“Tipsters,” Passwords and Private Searches

As I’ve explained in prior posts, the 4^th Amendment’s prohibition on “unreasonable” searches and seizures only protects you from “state action,” i.e., from searches and seizures that are conducted by law enforcement officers or by private citizens who are acting as agents of law enforcement. So if, as I’ve noted, a private person decides to share evidence that incriminates you in a crime – evidence to which they have lawful access under the 4^th Amendment – you’re out of luck.

That principle became an issue in a U.S. Court of Appeals’ review of the district court judge’s decision in a case I wrote about nearly four years ago: U.S. v. D’Andrea, 497 F. Supp. 117 (U.S. District Court for the District of Massachusetts 2007). You might want to review that post to see what the lower court judge did in the case that began this way:

[O]n December 2, 2004, . . .the `Tipster’ called the . . . child abuse hotline of the Massachusetts Department of Social Services (`DSS’) She said she lived in California and had a child with Willie Jordan, but wanted to remain anonymous. [She] identified Kendra D'Andrea and Jordan as partners, provided D'Andrea's residential address, and identified Jordan's employer. . . .

She [said she] received a message on her phone containing photographs of D'Andrea and Jordan performing sexual acts on D'Andrea's eight-year-old daughter . . . and of the victim with her genitalia exposed. (Apparently D'Andrea . . . sent it . . . by mistake.) [She] said the pictures could be accessed by going to www.sprintpcs.com and entering a certain phone number and pass codes, which she provided to the DSS intake agent.

U.S. v. D’Andrea, __ F.3d __, 2011 WL 1760207 (U.S. Court of Appeals for the 1^st Circuit 2011) (U.S. v. D’Andrea #2).

DSS agents eventually accessed the website – after “several unsuccessful attempts” and “at least one” phone conversation with the Tipster – and found photos “consistent with the Tipster’s report.” U.S. v. D’Andrea #2. They printed “numerous pornographic pictures of the victim” and took them to the Gloucester Police Department; after viewing the photos, a detective got a warrant to search D’Andrea’s home for files that might contain “evidence of child abuse and child pornography” and officers executed the warrant a little after midnight. U.S. v. D’Andrea #2.

They found, among other things, a cell phone containing “pornographic pictures of the victim”; D’Andrea was arrested and “admitted she and Jordan had sexually abused the victim.” U.S. v. D’Andrea #2. Jordan was arrested later. U.S. v. D’Andrea #2. The printed images were the only copies law enforcement had of what was on the site because D’Andrea called Jordan when police knocked on her door to execute the warrant, and he “contacted Sprint and deleted the account.” U.S. v. D’Andrea #2.

Jordan was charged with sexual exploitation of a minor and conspiring to sexually exploit a minor in violation of 18 U.S. Code § 2251. Brief on Behalf of Appellant Jordan, 2009 WL 6851680. I’m assuming D’Andrea’s charges were the same or similar. After being charged, both moved to suppress the evidence against them, claiming it was obtained in violation of their 4^th Amendment rights. U.S. v. D’Andrea #2.

The district court judge denied the motion(s) (i) because he found that no one could “credibly” claim that the Tipster was an agent of the state and (ii) because he found that the DSS administrator (Curley) who accessed the password-protected site went no further than did the Tipster:

The argument is that . . . Curley . . . violated defendants' 4^th Amendment rights. This argument fails for the reason that Curley intruded no further into defendants' zone of privacy than did the anonymous caller. Where a private party, acting on his or her own, searches a closed container, a subsequent warrantless search of the same container by government officials does not further burden the owner's already frustrated expectation of privacy. U.S. v. Jacobsen, 466 U.S. 109 (1984). Moreover, where an expectation of privacy in an item has been effectively destroyed by a private search, police do not violate the 4^th Amendment by examining the same item more thoroughly or with greater intensity so long as they do not ‘significantly expand’ upon or ‘change the nature’ of the underlying private search. . . .

[T]his case falls clearly into the ‘assumption of the risk’ exception. . . . [E]ven granting defendants a reasonable expectation of privacy in the website images of Jane Doe, by sharing the website access information with the anonymous caller, [they] took the risk that their right to privacy in the site's contents could be compromised.

U.S. v. D’Andrea #2 (quoting the lower court’s opinion). D’Andrea and Jordan then conditionally pled guilty, reserving their right to appeal the denial of their motions to suppress and the court’s failure to hold an evidentiary hearing on the motions. U.S. v. D’Andrea #2. (For a discussion of the assumption of risk principle the Supreme Court articulated in Katz v. U.S., 389 U.S. 347 (1967), check out this post.)

The Court of Appeals found the district court judge was correct in finding that Jacobsen governed the 4^th Amendment issues involved in this case. U.S. v. D’Andrea #2. In that case, FedEx employees opened a damaged box to check it out pursuant “to a company policy concerning insurance claims” and found a “suspicious white powdery substance inside”. U.S. v. D’Andrea #2. They called the DEA, which sent agents who tested a sample of the substance, which was cocaine. U.S. v. D’Andrea #2. After Jacobsen was charged with violating federal drug laws, he moved to suppress the evidence, arguing that the DEA agents violated the 4^th Amendment when they checked out what was in the box without first getting a warrant. U.S. v. D’Andrea #2. The Supreme Court held the search didn’t violate the 4^th Amendment because, as noted above, they didn’t go any further than the FedEx employees, who’d already compromised the privacy of the box.

The Court of Appeals noted that the Jacobsen holding was based on the Katz assumption of risk principle, i.e., “when an individual reveals private information to another, he assumes the risk” that this private person will share that information with law enforcement. U.S. v. D’Andrea #2. It also noted that in this case, the defendants’ “assumption of the risk, if any, goes to how the Tipster obtained the account access information.” U.S. v. D’Andrea #2.

[C]ontrary to the district court's finding, there is no evidence in the record that defendants `shar[ed] the website access information with the anonymous caller.’ . . . [B]oth defendants affirmed in sworn affidavits that they did not share the password with anyone. Moreover, in a February 2007 interview, the Tipster told an investigator for the Federal Public Defender Office that she pieced together the password by surreptitiously taking scraps of paper on which Jordan had jotted down various letters and numbers. Therefore, on this record, the district court's factual finding that defendants shared the password with the Tipster was clearly erroneous.

U.S. v. D’Andrea #2.

The Court of Appeals then explained that the district court judge erred in not holding an evidentiary hearing on this issue:

It is possible that an evidentiary hearing would unearth facts to support a finding of assumption of the risk -- for example, if Jordan or D'Andrea were so careless with the password that one of them assumed the risk of its disclosure. Further, it is mentioned on one of the DSS information sheets that `[t]he pictures had been forwarded to the site and various responders with web-names had written to many pictures with comments of a highly sexualized nature.’ This arguably implies defendants shared the site with others. If, however, as D'Andrea and Jordan have sworn, they never shared the password with anyone and reasonably believed no one else could get into the account, assumption of the risk would not be present.

U.S. v. D’Andrea #2.

The court also noted that because the evidentiary record in the case did not provide

meaningful details on the searches of the website by the Tipster and the DSS, we do not have enough evidence to determine whether the DSS search of the website exceeded the scope of the Tipster's search. This is important, because under Jacobsen the `additional invasions of respondents' privacy by the Government agent must be tested by the degree to which they exceeded the scope of the private search.’ Thus, the evidentiary hearing should explore whether DSS obtained any of the pictures by exceeding the scope of the Tipster's search. To the extent it did, those pictures are not admissible under the private search doctrine.

U.S. v. D’Andrea #2.

Finally, it pointed out that the district court judge failed to explore an important issue:

[E]ven though the facts make clear that the Tipster's initial hacking into the website before she called the authorities was a private search, it is not clear whether the Tipster had to hack into the website a second time, possibly with the aid of the authorities, before she successfully directed them to the website. . . . [S]ome of the DSS call sheets suggest DSS was unable to access the website after the Tipster's initial call, and possibly even after a second call. This raises the possibility that the Tipster did not have the correct password when she called the authorities. If that is indeed the case, the record is unclear as to whether the Tipster re-hacked the website and, if so, whether the authorities actively assisted her in this second attempt.

U.S. v. D’Andrea #2.

This issue was important because if the Tipster re-hacked the site at the instigation of DSS agents in order to find information that would help them -- as state actors – by locating evidence they could use in their investigation of D’Andrea and Jordan, she might very well have become an agent of law enforcement. In other words, as I noted earlier, she might have lost her status as a private person and become an agent of law enforcement for the purposes of applying the 4^th Amendment.

The Court of Appeals therefore directed that the district court judge explore, on remand, “whether the Tipster had to re-hack the website before she could give DSS the correct password; whether the DSS or other authorities were involved in the re-hacking; and whether . . . the re-hacking amounted to a government search and not a private search.” U.S. v. D’Andrea #2. The court therefor vacated the district court’s orders denying the motions to suppress and remanded the matter for an evidentiary hearing on those motions. U.S. v. D’Andrea #2.