Computer Search warrants

[admin]

How is a search warrant for a computer obtained?

• A police officer or other official applies to a judge or magistrate for a search warrant 
  
• The applicant must establish probable cause that a crime was committed, and that the computer contains evidence of that crime 
  
• The applicant must swear to the truth of the facts that establish probable cause 
  
• The warrant must describe the specific items to be searched and seized 
  

What is protected by a search warrant?

• The Fourth Amendment of the U.S. Constitution protects people from unreasonable searches and seizures 
  
• A search warrant protects the privacy of the person whose computer is being searched 
  

What are some exceptions to the search warrant requirement? 

• Evidence is in plain view
  
• The owner of the computer consents to the search
  
• There are exigent circumstances, such as an emergency
  
• The search is at a U.S. border
  
• The person being searched is on probation, parole, or supervised release
  

[admin]

A warrant is normally required to search a digital device. Under most circumstances, individuals have a reasonable expectation of privacy in the contents of their digital devices, such as cell phones, tablets, and computers. Therefore, the Fourth Amendment requires a law enforcement officer to obtain a search warrant to search such a device, unless an exception to the warrant requirement applies. The Supreme Court recently eliminated one important exception when it held that a digital device may not be searched incident to a suspect’s arrest. Thus, a search warrant will often be necessary to search a suspect’s digital devices.

[admin]

Establishing probable cause. A warrant, of course, requires probable cause. In general, probable cause to search a digital device is no different from probable cause to search a physical object or location. But there are a few probable cause issues that are unique to digital searches.

Probable cause may be based on an IP address. Investigators sometimes determine that criminal activity has been conducted through a particular Internet Protocol address, or IP address, and are able to trace the IP address to a residence, only to learn that the residence has an unsecured wireless network. In such a case, investigators may be unable to rule out the possibility that a neighbor or a passer-by, rather than a resident, used the network for criminal purposes. Nonetheless, courts have generally ruled that there is probable cause to search the digital devices at the residence, as residents are the most likely users of the network.

Probable cause in child pornography cases. Courts have addressed a number of recurrent issues that arise in child pornography investigations. In general:

• When probable cause is based on a witness having seen child pornography on a suspect’s digital device, the officer who applies for the search warrant should provide an explicit and detailed description of the images or videos seen by the witness. If the officer simply describes the material as “child pornography,” a judicial official may be unable to make an independent determination about the nature of the material and the existence of probable cause.

• When probable cause is based on information that a suspect had child pornography on his digital device's weeks or months in the past, an officer with experience in child pornography investigations should explain in the search warrant application that individuals who view child pornography tend to retain it. When presented with such information, courts often recognize that information that a suspect has child pornography on his or her digital devices does not easily become too outdated, or “stale,” to support a search warrant.

• Where there is evidence that a suspect has had sexual contact with children or has visited non pornographic web sites oriented towards pedophiles, these facts may help to support a finding of probable cause to believe that child pornography will be present on the suspect’s digital devices. However, these facts alone may not be sufficient to provide probable cause.

[admin]

Drafting warrant applications and proposed warrants. Several practices should be followed when drafting search warrant applications and proposed search warrants for digital devices. Include digital-specific language. The Fourth Amendment requires that a warrant describe the place to be searched with particularity. If a warrant identifies a physical location, such as a suspect’s home or office, without specifically mentioning digital devices that may be present, there may be some doubt about the sufficiency of the warrant to authorize the search of the devices. Several courts have ruled that such a warrant is adequate, because a warrant authorizing the search of a particular location for a particular item generally authorizes the search of any container at the location that might reasonably contain the evidence sought, and digital devices are containers for information. So, for example, a warrant authorizing the search of a home for records of drug sales, lists of drug customers, and the like would allow the search of any drawer or box within the home in which the records could reasonably be found, and the search of any computer or cell phone that could contain such records. However, a few courts have suggested that digital devices are different and normally may be searched only if specifically permitted by the warrant. Therefore, a cautious officer who anticipates needing to examine digital devices should note that fact in the application and provide for it in the proposed warrant. Officers should also seek authorization to seize manuals, power cables, and passwords associated with digital devices, as not having these items may make a forensic search difficult or even impossible. Describe the items to be seized in as much detail as reasonably possible. The Fourth Amendment requires that a warrant describe the items to be seized with particularity. In most cases involving digital devices, the devices themselves are incidental to the true object of the search, which is the information contained on the devices. Thus, a warrant application should describe the files or information sought, not merely the devices, and should do so as specifically as reasonably possible. At a minimum, it should link the material sought to a specific offense. A court may view as overbroad a warrant that authorizes the seizure of all digital devices that belong to a suspect but is likely to approve of a warrant that authorizes the seizure of all digital devices that belong to the suspect and that could contain evidence of the specific crime under investigation. In an appropriate case, the description of the items to be seized could be further tailored by limiting the files to be examined to files created or accessed by a specific user, or to files created or accessed on or after a specific date.

[admin]

When executing search warrants, police are restricted to searching only areas in which the listed object of the search could be found or concealed. This is said to be the “scope” of the search warrant. For example, if an officer was executing a search warrant for a piano located in a house, the officer could only look places where a piano could be concealed. Thus, if the officer looked into a jewelry box, he would be exceeding the scope of the search warrant, and any evidence discovered in the jewelry box would likely be suppressed as fruit of an unreasonable search. On the other hand, a search warrant authorizing the search for illegal narcotics located in a house would most likely authorize the search of just about everywhere in the house because narcotics can be hidden is very small spaces. With searches for such tangible objects, it is fairly easy to determine the scope of the search. However, when we consider searches of computers and similar technology for digital media or other evidence, the scope of the search is sometimes less clear.