Unauthorized Access and the Statute of Limitations

I recently received this email, and decided to make it the focus of a blog post:

I noticed that the federal statue for unauthorized access into an electronic system has a statue of limitations of 2 years. Couldn't law enforcement break into electronic systems illegally and if they discover something illegal, just wait 2 years before bringing an indictment. Since most cybercrimes have statutes of limitations in excess of two years, wouldn't such a method effectively allow law enforcement to use a criminal method as an investigative technique without the fear of criminal repercussions? Am I missing something here?

It’s a good question, a logical question. Even if we assume (as I do not) that law enforcement officers would deliberately violate the law to obtain evidence to be used to prosecute someone, this scenario hypothesized in this email still wouldn’t work, for several reasons.

Let’s begin with the statute of limitations. As Wikipedia explains, in common law countries like the United States, a statute of limitations is a statute “that sets forth the maximum time after an event that legal proceedings based on that event may be initiated.” (According to Wikipedia, civil law countries – like France and Italy – have laws that do the same thing, but they’re known as “periods of prescription” or “prescriptive periods.”) Statutes of limitations apply to civil causes of action as well as to most crimes (murder, at least in the U.S., generally doesn’t have a statute of limitations).

In Toussie v. U.S., 397 U.S. 112 (1970), the U.S. Supreme Court outlined the policies that are responsible for establishing and enforcing statutes of limitations:

The purpose of a statute of limitations is to limit exposure to criminal prosecution to a certain fixed period of time following the occurrence of those acts the legislature has decided to punish by criminal sanctions. Such a limitation is designed to protect individuals from having to defend themselves against charges when the basic facts may have become obscured by the passage of time and to minimize the danger of official punishment because of acts in the far-distant past. Such a time limit may also have the salutary effect of encouraging law enforcement officials promptly to investigate suspected criminal activity.

As the Supreme Court noted in U.S. v. Marion, 404 U.S. 307 (1971), statutes of limitations “provide predictability by specifying a limit beyond which there is an irrebuttable presumption that a defendant's right to a fair trial would be prejudiced.” This means that once the statutory period has run, the person suspected of the crime can no longer be prosecuted.

That brings us to the issues raised by the email quoted above. Before we get into the substantive issues it raises, I need to note one correction: The statute of limitations I assume the author of the email is referring to appears in 18 U.S. Code § 1030(g), which, as I’ve noted before, creates a civil cause of action for anyone injured by conduct that violates one of the criminal provisions of § 1030. Section 1030(g) provides, in part, as follows:

Any person who suffers damage or loss by reason of a violation of [§1030] may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief. . . . No action may be brought under this subsection unless such action is begun within 2 years of the date of the act complained of or the date of the discovery of the damage. . . .

Since the limitations period set out in § 1030(g) doesn’t apply to criminal prosecutions, and since federal crimes usually have a statute of limitations, the question becomes, what is the statute of limitations for bringing criminal prosecutions for violations of 18 U.S. Code § 1030?

Federal criminal statutes usually don’t include a statute-specific statute of limitations; instead, the statutes of limitations for various crimes are set out in a separate part of Title 18 of the U.S. Code. The statute of limitations for the crimes created by 18 U.S. Code § 1030 is the general five-year statute of limitations set out in 18 U.S. Code § 3282. U.S. v. Schaffer, 586 F.3d 414 (U.S. Court of Appeals for the Sixth Circuit 2009). Section 3282(a) says that “no person shall be prosecuted . . . for any offense, not capital, unless the indictment is found . . . within five years next after such offense shall have been committed.”

All that means, of course, is that we need to modify the scenario set out in the email quoted above so it encompasses a five-year, rather than a two-year, limitations period. I don't think the scenario (i.e., officers violate 18 U.S. Code § 1030(a) by hacking into a computer or computer system) is a viable one even if the officers wait for the five-year limitations period to run, for at least two reasons.

One is that if what the officers/agents did came to light, they might still be prosecuted . . . somehow. Certain circumstances (like conspiracy) can toll (i.e., stop the running) of the statute of limitations; the reason is that unlike a substantive crime (e.g., theft), which is committed at a specific date and time period, a conspiracy is a continuing offense. Section 1030(b) of Title 18 of the U.S. Code makes it a crime to commit one of the offenses defined by 1030(a), which criminalizes unauthorized access.

So if the officers engaged in a conspiracy to violate 18 U.S. Code § 1030(a) by gaining unauthorized access to a computer or computer system, they could be prosecuted if the conspiracy continued into the applicable limitations period, i.e., into a period within five years of the bringing of the indictment. U.S. v. Coia, 719 F.2d 1120 (U.S. Court of Appeals for the 11^th Circuit 1983). Courts have held that a conspiracy “can be deemed to continue as long as its purposes have neither been abandoned nor accomplished.” U.S. v. Coia, supra. So if the officers entered into a conspiracy to commit unauthorized access in order to obtain evidence that could be used to prosecute John Doe, the conspiracy would continue until they either abandoned it or they had accomplished its purpose, i.e., using the evidence to prosecute John Doe. In other words, the statute of limitations might extend beyond the basic five-year period. The officers might also be open to prosecution by the state in which the crime occurred, if the state's statute of limitations is longer than the federal one (which is possible). Every U.S. state makes unauthorized access to a computer system a crime.

Even if our hypothetical rogue law enforcement officers are so determined to “get” John Doe that they break the law knowing they can be prosecuted (and are), that doesn’t do anything to help John Doe. What Doe needs is to be able to prevent the prosecution from being able to use the evidence the rogue officers got by gaining unauthorized access to (what I am assuming) is his computer or a computer that held information about his illegal acts. In other words, he needs to be able to get the court to suppress the evidence because it was illegally obtained.

As I noted in a recent post, the fact that officers broke the law (state or federal) usually isn’t enough, in and of itself, to have evidence they obtained as a result of their criminal activity suppressed. As the U.S. Court of Appeals for the Sixth Circuit explained,

there is no exclusionary rule generally applicable to statutory violations. Rather, the exclusionary rule is an appropriate sanction for a statutory violation only where the statute specifically provides for suppression as a remedy or the statutory violation implicates underlying constitutional rights such as the right to be free from unreasonable search and seizure.

U.S. v. Abdi, 463 F.3d 547 (2006). I don’t know why someone would want to move to suppress evidence based on a statutory violation when the statutory violation “implicate[d] . . . constitutional rights” such as the 4^th Amendment right to be free from unreasonable searches and seizures. It seems it would make more sense simply to move to suppress the evidence as having been obtain in violation of the 4^th Amendment itself; here, you’d be relying on a constitutional provision, not on a statute.

Doe, then, could move to suppress the evidence the officers obtain as having been obtained in violation of his 4^th Amendment rights (assuming, of course, that their unauthorized access targeted a computer or computer system in which Doe had a 4^th Amendment reasonable expectation of privacy). As I noted in an earlier post, the U.S. Supreme Court has not found the two coextensive, i.e., has not found that a violation of statutory law necessarily established the 4^th Amendment expectation of privacy that is required for law enforcement conduct to constitute a “search.”

As far as I can tell, the ultimate reason why the scenario outlined above won’t work in practice is the 4^th Amendment problem. If officers went rogue and deliberately violated 18 U.S. Code § 1030(a) (or some state unauthorized access statute) in order to obtain evidence to be used to prosecute our friend Doe, the 4^th Amendment would bar the use of the evidence as long as their conduct violated Doe’s rights under the 4^th Amendment.

In this situation, the government therefore couldn’t use the evidence as long as the officers/agents were acting as law enforcement officers and not on their own behalf. As I noted in another post, the 4^th Amendment only protects us from state action, i.e., from law enforcement officers who are acting as law enforcement officers. That seems to be the case in the scenario outlined above, since in that scenario the officers commit the unauthorized access to get evidence to be used to prosecute Doe for some crime or crimes.

The prosecution might, though, be able to show that even though the officers did this to get evidence that could be used to prosecute Doe for a crime, they weren't really acting as law enforcement officers when they engaged in the unauthorized access. If the prosecution could, for example, show that the officers did this for purely personal reasons – maybe they were angry with Doe for some reason and wanted to “get” him – that might mean there was no state action and the 4^th Amendment wouldn’t apply.