Wisconsin Court Says Warrants Are Needed To Search Dropbox Accounts, Even If They Belong To Cops

from the seems-obvious dept

If you want access to content and communications, it seems pretty obvious you should get a warrant. There are plenty of warrant exceptions, but rooting around in things pretty much everyone believes have an expectation of privacy — whether it’s their house, their phones, or their online document storage services — generally requires a warrant.

Cloud storage is no different. Just because it’s not physically in the possession of investigation targets or suspected criminals doesn’t mean they don’t have a reasonable expectation of privacy in the contents of their accounts.

There’s not much court precedent dealing with this particular issue, though. Fourth Amendment expert Orin Kerr suggests this may have something to do with corporate policies governing users’ content.

It’s surprising how little caselaw there is on this. That’s partly because lawyers for Internet providers generally require a warrant before they’ll turn over account contents, and investigators can’t practically sue the providers over that if they disagree (it takes too long).

First off: good for service providers! Demanding a warrant even when there’s a dearth of supporting case law is a good first step. It deters fishing expeditions and discourages law enforcement from wading into untested legal waters too often.

Second, pushback like this forces law enforcement to tacitly admit they too believe warrants should be used to obtain content from third party services. If they firmly believed warrant exceptions (like the Third Party Doctrine) applied, they’d perform their own pushback, especially in cases (like this one) where time doesn’t appear to be of the essence.

Of course, doing this runs the risk of generating precedent that works against law enforcement’s warrant-optional desires. That’s what has happened here. Unsurprisingly, it took someone who knows how to work the system to get this established by a Wisconsin appeals court [PDF]: a cop.

Detective Sergeant Steven Bowers was charged with misconduct in office after sharing confidential sheriff’s department files with the producers of the “Cold Justice” TV show. Bowers used his Taylor County email address to create the account — a fact that apparently led investigators to believe no warrant was needed to access the contents of Sgt. Bowers’ account.

They were wrong. The lower court suppressed the evidence, ruling that the warrantless search violated the Fourth Amendment. The Appeals Court comes to the same conclusion — one that makes it clear the expectation of privacy still applies to the contents of online storage services, even if the account was activated using a government provided email account.

The route taken to achieve this Fourth Amendment violation was, however, made much, much easier by Sgt. Bowers’ decision to use a government email account, rather than one of his own.

Bowers had used his county e-mail address to set up his Account, although he paid for it with his own funds. Lind testified that on March 2, 2017, she performed a password reset on Bowers’ Account, which then “e-mailed a link to [Bowers’ county] e-mail address.” Given that she had access to Bowers’ county e-mail account through her role in IT, she then entered his e-mail account and used that link to change Bowers’ Account password, effectively severing Bowers’ access to his Account. Lind then personally accessed Bowers’ Account “with the [district attorney] and [Daniels] present.” According to Lind, the search of Bowers’ Account revealed both that the Murder 3 file was in the Account and that Bowers had shared the case file with individuals outside the department.

So, yeah… OpSec is still hit and miss when it comes to rookie leakers. Bowers should have known utilizing his government email account gave him less than exclusive control of it. That much was made clear by the county’s clickwrap, which informed Bowers his account was “exclusively owned” by the government he worked for.

Even so, it was still his personal Dropbox account that was accessed. The lower court first said Bowers had no expectation of privacy in this account because he had no expectation of privacy in his government email account. It rolled that decision back after taking a second look at the situation after Bowers reminded the court this search involved the contents of a Dropbox account he personally paid for, rather than one provided to him by the county government.

The Appeals Court affirms: this was a search under the Fourth Amendment. And, as such, a warrant was needed. The fact that the department was able to avoid interacting with Dropbox and utilized a government email address to reset the password to gain access doesn’t change the calculus of the Fourth Amendment issues.

[T]he department seized control of Bowers’ private Account located on servers outside the department by using Bowers’ county-owned e-mail address to change his Dropbox password. It then accessed and searched the information in his Account. The department did not receive the evidence from a third party, and it did not simply obtain specific files from Bowers’ Account. The department seized and searched at least portions of, if not all of, Bowers’ Account. Accordingly, the third-party doctrine cases that the State relies upon are inapt under the circumstances of this case. We agree with Bowers that the Court’s decisions in Miller and Smith do not clearly control the department’s actions here, as the department did much more than obtain access to metadata or Dropbox’s business records.

The State focuses on the fact that Bowers created this Account with his county-owned e-mail address. Apart from using that e-mail address, however, Bowers created the Account on his own. Bowers paid for the Account with his own money, and the Account was password protected. The department did not search its own devices to access the information in Bowers’ Account; it used the internet as a tool to access the outside server on which the Account was located.

Even if some of that might apply if the court were willing to fully oblige the terrible Third Party Doctrine arguments the state presented, it still wouldn’t matter. There’s an expectation of privacy in online storage accounts — something that can’t be undone simply because the government claims there isn’t.

Here, we conclude that society is willing to recognize that a user has a legitimate expectation of privacy in his or her Dropbox account. According to Dropbox, it boasts over 700 million users on its platform, and it specifically tells its users that “[w]ith Dropbox, your files belong to you, not us, so you can be sure we’re not reselling your data.” Dropbox, https://www.dropbox.com (last visited Dec. 13, 2022). By using a password that is not shared, these users expect their cloud-storage accounts to remain private unless the user shares the files with others, even if the information is stored by a third party. See Johnson, supra, at 886 & n.126 (“This is the equivalent of renting a safety deposit box, locking it, and trusting the bank not to break the lock.”).

Thus, under the totality of the circumstances and when considering the Dumstrey factors, we conclude that Bowers had a reasonable expectation of privacy in his Account. Law enforcement seized Bowers’ Account and searched it without a warrant, thereby violating Bowers’ Fourth Amendment rights.

Rights are for the people. The government doesn’t have any. It has powers, and that’s what these rights constrain. What ultimately matters in terms of the “reasonableness” of privacy expectations is what the public believes is reasonable. That the government believes otherwise doesn’t matter. Not in this case, at least.

Filed Under: , , , , ,
Companies: dropbox

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Wisconsin Court Says Warrants Are Needed To Search Dropbox Accounts, Even If They Belong To Cops”

Subscribe: RSS Leave a comment

This comment has been flagged by the community. Click here to show it.

Matthew M Bennett says:

The email, tho.

Ok, I hate cops and love the 4th amendment. But creating the account under a department email effectively means the department owns the account, since they own the email.

Like it’s not searching something of the officers, anymore. Completely different than using a personal email. It’s not about him being a cop or warrants, it’s about the email and ownership.

I think the court got it wrong.

PaulT (profile) says:

Re: Re:

I’m not so sure about that. If you’re using the work mail to administer the account, then there may be some technical involvement even if the costs are paid out of the employee’s own pocket. If I subscribed to something that’s delivered to my work address, I could expect some involvement in company policy, even if I consider it a private thing that I’m just having delivered to the office for convenience.

I’m not saying the employer owns everything that’s connected to a work email address, but if the account is maintained and operated through the work email (for example, if they also use it for 2FA), it might get muddier than if the employee used their personal address but just happened to access it at work.

A guy says:

The 2FA with a phone is close. This is more like. The police have a key cutting machine, and the office used it to make a new key to his house. Cops come around and having the key code, key themselves a key to the house, then have a locksmith change the locks on the house, showing the locksmith the key the already have to prove it it their house.

Now with him locked out the enter the house when they want a search and claim the house belongs to the police because they have the one and only key. And that whatever key he did have, was cut on the cop’s key machine, so the key and house belong to them.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...