Cybertelecom Federal Internet Law & Policy An Educational Project

4th A :: Without a Warrant :: Exceptions

Derived From: Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations Computer Crime and Intellectual Property Section, Criminal Division, DOJ (2009) (Remember: This is a rendition of the state of the law from law enforcement and reflects their views)

Chapter 1 Searching and Seizing Computers Without a Warrant

C. Exceptions to the Warrant Requirement in Cases Involving Computers

1. Consent

2. Exigent Circumstances

See ECPA Emergencies

The exigent circumstances exception to the warrant requirement generally applies when one of the following circumstances is present: (1) evidence is in imminent danger of destruction; (2) a threat puts either the police or the public in danger; (3) the police are in "hot pursuit" of a suspect; or (4) the suspect is likely to flee before the officer can secure a search warrant. Georgia v. Randolph, 547 U.S. 103, 117 n.6 (2006) (collecting cases); Brigham City v. Stuart, 547 U.S. 398, 403-06 (2006) (police appropriately entered house to stop assault when occupants did not respond to the officers' verbal directions); Illinois v. McArthur, 531 U.S. 326, 331-33 (2001) (police appropriately seized house for two hours while warrant was obtained); Cupp v. Murphy, 412 U.S. 291, 294-96 (1973) (murder suspect was temporarily seized and his fingernails scraped to prevent destruction of evidence). Of the four factors justifying an exigent circumstances search, the first-that the evidence is in imminent danger of destruction-is generally the most relevant in the context of computer searches. In determining whether exigent circumstances exist, agents should consider: (1) the degree of urgency involved, (2) the amount of time necessary to obtain a warrant, (3) whether the evidence is about to be removed or destroyed, (4) the possibility of danger at the site, (5) whether those in possession of the contraband know that the police are on their trail, and (6) the ready destructibility of the contraband. See United States v. Reed, 935 F.2d 641, 642 (4th Cir. 1991); see also United States v. Plavcak, 411 F.3d 655, 664-65 (6th Cir. 2005) (agents appropriately seized computer without warrant when targets were caught burning relevant documentary evidence and then ran from residence carrying computer); United States v. Trowbridge, 2007 WL 4226385, at *4-5 (N.D. Tex. Nov. 29, 2007) (agents appropriately seized computers without a warrant based on exigent circumstances where agents were concerned for their safety during a fast-moving investigation and it was likely that computer evidence would be destroyed).Exigent circumstances can arise in computer cases before the evidence has been properly secured because electronic data is inherently perishable. Computer data can be effectively put out of law enforcement reach with widely available and powerful encryption programs that can be triggered with just a few keystrokes. In addition, computer commands can destroy data in a matter of seconds, as can moisture, high temperature, physical mutilation, or magnetic fields created, for example, by passing a strong magnet over a disk. For example, in United States v. David, 756 F. Supp. 1385 (D. Nev. 1991), agents saw the defendant deleting files on his computer and seized the computer immediately. The district court held that the agents did not need a warrant to seize the computer because the defendant's acts had created exigent circumstances. See id. at 1392. See also United States v. Gorshkov, 2001 WL 1024026, at *4 (W.D. Wash. May 23, 2001) (circumstances justified downloading without a warrant data from computer in Russia where probable cause existed to believe that Russian computer contained evidence of crime, where good reason existed to fear that delay could lead to destruction of or loss of access to evidence, and where agent merely copied data and subsequently obtained search warrant).With some electronic devices, exigent circumstances may arise because information may be lost when the device's battery dies, or new information may cause older information to be lost permanently. For example, in United States v. Romero-Garcia, 991 F. Supp. 1223, 1225 (D. Or. 1997), aff'd on other grounds 168 F.3d 502 (9th Cir. 1999), a district court held that agents had properly accessed the information in an electronic pager in their possession because they had reasonably believed that it was necessary to prevent the destruction of evidence. The information stored in pagers is readily destroyed, the court noted: incoming messages can delete stored information, or the batteries can die, erasing the information. Accordingly, the agents were justified in accessing the pager without first acquiring a warrant. See also United States v. Ortiz, 84 F.3d 977, 984 (7th Cir. 1996) (in conducting search incident to arrest, agents were justified in retrieving numbers from pager because pager information is easily destroyed).

Cell Phones

"a warrantless search must be strictly circumscribed by the exigencies which justify its initiation," Mincey v. Arizona, 437 U.S. 385, 393 (1978) (internal quotation marks omitted), exigent circumstances that support the warrantless seizure of a computer may not support the subsequent search of the computer by law enforcement. "Recognizing the generally less intrusive nature of a seizure, the [Supreme] Court has frequently approved warrantless seizures of property, on the basis of probable cause, for the time necessary to secure a warrant." Segura v. United States, 468 U.S. 796, 806 (1984) (internal citations omitted). Thus, the need to seize a container to prevent the destruction of evidence does not necessarily authorize agents to take further steps without a warrant. See United States v. Doe, 61 F.3d 107, 110-11 (1st Cir. 1995); David, 756 F. Supp. at 1392 (exigency justified seizure but not search of computer); Morales-Ortiz, 376 F. Supp. 2d at 1142 n.2 (emphasizing that while exigent circumstances may justify seizing a pager to preserve evidence, the exception does not justify manipulating the pager in order to retrieve messages). In addition, absent an immediate need to access the data, practical factors may favor a Forensic analysis of a seized computer based on a search warrant. A trained analyst working in a Forensic setting can often extract detailed and relevant information from a computer that would not be recovered through a hastily conducted search.

3. Search Incident to a Lawful Arrest

Pursuant to a lawful arrest, agents may conduct a "full search" of the arrested person, and a more limited search of his surrounding area, without a warrant. See United States v. Robinson, 414 U.S. 218, 235 (1973); Chimel v. California, 395 U.S. 752, 762-63 (1969). For example, in Robinson, a police officer conducting a patdown search incident to an arrest for a traffic offense discovered a crumpled cigarette package in the suspect's left breast pocket. Not knowing what the package contained, the officer opened the package and discovered fourteen capsules of heroin. The Supreme Court held that the search of the package was permissible, even though the officer had no articulable reason to open the package. See Robinson, 414 U.S. at 234-35. In light of the general need to preserve evidence and prevent harm to the arresting officer, the Court reasoned, it was per se reasonable for an officer to conduct a "full search of the person" pursuant to a lawful arrest. Id. at 235.The permissible temporal scope for a search incident to arrest varies based on whether the item searched is an item "immediately associated with the person of an arrestee," such as clothing or a wallet, or other personal property near the arrestee, such as luggage. United States v. Chadwick, 433 U.S. 1, 15 (1977). Two Supreme Court cases illustrate this distinction. First, United States v. Edwards, 415 U.S. 800, 808-09 (1974), demonstrates the substantial time allowed for a search incident to arrest of items immediately associated with the person of an arrestee: the Court upheld a search of a defendant's clothing after a night in jail. In contrast, in United States v. Chadwick, the Court held that officers impermissibly searched a footlocker seized incident to arrest when they searched the locker away from the site of the arrest ninety minutes after the arrest. See Chadwick, 433 U.S. at 14-16. The Court stated that "[o]nce law enforcement officers have reduced luggage or other personal property not immediately associated with the person of the arrestee to their exclusive control, and there is no longer any danger that the arrestee might gain access to the property to seize a weapon or destroy evidence, a search of that property is no longer an incident of the arrest." Id. at 15.The Supreme Court recently revisited the search incident to arrest doctrine in Arizona v. Gant, 129 S. Ct. 1710 (2009). There, the Court authorized a search of a passenger compartment of a vehicle incident to arrest in only two situations: first, "when the arrestee is unsecured and within reaching distance of the passenger compartment at the time of the search"; and second, "when it is reasonable to believe evidence relevant to the crime of arrest might be found in the vehicle." Id. at 1719 (internal quotation marks omitted). Caution is appropriate until courts consider whether the reasoning of Gant is limited to vehicle searches, but there is good reason to conclude that the "evidence relevant to the crime of arrest" requirement should apply only to such searches. Gant states that its second exception is based on "circumstances unique to the vehicle context" and cites Justice Scalia's concurrence in Thornton v. United States, 541 U.S. 615, 632 (2004). That concurrence proposed the second exception in the context of vehicle searches and explained that "[a] motorist may be arrested for a wide variety of offenses; in many cases, there is no reasonable basis to believe relevant evidence might be found in the car." Thornton, 541 U.S. at 632.Beginning with pagers and now extending to cell phones and personal digital assistants, courts have generally agreed that the search incident to arrest doctrine applies to portable electronic devices. First, numerous cases over the last decade have approved searches of pagers incident to arrest. See United States v. Brookes, 2005 WL 1940124, at *3 (D.V.I. Jun. 16, 2005); Yu v. United States, 1997 WL 423070, at *2 (S.D.N.Y. Jul. 29, 1997); United States v. Thomas, 114 F.3d 403, 404 n.2 (3d Cir. 1997) (dicta); United States v. Reyes, 922 F. Supp. 818, 833 (S.D.N.Y. 1996); United States v. Lynch, 908 F. Supp. 284, 287 (D.V.I. 1995); United States v. Chan, 830 F. Supp. 531, 535 (N.D. Cal. 1993); see also United States v. Ortiz, 84 F.3d 977, 984 (7th Cir. 1996) (same holding, but relying on an exigency theory). More recently, many courts have upheld searches of cell phones incident to arrest. United States v. Finley, 477 F.3d 250, 259-60 (5th Cir. 2007); United States v. Valdez, 2008 WL 360548, at *2-4 (E.D. Wis. Feb. 8, 2008); United States v. Curry, 2008 WL 219966, at *10 (D. Me. Jan. 23, 2008); United States v. Mercado-Nava, 486 F. Supp. 2d 1271, 1278-79 (D. Kan. 2007); United States v. Dennis, 2007 WL 3400500, at *7-8 (E.D. Ky. Nov. 13, 2007); United States v. Mendoza, 421 F.3d 663, 666-68 (8th Cir. 2005); United States v. Brookes, 2005 WL 1940124, at *3 (D.V.I. Jun. 16, 2005); United States v. Cote, 2005 WL 1323343, at *6 (N.D. Ill. May 26, 2005). In addition, one appellate court has approved a search incident to arrest of an electronic address book. See United States v. Goree, 2002 WL 31050979, at *5-6 (6th Cir. Sept. 12, 2002).Courts have disagreed about whether a search incident to arrest of a cell phone is more like the footlocker in Chadwick (and thus subject to strict temporal requirements) or the search of the personal property in Edwards (and thus subject to more flexible temporal requirements). The only appellate court to consider the issue held that a cell phone found on the defendant's person constitutes personal property "immediately associated" with the arrestee. Finley, 477 F.3d at 260 n.7. See also United States v. Wurie, 2009 WL 1176946, at *5 (D. Mass. 2009); Brookes, 2005 WL 1940124, at *3 (analogizing pager and cell phone to wallet or address book); Cote, 2005 WL 1323343, at *6 (upholding search of cell phone at police station two and a half hours after arrest). However, two district courts have analogized cell phones to the footlocker in Chadwick and held that cell phone searches not contemporaneous with arrest violated the Fourth Amendment. See United States v. Lasalle, 2007 WL 1390820, at *7 (D. Haw. May 9, 2007) (rejecting cell phone search more than two hours and fifteen minutes after arrest); United States v. Park, 2007 WL 1521573, at *5-9 (N.D. Cal. May 23, 2007) (rejecting cell phone search approximately ninety minutes after arrest). See also United States v. Wall, 2008 WL 5381412, at *3-4 (S.D. Fla. Dec. 22, 2008) (search of cell phone performed at stationhouse after arrest could not be justified as incident to arrest).Courts have not yet addressed whether electronic media with the vast storage capacity of today's laptop computers may be searched incident to arrest. However, courts have allowed extensive searches of written materials discovered incident to lawful arrests. For example, courts have uniformly held that agents may inspect the entire contents of a suspect's wallet found on his person. See, e.g., United States v. Molinaro, 877 F.2d 1341, 1347 (7th Cir. 1989) (citing cases); United States v. Castro, 596 F.2d 674, 677 (5th Cir. 1979). Similarly, one court has held that agents could photocopy the entire contents of an address book found on the defendant's person during the arrest, see United States v. Rodriguez, 995 F.2d 776, 778 (7th Cir. 1993), and others have permitted the search of a defendant's briefcase that was at his side at the time of arrest. See, e.g., United States v. Johnson, 846 F.2d 279, 283-84 (5th Cir. 1988); United States v. Lam Muk Chiu, 522 F.2d 330, 332 (2d Cir. 1975). If these holdings are applied to searches incident to arrest where computers and similar storage media are recovered, agents should be able to review the contents of such devices without securing a search warrant. On the other hand, courts may analogize a laptop to the footlocker in Chadwick, so a search incident to arrest of a laptop may be judged under Chadwick's restrictive temporal standard if it is not seized from the suspect's person. As a practical matter, it may not be feasible to conduct an appropriate search of a laptop incident to arrest (though a brief review may be possible in some cases, particularly as Forensic tools designed for on-site review become available). A complete Forensic search often requires that the data on a computer be copied and then searched using tools designed for Forensic analysis, and such a full search may be impossible under Chadwick. Instead, agents may choose to seize a laptop incident to arrest and then obtain a search warrant for the subsequent thorough search. When making an arrest, seizure of items on the arrestee's person or within his reach is entirely appropriate. See Edwards, 415 U.S. at 805.

4. Plain View

Evidence of a crime may be seized without a warrant under the plain view exception to the warrant requirement. To rely on this exception, the agent must be in a lawful position to observe and access the evidence, and its incriminating character must be immediately apparent. See Horton v. California, 496 U.S. 128, 136 (1990). Although officers may occasionally come upon incriminating evidence on the screen of a computer, the most common use of the plain view doctrine in the computer context occurs when agents examine a computer pursuant to a search warrant and discover evidence of a separate crime that falls outside the scope of the search warrant. For example, in United States v. Wong, 334 F.3d 831, 838 (9th Cir. 2003), an agent discovered child pornography on a hard drive while conducting a valid search of the drive for evidence of a murder. Because the agent was properly searching graphics files for evidence of the murder, the child pornography was properly seized and subsequently admitted under the plain view doctrine. The plain view doctrine can also be useful in other circumstances when agents are lawfully in a position to discover incriminating evidence on a computer. See, e.g., United States v. Herndon, 501 F.3d 683, 693 (6th Cir. 2007) (officer permissibly seized a computer based upon plain view after a probation agent showed the officer child pornography discovered on subject's computer); United States v. Tucker, 305 F.3d 1193, 1203 (10th Cir. 2002) (approving seizure of computer under plain view doctrine by officer conducting parole search of home after officer noticed that computer had recently visited child pornography newsgroup). Most computer plain view cases involve agents viewing incriminating images, but in some circumstances the names associated with files (especially child pornography) can be incriminating as well. Compare Commonwealth v. Hinds, 768 N.E.2d 1067, 1073 (Mass. 2002) (finding that an officer lawfully searching for evidence of assault could open and seize image files whose sexually explicit names were in "plain view" and incriminating), with United States v. Stierhoff, 477 F. Supp. 2d 423, 445-49 (D.R.I. 2007) (rejecting the government's argument that the label on a computer file, "offshore," was sufficiently incriminating to justify opening the file under the plain view exception).Importantly, the plain view exception cannot justify violations of an individual's reasonable expectation of privacy. The exception merely permits the seizure of evidence that an agent is already authorized to view in accordance with the Fourth Amendment. This means that agents cannot rely on the plain view exception to justify opening a closed container that they are not otherwise authorized to view. See United States v. Maxwell, 45 M.J. 406, 422 (C.A.A.F. 1996) (holding that computer files opened by agents were not in plain view); United States v. Villarreal, 963 F.2d 770, 776 (5th Cir. 1992) (concluding that labels fixed to opaque 55-gallon drums do not expose the contents of the drums to plain view because "a label on a container is not an invitation to search it"). As discussed above in Section B.2, courts have reached differing conclusions over whether each individual file stored on a computer should be treated as a separate closed container, and this distinction has important ramifications for the scope of the plain view exception. Most courts have analyzed individual computer files as separate stored containers. See Guest v. Leis, 255 F.3d 325, 335 (6th Cir. 2001); United States v. Carey, 172 F.3d 1268, 1273-75 (10th Cir. 1999). When each file is treated as a separate closed container, agents cannot rely on the plain view doctrine to open files on a computer. However, Fifth Circuit decisions in United States v. Runyan, 275 F.3d 449, 464-65 (5th Cir. 2001), and United States v. Slanina, 283 F.3d 670, 680 (5th Cir. 2002), vacated on other grounds, 537 U.S. 802 (2002), aff'd, 359 F.3d 356, 358 (5th Cir. 2004), suggest that plain view of a single file on a computer or storage device could provide a basis for a more extensive search. In those two cases, the court held that when a warrantless search of a portion of a computer or storage device had been proper, the defendant no longer retained any reasonable expectation of privacy in the remaining contents of the computer or storage device. See Slanina, 283 F.3d at 680; Runyan, 275 F.3d at 464-65. Thus, a more extensive search of the computer or storage device by law enforcement did not violate the Fourth Amendment. This rationale may also apply when a file has been placed in plain view. The plain view doctrine arises frequently in the search warrant context because it is usually necessary to review all files on a computer to find evidence that falls within the scope of a warrant. As the Ninth Circuit explained in United States v. Adjani, 452 F.3d 1140, 1150 (9th Cir. 2006), "[c]omputer files are easy to disguise or rename, and were we to limit the warrant to such a specific search protocol [e.g., key word searches], much evidence could escape discovery simply because of [the defendants'] labeling of the files." As agents review a computer for information that falls within the scope of the warrant, they may discover evidence of an additional crime, and they are entitled to seize it under the plain view doctrine. Nevertheless, the Tenth Circuit's decision in United States v. Carey, 172 F.3d 1268, 1273 (10th Cir. 1999), provides a cautionary example regarding continuing the review of a computer after finding evidence of a second crime. In Carey, a police detective searching a hard drive with a warrant for drug trafficking evidence opened a "jpg" file and instead discovered child pornography. At that point, the detective spent five hours accessing and downloading several hundred "jpg" files in a search not for evidence of the narcotics trafficking that he was authorized to seek and gather pursuant to the original warrant, but for more child pornography. When the defendant moved to exclude the child pornography files on the ground that they were seized beyond the scope of the warrant, the government argued that the detective had seized the "jpg" files properly because the contents of the contraband files were in plain view. The Tenth Circuit rejected this argument with respect to all of the files except for the first "jpg" file the detective discovered. See id. at 1273, 1273 n.4. As best as can be discerned, the rule in Carey seems to be that the detective could seize the first "jpg" file that came into plain view when the detective was executing the search warrant, but could not rely on the plain view exception to justify the search solely for additional "jpg" files containing child pornography on the defendant's computers, evidence beyond the scope of the warrant. In subsequent cases, the Tenth Circuit has interpreted Carey narrowly, explaining that it "simply stands for the proposition that law enforcement may not expand the scope of a search beyond its original justification." United States v. Grimmett, 439 F.3d 1263, 1268 (10th Cir. 2006). For example, in United States v. Walser, 275 F.3d 981, 986-87 (10th Cir. 2001), the court found no Fourth Amendment violation when an officer with a warrant to search for electronic records of drug transactions opened a single computer file containing child pornography, suspended the search, and then returned to a magistrate for a second warrant to search for child pornography. See also United States v. Kearns, 2006 WL 2668544, at *8 (N.D. Ga. Feb. 21, 2006) (suggesting that agent who opened every file on a compact disk, regardless of file extension, in a search for evidence of fraud could have seized images of child pornography under the "plain view" doctrine as long as he did not abandon his search).

5. Inventory Searches

Law enforcement officers routinely inventory the items they have seized. Such "inventory searches" are reasonable-and therefore fall under an exception to the warrant requirement-when two conditions are met. First, the search must serve a legitimate, non-investigatory purpose (e.g., to protect an owner's property while in custody; to insure against claims of lost, stolen, or vandalized property; or to guard the police from danger) that outweighs the intrusion on the individual's Fourth Amendment rights. See Illinois v. Lafayette, 462 U.S. 640, 644 (1983); South Dakota v. Opperman, 428 U.S. 364, 369-70 (1976). Second, the search must follow standardized procedures. See Colorado v. Bertine, 479 U.S. 367, 374 n.6 (1987); Florida v. Wells, 495 U.S. 1, 4-5 (1990).It is unlikely that the inventory-search exception to the warrant requirement would support a search of seized computer files. See United States v. O'Razvi, 1998 WL 405048, at *6-7 (S.D.N.Y. July 17, 1998) (noting the difficulties of applying the inventory-search requirements to computer disks); see also United States v. Wall, 2008 WL 5381412, at *3 (S.D. Fla. Dec. 22, 2008) (inventory search exception did not justify search of cell phone); United States v. Flores, 122 F. Supp. 2d 491, 493-95 (S.D.N.Y. 2000) (finding search of cellular telephone "purely investigatory" and thus not lawful inventory search). Even assuming that standard procedures authorized such a search, the legitimate purposes served by inventory searches in the physical world do not translate well into the intangible realm. Information does not generally need to be reviewed to be protected and does not pose a risk of physical danger. Although an owner could claim that his computer files were altered or deleted while in police custody, an officer's examination of the contents of the files would offer little protection from tampering. Accordingly, agents will generally need to obtain a search warrant in order to examine seized computer files held in custody unless some other exception to the warrant requirement applies.

6. Border Searchers