Skip to main content

Category: digital evidence

Authentication of Digital Communications Chart

A common evidence question that arises is how to properly authenticate digital communications. We have written on the topic in several blogs: How Can a Party Show Authorship of a Social Media Post or Other Electronic Communication?, Authenticating Photographs Obtained from Social Media Platforms, Business Records: Posts, Chats, and Texts, New Guidance on Authenticating Social Media, Admissibility of Electronic Writings: Emails, Text Messages, and Social Networking Posts, and more. Last year, I created a chart to highlight the ingredients of authentication our appellate courts found to be adequate or inadequate as a foundation for surveillance video (also see the accompanying blog, Surveillance Video- When It Comes In and When It Doesn’t). I’ve received positive feedback on the chart and practitioners have asked for more evidence content in this format. For a second installment, I chose digital communications.

Fourth Circuit Strongly Suggests Including Temporal Limitations on Search Warrants for Social Media Account Information

Earlier this year, the Fourth Circuit decided United States v. Zelaya-Veliz, 94 F.4th 321 (4th Cir. 2024). Phil summarized it here when it came out, but we thought it merited its own post because of its extended discussion of how the Fourth Amendment applies to search warrants for social media account information. The court’s discussion of the need for temporal limitations in such warrants is especially noteworthy, as is the court’s analysis of the scope of the information seized pursuant to the warrants approved by the court. We’ll start with a recap of the case, and then end with some thoughts for law enforcement and prosecutors, and for defenders.

Search Warrants for Digital Devices and the Requirement that Warrants be Executed within 48 Hours

I’ve had several questions lately about the requirement in G.S. 15A-248 that “[a] search warrant must be executed within 48 hours from the time of issuance.” The specific concern is how this applies to searches of digital devices, which frequently require off-site forensic analysis that may not begin, let alone end, until substantially more than 48 hours after issuance of the warrant. Although we don’t have an appellate case on point in North Carolina, courts in other jurisdictions have held that so long as the initial seizure of the device is timely, the forensic analysis may be conducted later.

Geofencing Warrants

WRAL has several stories up about geofencing warrants. One major article is here. It describes a search warrant obtained by the Raleigh Police Department in a murder case. The warrant ordered “Google [to] hand over the locations of every [mobile] device within the confines of [a defined geographic area] during a specified time period.” In a nutshell, the police were trying to figure out who was near the scene of the crime when the murder took place and asked Google to comb its data banks to find out. This post is intended to start a conversation about warrants of this kind.

May Search Warrants for Cell Phones Include Connected Cloud Services?

While preparing to teach a recent class about search warrants for digital devices, I spoke with a number of experts in digital forensics. Each conversation was very helpful. Almost all of them touched on an issue I’d never previously considered: whether search warrants for cell phones do or may include the authority to search connected cloud services.

When a Person Commits a Crime, Is There Probable Cause to Search the Person’s Phone for Evidence?

The question in the title of this post is one that I've been asked lots of times in different factual contexts. The basic question is, given that most people have cell phones, and that people tend to use their phones to document and to communicate about just about everything that they do, is it reasonable to believe that a person who has committed a crime has evidence of that crime on his or her phone?

May an Officer Assume a False Identity Online in Order to “Friend” a Suspect?

Officers are allowed to misrepresent their identities in the course of their investigations: they may pose as drug buyers, or prostitutes, or members of an organized crime syndicate. Is the same thing true online? In other words, may an officer claim to be someone else in order to “friend” a suspect on social media and thereby gain access to whatever information the suspect has posted? The answer isn’t clear yet, but I would guess that courts ultimately will say yes.