnetic
media need to be protected. If a hard disk drive is being moved,
they
must insure that the read/write heads are secured to prevent
damage. Some
systems secure (park) the heads automatically whenever the machine
is not
in use, but other systems may require that a specific command
be executed
or that the heads be secured mechanically. The manufacturer's
operating
manual should specify the proper procedure for each system.
Agents should protect floppy disk drives according to manufacturer's
recommendations. Some suggest inserting a new diskette or piece
of
cardboard in the drive slot; others do not. (As with hard drives,
each
manufacturer's instructions may be found in the system manual).
Investigators must also label diskettes (either individually
or in
groups), mark them as evidence and place them in non-plastic
evidence
containers.
[page 33]
Agents must be conscious of static electricity buildup during
the
execution of the warrant since static electricity can "zap"
a disk and
damage data. So can degaussing equipment (an electronic appliance
that
creates a strong magnetic field and can be used to effectively
erase a
magnetic tape or disk). A well-known story in law enforcement
circles
involves a hacker who allegedly magnetized his metal door frame,
thus
creating a magnetic field that erased magnetic media as agents
carried it
through the doorway. This story has not been verified and, even
if true,
such an event is unlikely to occur now because high density media
is not
easily disrupted by magnetic fields. Nonetheless, a device to
measure
magnetic fields (a compass or, even better, a gaussmeter) can
determine
whether such fields exist and, as a general rule, agents should
avoid
placing magnetic media near any strong magnetic field. Magnetic
fields
may be created by telephones, radio transmitters, and photocopiers.
Additionally, although magnetic media has often been taken through
airport metal detectors and X-ray machines without damage, it
is wiser
not to take magnetic media through these devices. (It is the
motor
driving the conveyor belt on the X-ray machine, not the fluoroscope
itself, that creates the magnetic field which causes the damage.)
Transporting agents should keep all hardware and software
in dust-free,
climate-controlled environments. Computer-related evidence is
sensitive
to heat and humidity and should not be stored in the back seat
or trunk
of a car without special precautions. Temperature extremes may
render
magnetically stored evidence unreadable, and various types of
contamination can damage electronic equipment. A safe range for
storing
magnetic media is between 40-90F and 20%-80% humidity, free of
dust and
tobacco smoke.
[no page 34] [page 35]
IV. SEARCHING FOR AND SEIZING INFORMATION
A. INTRODUCTION
Hardware searches are not conceptually difficult. Like searching
for
weapons, the items sought are tangible. They occupy physical
space and
can be moved in familiar ways. Searches for data and software
are far
more complex. For purposes of clarity, these types of searches
must be
examined in two distinct groups: (1) searches where the information
sought is on the computer at the search scene and (2) searches
where the
information sought has been stored off-site, and the computer
at the
search scene is used to access this off-site location.3
In some cases, the distinction is insignificant, and many
topics covered
in this section apply equally to both types of searches. On the
other
hand, there are certain unique issues that arise only when the
computer
is part of a network. For example, since Fed. R. Crim. P. 41(a)
requires
that a search warrant be issued by a court in the district where
the
property is located, agents may have to get a second warrant
in another
district if the target has sent data to a distant computer. See
"Describing the Place to be Searched," infra p. 92.
Although "property" is defined in Federal Rule of
Criminal Procedure
41(h) to include "documents, books, papers and other tangible
objects,"
(emphasis added), courts have held that intangible property such
as
information may be seized. In United States v. Villegas, 899
F.2d 1324,
1334-35 (2d Cir.), cert. denied, 498 U.S. 991 (1990), the Second
Circuit
noted that warrants had been upheld for intangible property such
as
telephone numbers called from a given phone line and recorded
by a pen
register, conversations overheard by means of a microphone touching
a
heating duct, the movement of property as tracked by location-monitoring
beepers, and images seized with video cameras and telescopes.
The court
in Villegas upheld a warrant which authorized agents to search
a cocaine
factory and covertly take photographs without authorizing the
seizure of
any tangible objects. But see United States
-------------------------
3 Any home PC can be connected to a network simply by adding
a modem.
Thus, in any ease where a modem is present, agents should consider
the
possibility that the computer user has stored valuable information
at
some remote location.
[page 36]
v. Johns, 948 F.2d 599 (9th Cir. 1991), cert. denied, 112
S. Ct. 3046
(1992) (a "sneak and peek" warrant executed without
giving notice to the
defendants that the search had occurred violated Rule 41(d)).
B. INFORMATION AS CONTRABAND
The same theories which justify seizing hardware--contraband
or fruit of
crime, instrumentality, or evidence--also apply to seizing information.
See "Authority for Seizing Contraband or Fruits of Crime,"
supra p. 26.
Because individuals often obtain copies of software in violation
of
copyright laws, it may be appropriate to seize that software
as well as
any documentation (such as photocopied software manuals) because
they
are likely to be illegally obtained. (Software producers may
allow a
purchaser to make a backup copy of the software bought, but these
copies
may not be disseminated because of copyright laws.) Lists of
telephone
card access codes and passwords for government computer networks
may also
be considered contraband, because their possession is prohibited
by
statute if the possessor has the requisite mens rea. 18 U.S.C.
1029(a)(3), 18 U.S.C. 1030(a)(6).
C. INFORMATION AS AN INSTRUMENTALITY
Rule 41(b) broadly defines what may be seized as an instrumentality:
any
"property designed or intended for use or which is or has
been used as
the means of committing a criminal offense." Fed. R. Crim.
P. 41(b)(3).
This includes both tangible and intangible property. See United
States
v. Villegas, supra, p. 35. Thus, in some cases, informational
documents
and financial instruments which have been used in the commission
of an
offense may be seized as instrumentalities of crime. Compare
Abel v.
United States, 362 U.S. 217, 237-9 (1960) (documents used in
connection
with suspect's illegal alien status were instrumentalities, including
phony birth certificates, bank records,
[page 37]
and vaccination records) with Application of Commercial Inv.
Co., 305 F.
Supp. 967 (S.D.N.Y. 1969) ($5 million in securities were not
instrumentalities where the government suspected improprieties
with an
$18,000 brokerage account and the securities were at most "incidental"
to
the offense).
Likewise, investigators should seize objects if they are "designed
or
intended for use" as instrumentalities. Fed. R. Crim. P.
41(b)(3).
Sometimes an item will obviously fit that description (like software
designed to help hackers crack passwords or lists of stolen credit
card
numbers) but, at other times, it may not be so simple. Even so,
as long
as a reasonable person in the agent's position would believe
the item to
be an instrumentality, the courts will probably respect the agent's
judgment. This is, after all, the same test used to determine
when an
object would aid apprehension or conviction of a criminal. See
Andresen
v. Maryland, 427 U.S. 463, 483 (1976). As such, the particular
facts of
the case are very important. For example, if an agent investigating
the
sysop of an illegal bulletin board knows that the board only
operates on
one personal computer, a second computer sitting in the same
room is
probably not an instrumentality. But if the agent has heard from
a
reliable informant that the suspect has boasted about expanding
his
operation to a second board, that second computer is probably
"intended"
as an instrumentality, and the agent should take it. Additionally,
if the
suspect has substantially modified a personal computer to enhance
its
usefulness for a particular crime (perhaps by installing
password-cracking software), an agent might well reasonably believe
that
the computer and the software was "designed" for criminal
activity.
D. INFORMATION AS EVIDENCE
Before the Supreme Court's rejection of the "mere evidence"
rule in
Warden v. Hayden, 387 U.S. 294, 300-301 (1967), courts were inconsistent
in ruling whether records that helped to connect the criminal
to the
offense were instrumentalities of crime (and thus seizable),
or were
instead merely evidence of crime (and thus not seizable). Compare
Marron
v. United States, 275 U.S. 192 (1927) (approving prohibition
agent's
seizure of bills and ledger books belonging to speakeasy operators
as
instrumentalities of crime) with United States v. Lefkowitz,
285 U.S. 452
(1932)(disapproving prohibition agent's seizure of papers intended
to
solicit orders for illegal liquor). Indeed, several courts have
concluded
that, when it comes to documents, it is impossible to
[page 38]
separate the two categories. See Hayden, 387 U.S. at 302 (stating
that
the distinction between mere evidence and instrumentalities "is
wholly
irrational, since, depending on the circumstances, the same `papers
and
effects' may be `mere evidence' in one case and `instrumentality'
in
another"); United States v. Stern, 225 F. Supp. 187, 191
(S.D.N.Y. 1964)
("It would be hazardous to attempt any definition [of papers
that are
instrumentalities of crime and not mere evidence]; we shall not.").
Now
that evidence of crime may be seized in the same way as instrumentalities
of crime, it is useful to acknowledge that, in most instances,
documents
and other information connecting the criminal to his offense
should be
viewed as evidence of the crime, and not as instrumentalities.
For
example, in United States v. Lindenfield, 142 F.2d 829, 830-32
(2d Cir.),
cert. denied, 323 U.S. 761 (1944), the prescription records of
a doctor
who illegally prescribed morphine to "patients" were
classified as
evidence, not as instrumentalities.
The prescription records in Lindenfield illustrate the sort
of document
that may be seized as evidence: records that reveal the operation
of the
criminal enterprise over time. Other examples include the customer
lists
of narcotics traffickers, telephone bills of hackers who break
into
computer networks, and plans for the fraud or embezzlement of
corporate
and financial targets. This documentary evidence may be in paper
or book
form, or it may be stored electronically in a computer or on
a backup
tape. As with other types of evidence, documents may be seized
if they
aid in showing intent and the absence of mistake on the suspect's
part,
even though they may not relate directly to the commission of
the crime,
but to some other similar transaction instead. See Andresen v.
Maryland,
427 U.S. 463, at 483-84 (1976)(approving seizure of documents
about a
second transaction because they showed criminal intent and absence
of
mistake in the first transaction).
1. Evidence of Identity
Evidence of a crime also includes various types of identification
evidence. For example, courts have recognized that clothing seen
worn by
a criminal during the commission of the offense constitutes evidence
of
the crime,
[page 39]
because it helps to tie the suspect to the crime. See, e.g.,
United
States v. Korman, 614 F.2d 541, 547 (6th Cir.)(approving the
seizure of a
green ski jacket as both evidence of and an instrumentality of
the
crime), cert. denied, 446 U.S. 952 (1980).
Documents that incriminate a suspect's co-conspirators also
may be seized
as evidence because they help identify other involved parties
and connect
them with the suspect. See, e.g., United States v. Santarsiero,
566 F.
Supp. 536, 544 (S.D.N.Y. 1983) (approving the seizure of the
suspect's
notebook in a counterfeit credit card investigation where others
were
working with or purchasing cards from him, and the notebook contained
telephone numbers that the investigating officers could reasonably
believe would help in identifying and connecting others with
the
suspect's crimes). In many computer crimes, we have found that
hackers
work jointly and pool hacking information. In these cases, telephone
records may prove this connection. Moreover, agents may seize
evidence
that helps identify the occupant of a home or office connected
to the
crime, where the home or office is used regularly by more than
one
person. See, e.g., United States v. Whitten, 706 F.2d 1000, 1008-09
(9th
Cir. 1983)(approving the seizure of telephone books, diaries,
photos,
utility bills, telephone bills, personal property, cancelled
mail, keys,
rent receipts, deeds, and leases that helped establish who owned
and
occupied premises used for a large scale narcotics operation,
where the
premises were used by more than one person and the warrant authorized
seizing items "indicating the ownership or occupancy of
the residence"),
cert. denied, 465 U.S. 1100 (1984). As with houses and offices,
computers
are often used by more than one person, and this sort of evidence
may
help establish just who used the computer or computers to commit
the
crime.
2. Specific Types of Evidence
a. Hard Copy Printouts
Any information contained in a computer system may have been
printed out
by the target of the investigation. Finding a printed copy may
be
valuable for a number of reasons. First, a printout may display
an
earlier version of
[page 40]
data that has since-been altered or deleted. Second, in certain
electronic environments (such as bulletin boards), individuals
may claim
to lack knowledge about what information is electronically stored
in the
computer (e.g., a bulletin board operator may disavow any knowledge
that
his board contained illegal access codes that were posted and
downloaded
by others). Finding printed copies in someone's possession may
negate
this defense. Third, the printouts may tie the crime to a particular
printer which, in turn, may be seizable as an instrumentality
(e.g., the
printouts may reveal that extortionate notes were printed on
a certain
printer, thus warranting seizure of the printer).
b. Handwritten Notes
Finally, agents should be alert for notes in manuals, on the
equipment,
or in the area of the computer. These may provide critical keys
to
breaking passwords, finding the file or directory names of important
data, operating the hardware or software, identifying the suspect's
electronic or telephone connections with co-conspirators and
victims, or
finding login names or accounts.
E. PRIVILEGED AND CONFIDENTIAL INFORMATION
1. In General
Warrants to search computers which contain privileged information
must
meet the same requirements as warrants to search for and seize
paper
documents under similar conditions; that is, the warrant should
be
narrowly drawn to include only the data pertinent to the investigation,
and that data should be described as specifically as possible.
See, e.g.
Klitzman v. Krut, 744 F.2d 955 (3d Cir. 1984). Since a broad
search of
computers used by confidential fiduciaries (e.g., attorneys or
physicians) is likely to uncover personal information about individuals
who are unconnected with the
[page 41]
investigation, it is important to instruct any assisting forensic
computer experts not to examine files about uninvolved third
parties any
more than absolutely necessary to locate and seize the information
described in the warrant.
a. Doctors, Lawyers, and Clergy
Federal law recognizes some, but not all, of the common law
testimonial
privileges. Fed. R. Evid. 501. Indeed, Congress has recognized
a "special
concern for privacy interests in cases in which a search or seizure
for
.... documents would intrude upon a known confidential relationship
such
as that which may exist between clergyman and parishioner; lawyer
and
client; or doctor and patient." 42 U.S.C. 2000aa-11(1)(3).
At Congress's
direction, see 42 U.S.C. 2000aa-11(a), the Attorney General has
issued
guidelines for federal officers who want to obtain documentary
materials
from disinterested third parties. 42 U.S.C. 2000aa-11. Under
these
rules, they should not use a search warrant to obtain documentary
materials believed to be in the private possession of a disinterested
third party physician, lawyer, or clergyman where the material
sought or
likely to be reviewed during the execution of the warrant contains
confidential information on patients, clients, or parishioners.
28 C.F.R.
59.4(b). A search warrant can be used, however, if using less
intrusive
means would substantially jeopardize the availability or usefulness
of
the materials sought; access to the documentary materials appears
to be
of substantial importance to the investigation; and the application
for
the warrant has been recommended by the U.S. Attorney and approved
by the
appropriate Deputy Assistant Attorney General. 28 C.F.R. 59.4(b)(1)
and
(2).
b. Publishers and Authors
Additionally, Congress has expressed a special concern for
publishers and
journalists in the Privacy Protection Act, 42 U.S.C. 2000aa.
Generally
speaking, agents may not search for or seize any "work product
materials"
(defined by statute) from someone "reasonably believed to
have a purpose
to disseminate to the public a newspaper, book, broadcast, or
other
similar form of public communication." 42 U.S.C. 2000aa(a).
In
addition, as an even
[page 42]
broader proposition, government officers cannot search for
or seize
"documentary materials" (also defined) from someone
who possesses them in
connection with a purpose to similarly publish. 42 U.S.C. 2000aa(b).
These protections do not apply to contraband, fruits of a crime,
or
things otherwise criminally possessed. 42 U.S.C. 2000aa-7.
Although this provision may seem, at first blush, to have
a somewhat
limited application for law enforcement, it has emerged as a
frequent
issue in computer searches. Because even a stand-alone computer
can hold
thousands of pages of information, it is common for users to
mix data so
that evidence of crime is commingled with material which is innocuous--or
even statutorily protected. And as a technical matter, analysts
sometimes
cannot recover the electronic evidence without, in some manner,
briefly
searching or seizing the protected data. Moreover, this problem
becomes
exponentially more difficult, both legally and practically, if
the target
computers are part of a network which holds the work of many
different
people. The larger the network and the more varied its services,
the
harder it is to predict whether there might be information on
the system
which could arguably qualify for statutory protection. (This
complex area
of the law is discussed in detail at "THE PRIVACY PROTECTION
ACT, 42
U.S.C. 2000aa," infra p. 72. It is critical that prosecutors
and agents
read this section and the statute with care before undertaking
a search
which may intrude on protected materials.)
2. Targets
If the person who holds the documents sought is not "disinterested"
but a
target of the investigation, the rules are understandably different.
In
those cases, agents may get a warrant to search the files for
confidential information (regardless of whether that information
is
technically "privileged" under Federal law), but the
warrant should be
drawn as narrowly as possible to include only information specifically
about the case under investigation.
When the target of an investigation has complete control of
the computer
to be searched (such as a stand-alone PC), it may be difficult
to find
all the evidence without examining the entire disk drive or storage
diskettes. Even in situations like these, it may be possible
to get other
people in the suspect's office to help locate the pertinent files
without
examining everything. When a
[page 43]
computer must be removed from the target's premises to examine
it, agents
must take care that other investigators avoid reading confidential
files
unrelated to the case. Before examining everything on the computer,
analysts should try to use other methods to locate only the material
described in the warrant. Finally, as experts comb for hidden
or erased
files or information contained between disk sectors, they must
continue
to protect the unrelated, confidential information as much as
possible.
3. Using Special Masters
In rare instances, the court may appoint a special master
to help search
a computer which contains privileged information. See, e.g.,
DeMassa v.
Nunez, 747 F.2d 1283 (9th Cir. 1984). A neutral master would
be
responsible to the court, and could examine all the documents
and
determine what is privileged. If the court appoints a master,
the
government should ask for a neutral computer expert to help the
master
recover all the data without destroying or altering anything.
In cases
like these, the computer expert needs detailed instructions on
the search
procedures to be performed. In no event should the target of
the search
or his employees serve as the master's computer expert.
F. UNDERSTANDING WHERE THE EVIDENCE MIGHT BE: STAND- ALONE
PCs, NETWORKS
AND FILE-SERVERS, BACKUPS, ELECTRONIC BULLETIN BOARDS, AND ELECTRONIC
MAIL
1. Stand-Alone PCs
When searching for information, agents must not overlook any
storage
devices. This includes hard drives, floppy disks, backup tapes,
CD-ROMs4,
[page 44]
WORM drives 5, and anything else that could hold data. In
addition,
notwithstanding the high-tech nature of computer searches, investigators
must remember basic evidentiary techniques. If identification
is an
issue, they should look for fingerprints or other handwritten
notes and
labels that may help prove identity. If data is encrypted, a
written copy
of the password is clearly important.
--------------------------
4 CD-ROM stands for Compact Disk--Read Only Memory. Much like
a compact
disk for music, it allows the user to search for and read information
without being able to alter it.
5 WORM stands for Write Once Read Many. The user can write
large amounts
of information to a platter (a large disk); but once written,
the platter
can only be read, not altered.
a. Input/Output Devices: Do Monitors, Modems, Printers, and
Keyboards
Ever Need to be Searched?
Prosecutors must always keep in mind the independent component
doctrine (
supra p. 25); that is, there must be a basis for seizing each
particular
item. If agents are only searching for information, it may be
senseless
to seize hardware that cannot store information.
That said, it is important to remember that information can
be retrieved
from many hardware devices, even those not normally associated
with a
storage function. Generally speaking, input and output (I/O)
devices such
as keyboards, monitors, and printers do not permanently store
data. Most
data is stored on devices such as hard drives, CD-ROMs, and floppy
disks.
By contrast, I/O devices are used to send data to, and receive
data from,
the computer. Once the computer is turned off, I/O devices do
not store
information. For example, when a computer is turned off, the
information
on the screen is lost unless it has been saved to a storage device.
However, there are significant exceptions to this general
rule. A trained
computer specialist, using specialized techniques, may find data
or other
evidence even on I/O devices. The following list is not all-inclusive,
but rather offers some examples of I/O devices that may provide
useful
evidence even after they have been turned off.
(1) Laser printers -- It may be possible to search for images
of the last
page printed on laser printers. This technique requires planning
because
the expert must examine the printer before it is moved. If this
type of
evidence may be needed, a computer expert must be ready at the
[page 45]
scene with the necessary equipment. Additionally, paper containing
information may still be inside a laser printer due to a paper
jam that
was not cleared.
(2) Hard disk print buffers -- Some laser printers have five-
or
ten-megabyte hard drives that store an image before it prints,
and the
information will stay on the drive until the printer runs out
of memory
space and writes over it. One example of a printer that may have
an
internal hard drive is the Qume 1000 Color Printer. An expert
would be
able to search the hard drive for information sent to and stored
by that
printer.
(3) Print Spooler Device -- This device holds information
to be printed.
The spooler may be holding a print job if the printer was not
ready to
print when the print command was given (e.g., the printer was
not turned
on or was out of paper). This device should be handled at the
scene since
the information will be lost when power is disrupted.
(4) Ribbon printers -- Like old typewriter ribbons, printer
ribbons
contain impressions from printed jobs. These impressions can
be recovered
by examining the ribbon.
(5) Monitors -- Any burning of the screen phosphorus may reveal
data or
graphics commonly left on the screen.
(6) Keyboards -- Although they do not normally store information,
some
unusual keyboards are actually computer workstations and may
contain an
internal diskette drive.
(7) Hard Cards -- These appear to be a typical function board
but they
function like a hard disk drive and store information.
(8) Scanner -- Flatbed type scanners may have hard paper copy
underneath
the cover.
(9) Fax machines -- Although some kinds of stand-alone fax
machines
simply scan and send data without storing it, other models can
store the
data (e.g., on a hard drive) before sending it. Significantly,
the data
remains in the machine's memory until overwritten. Some fax machines
contain two or more megabytes of memory--enough to hold hundreds
of pages
of information.
[page 46] b. Routine Data Backups
Even on stand-alone systems, computer users often make backup
copies of
files to protect against hardware failure or other physical disruptions.
If the computer has any sort of failure which destroys the original
copy
of data or programs (e.g., a hard disk failure), the data can
then be
restored from the backups. How often backups are made is solely
up to the
user. As a practical matter, however, most computer-literate
users will
back up data regularly since mechanical failures are not uncommon
and it
is often difficult and time~-consuming to recreate data that
has been
irretrievably lost. Backup copies can be made on magnetic tape,
disks, or
cartridges.
2. Networked PCs
Increasingly, computers are linked with other computers. This
can be done
with coaxial cable in a local area network, via common telephone
lines,
or even through a wireless network, using radio frequency (RF)
communications. Due to this interconnectivity, it has become
more
important than ever to ascertain from sources or surveillance
what type
of system agents will encounter. Without knowing generally what
is there
before the search, investigators could end up with nothing more
than a
"dumb terminal" (no storage capability) connected to
a system which
stores the files in the next county or state. It would be akin
to
executing a search warrant for a book~making operation on a vacant
room
that only has a phone which forwards calls to the actual operation
site.
During the planning stage of a search, the government must consider
the
possibility of off-site storage locations.
The following are systems or devices which make it possible
for a suspect
to store data miles, or even continents, away from her own computer:
FILE SERVER: A file server is a computer on a network that
stores the
programs and data files shared by the users of the network. A
file server
acts like a remote disk drive, enabling someone to store information
on a
computer system other than his own. It can be located in another
judicial
district from the target machine. [page 47]
ELECTRONIC MAIL: Electronic mail provides for the transmission
of
messages and files between computers over a communications network.
Sending information in this way is similar in some ways to mailing
a
letter through the postal service. The messages are sent from
one
computer through a network to the electronic address of another
specific
computer or to a series of computers of the sender's choice.
The
transmitted messages (and attached files) are either stored at
the
computer of the addressee (such as someone's personal computer)
or at a
mail server (a machine dedicated, at least in part, to storing
mail). If
the undelivered mail is stored on a server, it will remain there
until
the addressee retrieves it. When people "pick up" e-mail
from the mail
server, they usually receive only a copy of their mail, and the
stored
message is maintained in the mail server until the addressee
deletes it
(some systems allow senders to delete mail on the server before
delivery). Of course, deleted mail may sometimes be recovered
by
undeleting the message (if not yet overwritten) or by obtaining
a backup
copy (if the server was backed up before the message was deleted).
ELECTRONIC BULLETIN BOARD SYSTEMS (BBS): A bulletin board
system is a
computer dedicated, in whole or in part, to serving as an electronic
meeting place. A BBS computer system may contain information,
programs,
and e-mail, and is set up so that users can dial the bulletin
board
system, read and leave messages for other users, and download
and upload
software programs for common use. Some BBSs also have gateways
which
allow users to connect to other bulletin boards or networks.
A BBS can
have multiple telephone lines (so that many people can use it
at the same
time) or a single line where a user's access is first-come, first-served.
BBSs can have several levels of access, sometimes called "sub-boards"
or
"conferences." Access to the different conferences
is usually controlled
by the system operator with a password system. A single user
may have
several different passwords, one for each different level or
conference.
A user may store documents, data, programs, messages, and even
photographs in the different levels of the BBS.
A bulletin board system may be located anywhere telephone
lines go.
Therefore, if a suspect may have stored important information
on a BBS, a
pen register on the suspect's phone may reveal the location of
these
stored files. Agents must be careful, though, because sysops
have been
known to forward incoming calls through a simple phone in one
spot to
[page 48]
their BBS computers somewhere else. Sometimes these calls
hop between
houses, and sometimes, between jurisdictions. Investigators cannot
assume
that the phone number called by the suspect is always the end
of the
line.
VOICE-MAIL SYSTEMS: A voice-mail system is a complex phone
answering
machine (computer) which allows individuals to send and receive
telephone
voice messages to a specific "mailbox" number. A person
can call the
voice-mail system (often a 1-800 number) and leave a message
in a
particular person's mailbox, retrieve messages left by other
people, or
transfer one message to many different mailboxes in a list. Usually,
anyone can leave messages, but it takes a password to pick them
up or
change the initial greeting. The system turns the user's voice
into
digital data and stores it until the addressee erases it or another
message overwrites it. Criminals sometimes use voice mailboxes
(especially mailboxes of unsuspecting people, if the criminals
can beat
the mailbox password) as remote deaddrops for information which
may be
valuable in a criminal case. Voice mailboxes are located in the
message
system computer of the commercial vendor which supplies the voice-mail
service, or they can be found on the computer at the location
called.
Voice mail messages can be written on magnetic disk or remain
in the
computer's memory, depending on the vendor's system.
Of course, all networked systems, whether data or voice, may
keep routine
and disaster backups.
a. Routine Backups
Making backups is a routine, mandatory discipline on multi-user
systems.
On larger systems, backups may be created as often as two to
three times
per working shift. Usually backups are made once per day on larger
systems and once per week on smaller ones. Backups are usually
stored in
a controlled environment to protect the integrity of the data
(e.g.,
locked in a file cabinet or safe). The system administrators
will usually
have written procedures which set out how often backup copies
will be
made and where they will be kept. Backups for large systems are
often
stored at remote locations.
[page 49]
b. Disaster Backups
These are additional backups of important data meant to survive
all
contingencies, such as fire, flood, etc. As extra protection,
the data is
stored off-