Kyllo

As I’ve explained in earlier posts, the 4th Amendment to the U.S. Constitution protects citizens from “unreasonable” searches (and seizures).

As I’ve also explained, a search intrudes on a cognizable 4th Amendment expectation of privacy – what the Supreme Court in Katz v. United States defined as a “reasonable expectation of privacy.” To have a reasonable expectation of privacy in something – like the contents of your hard drive, say – you have to believe it is private and a court has to find that our society, in general, does, too. In other words your belief that the contents of your hard drive are private has to be objectively reasonable; we don’t enforce the quirky beliefs of those who are out of step with the general culture.

Courts uniformly agree that you have a reasonable expectation of privacy in your hard drive unless, as I’ve noted earlier, you give people access to it via file-sharing software or by simply giving them the password they need to access the files on it. (In those instances, courts say that your belief, if you really continued to believe that the contents of the hard drive were private, was unreasonable, and so fails.)

A couple of years ago I noted that in 2001, in Kyllo v. United States, the Supreme Court was asked to decide if it was a “search” for law enforcement officers to stand across the street from someone’s home and use a thermal imager to detect the signature of the heat radiating from the house. A federal agent did that to Danny Kyllo’s home, and the thermal imager showed that there was an unusual amount of heat radiating from his garage. The agent (as agents regularly did back then) used that information plus other information he had gathered to get a warrant to search Kyllo’s house and garage for evidence of marijuana being grown illegally (as it inevitably is).

Kyllo moved to suppress the evidence (marijuana plants, among other things) the agents found when they executed the warrant at his house. He argued that it was a search to use the thermal imager because he had a 4th Amendment expectation in the privacy of his home. As I’ve explained before, the home is the ultimate private place under the 4th Amendment, so it seemed Kyllo had a pretty good argument.

The problem was that every federal court (and most state courts) that had addressed this issue up to that point had held it was NOT a search to use the thermal imager, even on a home. The rationale was that the use of the thermal imager was not a “search” because nobody and no thing actually intruded INTO the home. The thermal imager detected heat radiating out of the home. So courts said this was not a search; some of them agreed with the prosecution’s theory that what the thermal imager was picking up was essentially garbage (which isn’t private under the 4th Amendment, at least not once you put it outside). The problem with that, IMHO, is that you choose to discard garbage, but you cannot choose whether or not to let heat radiate from your home. As I understand it, you might be able to seal your home so no heat got out, but you’d be in a very, very bad way after spending time in it.

Okay, so what does all this have to do with cybercrime? Well, in deciding the Kyllo case the Supreme Court decided (correctly, IMHO) that the user of the thermal imager was a search. The problem comes with the standard they enunciated in issuing that holding. The Kyllo Court held that it is a search (i) to use technology that is not in general public use to (ii) detect information from inside a home.

That’s a bad standard for two reasons. The first reason results from the reference to one’s home: Does that mean it’s not a search to use a thermal imager on a business or a school or a church? You may not have as much of a privacy interest in a non-home structure as in your home, but you still have a privacy interest and police still have to get a warrant to search (absent consent or other exceptions). So it would have been better, again IMHO, for the Court to have said something like “it’s a search to use a thermal imager to detect information from inside a home or other structure in which a person has a cognizable 4th Amendment expectation of privacy.” Since that wasn’t spelled out in the opinion but MIGHT be a logical corollary of the holding, it looks like officers are tending to get warrants to use thermal imagers on structures other than homes, according to the slight anecdotal evidence I can find. Seems like a very good idea to me.

It’s the other problem with the Kyllo holding that I find really interesting. When does technology move into “general public use”? When Court issued its opinion (and when the thermal imager was used on Kyllo’s home), you could buy a thermal imager if you liked. You still can – they’re even cheaper and more effective. So is it now not a search to use a thermal imager on a home (or other private place) because we can buy them? Or does something else have to happen for technology to move into general public use?

I keep waiting for cases to raise that issue with various technologies – including computer technology – but so far all the reported Kyllo-general-public-use cases are about the use of drug dogs. When my students and I discuss that I usually ask them if a dog – a trained drug dog, to be specific – is “technology.” Not in the conventional sense, but I suppose a highly trained drug dog is technology. (My not highly trained dog is most certainly not technology, though he is a great dog.)

So far, I’ve only found one case that explicitly raises the Kyllo issue with regard to computer technology. In State v. Jacobs, 2007 WL 1121289 (Minnesota Court of Appeals, 2007), Jacobs was charged with possessing child pornography after officers searched his home and found child pornography. This is how the search came about:

[A] Pennsylvania police officer . . . was assigned to investigate computer crimes involving child pornography. . . . [W]hile searching for child pornography on Kazaa P2P, a software program that allows people to share and exchange computer files over the Internet, he observed that a particular computer with an IP (Internet protocol) address was offering to share images of child pornography. The officer then determined that the Internet service provider, Mediacom Communications Corporation, had the name and address of the user and obtained a court order requiring Mediacom to provide that information to him. When the officer recovered the information from Mediacom, he forwarded it to the Redwood Falls police department. A search warrant was executed on [Jacobs’] residence, which resulted in the seizure of the computer disks.

State v. Jacobs, supra.

Jacobs moved to suppress the evidence, arguing that the “officer’s acquisition of his identity and address from a third-party Internet Service Provider” was an unreasonable search under the 4th Amendment. Specifically, he argued that “because he had installed certain software programs on his computer and turned his file-sharing option to the `off’ position, the officer's use of software to discover his IP address was a violation of his reasonable expectation of privacy and was a `search’ similar to the one in United States v. Kyllo”. State v. Jacobs, supra.

The Minnesota Court of Appeals disagreed:

In Kyllo, police used special thermal-imaging technology to peer into defendant's home and obtain proof that he was growing marijuana. The Court held that this was a `search’ within the meaning of the Fourth Amendment because the police employed technology not widely used by the general public to peer into defendant's home. . . . But this case is factually distinguishable. . . Here, the officer did not use special technology to identify appellant's IP address, but rather was able to identify appellant through CommView, a software program that is readily available to the public. Thus, there was no `search’ . . . requiring a warrant under the Fourth Amendment.

State v. Jacobs, supra.

I found one other case that mentioned the use of CommView for the same purpose:

FBI Special Agent (SA) Gordon, using an internet connected computer, launched the P2P Limewire program and conducted a keyword search using the term `r@gold’ which is commonly found in the file names of child pornography images on file sharing networks. The . . . search identified 19 matching files which could be viewed and downloaded from the computer using the IP address 68.224.236.152. . . . [He] used the Limewire `browse’ function to view the names of . . . 270 image files stored in the share folder of the computer using the IP address 68.224.236.152. . . . [M]ore than half . . . had names indicative of child pornography. SA Gordon then downloaded four image files from the computer using IP address 68.224.236.152, all of which contained images of child pornography. . . . During the downloading process, the Limewire program displayed the source IP address of each image as 68.224.236.152. SA Gordon also used a . . . program called CommView which monitors internet and local network traffic and allows the user to view detailed IP address connections. This program also showed that the four images of child pornography were downloaded from the IP address 68.224.236.152.

United States v. Latham, 2007 WL 4563459 (U.S. District Court - District of Nevada, 2007).

You can buy CommView online, for $149 if you’re a “home user” or for $499.99 if you’re an “enterprise user.”

I’m not sure if the Jacobs court was right in finding that CommView is in general public use. What I find interesting, and disconcerting, is the premise that once a technology CAN be purchased by members of the public, it moves into general public use which means that law enforcement’s using it against us is not a 4th Amendment search. If it’s not a search, then law enforcement can use the technology without getting a warrant or otherwise satisfying the 4th Amendment. My problem with what the Jacobs court did is that I don’t see how CommView differs from the thermal imager that was used on Kyllo’s home: Any member of the general public who could afford one could buy (and use) a thermal imager when one was used on Kyllo’s home; and any member of the general public could have done the same at the time the Supreme Court decided the Kyllo case. The Court still held it was a search to use the thermal imager. So why isn’t it a search for law enforcement to use CommView?

My concern about the holding in Jacobs is the consequences. If this approach prevails, I’m afraid it’s going to skew the notion of privacy, so that instead of working on my laptop in my home study (as I am at this moment) and assuming what I’m doing is private, I have to take countermeasures to ensure what I am doing is private. Once a surveillance technology (of whatever type) goes on sale, I presumably have to know that and have to figure out how to defeat its application to me . . . or I’ve waived my privacy. Somehow, that doesn’t seem quite right.