"Computer trash"

The notion of "trash" is pretty straightforward in the real-world: Whenever we have finished using something or are tired of it, we discard it . . . by putting it in a public "rashcan, in plastic trash bags or in the kinds of trash containers many garbage pickup services require. Once our discards have been formally deposited in the trash -- by whatever means -- they will be taken away by the public or private services that are in charge of ridding our real, physical world of refuse.

The notion of "trash" is not so straightforward when it comes to "computer trash" . . . to the data we delete from our desktops, laptops, servers, etc. In this post, I want to talk about the conceptual problems "computer trash" poses for the application of our Fourth Amendment prohibition on unreasonable searches and seizures.

In California v. Greenwood, 486 U.S. 35 (1988), the U.S. Supreme Court held that we have no Fourth Amendment expectation of privacy in trash we put outside our residences to be collected by a trash-collection service. Billy Greenwood packaged his trash in opaque plastic trash bags and left them at the curb for collection. Police arranged for the trash collection service to pick up his trash and turn it over to them; when police searched Greenwood's trash, they found evidence of drug use. Police used this evidence to get a warrant to search Greenwood's home, where they found "quantities of cocaine and hashish." Based on this, Greenwood was charged with felony drug offenses.

Greenwood argued that the charges against him were improper because they were based on what he claimed was an illegal "search" under the Fourth Amendment. He claimed he had had a legitimate Fourth Amendment expectation of privacy in the trash he put out to be collected by the local trash service. As I explained in an earlier post, a Fourth Amendment "search" occurs only if police violate a "reasonable expectation of privacy," i.e., a subjective expectation of privacy that we, as a society, are prepared to regard as objectively reasonable. Greenwood claimed (i) that he believed his trash was private and (ii) that this belief is held generally by U.S. citizens. He concluded, therefore, that his trash was private, which meant that the local police engaged in an unlawful "search" when they went through his garbage.

Unfortunately for Greenwood, the Supreme Court disagreed. They held that citizens have no Fourth Amendment expectation of privacy in trash when, as was true here, it is intentionally put outside their home to be picked up by a garbage collection service. The Court held that it was completely unreasonable for Greenwood to argue that he had a constitutionally cognizable expectation of privacy in trash he had left outside where it was "readily accessible to animals, children, scavengers, snoops and other members of the public."

This brings us to "computer trash:" I am writing this post on my laptop. In the course of composing it, I have on several occasions deleted text I had meant to include. Earlier, I finished drafting a chapter for a new book on cybercrimes; in the course of writing that chapter, I deleted whole sections of the original version of the chapter.

What is that deleted text? Is it "trash," in the Greenwood sense? Under the Supreme Court's interpretation of the Fourth Amendment, I have a cognizable Fourth Amendment expectation of privacy in the contents of my computer's hard drive. The courts have analogized hard drives to opague containers, like footlockers or desk drawers; we have a Fourth Amendment expectation of privacy in containers such as these because the contents are not clearly visible to anyone who happens to be in the room with them. The fact that a laptop containing a hard drive or a footlocker or a desk is in the room is clearly visible, so we have no Fourth Amendment expectation of privacy in those facts. We do, however, have an expectation of privacy in the contents of those containers . . . which means law enforcement officers have to get a search warrant (or my consent) to "open" them and look through their contents.

Okay, it's clear that police have to get a search warrant to search my laptop. But what does the warrant cover? Is there a distinction between the files I have saved and those I have deleted? Is there such a concept as "computer trash" or do all the files on my hard drive enjoy the same status as far as the Fourth Amendment is concerned?

This issue has come up in several lower court cases in which defendants claimed that deleted data is actually entitled to more Fourth Amendment protection that the data I have elected to preserve -- the non-trash data on my hard drive.

The case I find most interesting in this respect is People v. Weaver, 2003 WL 22183746 (Cal. App. 6th Dist. - 2003). The police had obtained a warrant to search Weaver's home computer for pornographic material, based on allegations of sexual abuse made by a teenaged boy; the boy claimed, among other things, that had used his computer to show the boy sexually-explicit images. It was clear that the search warrant was supported by probable cause which was obtained quite independently of anything on Weaver's computer. The issue in the case was whether the execution of the search warrant was flawed, and therefore violated the Fourth Amendment.

Weaver's attorney moved to suppress some of the evidence the police computer forensics expert obtained from the hard drive of Weaver's computer on the grounds that the expert's analysis of the hard drive went too far -- that it exceeded the permissible scope of the warrant. Weaver's attorney conceded that the search warrant allowed the expert to examine the hard drive for the pornographic material noted above, but claimed that the expert went "too far" when he used a "special program" to access files Weaver had deleted.

Weaver's attorney argued, essentially, that the search warrant allowed the computer forensics expert to search the hard drive for data that would have been visible to anyone who sat down at the computer and searched through the files it overtly contained. In other words, the attorney argued that the search warrant let the police do only what any ordinary citizen could do: to look through the files Weaver had saved and stored in various directories on the hard drive. As the attorney pointed out, the average citizen would not have been able to view or otherwise access the data Weaver had deleted from his hard drive; doing this require the use of special software.

Weaver's attorney specifically argued that the deleted data was outside the scope of the warrant and was therefore unavailable to the police unless and until they obtained a second warrant, one that specifically authorized them to resuscitate and view data Weaver had deleted from his hard drive. I think this is a very interesting argument: The Greenwood Court held that Billy Greenwood had no Fourth Amendment expectation of privacy in his real-world trash because he put it out at the curb, where it was readily accessible to any ordinary citizen. Weaver's attorney argued that he had such an expectation of privacy in the data he had deleted because he had, in effect, taken steps to make that data inaccessible to any ordinary citizen who might gain access to his hard drive.

Weaver lost: The California Court of Appeals found, among other things, that the program the computer forensics expert used to access the deleted data was not sophisticated software but was, instead, a "free download from the Internet."

The California Court of Appeals issued its decision in 2003, which means that the search of Weaver's computer probably occurred several years before . . . when computer technology was even less evolved than it was in 2003. I have not seen anyone else try this argument, but I think it could be interesting if someone did.

In Kyllo v. United States, 533 U.S. 27 (2001), the U.S. Supreme Court held that it is a "search" under the Fourth Amendment for law enforcement officers to use technology that is not "in general public usage" to locate evidence. I have always assumed that Weaver's lawyer was making a Kyllo argument, but the case is not cited in the Weaver opinion. I wonder what a court would do if a defendant made a clear Kyllo argument . . . arguing that he/she had deleted data and that the police used technology that is not "in general public usage" to recover it. My sense is that the programs police computer forensics experts currently use to restore deleted data is not something the average, ordinary citizen would know about, let alone have access to and know how to use to restore data deleted from a hard drive.

That at least raises the rather peculiar possibility that we may, just may, have more privacy in our "computer trash" than in the trash we discard in the real-world.