Oregon Supreme Court Sets Up New Limits For Digital Device Searches

from the if-it-isn't-what-you-said-you're-looking-for,-you-don't-get-to-use-i dept

Searching digital things isn't like searching physical things. But a majority of Fourth Amendment jurisprudence relies on making inapt comparisons between houses/papers and devices capable of holding several housefuls of papers, communications, photos, etc.

Guidelines for digital searches are an inexact science. Given the nature of these searches, there's clearly room for abuse. It's almost inevitable. Access must be granted to an entire device (computer, phone, hard drive) to find what's sought as evidence. Files aren't named incriminating.docx so files must be opened to determine their contents. In almost all digital searches, law enforcement gets the haystack and then goes looking for needles.

The problem with this approach is it allows law enforcement to reroute search efforts (or apply for new warrants) if they happen to discover something incriminating that wasn't exactly what they were looking for. We've already seen this happen in espionage cases (where child porn was discovered) and the FBI's dig into Hillary Clinton's private email server (a search for illicit text messages from Anthony Weiner resulted in the examination of thousands of emails stored by his estranged wife [and former Clinton aide] Huma Abedin).

If law enforcement needs to view unrelated files to find the evidence they've sworn (in an affidavit) they'd find, how do you stop them from using evidence not specifically related to the confines of the search? That's the question the Oregon Supreme Court wrestled with before coming up with an imperfect answer.

The facts of the case are undeniably tragic. Here they are summed up by Orin Kerr, whose own writings on the subject of digital searches are referenced a few times in the court's decision.

Here's a very simplified version of the facts (enough to explain the legal context, no more). The police suspected that Mansor had abused his infant son in a way that led to his tragic death. The police obtained a warrant to search Mansor's computer for evidence of abuse. But the warrant they drafted was incredibly narrow. As construed by the Oregon Supreme Court, the warrant only authorized a search for the Internet search terms that Mansor had entered in to his browser for a specific 15-minute window before Mansor had called 911 to report his son's injury.

The problem with the search is it immediately exceeded the restrictions law enforcement had placed on itself. These restrictions weren't found in the warrant request, which was completely open-ended, but in the instructions the agency passed on to the forensic examiner. From the opinion [PDF]:

The warrant was executed that night. Two laptop computers, two desktop computers, and other items from B’s room were seized. The computers were taken to the Northwest Regional Computer Forensics Laboratory, operated by the FBI, which performed the forensic analysis. The lab’s report summarized the request:

“[Rookhuyzen] requested that the [seized computer drives] be examined for internet history and internet search terms input by the user on [June 12] especially from 2pm onward. Per a discussion with Det. Rookhuyzen, the suspect searched the internet 15 minutes prior to calling 9-1-1 in regards to his 11-week old child suffering injuries. Suspect claimed that the internet searches were regarding how to aid an injured infant. Pertinent examination results should be regarding child abuse and a possible history thereof.”

This self-imposed limitation was almost immediately exceeded. New search terms were added. For no discernible reason, the agency asked forensics to recover emailed messages. Eventually, law enforcement found what it was looking for by removing the time limit placed on internet history/search terms to allow examination of data dating back to 2005 -- five years before the infant at issue was born.

The search results compiled covering the 15-minute window surrounding the original 911 call appeared to track with the suspect's story. Those dating back further indicated a history of abusive behavior towards the infant. The search terms from outside the original proposed range of June 12th (the date of the 911 call) were introduced as evidence of Mansor's motive and mindset.

At trial, Detective Hays relied on the forensic lab’s reports to testify about defendant’s internet history. He stated that shortly before the 9-1-1 call, defendant searched the term “baby pulse no breathing”—a search consistent with defendant’s explanation of events. The focus of Hays’s testimony on defendant’s internet history, however, was computer activity that occurred before that day. Interpreting reports generated by the forensic examiner, Hays concluded that on five separate occasions—the day of the 9-1-1 call and four earlier occasions, the earliest 54 days before the call—the computer had been used to conduct searches about or related to child abuse. The prosecutor implied that the search terms typed into the computer, often in quick succession, provided a snapshot of defendant’s thought process and conduct. For example, three days before the 9-1-1 call, there were many relevant searches, including, at 6:24 a.m., a search for “afraid of abusing my baby,” then shortly after that, “how do I deal with a screaming baby,” then three minutes later, “baby, swelling, back of head.”

This evidence was challenged by Mansor but the trial court ruled the evidence collected fell under the "plain view" warrant exception. Even if law enforcement had exceeded its self-imposed limits, the information would apparently have been uncovered during the course of the lawful search. This ruling ignored the fact that very little of what's uncovered during a forensic search could really be considered "plain view," what with access to deleted files and years of internet activity.

The appeals court reversed this decision, ruling the warrant itself was unconstitutionally broad. It held that ordering a forensic examination of the suspect's computers exceeded what was necessary to obtain evidence related to crime at hand.

The state supreme court comes to a similar conclusion, but for different reasons. The warrant is still overbroad but the remedies and protections flow from the state's Constitution, rather than the US Constitution. Oregon's protections exceed those of the Fourth Amendment.

Addressing the issue of overbroad searches and search warrants, the court hands down this deterrent and avenue for challenge. Citing the Supreme Court's Riley decision and noting its refusal to compare digital devices containing millions of "papers" to yesteryear's "containers" and "pants pockets," the state court finds the most practical way to limit digital searches is to immediately disqualify evidence obtained in excess of the warrant's stated confines.

In our view, the privacy interests underlying Article I, section 9, are best protected by recognizing a necessary trade-off when the state searches a computer that has been lawfully seized. Even a reasonable search authorized by a valid warrant necessarily may require examination of at least some information that is beyond the scope of the warrant. Such state searches raise the possibility of computer search warrants becoming the digital equivalent of general warrants…

[...]

Although such searches are lawful and appropriate, individual privacy interests preclude the state from benefiting from that necessity by being permitted to use that evidence at trial. We thus conclude that the state should not be permitted to use information obtained in a computer search if the warrant did not authorize the search for that information, unless some other warrant exception applies.

It's a new exclusionary rule specifically aligned to Oregon's Constitution that will hopefully deter fishing expeditions or unrelated investigations. But even if it doesn't, it's a challenge that can immediately be raised to presented evidence that goes further than a Fourth Amendment challenge would. Defendants don't have to challenge the validity of the warrant but rather the evidence obtained by it, if it's in excess of the warrant's demands. This may encourage law enforcement to craft broader search warrants, but the language in the first paragraph of the previous quote shows the state's supreme court is already viewing broad digital search warrants with skepticism.


Reader Comments

The First Word

Subscribe: RSS

View by: Time | Thread


  • This comment has been flagged by the community. Click here to show it
    identicon
    Anonymous Coward, 16 Jul 2018 @ 12:12pm

    Oh, pooh. Going to ignore child porn and murders if not EXACT?

    ALL that makes these gadgets different is not degree or kind but that people PUT evidence on them. It's no different than if were written on paper or photographed and tacked on the kitchen wall.

    There'll be some kibitzing and dodging (by lawyers trying to get criminals off) until a really horrific crime must be ignored -- sheerly under weenie lawyer rules, where common law is clear that ANY evidence incidentally discovered IS to be used.

    reply to this | link to this | view in chronology ]

    • icon
      Gary (profile), 16 Jul 2018 @ 12:20pm

      Re: Oh, Troll

      I don't think "Common Law" means what you think it does.
      But, you do seem to be giving a hearty endorsement to repeal the useless 4th and 5th amendments.
      I guess the constitution is just a barrier to out Natural Rights?

      reply to this | link to this | view in chronology ]

      • icon
        Stephen T. Stone (profile), 16 Jul 2018 @ 12:28pm

        Re: Re:

        Mr. SovCit still has yet to explain what he means by “common law” and why it should override every local, state, and federal law and statute on the books (not to mention international treaties).

        reply to this | link to this | view in chronology ]

        • icon
          That One Guy (profile), 16 Jul 2018 @ 7:24pm

          Re: Re: Re:

          Explicitly perhaps not, though over time it's pretty clear that they think 'common law' is a magic phrase which might as well translate to 'I win the argument'. It's never been correct, but that's hardly new for them.

          reply to this | link to this | view in chronology ]

        • icon
          The Wanderer (profile), 17 Jul 2018 @ 8:25pm

          Re: Re: Re:

          It seems fairly clear to me that he thinks "common law" means "the common person's understanding of what the law is" (or, perhaps, "should be" rather than "is").

          The logic underlying his position that common law is supreme over all other laws is less clear to me, but I think it has something to do with a combination of the idea of common sense ("if the idea of X not being the rule would seem strange to the common person, then obviously X should be the rule, because something that's that obvious to the common person is clearly accepted by the majority") with the idea that since all law derives its validity from the consent of the governed, and the common person is the majority, clearly any law which doesn't fit what the common person thinks the law should be is invalid because the people don't consent to it.

          Problems with that include defining "the common person" (on which point I don't have any articulable insights at present) and - at least for the implications for his other positions - the fact that it seems quite likely that a majority of the populace don't have any problem with casual copyright violation...

          reply to this | link to this | view in chronology ]

    • icon
      Stephen T. Stone (profile), 16 Jul 2018 @ 12:26pm

      Re:

      If you were a prosecuting attorney who learned that an “incidental discovery” infringed upon the civil rights afforded to all people under criminal investigation, which would mean any inquiry into how the evidence was gathered could jeopardize your case, how hard would you press for the use of that evidence at trial?

      reply to this | link to this | view in chronology ]

      • icon
        Gary (profile), 16 Jul 2018 @ 12:41pm

        Re: Re: Incidental

        Remember when the FBI paid Best Buy to search every computer they worked on?
        That was "Incidental Discovery." (At least according tot he FBI.)
        If AC wants to legalize mass surveillance so the feds can up their game, seems like he is in favor of a police state.

        reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 16 Jul 2018 @ 12:35pm

      Re: Oh, pooh. Going to ignore child porn and murders if not EXACT?

      >It's no different than if were written on paper or photographed and tacked on the kitchen wall.

      Its more like they are written down and put in a safe. The contents of a phone are not in plain view, and are usually protected by a password.

      reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 16 Jul 2018 @ 3:10pm

      Re: Oh, pooh. Going to ignore child porn and murders if not EXACT?

      It's inevitably some horrible situation that gets used by someone to erode rights. A child dies, a murderer goes free, an abusive parent gets their kids back, and so on. And those are indeed unfortunate outcomes. However, I'll accept those outcomes over the alternative, where the government can beat someone until they confess, or plant evidence because they KNOW that person is guilty of something, or shoot somebody out of "fear" because they were breathing while black (oh wait, that already happens).

      Everyone is entitled to protection under the law and protection from governmental abuse of power. Even criminals. Even when the acts committed are so despicable that old school cut-your-hand-off-for-stealing style retribution sounds very satisfying.

      But no, you don't ignore child porn and murders if the warrants and such aren't exact. You either a) make sure you're doing your job well and the warrants are exact or b) if you honestly screw up and someone walks, you go have a drink, come back tomorrow, and find another way to catch the scum that doesn't rely on violating their rights. If, on the other hand, you think that "because they're a criminal" entitles you to do whatever you want to get them, you should find another job. I hear gangs, warlords, and dictators might have some openings.

      reply to this | link to this | view in chronology ]

      • icon
        Bergman (profile), 20 Jul 2018 @ 9:56pm

        Re: Re: Oh, pooh. Going to ignore child porn and murders if not EXACT?

        Given the way the Constitution works and the statutes that define criminal penalties for violating constitutional rights, anyone who thinks "because they're a criminal" entitles them to do whatever they want to that criminal, IS a criminal as well.

        Title 18, Sections 241 & 242 of the US Code made this very, very clear. And neither of those are new or unknown laws.

        reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 16 Jul 2018 @ 7:09pm

      Re: Oh, pooh. Going to ignore child porn and murders if not EXACT?

      ...Yes? Because if you elect to ignore fruit of the poisonous tree and catch the wrong guy, that individual is fucked for the rest of his life, no questions asked. Such as the pastor who was emailed child porn that he never took or viewed, but was harassed so much by law enforcement and his own congregation he had to leave town.

      But then again, you'd support any lowering of standards for evidence because your corporate heroes in the RIAA have absolutely none. Just random numbers pulled out of their ass.

      reply to this | link to this | view in chronology ]

  • icon
    Wyrm (profile), 16 Jul 2018 @ 2:29pm

    And how does that conclusion prevent parallel construction? It happens all the time already, this will just give them one more reason to use this illegal - but hard to prove - practice.

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 17 Jul 2018 @ 3:12pm

    Does anyone here feel as I do, that it must be a tragic failure of governing process's that constitutional rights are so often maintained and secured (or lost) in the process of defending child murder's/abusers, and other horrible people?

    It just feels so rotten and off... Any sharp legal minds around with some insight on this? Is it a deliberate way for pushing back on constitutional rights, or happenstance? IOW do prosecutors deliberately push interpretation of law and policy in extreme cases such as these knowing those involved will be very focused on justice for the victims? Or are these honest mistakes that happen in the fog of anger, passion and zeal?

    Is there a smarter way of doing this?
    I want reasonable modern 4th amendment protections- I also want terrible people to answer for their crimes- Those two things shouldn't be exclusive of the other.

    Also- I've heard of people getting contacted for searches as innocuous as special cooking pots- how was this guys searches not enough for him to get a knock on the door and an investigation started?

    reply to this | link to this | view in chronology ]

    • icon
      That One Guy (profile), 19 Jul 2018 @ 2:50am

      Re:

      IOW do prosecutors deliberately push interpretation of law and policy in extreme cases such as these knowing those involved will be very focused on justice for the victims? Or are these honest mistakes that happen in the fog of anger, passion and zeal?

      Little of column A, little of column B I suspect.

      (The attempt a few years back to undermine encryption by forcing companies, Apple at the time, to decrypt was very much the former as a semi-recent article revealed. They were pushing the case because the wanted the precedent from it, and with the 'defendant' being both murdering scum and dead they probably figured they'd have a trivial time of it.)

      As for leaving a foul taste in your mouth, yeah, that's unfortunately how it works more often than not, where you can all too easily find yourself defending the rights of truly deplorable people because the rights and legal protections that they enjoy are the same ones that could very well save you if you find yourself in the crosshairs down the line and a prosecutor is looking to add another notch on the 'plea deal/convictions' record.

      reply to this | link to this | view in chronology ]

    • icon
      Bergman (profile), 20 Jul 2018 @ 9:59pm

      Re:

      The problem is that it's not just child abusers who are terrible people that deserve to answer for their crimes.

      A public official -- which includes police officers -- who violates someone's rights has committed a crime. Depending on the nature of the violation, the sentence if they are prosecuted and convicted can range from a year in prison to life without possibility of parole or even execution.

      When a cop or prosecutor or judge commits capital crimes to catch a suspected criminal who is guilty of a far less serious crime, even if they get the guy they haven't reduced the number of criminals on the street, they've made more!

      reply to this | link to this | view in chronology ]


Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here
Get Techdirt’s Daily Email
Use markdown for basic formatting. HTML is no longer supported.
  Save me a cookie
Follow Techdirt
Techdirt Gear
Shop Now: Techdirt Logo Gear
Advertisement
Report this ad  |  Hide Techdirt ads
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Chat
Advertisement
Report this ad  |  Hide Techdirt ads
Recent Stories
Advertisement
Report this ad  |  Hide Techdirt ads

Close

Email This

This feature is only available to registered users. Register or sign in to use it.