Searching digital things isn’t like searching physical things. But a majority of Fourth Amendment jurisprudence relies on making inapt comparisons between houses/papers and devices capable of holding several housefuls of papers, communications, photos, etc.
Guidelines for digital searches are an inexact science. Given the nature of these searches, there’s clearly room for abuse. It’s almost inevitable. Access must be granted to an entire device (computer, phone, hard drive) to find what’s sought as evidence. Files aren’t named incriminating.docx so files must be opened to determine their contents. In almost all digital searches, law enforcement gets the haystack and then goes looking for needles.
The problem with this approach is it allows law enforcement to reroute search efforts (or apply for new warrants) if they happen to discover something incriminating that wasn’t exactly what they were looking for. We’ve already seen this happen in espionage cases (where child porn was discovered) and the FBI’s dig into Hillary Clinton’s private email server (a search for illicit text messages from Anthony Weiner resulted in the examination of thousands of emails stored by his estranged wife [and former Clinton aide] Huma Abedin).
If law enforcement needs to view unrelated files to find the evidence they’ve sworn (in an affidavit) they’d find, how do you stop them from using evidence not specifically related to the confines of the search? That’s the question the Oregon Supreme Court wrestled with before coming up with an imperfect answer.
The facts of the case are undeniably tragic. Here they are summed up by Orin Kerr, whose own writings on the subject of digital searches are referenced a few times in the court’s decision.
Here’s a very simplified version of the facts (enough to explain the legal context, no more). The police suspected that Mansor had abused his infant son in a way that led to his tragic death. The police obtained a warrant to search Mansor’s computer for evidence of abuse. But the warrant they drafted was incredibly narrow. As construed by the Oregon Supreme Court, the warrant only authorized a search for the Internet search terms that Mansor had entered in to his browser for a specific 15-minute window before Mansor had called 911 to report his son’s injury.
The problem with the search is it immediately exceeded the restrictions law enforcement had placed on itself. These restrictions weren’t found in the warrant request, which was completely open-ended, but in the instructions the agency passed on to the forensic examiner. From the opinion [PDF]:
The warrant was executed that night. Two laptop computers, two desktop computers, and other items from B’s room were seized. The computers were taken to the Northwest Regional Computer Forensics Laboratory, operated by the FBI, which performed the forensic analysis. The lab’s report summarized the request:
“[Rookhuyzen] requested that the [seized computer drives] be examined for internet history and internet search terms input by the user on [June 12] especially from 2pm onward. Per a discussion with Det. Rookhuyzen, the suspect searched the internet 15 minutes prior to calling 9-1-1 in regards to his 11-week old child suffering injuries. Suspect claimed that the internet searches were regarding how to aid an injured infant. Pertinent examination results should be regarding child abuse and a possible history thereof.”
This self-imposed limitation was almost immediately exceeded. New search terms were added. For no discernible reason, the agency asked forensics to recover emailed messages. Eventually, law enforcement found what it was looking for by removing the time limit placed on internet history/search terms to allow examination of data dating back to 2005 — five years before the infant at issue was born.
The search results compiled covering the 15-minute window surrounding the original 911 call appeared to track with the suspect’s story. Those dating back further indicated a history of abusive behavior towards the infant. The search terms from outside the original proposed range of June 12th (the date of the 911 call) were introduced as evidence of Mansor’s motive and mindset.
At trial, Detective Hays relied on the forensic lab’s reports to testify about defendant’s internet history. He stated that shortly before the 9-1-1 call, defendant searched the term “baby pulse no breathing”—a search consistent with defendant’s explanation of events. The focus of Hays’s testimony on defendant’s internet history, however, was computer activity that occurred before that day. Interpreting reports generated by the forensic examiner, Hays concluded that on five separate occasions—the day of the 9-1-1 call and four earlier occasions, the earliest 54 days before the call—the computer had been used to conduct searches about or related to child abuse. The prosecutor implied that the search terms typed into the computer, often in quick succession, provided a snapshot of defendant’s thought process and conduct. For example, three days before the 9-1-1 call, there were many relevant searches, including, at 6:24 a.m., a search for “afraid of abusing my baby,” then shortly after that, “how do I deal with a screaming baby,” then three minutes later, “baby, swelling, back of head.”
This evidence was challenged by Mansor but the trial court ruled the evidence collected fell under the “plain view” warrant exception. Even if law enforcement had exceeded its self-imposed limits, the information would apparently have been uncovered during the course of the lawful search. This ruling ignored the fact that very little of what’s uncovered during a forensic search could really be considered “plain view,” what with access to deleted files and years of internet activity.
The appeals court reversed this decision, ruling the warrant itself was unconstitutionally broad. It held that ordering a forensic examination of the suspect’s computers exceeded what was necessary to obtain evidence related to crime at hand.
The state supreme court comes to a similar conclusion, but for different reasons. The warrant is still overbroad but the remedies and protections flow from the state’s Constitution, rather than the US Constitution. Oregon’s protections exceed those of the Fourth Amendment.
Addressing the issue of overbroad searches and search warrants, the court hands down this deterrent and avenue for challenge. Citing the Supreme Court’s Riley decision and noting its refusal to compare digital devices containing millions of “papers” to yesteryear’s “containers” and “pants pockets,” the state court finds the most practical way to limit digital searches is to immediately disqualify evidence obtained in excess of the warrant’s stated confines.
In our view, the privacy interests underlying Article I, section 9, are best protected by recognizing a necessary trade-off when the state searches a computer that has been lawfully seized. Even a reasonable search authorized by a valid warrant necessarily may require examination of at least some information that is beyond the scope of the warrant. Such state searches raise the possibility of computer search warrants becoming the digital equivalent of general warrants…
[…]
Although such searches are lawful and appropriate, individual privacy interests preclude the state from benefiting from that necessity by being permitted to use that evidence at trial. We thus conclude that the state should not be permitted to use information obtained in a computer search if the warrant did not authorize the search for that information, unless some other warrant exception applies.
It’s a new exclusionary rule specifically aligned to Oregon’s Constitution that will hopefully deter fishing expeditions or unrelated investigations. But even if it doesn’t, it’s a challenge that can immediately be raised to presented evidence that goes further than a Fourth Amendment challenge would. Defendants don’t have to challenge the validity of the warrant but rather the evidence obtained by it, if it’s in excess of the warrant’s demands. This may encourage law enforcement to craft broader search warrants, but the language in the first paragraph of the previous quote shows the state’s supreme court is already viewing broad digital search warrants with skepticism.