Recent Encrypted Laptop Issues

You may have seen the stories – they ran about a week ago – about Joseph Edward Duncan III’s plea bargain with state prosecutors on charges arising out of his killing three people so he could kidnap a little girl and her brother.

The little girl was eventually rescued, but Duncan apparently murdered the boy.

I’ve read a number of these stories, and I’m still somewhat confused about the nature of the plea bargain.

The stories all say Duncan originally wanted to give up the key to encrypted files on his laptop in exchange for getting a pass on the death penalty. State prosecutors apparently rejected that offer, but have accepted a plea bargain under which the encryption key will be revealed, but only to Duncan’s defense lawyer.

Prosecutors are apparently interested in the encrypted files because they may contain a journal that provides information about the crimes with which he has been charged (and maybe others, as well). Duncan is being prosecuted both by federal and state officials, for different crimes arising out of the murders and kidnappings I noted above. Both jurisdictions intend to seek the death penalty.

What I found interesting about some of these stories, anyway, is that they say federal computer experts have spent a year trying to crack the encryption, have been unable to do so. Duncan is reported as saying that it would take “at least 30 years” for technology to emerge that would let law enforcement crack the encryption. I don’t know. I have been told that there are federal experts who could crack the encryption now, but then they would probably have to explain how they did it – in court – and that is not something the government wants to do.

In an earlier post, I speculated about what would happen if someone entering or leaving the United States with a laptop were ordered to give Customs Officials the encryption key needed to access encrypted files on that laptop. Duncan is not going that route – he’s apparently less concerned about giving up incrementally incriminating information than he is about saving his neck (which may or may not work, since it doesn’t seem either the federal or state prosecutors are interested in that particular deal).

A couple of weeks ago, I got a letter from a man who was arrested at an airport when he was trying to return to the U.S. from a business trip abroad. He was carrying a laptop with encrypted files on it, among which there apparently were some child pornography files. Customs Officers stopped him, looked through his belongings, tried to review the files on the laptop but could not because the hard drive was encrypted.

According to him, they ordered him to give them the encryption key and he complied because he didn’t know he had a choice. He says the officers then took the laptop away for some time, searching it, and came back after finding child pornography. He was then arrested, and has been in jail since. (He has dual citizenship and so is considered a flight risk).

I gather the Customs Officers say they did not coerce him, that he voluntarily gave up the encryption key. If that is true, then he waived any hope of invoking his Fifth Amendment privilege against self-incrimination. The Supreme Court has held that, when it comes to the Fifth, you either invoke it or lose it. In other words, if you answer questions or give up an encryption key, you’re toast. You cannot object to the use of the evidence on the basis that it was obtained in violation of the Fifth Amendment.

The man’s story makes me wonder about several things: I wonder what actually happened to him, though I tend to suspect that here, as is usually the case, the truth lies somewhere between his version and the Customs Officers’ version of what happened.

I wonder if this happens to other people and if they, too, give up the encryption key, not being aware that they have (may have) an alternative.

I wonder what would happen if someone adamantly refused to give up their encryption key – would the Customs Officers simply arrest them, for failing to cooperate with U.S. Customs procedures?

I rather doubt that, because I once did a presentation on the border search exception and the Fifth Amendment to a group of federal prosecutors, nearly all of whom said that if someone adamantly refuses to give up the encryption key, the Customs Officers would let them go . . . not “go” in the sense of passing through Customs and boarding a plane, but “go” in the sense that they could decide they did not really want to fly that day, and would instead abort the trip.

I’m not all that sure Customs Officers would want to let someone walk away who refuses to give them an encryption key. Obviously, the officers would not ask for it unless they thought there was some reason to search the files (since I assume they are far too busy to search every laptop they see). If they had “reasonable suspicion” – a lower level of probable cause to believe a crime has bee committed – they might be able to hold the person while they seek some alternative way to resolve matters, not that I’m sure what that would be.

I actually have two trips abroad this fall, but I won’t be taking a laptop either time, so I won’t have the occasion to check all this out. If I really needed a laptop on either trip, it might be an interesting experiment, to see if mine got flagged for a check (or maybe not . . . . ).

MMORPGs and the Government

I recently read a blog post that vividly described how online games – MMORPGs – can take over someone's life. That motivated me to do a quick Google search for the notion that online games are addictive.

I found a lot of comments, stories, etc. to that effect.

One website said the addiction rate for MMORPGs “appears to be about twice that of crack Cocaine.”

As you probably know, stories (and probably rumors) about the consumingly addictive nature of MMORPGs has generated some government efforts to control the (alleged) addiction. China has reportedly opened a game addiction clinic that uses electroshock and psychotherapy to treat those who are seriously addicted to online gaming. And it seems to me I have read other stories about governments either cracking down on online gaming or threatening to do so.

I find that notion interesting, because it looks to me like there COULD be a move to treat immersive online games in a fashion analogous to the drugs we outlaw. Why do we outlaw certain drugs? Think about it: The drugs we outlaw tend to take people away from reality, in good or bad ways. PCP and some other violence-inducing drugs take people away in a fashion I, anyway, would submit is not desirable or acceptable, given the high risk of harm the user poses to others.

But my understanding is that many of the drugs we outlaw – marijuana, heroin and other opium-derivatives, LSD, etc. – are anything but violence-inducing. (Some may argue that LSD is, and they may be right; I read a book a few years ago, which persuaded me that it is not.) Many of them (think marijuana) tend to induce a very passive state, one that is pretty much the antithesis of how people behave on alcohol (which tends to make us more aggressive), which is still legal in most of the US, anyway.

Why outlaw drugs that alter out relationship with reality that, in effect, blur the edges of physical reality? I really do not know. One argument, I do know, is that people who become addicted to these drugs cease to be productive citizens, and consequently tend to commit crime, become dependent on society, neglect their children, etc. If that is true, if certain drugs inevitably result in those behaviors, then outlawing them makes sense for reasons that are analogous to those which, I submit, support outlawing PCP and similar drugs.

I also read, some years ago, that it is possible to function quite well on certain kinds of drugs (like heroin) as long as one has an adequate supply of the drug. If that is true, and let’s assume for the sake of argument that it is true, then why would we outlaw these drugs? Is it because we believe physical reality is a given that we must confront without the palliative effects of drugs that blur our experience with that reality? If that is so, then I wonder why we believe this. (I’m not sure I believe this.)

There is a view that the current aggressively-anti recreational drug stance in the US is a product of lobbying by Harry Anslinger, who basically created US anti-drug policies in the 1930s. According to this view, Anslinger, who had been a high-level bureaucract in the Bureau of (Alcohol) Prohibition, worked to develop an aggressive federal anti-drug program to give himself job security by essentially transforming that Bureau into the foundation of a federal anti-drug agency.

I don’t know if that is true or not, but from what I have read Anslinger did sometimes play fast and loose with the truth about certain drugs in order to advance his ends. (I read somewhere that when Congress was holding hearings on criminalizing marijuana he told them a story about a “Mexican” who used marijuana, went psychotic and killed one, two, three, I forget how many people. I also read that he used the same story when Congress was considering criminalizing LSD.)

Anyhow, I digress. For some reason – historical, functional, logical, illogical, who knows – we outlaw drugs that blur the edges of physical reality.

Now we have MMORPGs, which take us away from physical reality into realities that are limited only by our imaginations. I’m not a gamer, but I can certainly understand why people might want to spend time away from the aggravations and limitations of their real, physical lives. And I can understand why that experience might become “addictive,” in the sense that we want to repeat it.

But are MMORPGs really addictive . . . in the way “bad” drugs are addictive? I can’t imagine that anyone would say they’re physically addictive, but that probably doesn’t resolve the question. Gambling is often described as addictive, too, and no one, I assume, would say it is physically addictive.

I’m sure people can become overly immersed in MMORPGs. I’ve fooled around a bit in Second Life, know people who spend a lot of time there, and I can understand why. It’s fun, it’s creative, it frees them from the constraints and aggravations of their real-life (not being in charge of things, bosses, traffic, financial issues, relatives, etc.).

What’s wrong with that? What’s wrong with escaping from our physical reality for a while? Why can’t that be a good thing? Why can’t that be a coping mechanism – something that lets us put our real-life experiences in perspective and maybe deal with them in a better way than we would otherwise?

Is it just that government feels the need to step in and control certain kinds of behaviors? I may be wrong (it’s been known to happen), but I don’t see how the crack addict kinds of justifications work in this context. Is anyone really going to go out and commit crimes to get money to be able to keep participating in a MMORPG? And if that is not likely, then what possible justification could there be for restricting – even, perhaps, ultimately outlawing – MMORPGs?

I could see a future Harry Anslinger arguing to Congress that we need to outlaw MMORPGs (or restrict access to them) because someone – the twenty-first century’s version of the “Mexican” he used seventy years ago – spent so much time in World of Warcraft they became acclimated to violence and killed five people in the real-world (probably using a virtual sword).

Sorry – I seem to be on a soapbox this morning.

And on a somewhat related but probably more rational note, you may have seen that Congress is considering taxing “virtual economies.” I wonder what effect taxation would have on the “take us away from reality” effect of MMORPGs.

Online/Offline Rage

Yesterday the BBC had a story about “Britain’s first `web-rage’ attack.”

I’m not exactly sure what “web-rage” is, and I’m not sure if this qualifies as web-rage, assuming it exists . . . since the attack in this case occurred online.

Two men apparently met and chatted in a Yahoo! chatroom, but they fell out when one allegedly began to spread rumors about the other. The object of the alleged rumors tracked the other fellow down, using online sources, and showed up at the alleged rumor-monger’s home armed and with an armed companion. A fight broke out, but fortunately no one was seriously injured.

The story made me think about the notion of web-rage. Some (including me) have written about the fact that life online seems to spawn a version of road rage. We’re all, I imagine, familiar with road rage: When we get in a vehicle, the anonymity of being isolated inside and the perceived power the vehicle gives us causes us (many of us, all of us, maybe, sometimes) to act in ways we would never act if we were face-to-face with others. People who would never cut in front of someone in a grocery line cut people off in traffic, tailgate others, honk and/or make rude gestures to indicate their frustration and hostility with people they blame for driving too slowly, too cautiously, too ineptly. It’s a documented phenomenon, studied by social psychologists and others with expertise far exceeding mine.

It struck me, a few years ago, that we seem the same phenomenon migrating online. Cyberspace is actually a more hospitable venue for this kind of amorphous hostility: While you can be relatively anonymous in your vehicle, the vehicle itself is clearly identifiable if anyone wants to make the effort (model, make, color, license plate #). And you are visible – to a greater or lesser degree – inside your vehicle, so you, too, run the risk of being identified if you do something awful enough that anyone actually wants to track you down. That, I think, serves as something of a moderating force for road rage; we know we can be hostile to a point, but if we go further than that we begin to run the risk that someone will report us to law enforcement and create the risk of consequences we’d prefer to avoid.

So you have some anonymity in your vehicle, but nothing approaching what you can achieve online. Depending on the effort you put in, you can achieve almost-perfect or functionally-perfect anonymity online and this, I submit, erodes or even erases the risk of consequences that keeps real-world road rage in line.

The effects of this heightened anonymity are exacerbated by the real power one can achieve online. The power of the vehicle lies in its physically insulating us from others, in its capacity for speed and in its mass – its bulk. It makes us feel bigger, stronger, more invincible.

Much of the heightened sense of power people can enjoy online derives, I think, from the perfect/almost-perfect anonymity they can assume. Anonymity has often been equated with power: Super-heroes are always anonymous and that’s part of their power. They stand apart from everyone else, tinkering in our mundane lives with their special talents; in a sense, they manipulate us and the context in which we live like children manipulate toys.

I think some of that comes out online, with web-rage or whatever we want to call it. This phenomenon is very apparent in the behavior of online stalkers and harassers. While some of them might engage in similar conduct in the real-world, many, I think, would not, at least would not go as far as they are willing to go online.

That reminds me of a conversation I had several years ago with a county prosecutor in a state I won’t identify. For some reason, we were talking about cyberstalkers, and he told me he has the perfect way of dealing with them – guaranteed to stop them. He said, and I agree with this, that much of the motivation for thee stalking lies in the power of the anonymity they assume online. So he said when his office gets a report of cyberstalking he contacts the police and they send officers out to the alleged perpetrator’s home. There, they take his/her computer (computers). He said that puts an end to it.

I was sputtering a bit at this point, trying to point out to this prosecutor that police simply can’t go out and seize someone’s computers – that this would be a blatant violation of the 4th Amendment. His response? He said that cyberstalkers depend on anonymity, and so are embarrassed and unwilling to complain about their computer’s being seized because this would “out” them as alleged cyberstalkers. Reeling, I asked him how long they keep the computers. He said, basically, forever, unless the person at some point really makes an issue of it.

That story is kind of a digression from my main point, but not really. Online anonymity, coupled with the information you can discover about people online and with the ability you have to . . . what? . . . interfere with, manipulate, harass, etc. other people online produces what I think are some very interesting, and often very unpleasant, variations on real-world road rage.

I don’t, though, think the solution lies in taking people’s computers.

Using Mediation to Control Virus Writers

A law student I know sent me a link to a paper he wrote on using mediation to control virus-writers.

The title of the paper is "Taming the Internet Wild: Punishing and Deterring Virus-Writers and Script-Kiddies Through Victim-Offender Mediation" and you can find it here.

As he explains on the site where the paper is posted, he wrote while he was on the staff of a law review, but the law review did not publish it.

So, he's been kind enough to release it for public review via his blog. I think you might find it very interesting. As he says on his blog, most of the paper deals with computer virus writers and the nature of the crimes they commit; he didn't get to include all that much about why mediatiion is likely to be an effective way of controlling this type of activity.

Still, though, I think you might find it an interesting read. And you can contribute any thoughts you have to his blog, address given above.

GPS Tracking and the 4th Amendment: Part 2

Last time I talked about using GPS devices to track vehicles. There' a Supreme Court decision that seems to hold that monitoring such a device in order to track someone’s movements is outside the 4^th Amendment, so no warrant is required to do so. We can argue that the decision doesn’t apply to modern GPS technology, of course, but at least there is a decision out there.

The Supreme Court did not decide, when it issued that decision twenty-plus years ago, whether the installation of a tracking device, such as a GPS device, is something that comes within the scope of the 4^th Amendment. That issue is now surfacing, as courts try to figure out whether putting a tracking device on someone’s car is either a “search” or a “seizure” under the 4^th Amendment.

Putting the device on a vehicle is not, I would submit, a “search” because a search violates a valid 4^th Amendment expectation of privacy. The issue that’s coming up in these cases is whether the 4^th Amendment is implicated when a tracking device is installed on a “public” area of a vehicle: under a bumper, on the undercarriage, etc. It’s clear that officers cannot go into “private” areas of a vehicle (the trunk, under the hood, inside the passenger compartment, etc.) without having a warrant; that would clearly be a search regardless of whether their motive is to install a tracking device or just to look around (or both). When the devices are installed on areas that are, at least arguably, accessible to the general public, I don’t think we can legitimately characterize the act of installing them as a “search.” After all, what “private” information do the officers obtain by doing so?

I tend to think, though, that the act of installing a tracking device on such a “public” area of a vehicle is a seizure under the 4^th Amendment. Seizures occur when agents of the government interfere with someone’s possession and use of their vehicle. Now, when an officer sneaks up to a car at night or at some other time when it is parked and is not being used by the owner and installs a GPS device, there would not seem to be any particular interference with the owner’s possession and use of the property. The owner never even knows what’s happened – that’s the whole point.

But something has definitely happened, and some courts have said that something is a seizure, which means that the installation of a tracking device comes within the 4^th Amendment. A Wisconsin district court held, earlier this year, that officers must have reasonable suspicion to believe that a crime is being/has been committed and that the installation of the tracking device will yield evidence of that crime. U.S. v. Garcia, 2006 WL 298704 (W.D. Wisconsin 2006). This court found that reasonable suspicion was enough because “the intrusion caused by the application of the device is minimal. The real intrusion . . . is the 24/7 governmental monitoring that follows.”

(Reasonable suspicion is a lower level of individualized suspicion of probable cause. It basically means that officers can’t just install a tracking device whenever they feel like it in hopes something will turn up. Instead, they must be able to articulate specific facts which supported their belief that installing the device would yield evidence of criminal activity.)

A couple of years ago, a New York court went further. In People v. Lacey, 787 N.Y.S.2d 680 (N.Y. Co. Court 2004), the court held that police must get a warrant, based on probable cause, to install a tracking device”

“Although . . . persons have diminished expectations of privacy in automobiles on public roads and can be visually tracked by the police, it is clear that the mere act of parking a vehicle on a public street does not give law enforcement the unfettered right to tamper with the vehicle by surreptitiously attaching a tracking device without either the owner's consent or without a warrant issued by a Court. . . . Attachment of the GPS requires a physical intrusion into an individual's personal effects . . . . Accordingly, the Court finds that in the absence of exigent circumstances, not here present, the police should have obtained a warrant prior to attaching the GPS to the Mitsubishi.”

About a month ago, a New Jersey court held that the 4^th Amendment requires police to get a warrant before attaching a GPS tracking device. State v. Scott, 2006 WL 2640221 (N.J. Super. A.D. 2006).

Courts in Washington and Oregon have reached similar conclusions by applying their state constitutions (which can and often do provide more protection than the 4^th Amendment). State v. Jackson, 76 P.3d 217 (Washington 2003); State v. Campbell, 759 P.2d 1040 (Oregon 1988). The Jackson court noted, for example, that if “police are not required to obtain a warrant . . . before attaching a GPS device to a citizen's vehicle, then there is no limitation on the State's use of these devices on any person's vehicle, whether criminal activity is suspected or not.”

Other courts have disagreed, basically on the premise that the installation of a GPS tracking device in no way interferes with the vehicle owner’s possession and use of the vehicle. As the Ninth Circuit said in U.S. v. McIver, 186 F.3d 1119 (1999), “McIver did not present any evidence that the placement of the . . . tracking devices deprived him of dominion and control of his Toyota 4Runner, nor did he demonstrate that the presence of these objects caused any damage to the electronic components of the vehicle. Under these circumstances, we hold that no seizure occurred because the officers did not meaningfully interfere with McIver's possessory interest in the Toyota 4Runner.”

I understand that viewpoint, but whenever I think about this issue I come back to the argument a gentleman made earlier this year, when I raised this issue in a conference presentation. He said something to the effect of “the government can’t put a bumper sticker on my car – it’s my car and putting a bumper sticker on it would violate my rights to the ownership of the car. So if they can’t put a bumper sticker on my car, how can they put a GPS device on it?”

Good question.

GPS Tracking and the 4th Amendment: Part 1

As you may know, police often use GPS devices to monitor the movements of vehicles used by those who are suspected of being involved in criminal activity. The use of these devices is becoming increasingly common because they are so effective.

The devices are usually attached somewhere on the exterior of the vehicle, under a bumper or on the undercarriage, say.

The use of GPS tracking devices is raising 4th Amendment issues, for several reasons. In this post I want to talk about what has been the most common issue: Whether the use of a tracking device is a "search" under the 4th Amendment.

To explain why this is an issue, I need to review what happened in a twenty year old Supreme Court case: In United States v. Knotts, 460 U.S. 276 (1983), the Supreme Court was asked to decide if law enforcement’s using a “beeper” to track the movements of a vehicle was a search under the 4th Amendment. If it was, law enforcement would have had to have gotten a search warrant for the use of the beeper to be constitutional; if it was not, then their using the beeper without getting a warrant did not violate the 4th Amendment.

The “beeper” was a radio transmitter that was placed in a container of chloroform that was sold to a suspect – Armstrong – who was believed to be involved in manufacturing illegal drugs. Armstrong put the container with the beeper in it in his vehicle and officers followed him to see where he was taking it. In following him, they relied both on visual surveillance and on the signals from the beeper; the beeper basically made it easier for them to keep track of Armstrong’s vehicle as he traveled along roads in rural Wisconsin. As its name implies, the beeper merely transmitted an audio signal that became stronger when the officers were closer to Armstrong’s vehicle and weakened as they fell further behind it.

The Supreme Court said the use of the beeper was not a “search” because Armstrong did not have a 4th Amendment expectation of privacy in his movements along public highways. The Knotts Court noted that the “fact that the officers . . . relied not only on visual surveillance, but also on the use of the beeper . . . does not alter the situation. Nothing in the Fourth Amendment prohibited the police from augmenting the sensory faculties bestowed upon them at birth with such enhancement as science and technology afforded them”.

Since Armstrong’s movements were not private, there was no search and the 4th Amendment was not implicated. Given the Knotts decision, it would seem that law enforcement’s using GPS devices to track vehicles would not be a search within the 4th Amendment . . . which means law enforcement could install a GPS device on a vehicle and monitor it without obtaining a warrant, just as the officers did in Knotts. Some courts, though, are suggesting that Knotts is not dispositive of this issue because of the significant differences between GPS tracking devices and the beeper used in Knotts.

In State v. Jackson, 76 P.3d 217 (Wash. 2003), the Washington Supreme Court held that the use of a GPS tracking device is a search under the state’s constitution, which the court interprets as providing more privacy protection than does the 4th Amendment. The Jackson Court explained that the use of a GPS device is much more intrusive than the monitoring of the beeper used in Knotts:

“[W]hen a GPS device is attached to a vehicle, law enforcement officers do not in fact follow the vehicle. Thus, . . . the GPS device does not merely augment the officers' senses, but rather provides a technological substitute for traditional visual tracking. Further, the devices in this case were in place for approximately two and one-half weeks. It is unlikely that the sheriff's department could have successfully maintained uninterrupted 24-hour surveillance throughout this time by following Jackson. Even longer tracking periods might be undertaken, depending upon the circumstances of a case. We perceive a difference between the kind of uninterrupted, 24-hour a day surveillance possible through use of a GPS device, which does not depend upon whether an officer could in fact have maintained visual contact over the tracking period, and an officer's use of binoculars or a flashlight to augment his or her senses.

Other courts are suggesting that the same result may hold under the 4th Amendment, on the premise that the increased sophistication of GPS tracking makes it more intrusive than the use of the beeper at issue in Knotts and therefore should bring it within the scope of the 4th Amendment.

A New York court concluded, for example, that “[a]t this time, more than ever, individuals must be given the constitutional protections necessary to their continued unfettered freedom from a `big brother’ society. . . . [A] person must feel secure that his or her every movement will not be tracked except upon a warrant based on probable cause establishing that such person has been or is about to commit a crime. Technology cannot abrogate our constitutional protections.” People v. Lacey, 787 N.Y.S.2d 680 (N.Y. Co. Ct. 2004).

A federal district court in Maryland noted that the use of GPS technology raises issues that may implicate the 4th Amendment, but concluded it did not have to decide whether this is true because the officers in the case had obtained a warrant before they installed the GPS device on the suspect’s vehicle. United States v. Berry, 300 F.Supp.2d 366 (D. Md. 2004).

It’s likely to be a long time before the Supreme Court addresses this issue if, indeed, it ever does. This means the applicability of the 4th Amendment to GPS tracking will probably remain uncertain, dependant upon whether a court construes GPS technology as indistinguishable from the beeper used in Knotts or as a device the intrusiveness of which takes it out of the Knotts holding. We may also see state courts using state constitutions to impose restrictions on the use of this technology.

The question as to whether GPS tracking constitutes a search within the compass of the 4th Amendment is really just one manifestation of a larger issue: How do we apply constitutional protections -- such as the 4th Amendment -- to evolving technologies? The constitution, and the 4th amendment in particular, were written at a time when the only world was the real, physical world and searches involved law enforcement's kicking down doors and rummaging through closets and other "private" areas.

Technology lets law enforcement officers do what they could not do when the Constitution was drafted. Here, as in other areas, courts need to decide how we reconcile new technologies, new methods, with traditional principles.

The 4th Amendment and Copying Data

This is aabout whether the 4th amendment applies to a law officer's copying data. The issues whether copying data is a "search" or a "seizure" under the 4th Amendment. At the moment, it is not clear that copying data is either.

This is an important issue because, if copying data is neither a search nor a seizure, then it is outside the scope of the 4th Amendment . . . which means officers do not need a search (and/or seizure) warrant or an exception to the warrant requirement in order to copy data lawfully.

As I explained in an earlier post, the 4th amendment creates the right to be free from “unreasonable” (a) searches and (b) seizures. Searches violate a reasonable expectation of privacy, while seizures of property violate the owner’s legitimate interest in the possession and use of that property.

I have argued elsewhere that copying data is a seizure – I don’t think it is a a search because you can copy data without scrutinizing its contents; I think such scrutiny is essential for there to be a “search.”

I think the act of copying data is a seizure, though, because “something” clearly happens: The government obtains a copy of data, something it did not have before the copying occurred.

I see this as somewhat analogous to the rule with regard to copying data as theft: In an Oregon case, the defendant was charged with “theft” because he copied a file containing user passwords, a file that belonged to Intel, his employer. The defendant in that case claimed he had not committed “theft” because theft is, and has traditionally been, a zero-sum offense. That is, it consists of taking someone’s property and thereby wholly depriving them of its possession and use. The defendant in this case claimed he had not “deprived” Intel of anything because it still had the file with the passwords in it.

The Oregon court basically finessed his argument, finding there had been a “theft” because Intel had lost something – essentially the exclusive possession and use of the property. (I say finessed because the statute was somewhat problematic, as many theft statutes are – they can reflect history and define theft in terms of taking “tangible property” and/or in terms of completely depriving the owner of the possession and use of the property.)

But let’s get back to seizures: I think copying data has to be defined as either a search or a seizure, because otherwise it’s completely outside the 4th Amendment . . . which would mean, as I noted earlier, that law enforcement agents could copy data without obtaining a warrant or having any other justification under the 4th amendment. I also think, as I explain above, that it is sufficiently analogous to data theft to qualify as a seizure.

What I really want to talk about is a hypothetical (or maybe a real case) that was posed to me at a conference last year. Here it is: Two officers go to John Doe’s home to execute a search warrant for his laptop. The warrant authorizes them to search the home for the laptop and then seize it, bring it back so it can be analyzed forensically. As they arrive at Doe’s home, he drives up. They tell him why they’re there and he agrees to get the laptop and give it to them, which he does. To get the laptop, he goes inside and they follow, with his permission. They see a terabyte server in the room where he goes to get the laptop -- however many terabytes is up to you, but it’s big. They ask Doe if they can make a mirror image of the server, and he agrees. (Now, I’m assuming they don’t actually do this, that they call others to do so, but for simplicity’s sake I’ll just act as if they whip out the necessary equipment and proceed.)

The process of imaging the server begins. It will take, say, 10 hours. About halfway through, Doe says, “You know, I’ve changed my mind. Quit making the copy.” The question posed to me is: What can the officers do? If they stop, they lose what they have already copied; if they keep going, they clearly do so without Doe’s permission, and his consent is their only 4th amendment justification for copying the data.

If copying the data is a search (which I don’t think it is), they clearly have to stop. The rule is that a search authorized by the property owner’s consent is reasonable as long as the consent continues. But once the property owner changes his/her mind and revokes the consent, the search has to stop. So if the copying is a search – just a search, and one that is still in process – then they have to stop.

What if it’s a seizure? The rule is that if the property owner revokes his/her consent to the seizure of property, the revocation is prospective but not retroactive. So, assume that instead of copying data the officers wanted to look for hard copy child pornography and Doe consented. They’re looking for child pornography (searching often precedes seizing, and he’s consented to both, in this version) and pick up photos, videos and other tangible items as they do so – they seize these items pursuant to Doe’s consent. Then he says to stop. They can keep what they have already seized, but can’t keep seizing further items.

If we say that copying data is a seizure, then how do we resolve the scenario above, the one that was posed to me last year? If it’s a seizure, is it a partially-completed one, which would mean the officers imaging the server could keep the data they had copied to the point at which Doe revoked his consent (assuming that is possible)? If we go with that theory, then can they finish the imaging process, on the premise that this is the only way they can keep what they had already seized?

Or do we say this is a seizure that is in process but that has not yet been completed? If we say that, then it seems that Doe’s revocation of his consent would require that the officers stop the imaging process and abort the seizure.