The Fourth Amendment, warrants and court orders for data

On the evening of March 19, while Pike's phones sat sealed in the exhibit locker, Detective Park sat at her desk writing. By the next morning she had drafted an affidavit for a warrant to search both phones, three preservation letters to companies, and an application for a court order for phone records. She tells the class that people imagine cybercrime investigation as typing at a keyboard, but most of the work she did in the first week was legal writing. Every important piece of digital evidence in the case was obtained with a court's authorization or under a legal demand, and every one of them would later be scrutinized by the defense.

This lesson covers the law that governs police access to digital data: when people have a reasonable expectation of privacy in it, what authorizations police need, and what happens when they get it wrong. It is a field where the Supreme Court of the United States has decided several major cases in the last fifteen years, and where lower courts are still divided on many questions.

The Fourth Amendment and reasonable expectations of privacy

The Fourth Amendment protects people against unreasonable searches and seizures and requires that warrants be issued only on probable cause, supported by oath or affirmation, and particularly describing the place to be searched and the things to be seized. A search occurs when the government intrudes on a reasonable expectation of privacy, the test from Katz v. United States (1967). Under the third-party doctrine, from United States v. Miller (1976) and Smith v. Maryland (1979), information a person voluntarily gives to a third party, such as bank records or the numbers dialed on a phone, traditionally carried no reasonable expectation of privacy. Digital technology has strained that doctrine, because almost everything people do now passes through companies.

Searching devices

In Riley v. California (2014), the Supreme Court held unanimously that police generally may not search the digital contents of a cell phone seized during an arrest without a warrant. The Court said modern phones hold 'the privacies of life' and differ in both quantity and quality from anything else a person might carry. Officers may seize and secure a phone on arrest, and may examine its physical aspects for safety, but a search of its data needs a warrant, unless a specific exception such as exigent circumstances applies. A warrant to search a phone must describe with particularity the data to be searched for, and many courts expect it to be limited by subject matter and time period.

Park chose not to search Pike's phone on the step, although the conversation with 'Mav' was open and he was presumably about to arrive. Rourke recorded only what was already on the screen, which officers lawfully present may observe. There was no exigency that would have justified a warrantless search, and Park preferred a warrant. The warrant, issued the next day, authorized the search for specified categories of data relating to the frauds between January 1 and March 19, which is why Lam wrote the scope at the top of her notes.

Data held by companies

In Carpenter v. United States (2018), the Supreme Court held that the government's acquisition of seven days or more of historical cell site location records from a phone company was a search requiring a warrant, despite the third-party doctrine, because such records give an intimate, comprehensive record of a person's movements. The Court called its decision narrow, and lower courts are still working out how far it reaches, for example to real-time location tracking, tower dumps and searches of location data held by technology companies. Other non-content records held by providers, such as subscriber information and IP logs, are still generally obtained under the Stored Communications Act without a warrant.

The Stored Communications Act, 18 U.S.C. sections 2701 to 2713, sets out how the government may compel providers to disclose records. Basic subscriber information, such as name, address, session times and payment method, can be obtained with a subpoena under section 2703(c)(2). Other non-content records, such as logs of IP addresses and email headers, require a court order under section 2703(d), issued on specific and articulable facts showing reasonable grounds to believe the records are relevant and material to an ongoing investigation. The contents of communications require a search warrant on probable cause; since United States v. Warshak (2010) in the Sixth Circuit, which includes Ohio, and under major providers' practices, that is the rule for all stored content. Historical cell location records require a warrant under Carpenter. Real-time interception requires a wiretap order under Title III, and real-time collection of dialing and routing information requires a pen register or trap and trace order.

# Matching each request in the case to the authority it needs
requests = [
    ("search both seized phones", "warrant"),
    ("times and routes of incoming calls to the two victims' lines", "transmission data"),
    ("account details and IP logs of the calling service's account", "subscriber and IP"),
    ("messages stored in 'Mav' account", "content"),
]
authority = {
    "warrant": "search warrant particular to the data (Riley)",
    "transmission data": "court order under 2703(d), specific and articulable facts",
    "subscriber and IP": "subpoena for subscriber data and 2703(d) order for IP logs",
    "content": "search warrant on probable cause, or a foreign request",
}
for what, kind in requests:
    print(f"{what}\n   -> {authority[kind]}")

search both seized phones
   -> search warrant particular to the data (Riley)
times and routes of incoming calls to the two victims' lines
   -> court order under 2703(d), specific and articulable facts
account details and IP logs of the calling service's account
   -> subpoena for subscriber data and 2703(d) order for IP logs
messages stored in 'Mav' account
   -> search warrant on probable cause, or a foreign request

Each request in the case needed a different authority, with a different standard of proof, issued by a judicial officer who had to be satisfied by Park's sworn evidence. The incoming call records for Grace's and Mercer's lines showed that the calls had not come from the local numbers displayed on their phones. They had entered the phone network through a voice over internet protocol provider, and both sets of calls had come through the same customer account at that provider. That was the first evidence linking Grace's case to the network Pike worked for.

Writing the application

An application for a warrant or order must be full, fair and frank. It must set out the facts that establish the required grounds, identify the sources of information and their reliability, and disclose facts that might cut against the application, such as information that another person might be responsible. It must describe precisely what is to be searched or produced and for what time period, so that the authorization is no broader than the grounds justify. For devices, it should explain what kinds of data are sought and why, and may propose a search protocol. Boilerplate paragraphs copied from other applications, assertions not tied to the facts of the case, and failures to disclose unhelpful facts are the most common reasons digital warrants are later found defective.

Desjardins reminds the class of the consequences. Evidence obtained in violation of the Fourth Amendment is generally excluded, subject to the exceptions described in the evidence course. The good-faith exception often applies where officers reasonably relied on a warrant that turns out to be defective, or on the law as it stood before a new decision such as Carpenter.

Consent and exigent circumstances

Police can sometimes obtain data without a warrant through valid consent or in an emergency. Consent must be voluntary and informed, given by a person with authority over the data, and can be limited or withdrawn. A victim like Owen can consent to an examination of their own phone, limited to the relevant conversation. A roommate generally cannot consent to a search of another person's phone. Providers may disclose data voluntarily in emergencies involving a risk of death or serious injury, and the Stored Communications Act allows it under section 2702(b)(8) and (c)(4). Exigent circumstances allow police to act without a warrant only where there is an urgent need, such as an imminent threat to someone's safety or the imminent destruction of evidence, and only as far as the urgency requires.

Real-time access and tracking

Real-time access to communications and locations is more intrusive than access to stored records, and the law treats it accordingly. Intercepting communications as they happen requires an order under Title III of the Omnibus Crime Control and Safe Streets Act, available only for listed serious offenses and only where normal investigative procedures have been tried and failed or appear unlikely to succeed or too dangerous; Ohio has a parallel wiretap statute in Revised Code Chapter 2933. Collecting dialing, routing and addressing information in real time requires a pen register or trap and trace order under 18 U.S.C. sections 3121 to 3127. Real-time tracking of a person's phone is generally treated as requiring a warrant after Carpenter, and installing a GPS tracker on a vehicle is a search under United States v. Jones (2012). Each authority has its own standard and time limit. None of these powers was needed in the Pike investigation, because the evidence was in stored records, but Desjardins says officers should know where the lines are so they do not cross them by accident, for example by asking a provider to send new messages as they arrive.

Notes, returns and disclosure

Every authorization creates paperwork that the defense will see. Officers must keep notes of when and how each warrant or order was executed, what was obtained, and any problems. Warrants must be executed within their time limits and returned with an inventory to the issuing judge, and the affidavit and results must be disclosed in discovery, subject to protective orders for informants or ongoing investigations. Park keeps a single table for each file listing every request to a company, the authority used, the date sent, the date records were received, their hash values and where they are stored. She says that table has answered more defense questions than any other document she has written.

Desjardins adds that particularity matters in practice as well as on paper. If an examiner searching a phone under a fraud warrant comes across evidence of a different offense, the safe course is to stop and obtain a further warrant rather than keep looking under the original one. Courts have suppressed evidence where officers treated a narrow warrant as a license to search the whole device, and the plain view doctrine gives limited protection for a search that goes beyond the warrant's terms.