Searching and Seizing Computers Obtaining Electronic Evidence in Criminal Investigations Computer Crime and Intellectual Property Section Criminal Division United States Department of Justice July 2002 DOWNLOADED FROM: Sovereignty Education and Defense Ministry (SEDM) Website http://sedm.org TABLE OF CONTENTS • PREFACE ................................................................................................... 6 • IN"TRODUCTION .......................................................................................... 7 • I. SEARCHIN"G AND SEIZIN"G COMPUTERS WITHOUT A WARRANT .................... 10 • A. Introduction .................................................................................... 10 • B. The Fourth Amendment's "Reasonable Expectation of Privacy" ....................... in Cases Involving Computers .................................................................... 11 • 1. General Principles ..................................................................... 11 • 2. Reasonable Expectation of Privacy in Computers as Storage Devices ......... 11 • 3. Reasonable Expectation of Privacy and Third-Party Possession ................ 13 • 4. Private Searches ........................................................................ 15 • 5. Use of Technology to Obtain Information ............................................ 17 • C. Exceptions to the Warrant Requirement in Cases Involving Computers ................ 18 • 1. Consent .................................................................................. 18 • a) Scope of Consent .............................................................. 18 • b) Third-Party Consent .......................................................... 20 • c) Implied Consent ............................................................... 23 • 2. Exigent Circumstances ................................................................. 24 • 3. Plain View ............................................................................... 25 • 4. Search Incident to a Lawful Arrest ...................................................26 • 5. Inventory Searches ..................................................................... 27 • 6. Border Searches ........................................................................ 28 • 7. International Issues ..................................................................... 29 • D. Special Case: Workplace Searches .......................................................... ,31 • 1. Private Sector Workplace Searches .................................................. 31 • a) Reasonable Expectation of Privacy in Private-Sector Workplaces ..... 32 • b) Consent in Private Sector-Workplaces ..................................... 32 • c) Employer Searches in Private-Sector Workplaces ........................ 33 • 2. Public-Sector Workplace Searches ................................................... 33 • a) Reasonable Expectation of Privacy in Public Workplaces ............... 34 • b) "Reasonable" Workplace Searches Under O'Connor v. Ortega ......... 36 • c) Consent in Public-Sector Workplaces ..................................... .39 • II. SEARCHIN"G AND SEIZIN"G COMPUTERS WITH A WARRANT .......................... .40 • A. Introduction .....................................................................................40 • B. Planning the Search ........................................................................... .43 • 1. Basic Strategies for Executing Computer Searches .............................. .43 2 • a) When Hardware Is Itself Contraband. Evidence. or an ................ Instrumentality or Fruit of Crime ..............................................44 • b) When Hardware is Merely a Storage Device for Evidence of Crime ... , ,,.. ,,;,,., ,,,..,,,,,. ,,,,.,,, ,.,,, ,,.., , , ,. .,,, ,. .. , .,, ,,., ,,,.., ,, ,.,, ,,44 • 2. The Privacy Protection Act .......................................................... .46 • a) A Brief History of the Privacy Protection Act ........................... .46 • b) The Terms of the Privacy Protection Act ................................. .47 • c) Application of the PP A to Computer Searches and Seizures ........... .48 • 3. Civil Liability Under the Electronic Communications Privacy Act ............. 51 • 4. Considering the Need for Multiple Warrants in Network Searches ............. 52 • 5. No-Knock Warrants .................................................................... 53 • 6. Sneak-and-Peek Warrants ............................................................. 54 • 7. Privileged Documents .................................................................. 55 • a) The Attorney General's Regulations Relating to Searches of. .......... Disinterested Lawyers. Physicians, and Clergymen ........................ .55 • b) Strategies for Reviewing Privileged Computer Files .....................56 • C. Drafting the Warrant and Affidavit ........................................................... 57 • Step 1: Accurately and Particularly Describe the Property to be Seized in the,,. Warrant and/or Attachments to the Warrant .......................................... .57 • Step 2: Establish Probable Cause in the Affidavit .................................... 62 • Step 3: In the Affidavit Supporting the Warrant, Include an Explanation of .. the Search Strategy (Such as the Need to Conduct an Off-site Search) as Well as the Practical and Legal Considerations That Will Govern the Execution of the Search ................................................................................... 64 • D. Post-Seizure Issues ............................................................................. ,69 • 1. Searching Computers Already in Law Enforcement Custody .................... 69 • 2. The Permissible Time Period For Examining Seized Computers ............... 70 • 3. Rule 4l(e) Motions for Return of Property ..........................................72 • III. THE ELECTRONIC COMMUNICATIONS PRIVACY ACT .................................. 74 • A. Introduction ......................................................................................74 • B. Providers of Electronic Communication Service vs. Remote Computing Service ..... 76 • C. Classifying Types of Information Held by Service Providers ............................ 80 • 1. Basic Subscriber Information Listed in 18 U.S.C. § 2703(c)(2) ................. 80 • 2. Records or Other Information Pertaining to a Customer or Subscriber ......... 81 • 3. Contents .................................................................................. 81 • D. Compelled Disclosure Under ECPA ......................................................... 82 • 1. Subpoena ................................................................................ 82 • 2. Subpoena with Prior Notice to the Subscriber or Customer ...................... 83 • 3. Section 2703(d) Order ................................................................. 84 • 4. § 2703(d) Order with Prior Notice to the Subscriber or Customer .............. 85 • 5. Search Warrant .......................................................................... 86 • E. Voluntary Disclosure ........................................................................... 87 3 • • F. Quick Reference Guide .... 00 ....... 00 .......................................................... 88 • G. Working with Network Providers: Preservation of Evidence, Preventing ... 00 ....... Disclosure to Subjects, and Cable Act Issues ....... 00 ............ 00 ............................ 89 • 1. Preservation of Evidence under 18 U.S.C. § 2703([) oo•·········oo·····oo····oo ... 90 • 2. Orders Not to Disclose the Existence of a Warrant, Subpoena................. or Court Order .............................................................................. 91 3. The Cable Act, 47 U.S.C. § 551 ....... 00 00 ........................................... 91 • H. Remedies ........................................................................................ 92 • 1. Suppression .............................................................................. 92 • 2. Civil Actions and Disclosures ......................................................... 93 • IV. ELECTRONIC SURVEILLANCE IN COMMUNICATIONS NETWORKS ................. 94 • A. Introduction ...................................................................................... 94 • B. Content vs. Addressing Information ......................................................... 94 • C. The Penffrap Statute, 18 U.S.C. §§ 3121-3127 oo .... oo ...... oooo············ ......... 00 ... 95 • D. The Wiretap Statute ("Title Ill"), 18 U.S.C. §§ 2510-2522 00.00 ............. 00 ..... 00 ... 98 • 1. Introduction: The General Prohibition ..............................................98 • 2. Key Phrases ............................................................................. 99 • 3. Exceptions to Title III ..... 00 ........... 00 ........... 00 ............. 00 ................ 101 • a) Interception Authorized by a Title ill Order, 18 U.S.C. § 2518 ....... 102 • b) Consent of a Party to the Communication, 18 U.S.C. § 2511(2)(c)(d) ......... oo•·· ........................................ 102 • c) The Provider Exception, 18 U.S.C. § 2511(2)(a)(i) ... oo ................ 104 • d)TheComputerTrespasserException. 18 U.S.C. § 2511(2)(i) ... 00 .... 108 • e) The Extension Telephone Exception. 18 U.S.C. § 2510(5)(a) ........ .108 • Q The 'Inadvertently Obtained Criminal Evidence' Exception, 18 U.S.C. § 2511(3)(b)(iv) 00 ...