Cybercrime Roundup: Searching and Seizing

In 2014, the Supreme Court held in Riley v. California that there was something different about searching cellphones:

Cell phones differ in both a quantitative and a qualitative sense from other objects that might be kept on an arrestee’s person. The term “cell phone” is itself misleading shorthand; many of these devices are in fact minicomputers that also happen to have the capacity to be used as a telephone. They could just as easily be called cameras, video players, rolodexes, calendars, tape recorders, libraries, diaries, albums, televisions, maps, or newspapers.

As lower courts figure out how Riley’s treatment of cellphones applies to the search of technology, courts on both the state and federal level are grappling with these issues. Recently, a state appellate court held that even if a cellphone appears to be physically abandoned but is locked with a passcode, it is not abandoned for Fourth Amendment purposes, acknowledging that cellphones are different beasts than locked containers. Applying the “cellphones are unique” arguments to computers in general, another state appellate court required increased particularity for computer search warrants—holding that in order to be searched, computers have to be specifically named, but the search of their contents must be specifically limited. Pressing further into the technological frontier, a district court found that users of internet-connected gaming systems have a reduced expectation of privacy in the messages they share and the images they upload.

In both cyber and run-of-the-mill crime, cases can turn on the application of the Fourth Amendment to electronic evidence. As demonstrated in several recent cases, Fourth Amendment jurisprudence can be both twisting and muddled. Every year, the Georgetown Law Journal releases a review of criminal procedure. For the visually inclined among us, here are charts based on the newly released 2016 edition.

• Was There a Search?
• Was There a Seizure?
• Warrant Requirement

State of Arizona v. Dean (Arizona Court of Appeals)
Based on an allegation of child sexual abuse, police officers obtained a search warrant for Thomas Dean’s trailer and car. While searching the trailer, officers seized a laptop, later discovered to contain child pornography. Dean filed a motion to suppress evidence from the search on the grounds that the warrant lacked “particularity in describing the places to be searched and the items to be seized.” Despite finding the warrant deficient of probable cause for possession of child pornography, the trial court found that the good faith exception to the warrant requirement applied.

In United States v. Leon, the Supreme Court held that even if officers relied on a faulty warrant, the evidence obtained should not be suppressed if law enforcement acted in good faith, subject to four exceptions:

1. when a magistrate is misled by information that the affiant knew was false or would have known was false but for his or her reckless disregard for the truth;
2. when the issuing magistrate “wholly abandon[s]” his or her judicial role;
3. when a warrant is based on an affidavit “so lacking in indicia of probable cause as to render official belief in its existence entirely unreasonable”; and
4. when a warrant is “so facially deficient...that the executing officers cannot reasonably presume it to be valid.”

Dean appealed the trial court’s denial of his motion to suppress, claiming that the fourth exception applied.

Relying on the Ninth Circuit’s holding in United States v. Spilotro, the Arizona Court of Appeals used a three-factor test to determine whether the description of items seized was sufficiently particular to fit within the good faith exception.

(1) whether probable cause exists to seize all items of a particular type described in the warrant

The appellate court affirmed the trial court’s holding that the first factor was not met. The allegations were of child sexual abuse, not child pornography, and probable cause does not transfer between the two. However, the officer obtaining the warrant knew, but never told the magistrate, that Dean was on parole for a child sexual assault case from 16 years prior in which Dean had taken photographs of the victim. Acknowledging a circuit split on whether a court can look beyond the four corners of a warrant in determining good faith, the appellate court held that even if this additional information was included in the analysis, the officers still would not have had probable cause. The court noted that there were no allegations that the victim in the ongoing case had been photographed, meaning that the fact that the previous victim had been photographed was irrelevant for probable cause.

(2) whether the warrant sets out objective standards by which executing officers can differentiate items subject to seizure from those which are not

In its analysis, the court relied on two of the four categories of items to be seized in the warrant:

• (A) Any and all electronic devices and associated materials capable of producing, manipulating, sending, receiving, and/or storing electronic files, media[,] and or/digital images which may be stored in (i.e. computers, cameras, cell phones, thumb drives, etc.).
• (B) Any and all items which visually depict minors engaged in exploitive exhibition or any and all other sexual conduct such as, but not limited to, posing nude.

As for category A, the trial court found, and the appellate court upheld, that the warrant was impermissibly broad. The appellate court relied on cases from both the Ninth and Tenth Circuit that require computer searches to be limited to evidence of specific crimes.
Turning its focus to category B, the appellate court held that,

Because of the privacy interests at state in computers, and the large amount of personal information available therein, we likewise conclude that a warrant that does not specify that officers intend to search a computer is not sufficiently particular to authorize such a search.

(3) whether the government was able to describe the items more particularly in light of the information available to it at the time the warrant was issued

The court found that both categories could have been remedied to be more particular: category A specifying evidence of child pornography and category B specifying computers.

As all three factors weighed against the state, the court held that the warrant was “so lacking in sufficient particularity that it was not objectively reasonable for an officer to rely on it,” focusing on a warrant’s requirement to distinguish between items that can be seized and those that cannot as well as the additional scrutiny placed on the particularity of computer search warrants.

The appellate court reversed the trial court’s denial of Dean’s motion to suppress.

United States v. Stratton (District Court of Kansas)
According to a district court in Kansas, Playstation users do not have an objectively reasonable expectation of privacy in their communications on the Playstation network or the images that they upload to their consoles. For a case that touches on the nature of a complaint review system, agency law, and adhesion contracts, it arose in a fairly typical way: child pornography.

Grief reports, Playstation’s form of user complaints, were filed against Michael Stratton’s account, Susan_14. Sony uses, in their words, “human eyes” to monitor the grief reports, classifying them according to severity. Offense that are potentially illegal or life threatening are sent to Sony’s security team, which is what happen with Stratton’s offense. The security team then forwarded the complaint, image, and Susan_14’s profile information—email address, home address, and date that the Playstation account was opened—to the National Center for Missing and Exploited Children (NCMEC), pursuant to 18 U.S.C. § 2258, which states:

A person who, while engaged in a professional capacity learns of facts that give reason to suspect that a child has suffered an incident of child abuse ... and fails to make a timely report ... shall be fined under this title or imprisoned not more than 1 year or both.

According to the following subsection, 18 U.S.C. §2258A, the report must be made to the CyberTipline of NCMEC.

Susan_14 received additional complaints for sending messages asking if the recipient would like to see explicit images of children or if they had any. Sony also found that Susan_14 uploaded additional images that warranted forwarding to NCMEC.

Based on the information that NCMEC provided the FBI, as well as subpoenaed information from Google and CenturyLink, the FBI obtained a search warrant for Stratton’s house. During the search, Stratton acknowledged his ownership of the Playstation3 and admitted that he used it to obtain child pornography.

Stratton filed a motion to suppress the evidence that NCMEC obtained from Sony, the evidence that was found during the search of his house, and any statements that were made during that search, arguing that Sony’s search of information stored on his gaming device violated the Fourth Amendment. Using a multi-tiered approach, Stratton claimed that the Fourth Amendment applied because Sony was acting as a government agent—and even if Sony wasn’t, NCMEC exceeded the scope of Sony’s search and triggered the Fourth Amendment in its own capacity as a government agent.

The court acknowledged that the Tenth Circuit has not decided whether electronic service providers act as government agents when they monitor their users’ activities on their servers. However, the circuits that have addressed this question—First, Fourth, and Eighth—have all found that the providers in the cases at issue were not acting as government agents.

Stratton argued that Sony fit under the agency relationship articulated by the Tenth Circuit in United States v. Ackerman (an opinion by the current Supreme Court nominee, Judge Gorsuch),

An agency relationship is usually said to ‘result [ ] from the manifestation of consent by one person to another that the other shall act on his behalf and subject to his control, and consent by the other so to act. (quoting the Restatement (Second) of Agency § 1)

The court distinguished Sony’s role in the current case from NCMEC’s role in Ackerman, as Sony is not subject to a comprehensive statutory structure similar to NCMEC’s and 18 U.S.C. § 2258 does not require Sony to take any affirmative actions to monitor its network. As a result, the court found that Sony acted in its own interest when it reviewed Susan_14’s messages and attachments related to the grief reports. Further, the court held that Sony retained the right to monitor and record online activity for their own interest, and there was no evidence that Sony’s had monitored Susan_14 at the request of the government after the grief report was filed.

Stratton’s argument that NCMEC exceeded the scope of Sony’s private search turned on Ackerman as well. In Ackerman, the court found that NCMEC exceeded the scope of AOL’s private search of a defendant’s email and attachments and, therefore, violated the defendant’s Fourth Amendment rights. However, AOL used “hash value matching” to flag images as potential child pornography, which analyzes the short string of characters associated with an image for similarities to the characters of images previously identified as child porn. Since AOL’s system of flagging images and forwarding them on to NCMEC never involved opening the image, when NCMEC opened the image, they exceeded the scope of AOL’s private search.

In contrast, Sony’s grief report review system uses “human eyes,” rather than algorithms. So, by the time an image is forwarded on to NCMEC, Sony has already opened it and looked at the contents. As a result, the court held that NCMEC did not exceed the scope of Sony’s private search and did not trigger the Fourth Amendment.

While the opinion could have stopped there, the court went on to hold that Stratton had no objectively reasonable expectation of privacy in his communications on the Playstation network and the images he uploaded to his console. A Fourth Amendment search occurs if there is intrusion into an area where the individual has a subjective expectation of privacy and “society [is] willing to recognize that expectation as reasonable.” Examining the communications to other users and the images separately, the court held that like mailed letters, the reasonable expectation of privacy terminates when an email reaches its recipient. As a result, there is no reasonable expectation of privacy in user communications on Playstation once they reach the recipient.

As for the images, the court relied on the Tenth Circuit's opinion in United States v. Angevine, which held that a public university's policies and procedures—which in this case expressly reserved the right to audit internet use and warned of legal action if violations of federal law occurred—negated, or at least reduced, any reasonable expectation of privacy that the internet user had in data downloaded. Similarly, Sony’s Terms of Service Agreement, which Playstation users must agree to before they sign up for an account, reserves the right to monitor online activity and states that any information Sony gathers from a user’s account—including uploaded images —may be turned over to law enforcement.

(Interestingly, Stratton argued that Sony’s Terms of Service Agreement was an adhesion contract, defined by the Tenth Circuit as “a standardized contract offered by a transacting party with superior bargaining strength to a weaker party on a take-it-or-leave-it basis, without the opportunity for bargaining.” However, the claimant bears the burden to demonstrate that the contract “contains terms that are patently unfair to the weaker party,” and the defendant failed to do so. As a result, the court finds no merit in the argument.)

Going even further, perhaps to protect itself upon appeal, the court found that even if there was a Fourth Amendment violation, the good faith exception to the exclusionary rule would apply and that none of the exceptions listed in United States v. Leon pertained to the situation: there existed sufficient probable cause, given the various information from Sony as well as the subpoenaed information from Google and CenturyLink, and the warrant sufficiently particularized the place or items to be seized as to not be “facially deficient.”

Packed with hot-button cybercrime and contract issues, this case will be interesting to watch if it reaches the Tenth Circuit.

State of Florida v. K.C. (Florida Court of Appeals)

A police officer stopped a vehicle with two individuals inside, only to have both occupants get out and flee from the officer. Realizing that the vehicle was reported stolen, the officer looked inside the car and saw two cell phones, one of them with a lock screen image resembling one of the individuals that fled. However, the cellphone was passcode protected.

The officer turned the phone over to the police department, where it sat for several months until the officer asked for the ownership to be determined. Assuming the phone had been abandoned and therefore the owner lacked a reasonable expectation of privacy,, the officer did not obtain a warrant before searching the phone to determine the name of the owner—who is identified as “K.C.” in court documents. The police charged K.C. for burglary of the stolen car.

K.C. filed a motion to suppress the evidence obtained from the search of the cell phone, arguing both that he retained a reasonable expectation of privacy as to the contents of the phone by placing a passcode on it, and he never disclaimed ownership of the phone and therefore had not abandoned it. The trial court granted K.C.’s motion to suppress without detailing the reason for its findings. The State appealed.

Relying on Riley, the appellate court emphasized that cell phones are unique, bolstering its argument with the Supreme Court of Florida’s holding in Smallwood v. State that cellphones are “materially distinguishable” from the “static, non-interactive container in Robinson,” a case that allowed a search incident to lawful arrest of a cigarette package. After signaling that it was going to treat cell phones specially, the court next examined Florida’s abandonment test:

Whether a defendant voluntarily discarded, left behind, or otherwise relinquished his interest in the property in question so that he could no longer retain a reasonable expectation of privacy with regard to it at the time of the search.

The court noted that Riley provided an exception for exigent circumstances:

[s]uch exigencies could include the need to prevent the imminent destruction of evidence in individual cases, to pursue a fleeing suspect, and to assist persons who are seriously injured or are threatened with imminent injury.

However, the appellate court found that abandonment did not fit any one of these exigencies and thus held that:

a categorical rule permitting warrantless searches of abandoned cell phones, the contents of which are password protected, is likewise unconstitutional.

Noting that only two other courts have taken up the issue of whether search warrants are required to search an abandoned cell phone, the appellate court of Florida sided with the dissent in both of the other cases, State v. Brown (S.C. Ct. App. 2015) and State v. Samalia, Wash. 2016). In both cases, the dissents distinguished cell phones from locked containers due to a cell phone’s capacity to store information. The appellate court pushed this analysis, holding that cell phones were quantitatively and qualitatively different from other physical objects, including locked containers.

Affirming the trial court’s grant of the motion to suppress, the appellate court concluded with a paraphrase of Chief Justice Roberts in Riley:

[our] answer to what police must do before searching [an abandoned, password protected] cell phone...is accordingly simple—get a warrant.