Obtaining admissible evidence from computers and internet service providers.

The use of personal computers in homes and businesses has flourished during the 1990s due to the advent of user-friendly operating systems and the low cost of computer equipment. The U.S. Census Bureau reports that "54 million households, or 51 percent, had one or more computers, up from 42 percent in 1998." (1) Moreover, "44 million households, or 42 percent, had at least one member who used the Internet at home in 2000."(2) People use personal computers to conduct word processing, maintain financial accounts, and play games, as well as instantly access vast amounts of information through the Internet. Most important, computers facilitate communication through e-mail, Web sites, chat rooms, and Internet phone. This transfer of information has impacted many aspects of daily life. While law enforcement officers know the importance of staying abreast of new technological trends and investigative practices, they also realize that lawfully obtaining admissible evidence from both computers and Internet service providers (ISPs) can be complicated in an ever-changing technological world. Thus, officers constantly must pay attention to new legislation and applicable investigation procedures.

Predictably, the phenomenon of unfettered access to personal computers did not go unnoticed by criminals. Law enforcement officials in the United States and abroad have learned that criminals routinely use computers to more easily manage the business aspects of their criminal enterprises. Criminals keep records of transactions, document planned crimes, and communicate with their peers via personal computers. As a result, courts now are being asked to analyze searches and seizures of computer equipment, computer peripherals, and information obtained from ISPs based on the venerable Fourth Amendment to the U.S. Constitution. Although the drafters of the Fourth Amendment may not have predicted the quantum leaps in technology that led to the computer generation, they composed the Fourth Amendment in such a way that it has proven to be exceptionally adaptable when applied to technological issues.

The Workplace

When analyzing cases involving searches and seizures of computers and their stored files in the workplace, the justice system has used basic Fourth Amendment concepts. The initial inquiry normally involves determining the computer owner's or user's reasonable expectation of privacy with respect to the computer or the information stored in the computer. To prove a legitimate expectation of privacy, individuals must show that their subjective expectation of privacy is one that society is prepared to accept as objectively reasonable. (3) For example, in United States v. Simons, the Fourth Circuit of the U.S. Court of Appeals held that Simons, a government employee charged with receiving and possessing child pornography on his work computer, "did not have a legitimate expectation of privacy with respect to the record or fruits of his Internet use in light of the FBIS (4) Internet policy." (5) The court permitted the employer's warrant-less search of Simon's office computer because

The policy clearly stated that FBIS would "audit, inspect, and/or monitor employees use of the Internet, including all file transfers, all Web sites visited, and all e-mail messages as deemed appropriate." This policy placed employees on notice that they could not reasonably expect that their Internet activity would be private. Therefore, regardless of whether Simons subjectively believed that the files he transferred from the Internet were private, such belief was not objectively reasonable after FBIS notified him that it would be overseeing his Internet use. (6)

The possibility does exist, however, for an employee to have or develop a legitimate expectation of privacy with computer files in the work place. Therefore, a police officer must inquire if an employer has authority to give valid consent to search or seize an employee's computer or computer files. Even though obtaining consent to search or seize is legal and accepted, it is an exception to the search warrant requirement, and the U.S. Supreme Court strongly prefers search warrants to authorize searches instead of exceptions. Officers never should rely on exceptions when probable cause exists to support a warrant application.

The Home

Complicating this issue is the reality that most crimes are not committed in the workplace. Home-based criminal enterprises, such as fencing stolen property, engaging in prostitution, and manufacturing controlled substances, often take advantage of the sanctity of the home to operate undetected by law enforcement authorities. The Fourth Amendment to the U.S. Constitution guarantees "the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures." (7)(Emphasis added.) Reasonable expectations of privacy in computer files stored in home computers fall subject to the same protections afforded to all other items located within the home. Thus, officers normally cannot search or seize these files unless they have a search warrant authorizing both entry into the house and a search of the computer. (8) Officers also may search or seize if they have probable cause and exigent circumstances that allow a warrantless entry and a search of the computer (9) or if they have freely and voluntarily received consent from someone who has the authority to grant consent. Furthermore, officers who see something on a computer monitor in plain view can seize that document if they have probable cause to believe that it is evidence of a crime. (10) However, the plain view doctrine is a separate seizure doctrine, not an exception to the search warrant requirement and, therefore, viewing one document that may be used as evidence of a crime does not necessarily permit the search or seizure of the entire computer.

Without consent, an officer cannot search or seize computer files unless probable cause exists showing that the computer contains files that constitute evidence of crime, was used in furtherance of or actually in committing a crime, or is subject to forfeiture. Multiple courts have held that "general searches for unspecified property are generally void. The affidavit should specifically state what is being sought and why it is believed to be on the premises. This applies to persons and property to be seized." (11)

Officers completing an affidavit and complaint for a search warrant should describe the computer and peripherals, such as zip drives, CD back packs, scanners, digital cameras, Web cameras, and printers (some may have recoverable memory). Officers should include color, make, model, and serial number, if available. Officers should include these items only if probable cause exists indicating that they are storing evidence of a crime or have been used to commit a crime. In the probable cause section of the search warrant affidavit and complaint, officers must link the computer to the crime by explaining how it helped commit the crime. For example, through officers' experience, training, and knowledge, they may know that persons who operate ongoing criminal enterprises involving the purchase and sale of illegal narcotics or stolen property normally maintain records of those transactions in either written or electronic form. Thus, because keeping records is typical, officers may link a computer or its files to a crime. Similarly, reliable information from informants may indicate that they communicated with a suspect via a computer to purchase controlled substances or stolen property. Officers should include this type of information in their probable cause statement to show how the computer is or was being used in criminal activity, which, in turn, converts the computer from lawfully held property to evidence of a crime. (12)

Shared Computers

Officers also need to consider the issue of authority to consent when dealing with persons who have joint access to certain computer files. In Trulock v. Freeh, the Fourth Circuit held that persons who share a computer cannot provide consent to search password-protected files unless they normally have access to them. (13) Persons with joint use have the authority to consent to a general search of the computer, but that authority does not extend to password-protected files. The court's decision in Trulock v. Freeh was based on its earlier ruling in United States v. Block, (14) wherein the court held that a criminal "defendant's mother had authority to consent to a search of his room, which was located in the home that they shared." (15) However, "the mother's authority did not extend to a search of a locked footlocker located within the room." (16) The court noted that the authority to give consent for shared or common areas does not automatically extend to such areas as a locked footlocker. (17)

Evidence from ISPs

Obtaining evidence from a workplace or home relies on knowing persons' names and contact information. However, officers routinely investigate crimes involving computer files, chat rooms, or e-mail messages where the only information available about the identity of the author is a screen name. The best source for learning the identity of anonymous persons who access the Internet is through their ISP. Obtaining information from ISPs recently was addressed in United States. v. Hambrick. The court held that

   While under certain circumstances,
   a person may have
   an expectation of privacy in
   content information, a person
   does not have an interest in the
   account information given to
   the ISP in order to establish
   the e-mail account, which is
   noncontent information. (18)

If the ISP refuses to voluntarily give an officer information, the officer has options. The Stored Wire and Electronic Communication and Transactional Records Act (21) (SWECTRA) deals with the release of the content of stored electronic communications. However, SWECTRA's provisions become powerful allies when attempting to obtain a person's noncontent account information. ISPs are required to disclose content information to law enforcement officers pursuant to a search warrant, a court order, a grand jury subpoena, an administrative subpoena, or an official request in the case of investigations involving telemarketing fraud. (22) The content of stored electronic communications is clearly protected by the Fourth Amendment, as well as SWECTRA. Although noncontent account information stands unprotected by either, officers who encounter resistance from ISPs when requesting noncontent information may use SWECTRA's provisions to force disclosure.

Recent provisions in the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act (USA Patriot Act) also have made more noncontent information readily available to law enforcement agencies. The use of a subpoena now can force the disclosure of a subscriber's "name; address; local and long distance telephone connection records, or records of session times and durations; length of service (including start date) and types of service utilized; telephone or instrument number or other subscriber number or identity, including any temporarily assigned network address; and means and source of payment for such service of a subscriber." (23) These changes, along with SWECTRA's provisions, help to speed up investigations and provide law enforcement officers with more reliable information.

Conclusion

As personal computer ownership continues to expand all over the world, law enforcement officers will continue to seek and find evidence of crimes hidden in computers. Computers, in the workplace and the home, are becoming more accessible as evidence to law enforcement officers through the adaptability of such avenues as the Fourth Amendment, but officers must stay abreast of new laws and evolving technology. Like their predecessors who had to apply the Fourth Amendment to new technology, such as telephones, automobiles, and covert listening devices, law enforcement officers likely will succeed in finding lawful and innovative ways to obtain the evidence required to convict criminals who use computers.

Endnotes

(1) U.S. Department of Commerce, U.S. Census Bureau, Home Computers and Internet Use in the United States: August 2000 (Washington, DC, 2001).

(2) Ibid.

(3) United States v. Simons, 206 F. 3d 392 (4th Cir. 2000).

(4) The FBIS is the Foreign Bureau of Information Services, a Division of the Central Intelligence Agency (CIA), which employed Simons.

(5) United States v. Simons, 206 F. 3d 392, 398 (4th Cir. 2000).

(6) Ibid.

(7) U.S. Const. amend. IV.

(8) Ibid.

(9) Emergencies involving threats to life or safety require a showing of reasonable suspicion. Maryland v. Buie, 494 U. S. 325, 110 S. Ct. 1093, 108 L. Ed. 2d 276 (1990). Emergencies involving escape or the destruction or removal of evidence, however, require a showing of probable cause. Warden v. Hayden, 387 U.S. 294, 87 S. Ct. 1642, 18 L. Ed. 2d 782 (1967).

(10) Arizona v. Hicks, 480 U. S. 321, 107 S. Ct. 1149, 94 L. Ed. 2d 347 (1987). If the officer manipulates the computer mouse or keyboard to deactivate the screen saver and view the desk top or an open document, that manipulation would (most likely) constitute an unlawful search pursuant to Hicks unless the search of the computer was authorized by a search warrant, probable cause and exigent circumstances existed with respect to the computer, or the officer had the consent of an owner or user who had access to the files that constituted evidence of a crime.

(11) State v. Bates, 181 W. Va. 36, 380 S. E. 2d 203 (1989); State v. Haught, 179 W. Va. 557, 371 S. E. 2d 54 (1988) citing Maryland v. Garrison, 480 U.S. 79, (1987); State ex rel. White v. Melton, 166 W. Va. 249, 273 S. E. 2d 81 (1980); State v. Greer, 130 W. Va. 159, 42 S. E. 2d 719 (1947).

(12) Stephen W. Cogar, West Virginia Law Enforcement Fieldbook, (3rd ed. forthcoming) manuscript at page 43, on file with author).

(13) Trulock v. Freeh, 275 F.3d 391 (4th Cir. 2001).

(14) United States v. Block, 590 F.2d 535, 539 (4th Cir. 1978).

(15) Ibid.

(16) Ibid.

(17) Ibid.

(18) United States v. Hambrick, 225 F.3d 656 (4th Cir. 2000) (unpublished opinion).

(19) Smith v. Maryland, 442 U. S. 735, 743-44 (1979).

(20) United States v. Hambrick, 225 F.3d 656 (4th Cir. 2000)(unpublished opinion).

(21) 18 U.S.C.A. 2701 et. seq.

(22) 18 U.S.C. 2703(c)(1)(A)-(E)(c)(2)(A)-(F).

(23) Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001, Pub. L. 107-56, 115 Sat. 272 (eff. October 26, 2001).

Expectation of Privacy in the Workplace

When determining expectation of privacy in the workplace, officers should ask questions similar to the following:

1. Is the employee's office shared with anyone else?

2. Does the computer's hard drive have password protection?

3. Is the computer physically locked?

4. Do any files on the computer have password protection?

5. Is the employee's office locked?

6. If so, who has keys and, thus, who has access (e.g., janitor or office manager)?

7. Does a network administrator or computer technician have unrestricted access to the computer or its files either because of policy or practice?

8. Can they access the files remotely over the employer's wide area network, local area network, or via the Internet using a similar remote access program?

9. Does the employer have a policy in place regulating computer use or notifying employees that their computer, files, e-mails, and Internet activity may be searched or monitored at any time?

10. Does the employer enforce the policy uniformly?

11. Does the employer have written or other proof indicating that the employee received, read, and understood the computer use policy?

12. Does the employer use software to monitor computer use, and are employees aware of this fact?

13. Do computer work stations have either a written or electronic message clearly visible while the machine is being used or when the machine boots indicating that computer usage is monitored?

Mr. Cogar practices law in Charleston, West Virginia.