Many child pornography cases begin when someone with access to the defendant’s computer looks through it, finds child pornography, and contacts law enforcement. For example, the recent Raleigh case in which a “Santa for hire” was charged with possessing child pornography began when a computer repair technician contacted police. In this type of case, does the private party’s search of the defendant’s computer destroy the defendant’s privacy interest such that an officer may then search the computer without a search warrant? A recent federal case explores the issue. Continue reading
Tag Archives: digital evidence
I’m happy to announce that my book on digital evidence is now available. There are five chapters, covering (1) search warrants for digital devices, (2) warrantless searches of digital devices, (3) law enforcement access to electronic communications, (4) tracking devices, and (5) the admissibility of electronic evidence. Continue reading →
Category: Evidence, Search and Seizure, Uncategorized | Tags: book, digital evidence, electronic evidence, publications, search warrants, tracking, warrantless searches
Years ago, the School of Government did quite a bit of training for the Highway Patrol and other law enforcement officers. These days, we focus most of our criminal law courses on judges, lawyers, and magistrates. But I still view officers as an important audience for our work, and I recently wrote an article for Police Chief magazine that is meant to help officers obtain valid search warrants for digital devices.
Category: Search and Seizure, Uncategorized | Tags: computers, digital evidence, police chief, Search and Seizure, search warrants
Whether the plain view doctrine makes sense in the context of computer searches, and if it doesn’t, what courts should do about it, are controversial issues. We don’t have any North Carolina case law on point but decisions are piling up around the country. This post summarizes the controversy.
Computer searches may be very thorough. Generally, courts have held that when an officer is entitled to search a computer for evidence of a crime, the officer may review every file on the computer. This is because of the ease with which files can be camouflaged or disguised through misleading file names or extensions. See, e.g., United States v. Stabile, 633 F.3d 219 (3rd Cir. 2011) (searching video files pursuant to search warrant for financial crimes was “objectively reasonable because criminals can easily alter file names and file extensions to conceal contraband,” and “the plain view doctrine applies to seizures of evidence during searches of computer files, [though] the exact confines of the doctrine will vary from case to case in a common-sense, fact-intensive manner”); United States v. Williams, 592 F.3d 511 (4th Cir. 2010) (stating that a computer search requires “at least a cursory review of each file on the computer”).
Broad computer searches may bring evidence of other crimes into view. Because of the broad scope of computer searches, they require officers to sift through large amounts of information unrelated to the crime under investigation. As a result, officers executing computer search warrants often encounter evidence of crimes other than those based on which the warrants were issued. Commentators have suggested for years that computer searches are different in degree, and perhaps in kind, from other types of searches in this regard. See, e.g., Orin S. Kerr, Searches and Seizures in a Digital World, 119 Harv. L.Rev. 531 (2005) (stating that “computer technologies may allow warrants that are particular on their face to become general warrants in practice”); Paul Ohm, Massive Hard Drives, General Warrants, and the Power of Magistrate Judges, 97 Va. L.Rev. In Brief 1 (2011) (“Computer search warrants are the closest things to general warrants we have confronted in the history of the Republic.”).
Some courts apply the plain view doctrine. When an officer searches a physical location pursuant to a search warrant and stumbles upon evidence of a crime other than the one that motivated the search, the evidence is said to be in “plain view,” and it may be seized by the officer and used to support a criminal prosecution. Many courts have simply applied the plain view doctrine to computer searches. For example, imagine that an officer is searching a computer under a warrant for evidence related to a homicide, but encounters files containing child pornography. These courts would rule that the plain view doctrine applies to the discovery of the child pornography, and that the officer may continue searching the computer under the original warrant, even though the officer may now subjectively expect to find additional child pornography. See, e.g., United States v. Williams, 592 F.3d 511 (4th Cir. 2010) (the defendant sent anonymous emails to a church expressing a sexual interest in some boys who attended school at the church; police obtained a search warrant for “computer systems and digital storage media” indicative of computer harassment or communicating threats; during search, police found child pornography; the court found no Fourth Amendment violation, in part because a computer search requires “at least a cursory review of each file on the computer,” bringing the child pornography into plain view); United States v. Mann, 592 F.3d 779 (7th Cir. 2010) (officer obtained search warrant to search the defendant’s computer for evidence of voyeurism; he properly searched the image files on the computer systematically, even though he thereby uncovered child pornography; however, the court found it “troubling” that the officer did not stop and seek a second warrant for child pornography).
Other courts seek to limit plain view as it applies to computer searches. Other courts have concluded that because computer searches bring so much information to officers’ attention, the plain view doctrine must be limited. These cases generally have arisen in the context of searches pursuant to search warrants, and courts have expressed a concern that computer search warrants may amount to general warrants that allow officers to rummage through a suspect’s computer for evidence of any wrongdoing.
The cases reflect two main strategies for limiting the effect of the plain view doctrine. One is to require, as a condition of issuing the warrant, that the prosecution forswear reliance on the plain view doctrine. The second is to order that the warrant be executed by a search team behind a “firewall” and that the search team report out to investigators only evidence related to the crime in connection with which the warrant was obtained. See, e.g., In re Search Warrant, 71 A.3d 1158 (Vt. 2012) (holding that a judicial official who issued a computer search warrant lacked the authority to prohibit law enforcement from relying on the plain view doctrine, but had the authority to accomplish the same result by requiring that the search be conducted by third parties behind a “firewall,” and that the search team provide to investigators only information relevant to the offense that gave rise to the search warrant); United States v. Comprehensive Drug Testing, Inc., 621 F.3d 1162 (9th Cir. 2010) (en banc) (noting that “over-seizing is an inherent part of the electronic search process” and suggesting that magistrate judges issuing search warrants should take steps to limit the government’s access to data for which it has no probable cause, such as requiring an on-site assessment of the feasibility of seizing only responsive data; requiring data segregation to be done by someone other than the case agent; and perhaps limiting the government’s plain view rights; Chief Judge Kozinski’s concurrence provides more detailed suggestions); In re United States’s Application For A Search Warrant To Seize and Search Electronic Devices From Edward Cunnius, 770 F.Supp.2d 1138 (W.D. Wash. 2011) (“Because the government, in this application, refuses to conduct its search of the digital devices utilizing a filter team and foreswearing reliance on the plain view doctrine, the Court denies the application as seeking an overbroad or general warrant in violation of the Fourth Amendment”). I would be interested to learn whether any judicial officials in North Carolina have imposed any such requirements on computer search warrants, and if so, how those requirements played out in practice.
Seeking a second warrant. Finally, a few courts have attempted to chart a middle ground, holding that the plain view doctrine applies to the initial discovery of unexpected evidence, but that if the officer wishes to continue looking for additional evidence in the same vein, a second warrant is required. See, e.g., United States v. Carey, 172 F.3d 1268 (10th Cir. 1999) (officer obtained search warrant for “evidence pertaining to the sale and distribution of controlled substances”; officer opened .jpg file with sexually suggestive name, apparently because the file could contain a photograph related to drug activity; it contained child pornography; officer continued viewing other .jpg files with sexually suggestive names, finding more child pornography; although the first image was in plain view, by “the officer’s own admission . . . each time he opened a subsequent [image] file, he expected to find child pornography and not material related to drugs,” so the plain view doctrine did not apply). But see United States v. Brooks, 427 F.3d 1246, 1251 (10th Cir. 2005) (noting that “we have not required a specific prior authorization along the lines suggested in Carey in every computer search”). The courts’ focus on the subjective intentions and expectations of the officer is inconsistent with the Supreme Court’s repeated emphasis on the objective nature of Fourth Amendment analysis, so this middle ground may be a sinking island. Nonetheless, because North Carolina’s appellate courts have yet to rule on the application of the plain view doctrine as it relates to computer searches, a cautious officer may wish to seek a second warrant whenever the focus of his or her search moves away from the crime that gave rise to the warrant.
Category: Uncategorized | Tags: computer searches, digital evidence, fourth amendment, plain view, Search and Seizure
There’s a recurrent discovery issue in child pornography cases. Generally, it goes like this: the defendant is arrested and charged with a child pornography offense. The prosecution contends that the defendant’s computer contains images of child pornography. The defendant retains a computer expert to examine his computer, hoping to show that the images were downloaded inadvertently, or were downloaded by someone else. The expert requests a copy of the defendant’s hard drive so that the expert can analyze it. The prosecution refuses to provide a copy on the grounds that doing so would amount to distributing child pornography to the expert, so the defendant files a motion asking the court to order the prosecution to provide a copy of the hard drive.
In federal cases, there is a statute that guides the resolution of this issue. Under 18 U.S.C. § 3509(m), “a court shall deny . . . any request by the defendant to copy, photograph, duplicate, or otherwise reproduce any property or material that constitutes child pornography . . . so long as the Government makes the property or material reasonably available to the defendant.” Evidence is “reasonably available” if “the Government provides ample opportunity for inspection, viewing, and examination at a Government facility of the property or material by the defendant, his or her attorney, and any individual the defendant may seek to qualify to furnish expert testimony at trial.” The statute has been upheld against a variety of constitutional challenges. United States v. Shrake, 515 F.3d 743 (7th Cir. 2008); United States v. Spivack, 528 F.Supp.2d 103 (E.D.N.Y. 2007) (collecting cases).
Litigation has focused on what constitutes an “ample opportunity” to review and analyze evidence. Among the leading opinions in this area is United States v. Flinn, 521 F.Supp.2d 1097 (E.D. Ca. 2007), which states:
An ample opportunity to forensically examine seized computer items means an examination whereby the government can supply reasonably up-to-date tools (hardware and software) and facilities such that a defendant can construct a reasonable, available forensic defense, if one is available at all, and whereby the analysis will not be impeached because it was not supported by the proper hardware or software. An ample opportunity will permit a defense expert to utilize his or her hardware or software. An ample opportunity also requires that the analysis be performed in a situation where attorney-client privilege and work product will not be easily, accidentally exposed to the government, and in a facility which is open to the defense at its request during normal working hours, and to the extent feasible, during non-working hours.
I am aware of only one published case in which a court has ruled that the government failed to give the defense team “ample opportunity” to analyze the defendant’s computer. In United States v. Knellinger, 471 F.Supp.2d 640 (E.D. Va. 2007), a defendant argued that he needed a team of experts to analyze video files on his computer to determine whether the files involved real children or virtual representations of children. The defendant’s experts testified that conducting the analysis at a federal facility would involve a week of moving fragile and expensive equipment and a cost of over half a million dollars. Based on the defendant’s showing and the specific facts of the case, the judge ordered that a copy of the defendant’s hard drive be given to the defense team, pursuant to a protective order. Aside from Knellinger, however, courts have generally denied defendants’ requests for copies of digital evidence in child pornography cases, finding that such evidence can be analyzed adequately in a government facility.
But that’s federal court. Section 3509(m) doesn’t apply to state cases: it refers to the Federal Rules of Criminal Procedure and describes the prosecution as the “Government.” State v. Allen, 2009 WL 348555 (Tenn. Ct. Crim. App. Feb. 12, 2007) (unpublished) (“Section 3509(m) does not apply to proceedings in Tennessee state courts.”) Nor is there any other specific statutory provision in North Carolina concerning how child pornography should be handled in discovery.
That leaves us back at square one. Under the general provisions of G.S. 15A-903, images or videos alleged to contain child pornography clearly count as “matter[s] or evidence obtained during the investigation” of the child pornography defendant, and so are presumptively available to be copied by the defense. Yet some prosecutors worry that copying such evidence violates state and federal child pornography laws. What to do?
I’ll start by suggesting that the concern about violating the law by distributing child pornography during discovery may be a bit overblown. By that reasoning, the prosecutor in every child pornography case violates the law by possessing the child pornography, and the prosecutor violates the law during every child pornography trial by distributing the child pornography to the court clerk, the judge, and the jurors. Likewise, the prosecutor in a drug case would be liable for possessing the drugs introduced as evidence, and for distributing the drugs to the clerk during the trial. I assume that there’s an implicit “official duty” exemption that would preclude prosecution in such circumstances, and I’m not aware of a single prosecution based on similar facts.
Nonetheless, I can understand a prosecutor not being enthusiastic about making additional copies of child pornography. (And frankly, if I were a defense lawyer, I wouldn’t be too excited to receive them. Consider United States v. Flynn, __ F.Supp.2d __, 2010 WL 1782157 (D.S.D. Apr. 28, 2010), where an attorney being prosecuted for possessing child pornography claims that he possessed the images in connection with his work.)
The solution, it seems to me, is to move for a protective order under G.S. 15A-908, which allows a court, upon a finding of “good cause,” to enter any appropriate order regarding discovery. Presumably, the court’s discretion includes the authority to enter an order along the lines of what section 3509(m) requires in federal court: that the defendant be given “ample opportunity” to inspect and analyze the digital evidence at a law enforcement facility, but not be given a copy, absent special circumstances that require the making of a copy in a particular case. Although I’m not aware of a North Carolina case on point, cases in other states have generally recognized some discretion to limit defense access to child pornography. Cf. State v. Brady, 894 N.E. 2d 671 (Ohio 2008) (proper to limit defense access to child pornography evidence to the state’s computer system); State v. Bowler, 772 N.W.2d 666 (Wisc. Ct. App. 2009) (court has the discretion to order copying or to forbid it). But cf. State v. Johnson, 2010 WL 1424369 (Ariz. Ct. App. Div.1 Apr. 8, 2010) (unpublished) (affirming dismissal of charges after defendant provided valid reasons for needing a copy of the digital evidence yet the agency with custody of the evidence refused to produce it). It may be useful to think of digital evidence of this type as analogous to controlled substances seized from the defendant — the defendant should be granted reasonable access to drug evidence for the purpose of analysis and testing, but need not be allowed to take the evidence off the premises of a law enforcement facility. As an aside, the SBI, and probably many other law enforcement agencies, have facilities designed for defendants to use to review digital evidence in privacy.
Category: Procedure, Uncategorized | Tags: child pornography, computers, digital evidence, discovery, protective orders
