On Wednesday, the Ninth Circuit released a new decision regarding the limits of the plain view doctrine when searching electronic data.

The facts behind United States v. Comprehensive Drug Testing, Inc. [PDF] are fairly straightforward: government agents, seeking to verify the identities of ten major league baseball players who had reportedly tested positive for steroid use, subpoenaed the records of the drug testing company to obtain all “drug testing records and specimens” pertaining to major league baseball. When the testing company and the player’s union sought to quash the subpoena, the government obtained a warrant limited to records of the ten players for whom the government had probable cause. Upon seizing the test company’s electronic records, the government examined the records of those ten players — and hundreds of other records that were “in plain sight” on the computer media taken pursuant to the warrant.  The government then used this information to seek more warrants and to issue additional subpoenas.

A district court judge ordered the government to return the property seized pursuant to the original warrant. Another district court judge ordered the government to return all the property seized based on the subsequent warrant, with the exception of the material relating to the originally-named ten players. Yet another district court judge quashed the subpoenas based on results from the original search. The government appealed all three decisions.

Portions of the Ninth Circuit decision turn on the timing of the lower court decisions and the government’s appeals, as well as the interplay of various federal rules of criminal procedure that have little or no application to military justice actions. The intriguing parts of the decision come later, when the court concluded the government’s assertion of plain view was overbroad: “The government agents were obviously counting on the search to bring constitutionally protected data into the plain view of the investigating agents … This was an obvious case of deliberate overreaching by the government in an effort to seize data as to which it lacked probable cause.”

To avoid such overreach in the future, the court went on, “the warrant application should normally include, or the issuing judicial officer should insert, a protocol for preventing agents involved in the investigation from examining or retaining any data other than that for which probable cause is shown.” The court concluded that the separation of “seizable data (as defined by the warrant) from all other data” should be conducted by government employees or third parties “not involved in the investigation,” lest “every warrant for electronic information [] become, in effect, a general warrant, rendering the Fourth Amendment irrelevant.”

The court set forth the following guidelines: magistrates should insist the government waive the plain view doctrine “in digital evidence cases”; segregation and redaction of data must essentially be done behind a Chinese wall, shielded from view of the investigators; the government must use search protocols designed to uncover only information for which there is probable cause, and only that information can be reviewed by the case agents; and the government must destroy or return non-responsive data and inform the magistrate what was returned and what was kept. In addition, the government must disclose actual risks of destruction of the data, as well as prior efforts to seize that data … a requirement plainly intended to keep the government from forum-shopping, as it apparently did here, with impunity.

For those who disagree with the scope of the ruling, this case will be a poster-child for the adage that “bad facts make bad law” — the government’s conduct here appears to have been just a little too cute for the court to stomach. Whether that’s true or not, as the circuit court for Silicon Valley, the Ninth Circuit’s impact on legal issues relating to computers can be pervasive, and this decision promises to be no exception.

17 Responses to “Ninth Circuit decision limits “plain view” in electronic searches”

  1. Anonymous says:

    short of a file marked “possible criminal evidence” on the desktop (e.g child porn or stolen data or history of steroid use) I am not sure how plain view applies to data since you have to manipulate the data before it becomes “plain view.”

  2. Christopher Mathews says:

    Anon @ 1916: the court raised almost exactly the same point. “There is no way to be sure exactly what an electronic file contains without somehow examining its contents — either by opening it and looking, using specialized forensic software, keyword searching or some other such technique.” Allowing the government to examine each file for seizable material could then be said to place each file in “plain view,” an outcome the court rejected.

  3. John O'Connor says:

    When CAAF decided Scheffer, my advice was to wait it out, the law was highly likely to change. Here, I’d be surprised if the military courts adopt the Ninth Circuit’s analysis during the shoert period of time I expect this to be the law in the Ninth Circuit.

  4. Christopher Mathews says:

    Until the case reaches the Supreme Court, I wouldn’t expect many changes — it was a 9-2 decision on the Fourth Amendment issues.

  5. Anonymous says:

    You really think J. Kennedy is going to say that this is ok?

    I know he often sides with the conservatives but this seems a bit far, even J. Scalia might look at this askew.
    I don’t see what the argument would be for why this is a “plain view” search when you have to manipulate the data 98% of the time to view it.

    Again, if it were a file labeled, “look at me I have child porn inside,” maybe that is plain view or if the desktop picture is of something similar, but other than that, if you have to click on something to see the data it aint plain view.

  6. John O'Connor says:

    Oh, I don’t think the Ninth Circuit is going to change Ninth Circuit law. To me, it’s just a matter of whether the government seeks cert on this one or waits for better facts (which it can get pretty much every day of the week by applying for a search warrant for a computer and refusing to waive plain view).

  7. Anonymous says:

    so what is the cogent argument for why this would be plain view? What facts would there be that would make the argument in a different case?

  8. John O'Connor says:

    Because once the government opens a file to see if it has what they are looking for, whatever is on the file is in plain view. They’re not asking to look at the outside of a computer, but to look at the files inside to see if they can find what they are looking for.

  9. Anonymous says:

    but one assumes they are not looking at the entire computer but for a specific subset.

    If it is porn then you’d think they are looking only for picture files for example so they have no need to open any other type of files, but only .jpg or other image files. There would be no need to open up non-image files.

    You eviscerate the fourth amendment if you say we can start looking for porn for example but we can look at the entire computer and go on a crime fishing expedition and charge you for whatever we find.

    That isn’t “plain view” and allowing it would mean that government agents would search every single file, even those not likely to contain anything pertaining to the probable cause based search and then declare anything found as being in “plain view.”

    I think Kennedy being the swing vote, he isn’t likely to bite off on the government’s argument without some limitations but we will see in a couple of years.

  10. John O'Connor says:

    Anon 2343:

    Imagine they suspect someone of having child porn. You’re right that a magistrate might legitimately restrict the search to video files. But what if they open a video file and find the defendant performing in an adult-only snuff film. Not the crime the defendant was suspected of, but evidence of a crime in plain view. The Ninth Circuit apparently would require that this evieence simply be destroyed and not used to prosecute. Just like the search of a premises, the cops can only look where they the evidence reasonably might be located. But just as the cops can seize whatever evidence of a crime they find when looking where the items they seek might be located, I feel confident the Supreme Court will hold that the police, if they open a file that could conain the subjct of their warrant, are allowed to keep any other evidence o a crime they might come across.

  11. Anonymous says:

    J O’C: “the Supreme Court will hold that the police, if they open a file that could conain the subjct of their warrant, are allowed to keep any other evidence o a crime they might come across.”

    The problem, as I read the opinion, is that any file could contain evidence that is the subject of the warrant — an image file doesn’t have to have a .JPG extension, and a document doesn’t have to have a name ending in .DOC. You can name the file anything you want, or embed one kind of file in another, or encrypt them, or compress them, and so on.

    The only way to be sure the storage media does not contain the kind information you’re searching for is to open and examine all the files … at which point any warrant to search for electronic data is effectively a general warrant as to all the contents of the media to be searched.

  12. John O'Connor says:

    Well, if a piece of evidence can be found in literally any place in a house (say, microfilm for a suspected spy), then you can search the entire house . . . and keep and use whatever you find.

  13. Anonymous says:

    But dont we have caselaw that says if you are looking for a gun you cant look in a place a gun cant fit?

    What’s the point of a particularized place in a search warrant anymore if this is the analysis? What’s the poitn of requiring probable cause for a specific offense anymore?

    Just say we wanna find stuff, somewhere on his computer, because that is effectively what you are doing, legal gymnastics aside.

  14. John O'Connor says:

    But the point is, if the stuff can fit in any file on the computer, then conventional 4th Amendment law lets you look in those places. If there are types of files that can’t contain the type of evidence for which you are searching, then this would be the analogy to the container into which the gun won’t fit.

  15. Anon says:

    I’m no defense hack or anything, but I agree that the Feds sure seem to be going overboard on this case….I doubt that the court would have issued such a reasonable opinion if instead of being all American baseball players it was a big cocaine trafficker’s computer they had seized and found child porn along with drug records.

  16. Anonymous says:

    there is too much technology available today to be able to target exactly what you need with a forensic search. There is absolutely no reason for cops to sit around and poke around and open up the files one at a time just looking.

    So this is not analogous to searching a house IMO because with the computer forensic tech we have a very targeted search can be done with relative ease.

    We might as well then again say that there is no need for a search warrant of any specificity for computers. Because the practical result is, they are looking for anything, anywhere on your computer.

    The interesting thing is, if the search warrant was for in the house for a gun or something tangible then they COULDN’T look in the computer.

    So here’s a question if we are going to allow the computer to be searched like this, can they also look anywhere in the place where the computer is located for other computers or computer like devices?

    I mean many computing devices now can be handheld, so they can look anywhere right? Which means plain view. So ostensibly, a search for child porn on a computer in the residence could turn up drugs, guns, weapons, or anything else anywhere in the house.

    That doesn’t seem like the 4th amendment is fairly superfluous to anyone?

  17. Anonymous says:

    A computer is nothing more than an electronic file cabinet. If we have the authority to search for something that could be located in a file cabinet, such as a receipt, we have the authority to look through every file folder and piece of paper in the file cabinet. Do we have to restrict our search to the drawers labeled “my illegal receipts” or can we assume that people engaged in criminal activity may (oh my!) hide their activity and/or mislabel files or drawers to conceal their true content.

    Since a file can be renamed to anything, including an extension, all files have to be ‘searched’ to some extent.

    Also images can be saved inside of Word Documents and PDF documents so limiting a search to just file extensions common to images such as .jpg doesn’t work.

    Video files can be embedded in power points, so now those have to be viewed to make sure they don’t contain illegal video files.

    Forensic software such as Encase or FTK can only do so much but child predators are just as computer savvy and are getting better at their craft as is everyone else.

    If you read the decision, the facts of the case in question dealt with agents looking at a SPREADSHEET and moving past the original names and expanding their search to other names.

    In fact, there was NOTHING to do with Child Pornography anywhere in this case, other than the Magistrate who was writing the opinion and his issues with obscene materials, which raises an entirely different question of why he was writing this.

    Finally, if I’m authorized to look for indicia of residence such as a driver license, utility bill, etc in a residence…those items can be stored in fairly small, compact areas. In fact, they can sometimes be found laying on the floor, behind beds, in drawers, trash cans, etc. That allows me search most of, if not including all of a house.

    I’ve been legally authorized to search for these items by a judge or magistrate.

    Are we going to restrict how houses are searched now too? Let’s say that if you’re searching a house for evidence of a rape, you can only look in living rooms, kitchens, and bathrooms but not bedrooms.

    This is the same logic that is being applied to computer searches now.