The 4th Amendment and Copying Data

This is aabout whether the 4th amendment applies to a law officer's copying data. The issues whether copying data is a "search" or a "seizure" under the 4th Amendment. At the moment, it is not clear that copying data is either.

This is an important issue because, if copying data is neither a search nor a seizure, then it is outside the scope of the 4th Amendment . . . which means officers do not need a search (and/or seizure) warrant or an exception to the warrant requirement in order to copy data lawfully.

As I explained in an earlier post, the 4th amendment creates the right to be free from “unreasonable” (a) searches and (b) seizures. Searches violate a reasonable expectation of privacy, while seizures of property violate the owner’s legitimate interest in the possession and use of that property.

I have argued elsewhere that copying data is a seizure – I don’t think it is a a search because you can copy data without scrutinizing its contents; I think such scrutiny is essential for there to be a “search.”

I think the act of copying data is a seizure, though, because “something” clearly happens: The government obtains a copy of data, something it did not have before the copying occurred.

I see this as somewhat analogous to the rule with regard to copying data as theft: In an Oregon case, the defendant was charged with “theft” because he copied a file containing user passwords, a file that belonged to Intel, his employer. The defendant in that case claimed he had not committed “theft” because theft is, and has traditionally been, a zero-sum offense. That is, it consists of taking someone’s property and thereby wholly depriving them of its possession and use. The defendant in this case claimed he had not “deprived” Intel of anything because it still had the file with the passwords in it.

The Oregon court basically finessed his argument, finding there had been a “theft” because Intel had lost something – essentially the exclusive possession and use of the property. (I say finessed because the statute was somewhat problematic, as many theft statutes are – they can reflect history and define theft in terms of taking “tangible property” and/or in terms of completely depriving the owner of the possession and use of the property.)

But let’s get back to seizures: I think copying data has to be defined as either a search or a seizure, because otherwise it’s completely outside the 4th Amendment . . . which would mean, as I noted earlier, that law enforcement agents could copy data without obtaining a warrant or having any other justification under the 4th amendment. I also think, as I explain above, that it is sufficiently analogous to data theft to qualify as a seizure.

What I really want to talk about is a hypothetical (or maybe a real case) that was posed to me at a conference last year. Here it is: Two officers go to John Doe’s home to execute a search warrant for his laptop. The warrant authorizes them to search the home for the laptop and then seize it, bring it back so it can be analyzed forensically. As they arrive at Doe’s home, he drives up. They tell him why they’re there and he agrees to get the laptop and give it to them, which he does. To get the laptop, he goes inside and they follow, with his permission. They see a terabyte server in the room where he goes to get the laptop -- however many terabytes is up to you, but it’s big. They ask Doe if they can make a mirror image of the server, and he agrees. (Now, I’m assuming they don’t actually do this, that they call others to do so, but for simplicity’s sake I’ll just act as if they whip out the necessary equipment and proceed.)

The process of imaging the server begins. It will take, say, 10 hours. About halfway through, Doe says, “You know, I’ve changed my mind. Quit making the copy.” The question posed to me is: What can the officers do? If they stop, they lose what they have already copied; if they keep going, they clearly do so without Doe’s permission, and his consent is their only 4th amendment justification for copying the data.

If copying the data is a search (which I don’t think it is), they clearly have to stop. The rule is that a search authorized by the property owner’s consent is reasonable as long as the consent continues. But once the property owner changes his/her mind and revokes the consent, the search has to stop. So if the copying is a search – just a search, and one that is still in process – then they have to stop.

What if it’s a seizure? The rule is that if the property owner revokes his/her consent to the seizure of property, the revocation is prospective but not retroactive. So, assume that instead of copying data the officers wanted to look for hard copy child pornography and Doe consented. They’re looking for child pornography (searching often precedes seizing, and he’s consented to both, in this version) and pick up photos, videos and other tangible items as they do so – they seize these items pursuant to Doe’s consent. Then he says to stop. They can keep what they have already seized, but can’t keep seizing further items.

If we say that copying data is a seizure, then how do we resolve the scenario above, the one that was posed to me last year? If it’s a seizure, is it a partially-completed one, which would mean the officers imaging the server could keep the data they had copied to the point at which Doe revoked his consent (assuming that is possible)? If we go with that theory, then can they finish the imaging process, on the premise that this is the only way they can keep what they had already seized?

Or do we say this is a seizure that is in process but that has not yet been completed? If we say that, then it seems that Doe’s revocation of his consent would require that the officers stop the imaging process and abort the seizure.