Fourth amendment privacy and websites

In United States v. D’Andrea, 497 F. Supp. 117 (D. Mass. 2007), a federal district court was asked to decide if the police's accessing a password-protected website was a “search” under the Fourth Amendment.

Under the Fourth Amendment, police must have either a search warrant or an exception to the warrant requirement, such as consent of someone with authority to allow the search, for a search to be “reasonable” under the Constitution. If a search is not “reasonable,” then it is unconstitutional and the evidence obtained can’t be used in court.

In D’Andrea, an anonymous caller reported that

Jane Doe [a pseudonym] the eight-year old daughter of defendant Kendra D'Andrea, was being sexually abused by her mother and the mother's live-in boyfriend, defendant Willie Jordan. The caller also stated that pictures of Jordan performing oral sex on the girl had been posted on a Sprint PCS website. The caller provided the address of D'Andrea's apartment . . ., the log-in name and password for the website, and the number of a cellular telephone used by defendants.

United States v. D’Andrea, supra.

An investigator accessed the website, using the login information provided by the caller. The investigator downloaded images of the child being abused, and police used the tip by the informant plus the photos to obtain a search warrant. The warrant was executed at D’Andrea’s home, where they found other images and further evidence.

D’Andrea and Jordan were charged with child abuse and moved to suppress the downloaded images police used to obtain the search warrant plus the evidence seized pursuant to the warrant. If the investigator conducted a Fourth Amendment search by accessing the website and downloading the photos, then the search warrant would be invalid and all the evidence would be suppressed.

So, the critical question is, was it a Fourth Amendment search for the investigator to access the website? As I’ve noted before, a search under the Fourth Amendment is police conduct that violates violates a “reasonable expectation of privacy.” To have a reasonable expectation of privacy in a place or thing, you have to believe that place or thing is private and your belief has to be one society accepts as objectively reasonable. So, if I say I thought my actions in my unfenced front yard were “private”, I would lose; I might be able to convince a court I really believed that, but the court would say my belief was not objectively reasonable, since we all know what we do in public, as in my front yard, is not “private.” Anyone can observe what I’m doing. Conversely, what I do in my own home with the shades drawn is private because no one can observe me.

That brings us to the website. According to the court, D’Andrea and Jordan argued that because the website

was password-protected, they believed that what was posted on the site was a private matter that was exclusively theirs to share, and that they therefore had a subjective expectation of privacy in the website's contents. Assuming that this is true -- it would be somewhat astonishing if it were not -- the question still remains whether this expectation is one that society would recognize as reasonable.

United States v. D’Andrea, supra. D’Andrea and Jordan lost.

`It is well-settled that when an individual reveals private information to another, he assumes the risk that his confidant will reveal that information to the authorities, and if that occurs the Fourth Amendment does not prohibit governmental use of that information.’ [United States v.] Jacobsen, 466 U.S. 109, 117 (1984). . . . Thus, even granting defendants a reasonable expectation of privacy in the graphic website images of Jane Doe, by sharing the website access information with the anonymous caller, defendants took the risk that their right to privacy in the website's contents could be compromised.

United States v. D’Andrea, supra.

So, it appears that if you share your login information with anyone else, you assume the risk they will give that information to the police, who use it to access your website or whatever else it provides access to.