Imagine that the police believe that there is evidence of crime on a suspect's computer, but they lack probable cause to obtain a warrant to search it. The police ask the suspect if he will consent to allow the police to search the computer for evidence. The suspect agrees, and gives the police his computer to be searched. A few days later, the suspect talks to an attorney and the attorney advises the suspect to revoke his consent and demand the return of the property. The lawyer (or the suspect) calls the police and withdraws consent to search the computer.
In cases of traditional physical evidence, the law here is very clear. The basic Fourth Amendment rule is that the police can conduct a search if someone with common authority over the computer consented, but that they have to stop their search if and when the consent is revoked. Given that rule, it's clear that any search of the defendant's actual computer would have to stop when the suspect withdraws his consent.
But here's the twist. It turns out that the first step a computer forensic analyst takes when seeking to retrieve evidence from a hard drive is to create a "bitstream copy" or "image" of the computer hard drive. The "image" is an exact copy of the hard drive that copies every one and zero on the drive. It is created for reasons of evidentiary integrity; searching a computer drive can alter the data it contains, so analysts copy the originial and do all of the analysis on the image copy. After the drive has been imaged, there are two copies of the data, not one: one copy of data on the defendant's property and another copy on the government's machine.
Now, back to our hypothetical. It turns out that a suspect often withdraws his consent after the computer has been imaged, but before government has begun to search the image. (This is common because imaging can be done in a few hours, but most government forensic labs have long waiting lists for the actual analysis.) So here's the big question: When the suspect withdraws his consent, does the withdrawal of consent also apply to the image? Can the police search the imaged copy, or will searching the imaged copy without a warrant violate the Fourth Amendment? In doctrinal terms, does a defendant retain a legitimate expectation of privacy in the image, and if so, does his common authority to regulate consent to search the original apply equally or differently to the copy?
Generally, the positions taken are this (my summary, for much better wording and explanations, please go over to Volkh):
1) The object turned over is the hard drive. The copy made by the state is essentially like a photograph taken during a time when the state had permission to search. Or like a xerox made while the state had permissive access to sensitive files. Either way, the copy was fairly made when the government had permission to do so, and it's now the government's legally-obtained property to do with as they please.
2) Think of data as a "thing" unto itself, rather than something intangible contained on a computer. The 'object' being turned over to the State is the data, not a meaningless bit of plastic and metal. The defendant gave permission to search within that data. The information is encoded and was not searched, breached or translated prior to withdrawal of consent. When the permission ends, all searching within that data has to stop.
It's a fun little problem, and they've enabled the comments if you'd like to join in the discussion.
No comments:
Post a Comment