Wednesday, May 12, 2010

Scope of Consent Issue

As I explained in a post I did several years ago, consent is one of the exceptions to the 4th Amendment’s warrant requirement. Like the other exceptions, consent lets an officer search for and/or seize evidence without first obtaining a search (and seizure) warrant.


As I’ve also explained, for consent to be valid under the 4th Amendment, it has to be given by someone who has authority over the place to be searched or the property to be seized. As I noted in a post I did last year, the issue of authority to consent can become tricky when two or more people at least arguably have authority to consent (or refuse to consent) to the search and/or seizure of property.


As I also noted in the post I did last year, the authority to consent to a search or seizure is based on two concepts. The first is actual authority; someone has actual authority to consent to a search or a place or thing if they have joint use of and access to the thing. The Supreme Court, as I explained in that 2009 post, has held that consent is based on your ability to use property, not on your ownership of it, as such. (Though if you own something, you’ll probably have actual authority to consent to its being searched and/or seized, because you no doubt use it.)


The other concept is actual authority; as I also noted in the post I did last year, the 4th Amendment protects us from “unreasonable” searches and seizures, which means “reasonable” searches and seizures do not violate the 4th Amendment. The U.S. Supreme Court has held that if officers reasonably, but mistakenly, believe someone has authority to consent to a search and/or seizure of property, the search or seizure is valid because their “reasonable” belief satisfies the 4th Amendment. If you want to know more about all that, read my 2009 post on the issues.


This post is about a rather unusual consent issue. The issue arose in U.S. v. King, 2010 1729733 (U.S. Court of Appeals for the 3d Circuit 2010). I’m not going to go into all the facts in the case because they’re disgusting and have nothing to do with the issue we’re concerned with.


All we need to know is that in August of 2003 Richard King met Angela Larkin on a site called “`CherryPoppinDaddys’” and they spent two months “chatting online about their mutual interest in watching minors engage in sex acts with adults and shared child pornography.” U.S. v. King, supra. At that time, Larkin and her two-year-old daughter lived in Emporium, Pennsylvania; and at all relevant times. King lived in Mohnton, Pennsylvania. U.S. v. King, supra. In October of 2003, Larkin left her husband and moved, with her daughter, to Buffalo, New York; in mid-November, she emailed King and asked if they could move in with him “because she was unhappy in Buffalo.” U.S. v. King, supra. King, who’d earlier expressed interest in having sex with Larkin’s daughter, agreed; on Thanksgiving Day he drove to Buffalo and brought them back to his home in Mohnton, where he soon started “performing oral sex on” the daughter. U.S. v. King, supra The opinion notes that “[t]hough they lived under the same roof”, they sent each other emails referring to King’s sexual contact with Larkin’s daughter and King helped her “use a PayPal account to obtain payment for distributing pornographic images” of the daughter “over the Internet.” U.S. v. King, supra.


In early 2004, officers in Texas discovered pornographic images of the daughter on a computer in Texas and notified the Pennsylvania State Police; they, in turn, notified FBI Agent Kyle that there was “a potential child pornography victim in Emporium”. U.S. v. King, supra. Kyle got a warrant to search the home where Larkin and her daughter had lived in Emporium; when he executed the warrant, he met her husband, who told him they no longer lived there. U.S. v. King, supra. The ex-husband didn’t know where they were living, but he sent Larkin and instant message and asked; she responded with a phone number where she could be reached, and the officers traced it to King’s home in Mohnton, Pennsylvania. U.S. v. King, supra.


The officers checked with local police to see if any warrants were outstanding for Larkin, and found one; State Troopers Coyle and Rodriguez went to King’s home to execute the warrant. U.S. v. King, supra. After they arrested Larkin, Coyle got a call from an officer who suggested that he ask Larkin for permission to take her computer. U.S. v. King, supra. She consented to the seizure of the computer and King “walked the troopers” to the bedroom where it was located and disconnected it. U.S. v. King, supra.


Before the troopers could seize it, however, King claimed ownership of the hard drive and objected to its seizure. King then requested permission to remove the hard drive, but the troopers denied his request and seized the computer, including the hard drive.


U.S. v. King, supra. The troopers left with Larkin, her daughter and the computer. U.S. v. King, supra. The next day, she “signed a form authorizing the FBI to assume her online identity and disclosed all of her passwords.” U.S. v. King, supra. Later that week, when Kyle reviewed Larkin’s emails and chats, “he found incriminating conversations between Larkin and King” and used this evidence to obtain and execute two search warrants: “one for the seized computer and one for King’s home, including all computers contained therein”. U.S. v. King, supra.


I won’t go into the details of what happened next. All we need to know is that (i) King was later interviewed and admitted performing oral sex on Larkin’s daughter and (ii) officers found “thousands of child pornography images” on his computer. U.S. v. King, supra. King was indicted for traveling interstate to have sex with a minor in violation of 18 U.S. Code § 2241(c) (his trip from Pennsylvania to New York and back). U.S. v. King, supra. A later indictment added sending and causing the receipt of child pornography and conspiring to destroy evidence and obstruct justice charges. U.S. v. King, supra.


King entered a conditional guilty plea to the § 2241(c) charge under Federal Rule of Criminal Procedure 11(a)(2); that is, he pled guilty but reserved his right to appeal the district court’s denial of his motion to suppress the evidence obtained from Larkin’s computer. U.S. v. King, supra. The opinion we’re concerned with is the U.S. Court of Appeals for the 3d Circuit’s ruling on the denial of that motion. U.S. v. King, supra.


Here’s how the 3d Circuit described the issue King raised in his motion to suppress:


King claims the police violated the Fourth Amendment when they entered his house . . . and seized his hard drive without a warrant or his consent. He does not dispute that Larkin consented to the seizure of her computer, which included the hard drive that King had installed. Nor does the Government dispute that King objected to the seizure of his hard drive and asked agents for the opportunity to remove it from Larkin's computer. These facts present a novel question of law: when an owner of a computer consents to its seizure, does that consent include the computer's hard drive even when it was installed by another who claims ownership of it and objects to its seizure?


U.S. v. King, supra. I’m only going to focus on the consent to seize the computer issue because the officers clearly had the right, under the 4th Amendment, to enter King’s home to find and arrest Larkin. In Payton v. New York, 445 U.S. 573 (1980), the U.S. Supreme Court held that if officers have a valid arrest warrant, they can enter someone’s home to arrest the person named in the warrant; the Court held that the arrest warrant satisfies the 4th Amendment’s requirement of a warrant for a home entry.


In analyzing the consent to seize computer issue, the 3d Circuit reviewed the Supreme Court’s decisions in U.S. v. Matlock, 415 U.S. 164 (1974) and Georgia v. Randolph, 547 U.S. 103 (2006). As I noted in the post I did last year, the Matlock Court held that those who jointly occupy and use property can each consent to a search of that property; so the Matlock Court held that if police ask a wife for permission to search the house she shared with her husband, she can consent and her consent will be valid under the 4th Amendment (and vice versa, of course).


In Randolph, the Court addressed an issue that didn’t come up in Matlock: what if the husband is home and objects to the search even though his wife consents? The Randolph Court held that “physically present co-occupant's stated refusal to permit entry prevails, rendering the warrantless search unreasonable and invalid as to him”, i.e., if the husband objects that nullifies the wife’s consent (and vice versa).


Both the Matlock and Randolph cases were about the search of real property, specifically a home shared by two people. The 3d Circuit had to decide which of the cases controlled the issue before it: If Matlock controlled, Larkin’s consent would be valid, but if Randolph controlled, it wouldn’t. After reviewing the majority opinion in Randolph, Justice Breyer’s concurring opinion and Chief Justice Roberts’ dissent, the 3e Circuit concluded that “the rule of law established in Randolph does not extend beyond the home”, i.e., it doesn’t apply to personal effects, like computers. U.S. v. King, supra. The court found that this interpretation of Randolph “does not risk encroaching on” people’s 4th Amendment rights in their personal property because “[c]omputer users can protect their files by using a password, just as one who shares a footlocker can protect his photographs by placing them in a locked container inside the footlocker.” U.S. v. King, supra.


King consequently lost. The 3d Circuit held that because


Randolph does not apply to personal effects, King's suppression argument necessarily fails. A computer is a personal effect. . . . Therefore, we apply the Matlock rule and ask whether King relinquished his privacy in the hard drive with respect to Larkin. Here, King placed his hard drive inside the computer Larkin owned and that the two of them shared, without any password protection. As a result, he assumed the risk that Larkin would consent to its seizure. Accordingly, the District Court did not err in holding that the seizure of Larkin's computer did not violate the Fourth Amendment and evidence derived therefrom was admissible against King.


U.S. v. King, supra. In a separate section of the opinion which involved different issues, the 3d Circuit upheld the 360 months sentence of incarceration the district court imposed on King. U.S. v. King, supra.


Oh, and according to this news story, on May 23, 2009, a federal judge in Pennsylvania sentenced Angela Larkin to “30 years in federal prison” after she pled guilty to federal charges of “sexual exploitation of a minor, using a minor to engage in sexually explicit conduct and related offenses.”

5 comments:

Anonymous said...

I hate the feds because they always use 'months' for the length of their sentences and then I have to sit and do the math to figure out long long it is in the 'normal' time of years. Who keeps knows off the top of their head how long 360 months is???

That being said, I think that the court's opinion is wrong. By using the analogy of a foot locker or password on a computer as support for their position, then why couldn't the same analogy have been used for the real property seach Randolph? Since you can lock a room or have a safe in a house, then I won't assumed the risk that my roommate or spouse would consent to its seizure.

Just because I co-mingle my stuff doesn't mean that I should run the risk of it being seized by the cops.

While I could understand the court's decision if the guy wasn't there, but the girl was, and she allowed the cops to take her computer with his hard drive in it, that is not what happened. Since he was physically present and announced the fact that it was his property inside the computer, the cops should not have been allowed to take it.

My property is still my property even if I put it inside someone else's computer. Since they guy was objected to the seizure and search of HIS property, I think the cops were wrong.

We all know why the court voted the way that it did - they think this guy is a dirt bag and deserves to be in jail. But Justice should not be decided on whether or not you like the guy.

Anonymous said...

Oh, and Cherry Poppin' Daddys is the name of a rock band.

Professor Don said...

Uh did I understand this right??

The court said,

“[c]omputer users can protect their files by using a password, just as one who shares a footlocker can protect his photographs by placing them in a locked container inside the footlocker.”

So anything in the refuser's MyDocuments folder is protected if the refuser has a separate user account than the consenter.

OK how about this one. In the system admin gives consent to search a server, are all user documents unprotected by that consent since they are not hidden from the SysAdmin's administrator privileges?

Or weirder still. If a user give consent to search their portion of a server, does it "unprotect" the entire server.

I can see the legal side of the house having a lot of fun with this one.

God help us if we start trying the apply the 4th amendment to swap spaces and cache files.

Susan Brenner said...

Professor Don,

You did a good job of pointing out some of the problems that arise from literally analogizing information stored on a computer to information stored in a physical container, like the footlocker that always seems to come up when courts discuss this.

The answer in the MyDocuments scenario would probably be yes because the refuser has a separate account from the consenter (and if, of course, the consenter doesn't have access to that account).

The answer in the sys admin scenario MIGHT also be yes . . . it would depend, I think, on whether the sys admin was considered to be acting on behalf of an employer who had a bailment relationship with those who had data on the system. As to bailments and consent, check out this post:

http://cyb3rcrim3.blogspot.com/2009/06/privacy-and-cloud.html

The answer here would probably be no since they don't have authority to consent to the search of the entire thing.

Now, having explained how these issues would probably be resolved under the current state of the law . . . I need to note that I agree with the point I believe you are making: It's conceptually difficult and arguably illogical and therefore impracticable literally to apply physical 4th Amendment principles to searches that occur in a non-physical context.

So far, that's pretty much what courts are doing . . . in part, I think, because these challenging scenarios aren't coming up yet. They will.

And then we need to figure out how to handle them . . . which presumably would mean that we need to decide how to extrapolate versions of the standards we use for physical searches to a non-physical context.

Any suggestions?

Professor Don said...

There is a schism between what people know ("Nothing on the internet is private") and how they act ("You can't look at my ???, it's private")

I think that there is a great deal blending between the concepts of privacy and anonymity.

The latter is a very strong controller of people's behavior. More riots are controlled by cameras than riot batons.

The mapping of physical standards into the cyberworld needs to address a person's right to anonymity. In the physical world, this is a minor issue and not a very strong societal expectation. It is accepted that people have to identify themselves routinely. We generally automatically assume that the right to a physical search includes the loss of anonymity.


In the cyberworld however, anonymity is a societal expectation that gets blended into privacy. Many(Most?) computer users assume their identity is protected even if their data is public.

How many privacy issues would go away if anonymity was preserved. "I don't care if you look at my ???? as long as you don't know who I am."

I'm going to play with the concept of anonymous physical searches for a while just to see where it leads. For example, if there is no personally identifying information on a computer, how can the owner of the information be identified? Is the identity of the owner of the information always the same as the owner of the computer? Nope.

I feel a techie article coming on here.

Getting back to the blog in question, what would have been the issues if King has asserted that the owner(s) of the files et al was/were anonymous. I really can't think of any technical way to prove ownership to a specific person. I can prove a file belongs to an account but I can't prove that a specific person placed that file in that account (short of some stuff the feds are doing such as anthropometric logins etc).

Probably the courts would have thrown out that argument because the physical search standards (ie the automatic mapping of possession to identity) would hold sway. But, as possession becomes more distributed, will that argument become stronger.

And, swinging in from the other side, possession often does not mean ownership. As a system admin, I possess everything on my servers but I own very little of it.

Might even go for a journal article on this one.