Technological advances seem to have a peculiarly recurring way of upsetting the legal applecart.

Invent the telephone, and the Fourth Amendment’s original applicability to merely the physical "persons, houses, papers, and effects" (and not to what transpires over a telephone),1 gets extended to situations where people have a "reasonable expectation of privacy," a judicially-created enhancement, to include telephonic communications.2

Develop the technology to record what is being said inside an office from a device affixed to an outside wall, and the warrantless recording of conversation occurring therein (which was originally ruled by the U.S. Supreme Court as not violating the Fourth Amendment since no physical trespass occurred),3 is later held to be overruled by the reasonable expectation of privacy doctrine.4

GPS tracking becomes a reality, and the ability of law enforcement to utilize technology to follow a vehicle being driven on public thoroughfares without a warrant (once held constitutional prior to the existence of GPS’s enhanced capabilities),5 has now been severely limited or abolished outright.6

Technology and Border Searches

Recently, advanced technology once again caused another long-standing applecart, and possibly one of the more sacrosanct ones, to be tossed over the cliff. This latest ruling, United States v. Cotterman, 709 F.3d 952 (9th Cir. March 8, 2013), appears to infringe on what had previously been the relatively unfettered ability of border agents to conduct warrantless searches of the contents of digital devices.

Prior to Cotterman, several federal decisions had held warrantless border searches of computers and digital storage media valid even when completely unsupported by any evidence of wrongdoing,7 two of which were even rendered by the Ninth Circuit: United States v. Arnold, 523 F.3d 941 (2008) and United States v. Romm, 455 F.3d 990 (2006). What distinguishes Cotterman from the Ninth Circuit’s previous two decisions is the manner in which the forensic examination of the computer was performed.

‘United States v. Cotterman’

The defendant and his wife attempted to drive across the Mexican border into the United States at Lukeville, Ariz., not exactly one of the busiest entry ports into this country. The border inspector, following protocol, ran both passports through a federally-maintained database, which informed the agent that the defendant had been convicted 15 years beforehand for sexually molesting a child.

The Long Beach, Calif., Immigration and Customs Enforcement (ICE) agent listed as the contact person in the database was called and advised the Lukeville authorities to seize from the Cottermans anything that might contain child pornography. Two laptops and three digital cameras were taken from the couple’s vehicle.

A Lukeville Customs and Border Protection officer examined the contents of the seized items at the crossing point, finding no contraband on any of the devices. Access to all of the files on one of the laptops, however, was inhibited in that several were password-protected.

Meanwhile, two ICE agents from Sells, Ariz., approximately 90 minutes away from Lukeville, were notified of the ongoing situation at the border crossing, and decided to participate in the investigation. On the way there, the agents determined it would be necessary to do a full forensic examination of the laptops.

Upon their arrival, the Cottermans were given Miranda warnings and interviewed separately, but nothing incriminating was said. During his interview, however, the defendant offered to access the protected files.

At the conclusion of approximately eight hours of detention, the Cottermans were informed they were permitted to continue their journey. Two of the cameras were returned, but they were informed that the agents would be taking the two laptops and remaining camera to Tucson for further examination.

Tucson Forensic Examination

An ICE computer forensic examiner in Tucson began his inspection of the laptops’ hard drives and the camera’s digital memory card the following morning. He was able to quickly determine there was no contraband contained in the camera’s memory and allowed that device to be released to the defendant’s wife that same day.

The laptops’ hard drives, however, had to be copied prior to examination. Due to the storage size of the hard drives, it required the overnight to complete the imaging.

The agent started his examination of the imaged drives the following morning. He realized fairly quickly that he had first selected the drive imaged from the laptop belonging to the defendant’s wife. Upon determining no contraband was stored on that hard drive, he authorized the return of her laptop to the Cottermans.

As he examined the two hard drives imaged from the defendant’s laptop that same evening, he discovered approximately 75 depictions of child pornography stored in unallocated space.8 He had not yet been able to crack the passwords on the protected files.

That same evening, the forensic examiner called the Cottermans and told them the camera and one of the laptops was available to be picked up the next morning, but he said he could use help with opening the protected files. The defendant agreed to assist the examiner the next day.

The wife arrived at the Tucson ICE office the following morning to secure possession of the returned items. When asked about her husband, she said he had business to which to attend. One of the agents reached the defendant by phone, who said the laptop was shared by several of his coworkers, and he was in the process of acquiring some of the passwords from them.

The following day, the ICE agents handling the investigation were informed by an agent from the ICE Pacific Field Intelligence Unit that the defendant had flown to Mexico from Tucson the previous day, and his ultimate destination was Sydney, Australia.

The next day the forensic examiner was finally able to defeat several of the passwords on the defendant’s laptop, leading to the discovery of approximately 378 depictions of child pornography. About 360 of these appeared to be images of the same child, apparently over a two-year period, her age varying between seven to 10 years old. In many of these, the defendant was molesting the child.

The defendant was ultimately extradited from Australia, with the forensic officer discovering stored on the defendant’s laptop hundreds of videos, stories, and depictions of other children in pornographic situations in the months leading to the defendant’s return to America. The agent ultimately was able to determine the identity of the female the defendant molested, and she was interviewed.

District Court Decision

Before the district court, Cotterman sought suppression of the contents of his laptop as a "non-routine" warrantless border search, which requires, at least, reasonable suspicion, which he argued did not exist here.

The district court agreed,9 finding that the previous federal decisions authorizing a warrantless border search of a computer absent any evidence of reasonable suspicion were all performed "at the border inspection station or the international airport and within a matter of hours." The court even noted that the search could have been conducted at the border station, maybe not to the convenience of law enforcement, if the Tucson forensic examiner had brought his laptop to Lukeville to perform the inspection.

Here, however, the removal of the laptops to a location 170 miles away for a search that produced results two days after the defendant initially attempted to cross the border, was too far removed to be considered a true border search. To justify such a search, "the law requires the Government to have reasonable suspicion before extending the search both in distance and time away from the border."

The court also ruled reasonable suspicion was lacking, claiming only two pieces of pertinent evidence existed to consider. The first, the conviction of child molestation from 15 years ago, did not "alone establish reasonable suspicion," without the court saying why not. The second, the password-protecting of files, while not sufficient by itself to establish reasonable suspicion, coupled with other evidence might support such a finding if the agents had not already decided to seize and transport the laptops, consistent with ICE written policy, before even arriving at the Lukeville station.

Initial Ninth Circuit Decision

The government appealed before a three-judge panel of the Ninth Circuit, which reversed the district court’s suppression in a 2-1 opinion, finding the search valid without even requiring the presence of reasonable suspicion.10

The majority began its opinion by affirmatively asserting that "the sovereign need not make any special showing to justify its search of persons and property at the international border."11 Quoting United States v. Ramsey, 431 U.S. 606, 616 (1977), the majority noted:

[S]earches made at the border, pursuant to the long-standing right of the sovereign to protect itself by stopping and examining persons and property crossing into this country, are reasonable simply by virtue of the fact that they occur at the border.12

The majority used this long-standing principle to establish that at the moment the Cottermans reached the border, they had no reason to believe they or their property had yet been permitted to enter the country. The mere denial of the return of their digital property until it had a chance to be fully inspected, even if that inspection were to occur at a time and distance removed from their attempted entry, infringed on none of their rights since the sovereign had not yet invited that property into the country.

There was also a practical side to this. To rule otherwise would require "the Government [to] staff every [Point of Entry] with the equipment and personnel needed to fully search all incoming property or otherwise be forced to blindly shut its eyes and hope for the best absent some particularized suspicion."13

The majority went on to note that the U.S. Supreme Court has required reasonable suspicion to be established for a permissible warrantless border search in only three scenarios, none of which were present in the defendant’s situation: (1) where there was a "highly intrusive" search of the person;14 (2) where the search for property is destructive;15 or (3) the manner in which the search was conducted was so offensive as to be unreasonable.16

Ninth Circuit En Banc Decision

The defendant then sought and was granted en banc review of the three-judge panel decision of the Ninth Circuit, which led to the opinion issued last month mentioned supra. Finding that the agents did not require any reasons to justify the limited search of the devices conducted at the Lukeville station, the majority of the court ruled that reasonable suspicion had to be present to do the more thorough examination regardless of whether it occurred at the border crossing or in Tucson.

Noting the massive amount of personal data capable of being stored in today’s laptops, the majority opined that, "[a] person’s digital life ought not be hijacked simply by crossing a border,"17 equating a forensic examination to the reading of a person’s diary "line by line."18

Nevertheless, the majority was able to justify the detailed forensic examination performed in Tucson due to the presence of reasonable suspicion based on several factors: the prior conviction for child molestation; the password protection afforded numerous computer files; the defendant’s frequent trips to a location known for sex tourism; and the expertise of the agents in rejecting defendant’s offer to help access the protected files out of a legitimate fear he might further hide or destroy evidence since those who possess child pornography typically do not act in a way to assist law enforcement seeking to discover such evidence.

While concurring in the final judgment of the majority, Judge Conseulo Callahan conveyed insightful comments in her partial dissent to the majority’s creation of a fourth category of border searches requiring the presence of reasonable suspicion for a warrantless search to occur.

Noting that by rejecting 125 years of the Supreme Court’s recognition of unfettered warrantless border searches, "the majority ignores that reality by erecting a new rule requiring reasonable suspicion for any thorough search of electronic devices entering the United States…and will severely hamstring the government’s ability to protect our borders."

Knowing the expertise required of today’s forensic examiners in understanding all kinds of varied and advanced digital devices, along with the enormous amount of necessary hardware and software they must possess to properly examine them in a complete and evidentiary manner, Callahan appears to have cut through much of the legal rhetoric and sees the forensic world as it really is, not the way her colleagues would want it to be in a theoretically perfect world.

Stephen Treglia, a former Nassau County prosecutor who headed the office’s computer crime unit, is legal counsel at Absolute Software Corporation, which makes tracking software for stolen computers and mobile digital devices.

Endnotes:

1. Olmstead v. United States, 277 U.S. 438 (1928).

2. Katz v. United States, 389 U.S. 347 (1967).

3. Goldman v. United States, 316 U.S. 129 (1942).

4. In re Grand Jury Subpoena Duces Tecum Dated May 9, 1990, 741 F. Supp. 1059 (S.D.N.Y. 1990).

5. United States v. Knotts, 460 U.S. 276 (1983)

6. People v. Weaver, 12 N.Y.3d 433 (2009); State v. Jackson, 150 Wash.2d 251 (Supr.Ct. 2003); State v. Campbell, 306 Or. 157 (Supr. Ct. 1988), and see the separate concurring opinions of Justices Samuel Alito and Sonia Sotomayor in United States v. Jones, 132 S.Ct. 945 (2012).

7. United States v. Lineraz-Delgato, 259 Fed. Appx.506 (3d Cir. 2007); United States v. Irving, 432 F.3d 401 (2d Cir. 2005); United States v. Ickes, 393 F.3d 501 (4th Cir. 2005); United States v. Hampe, 2007 WL 1192365 (D.Me. 2007).

8. "Unallocated space" consists of areas of digital storage media, such as hard drives, discs, USB drives, etc., that is currently "available" for the storage of data. Unallocated space can include areas of the storage media that currently contains no data, but it can also include areas where data had once been stored but was subsequently "deleted." Data so deleted is not immediately "erased," but those areas of the storage media are now designated as "available" for overwriting with new data being stored at some point in the future. This is one of the ways that forensic investigators can "discover" data that had been previously "deleted" on digital storage media.

9. United States v. Cotterman, 2009 WL 465028 (D.Ariz. 2009).

10. 637 F.3d 1068 (9th Cir. 2011).

11. Id. at 1074, citing United States v. Flores-Montano, 541 U.S. 149 (2004).

12. Id. at 1075.

13. Id. at 1077.

14. Flores-Montano, 541 U.S. at 152.

15. Id. at 155-56.

16. Ramsey, 431 U.S. at 618 n.13.

17. 709 F.3d at 965.

18. Id. at 962.