workplace, however, suggest that an employee's expectation of privacy > must be reduced to the degree that fellow employees, supervisors, > subordinates, guests, and even the general public may have access to that >0 individual's work space. Recognizing that government agencies could not >@ function properly if supervisors had to establish probable cause and >P obtain a warrant whenever they needed to look for a file in an employee's >` office, the Supreme Court held that two kinds of searches are exempt. >p Specifically, both (1) a noninvestigatory, workrelated intrusion and > (2) an investigatory search for evidence of suspected workrelated > employee misfeasance are permissible without a warrant and should be > judged by the standard of reasonableness. Id. at 7256. > > [page 19] > > Even so, the court made clear that "[n]ot everything that passes through > the confines of the business address can be considered part of the ? workplace context...." Id. at 717. For example, the contents of an ? employee's purse, briefcase, or closed luggage do not lose their private ? character just because the employee has brought them to work. Thus, while ?0 the circumstances may permit a supervisor to search in an employee's desk ?@ for a workrelated file, the supervisor usually will have to stop at the ?P employee's gym bag or briefcase. This analysis may have interesting ?` implications for "containers" like floppy disks, which certainly may be ?p either workrelated or private, depending on the circumstances. It will ? probably be reasonable for employers to assume that floppy disks found at ? an office are part of the workplace, but there may be cases where a court ? will treat a floppy disk as if it were a personal container of private ? items. ? ? Of course, there may be some government agencies where employees do ? consent (either expressly or tacitly) to searches of even private parcels F ? ? p ( @ H Fbecause of the nature of the job. For example, employees with security @ clearances who work with classified material may expect that their @ purses, briefcases, and other bags may be inspected under certain @0 circumstances. The factual variations on this "reasonable expectation" @@ theme are endless, and are tied absolutely to the details of each case. @P @` The O'Connor Court did not address the appropriate standard to be applied @p when a government employee is being investigated for criminal misconduct @ or breaches of other nonworkrelated statutory or regulatory standards. @ Id. at 729. In a case involving employee drug testing, at least one court @ has noted, in dicta, that "[t]he government may not take advantage of any @ arguably relaxed `employer' standard for warrantless searches....when its @ true purpose is to obtain evidence of criminal activity without complying @ with the more stringent standards that normally protect citizens against @ unreasonably intrusive evidencegathering." National Federation of @ Federal Employees v. Weinberger, 818 F.2d 935, 943 n.12 (D.C. Cir. 1987). A Therefore, it would appear that whenever law enforcement is conducting an A evidencegathering search, even if the search is to take place at a A government office, agents must either obtain a warrant or fall within A0 some generally recognized exception to the warrant requirement. A@ Appropriate consent from a third party is, of course, one of those AP exceptions. A` Ap Generally speaking, an employer (government or private) may consent to a A search of an employee's computer and peripherals if the employer has A A [page 20] A A common authority over them. Agents and prosecutors must consider whether, A under the facts, the employee would expect privacy in those items and A whether that expectation would be objectively reasonable. Relevant A factors include whether (1) the area/item to be searched has been set B aside for the employee's exclusive or personal use (e.g., does the B employee have the only key to the computer or do others have access to B the data); (2) the employee has been given permission to store personal B0 information on the system or in the area to be searched; (3) the employee B@ has been advised that the system may be accessed or looked at by others; BP (4) there have been past inspections of the area/item and this fact is B` known to the employee; and (5) there is an employment policy that Bp searches of the work area may be conducted at any time for any reason. F B B p ( B H FAnd when the employer is the federal government, another factor is (6) B whether the purpose of the search was workrelated, rather than primarily B for law enforcement objectives. See generally O'Connor, 480 U.S. at 717 B (employee's expectation of privacy must be assessed in the context of the B employment relationship). B B There are currently no cases specifically addressing an employer's C consent to search and seize an employee's computer (and related items). C But there are cases that discuss searches of an employee's designated C work area or desk. For example, the Seventh Circuit has upheld the search C0 of a hotel room that served as a welfare hotel's business office after C@ the hotel owner consented. United States v. Bilanzich, 771 F.2d 292 (7th CP Cir. 1985). The room searched was used by the defendant/manager of the C` hotel for hotel business, the hotel's books were stored there, and the Cp room was also used by doctors and welfare officials when they visited C residents. The manager kept the key to the room. In affirming the C manager's theft and forgery convictions (based in large part on documents ! C seized from the business office/hotel room), the Seventh Circuit found ! " C that the hotel owner had the requisite control over and relationship to " # C the business office to consent to its search. The court rejected the # $ C manager's argument that she had sole control over the business office $ % C because she generally had the key, finding that the owner could request % & C access to the room at any time, that the room was shared with others & ' D (visiting physicians and welfare officials), and that the items sought ' ( D were business records (e.g., welfare checks that the manager had forged). ( ) D Thus, the manager did not have exclusive control over the area nor was it ) * D0 for her personal use. In addition, the purpose of the search was * + D@ "employment related," since the manager was defrauding the employer and + , DP the customers. , - D` - . Dp [page 21] . / D / 0 D In United States v. Gargiso, 456 F.2d 584, 587 (2d Cir. 1972), the Second 0 1 D Circuit upheld the search of a locked, wiredoff area in the basement of 1 2 D a book company a search to which the highest official of the book 2 3 D company then on the scene (the company's vice president) had consented. 3 4 D The defendant, an employee of the book company, objected to the search. 4 5 D Both the defendant and the vice president had supervisory authority over 5 6 D the area searched, and both also had keys to the area, as did other 6 7 E company personnel. The court found that the vice president's control over F7 8 E E p (8 E H Fthe area was equal to that of the employee's, making the consent 8 9 E0 effective. The vice president had sufficient control over the area to 9 : E@ permit inspection in his own right and the employee had assumed the risk : ; EP that the vice president would do so. ; < E` < = Ep In Donovan v. A.A. Beiro Construction Co.. Inc., 746 F.2d 894, 900 (D.C. = > E Cir. 1984), the D.C. Circuit found the D.C. Government's consent to a > ? E search conducted by OSHA inspectors of a D.C. construction site effective ? @ E against one of the contractors. The site was a large, multiemployer area @ A E surrounded by a chain link fence with no interior fences separating the A B E various contractors' work areas. There was considerable overlap and B C E interaction among the various contractors and their employees. The Court C D E found that the defendant/contractor had no reasonable expectation of D E E privacy in the area searched, because it was a common construction site E F F shared by many. Thus, the defendant/contractor had assumed the risk that F G F anyone with authority at the site would permit inspection of the common G H F construction area. H I F0 I J F@ In an earlier case, United States v. Blok, 188 F.2d 1019 (D.C. Cir. J K FP 1951), the D.C. Circuit affirmed the reversal of a petty larceny K L F` conviction of a government employee, finding that the search of the L M Fp employee's desk violated the employee's right of privacy. The court found M N F that the employee had exclusive use of the desk and a reasonable N O F expectation of privacy in it. Her employer's consent to a police search O P F of the desk did not make the search reasonable. There was no policy P Q F putting employees on notice that they should not expect privacy in their Q R F desks. Nor was the search conducted by the employer for employment R S F purposes (e.g., searching for a file). "It was precisely the kind of S T F search by policemen for evidence of a crime against which the T U F constitutional prohibition was directed." Id. at 1021 (quoting the U V G district court). Thus, the employer's consent was ineffective because the V W G area searched was for the employee's exclusive and personal use (factor W X G number 1 above); the X Y G0 Y Z G@ [page 22] Z [ GP [ \ G` purpose of the search was not workrelated (factor number 6 above); and \ ] Gp there was no policy putting the employee on notice that her desk might be ] ^ G subject to search (factors number 3 and 5 above). Significantly, the ^ _ G O'Connor Court cited Blok with approval. O'Connor, 480 U.S. at 719. F_ ` G G p (` G H Fܿ ` a G e. Networks: System Administrators a b G b c G Case law demonstrates that the courts will examine the totality of the c d G circumstances in determining whether an employee has a reasonable d e H expectation of privacy or whether an employer shares authority over the e f H employee's space and can consent to a search. But applying this f g H employerconsent case law to computer searches can become especially g h H0 troublesome when the employee's computer is not a standalone container, h i H@ but an account on a large network server. The difficulty is a practical i j HP one. In the physical world, individuals often intuitively understand j k H` their rights to control physical space and to restrict access by others k l Hp because they can observe how everyone uses the space. For example, with l m H filing cabinets, employees can see whether they are located in private m n H areas, whether others have access, whether the cabinets are locked, and n o H who has the keys. While explicit company policies certainly help to o p H clarify the situation, employees can physically observe company practices p q H and will probably conclude from their observations that certain property q r H is or is not private. r s H s t H By contrast, in an electronic environment, employees cannot "see" when a t u I network administrator, supervisor, or anyone else accesses their data. u v I They cannot watch the way people behave with data, as they can with a v w I file cabinet, and deduce from their observations the measure of privacy w x I0 they ought to expect. As a practical matter, system administrators can, x y I@ and sometimes do, look at data. But when they do, they leave no physical y z IP clues which would tell a user they have opened one of his files. Lacking z { I` these physical clues, some users who are unfamiliar with computer { | Ip technology may falsely but honestly believe that their data is completely | } I private. Will the courts hold this false belief to be one that society is } ~ I prepared to recognize as reasonable? Will the courts still find it ~ I reasonable, even when a user knows that there are such people as system I administrators who are responsible in some fashion for operating and I securing the entire network? If so, do users who actually understand the I technology and the scope of a system operator's access to data I I J [page 23] have a lesser expectation of privacy and fewer Fourth Amendment J protections than users who are not so well informed? And what happens in J the years ahead as our population becomes increasingly computer literate? F J0 J0 p ( J@ H F Of course, these search and seizure questions are not limited to JP computer networks in the workplace. Universities, libraries, and other J` organizations, both public and private, may operate computer networks on Jp which users store data which they consider privateeither partly or J completely. If those networks provide services to the public, they will J be controlled by the provisions of 18 U.S.C. 2702, which limits the J situations in which a service provider may release the contents of J qualifying electronic mail. (For a detailed discussion of this statute, J see "STORED ELECTRONIC COMMUNICATIONS," infra p. 85.) But for material J which falls outside this statute, the Fourth Amendment analysis discussed J above will still apply. J Prosecutors who face these issues at trial should be ready to argue that K reasonable network users do, indeed, understand the role and power of K system operators well enough to expect them to be able to protect and K even restore their files. Therefore, absent some guarantees to the K0 contrary, reasonable users will also expect system administrators to be K@ able to access all data on the system. Certainly, if the system has KP published clear policies about privacy on the network or has even K` explained to users that its network administrators have oversight Kp responsibility and control, this will support the position that a system K operator's consent to a search was valid. But if the network and its K users have not addressed these issues and the situation is ambiguous, the K safest course will be to get a warrant. (Of course, if the system K administrator does have authority to access and produce a user's files K and simply will not do it on request, agents should use a subpoena.) K If agents choose to apply for a warrant and are concerned that a K target/user will delete his data before they can execute the search, the K agents should consider asking a cooperating system operator to make and L keep a backup of the target's data, which they can later procure under L the warrant or subpoena. The circumstances of each case will dictate the L wisest approach, but agents and prosecutors should explore all these L0 questions before they just ask a system administrator to produce a user's L@ files. [page 24] LP L` F. INFORMANTS AND UNDERCOVER AGENTS Lp As in other types of investigations, it is often helpful to use L informants or undercover agents to develop evidence. In some cases, of L course, they may be of limited value (e.g., a case involving a lone L hacker). Additionally, as a matter of policy, there may be restrictions L on the type of undercover activities in which agents may engage. For F L L p ( L H Fexample, the FBI does not access bulletin boards simply to view board L activities when there is no reason to believe the board is involved in L criminal activity. M Generally speaking, however, the law allows informers to read material M on electronic bulletin boards if they have the sysop's permission, M explicit or implicit, to access the material on the board. Many BBSs, for M0 example, have parts of the board which are open to the public and which M@ require no password or identification for access. Other boards may have MP isolated directories, known as subboards, that are open only to paying M` subscribers or trusted members, and those individuals must identify Mp themselves with passwords. Some sysops will ask newcomers to "introduce" M themselves and will verify the new user's name, address, and other M information before granting access with a password. These introductions M should follow the same rules that undercover work has traditionally M observed. Law enforcement agents need not identify themselves as such, M but they must confine their activities to those that are authorized: they M should not break into sections of the board for which they have not been M given access. Indeed, the Ninth and Tenth Circuits have both written, in M dicta, that an undercover participant must adhere scrupulously to the N scope of a defendant's invitation to join the organization. United States N v. Aguilar, 883 F.2d 662, 705 (9th Cir. 1989), cert. denied, 498 U.S. N 1046 (1991); Pleasant v. Lovell, 876 F.2d 787, 803 (10th Cir. 1989). N0 Thus, an informant or undercover agent must not exceed his authorized N@ access, and having been granted access to some "levels" of the board does NP not give him permission to break into others. N` Np [page 25] N N III. SEIZING HARDWARE N Depending on the facts of the case, the seizure of computer hardware N itself can be justified on one of three theories without regard to the N data it contains: (1) the hardware is itself contraband; (2) the hardware N was an instrumentality of the offense; or (3) the hardware constitutes N evidence of an offense. Of course, in many cases, hardware may be N seizable under more than one theory. For example, if a hacker uses his O computer to insert viruses into other systems, his computer may O constitute both an instrumentality of the offense and evidence admissible O in court. O0 As noted above under Definitions, (supra p. 2), hardware is defined as O@ the physical components of a computer system such as the central F OP OP p ( O` H Fprocessing unit (CPU), keyboard, monitor, modem, and printer. Op O A. THE INDEPENDENT COMPONENT DOCTRINE O We must highlight once again that computer systems are really a O combination of connected components (often by wire but increasingly by O wireless means). To say that the government has probable cause to seize a O "computer" does not necessarily mean it has probable cause to seize the O entire computer system (i.e., the computer and all connected peripheral O devices). Indeed, each component in a computer system should be O considered independently. P In a strictly corporeal world, this doctrine is easy to understand and P apply. For example, suppose a defendant stole a television and placed it P on a television stand that he lawfully owned. Agents with a warrant for P0 that television would not seize the stand, recognizing that the two items P@ are easily separable and that there is, simply put, no justification for PP taking the stand. P` With computers, the roles of the different attached components are not Pp always separable and it is more difficult to think in such concrete P terms. For example, agents with a warrant to seize a target's workstation P may discover that the workstation is nothing more than a dumb terminal, P and that all the evidence is in the server to which the dumb terminal is P connected by wire. P P [page 26] P P Nonetheless, it is simply unacceptable to suggest that any item Q connected to the target device is automatically seizable. In an era of Q increased networking, this kind of approach can lead to absurd results. Q In a networked environment, the computer that contains the relevant Q0 evidence may be connected to hundreds of computers in a localarea Q@ network (LAN) spread throughout a floor, building, or university campus. QP That LAN may also be connected to a globalarea network (GAN) such as the Q` Internet. Taken to its logical extreme, the "take it because it's Qp connected" theory means that in any given case, thousands of machines Q around the world can be seized because the target machine shares the Q Internet. Q Obviously, this is not the proper approach. The better view is to seize Q only those pieces of equipment necessary for basic input/output (i.e., Q the computer itself, plus the keyboard and monitor) so that the Q government can successfully execute the warrant. When agents prepare F Q Q p ( Q H Fwarrants for other devices, they should list only those components for R which they can articulate an independent basis for search or seizure R (i.e., the component itself is contraband, an instrumentality, or R evidence). Certainly, the independent component doctrine does not mean R0 that connected devices are exempt; it only requires that agents and R@ prosecutors articulate a reason for taking the item they wish to seize. RP For example, if the defendant has sent letters to the White House R` threatening the President's life, agents should explain, as a basis for Rp seizing the target's printer, the need to compare its type with the R letter. Additionally, there may be other times when the government should R seize peripherals that do not contain evidence but, again, there must be R a separate basis for the seizure. See, e.g., "Seizing Hardware and R Documentation so the System Will Operate at the Lab," infra p. 62. R R B. HARDWARE AS CONTRABAND OR FRUITS OF CRIME R Federal Rule of Criminal Procedure 41(b)(2) authorizes warrants to seize R "contraband, the fruits of crime, or things otherwise criminally S possessed." The rationale behind such seizures is to prevent and deter S crime. See Warden v. Hayden, 387 U.S. 294, 306 n.11 (1967). Often the S fruits of crime and S0 S@ [page 27] SP S` objects illegally possessed will also constitute evidence of a crime, so Sp that they also can be seized to help apprehend and convict criminals (see S infra p. 30). S S 2. Contraband and Fruits of Crime Defined The fruits of crime include S property obtained by criminal activity, United States v. Santarsiero, 566 S F. Supp. 536 (S.D.N.Y. 1983) (cash and jewelry obtained by use of a S counterfeit credit card), and contraband is property which the private S citizen is not permitted to possess, Warden v. Hayden, supra; Aguilar v. S Texas, 378 U.S. 108 (1964) (narcotics). Even plans to commit a crime may ! T constitute contraband. Yancey v. Jenkins, 638 F. Supp. 340 (N.D. Ill. ! " T 1986). " # T Of course, many objects which are fruits of crime or illegally possessed # $ T0 are innocent in themselves and can be possessed by at least certain $ % T@ persons under certain conditions. See, e.g. United States v. Truitt, 521 % & TP F.2d 1174, 1177 (6th Cir. 1975) (noting that a person legally can possess & ' T` a sawedoff shotgun if it is properly registered to its owner, though its F' ( Tp Tp p (( ! ! T H Flawful possession is rare). A court reviewing a seizure under Rule ( ) T 41(b)(2) will examine whether the circumstances would have led a ) * T reasonably cautious agent to believe that the object was a fruit of crime * + T or was illegally possessed. For example, the seizure of jewelry as a + , T fruit of crime in Santarsiero was upheld because a reliable informant had , - T told officers that the suspect had boasted of using counterfeit credit - . T cards to purchase jewelry. 566 F. Supp. at 54445. . / T Certainly, there are instances where computer hardware and software are / 0 U contraband or a fruit of crime. For example, there have been several 0 1 U recent cases involving the theft of computer equipment. Additionally, 1 2 U hackers have been known to penetrate credit reporting companies, 2 3 U0 illegally obtain credit card numbers, and then order computer equipment 3 4 U@ with these illegal access devices. In such cases, the equipment that they 4 5 UP receive is a product of the fraud and should be seized as such. 5 6 U` 6 7 Up [page 28] 7 8 U 8 9 U C. HARDWARE AS AN INSTRUMENTALITY OF THE OFFENSE 9 : U : ; U 1. Authority for Seizing Instrumentalities ; < U Federal Rule of Criminal Procedure 41(b)(3) authorizes warrants to seize < = U the instrumentalities of crime; that is, "property designed or intended = > U for use or which is or has been used as the means of committing a > ? U criminal offense." The historical justification for the government's ? @ V ability to seize instrumentalities of crime is the prevention of their @ A V use to commit future crimes. See Warden v. Hayden, 387 U.S. 294, 306 n.11 A B V (1967); United States v. Boyette, 299 F.2d 92, 98 (4th Cir.) (Sobeloff, B C V0 C.J., dissenting), cert. denied, 369 U.S. 844 (1962). C D V@ D E VP 2. Instrumentalities Defined E F V` An instrumentality of an offense is any machinery, weapon, instrument, F G Vp or other tangible object that has played a significant role in a crime. G H V See, e.g., United States v. Viera, 569 F. Supp. 1419, 1428 (S.D.N.Y. H I V 1983) (sophisticated scale used in narcotics trafficking and black light I J V used in counterfeiting currency). Where the object itself is innocent in J K V character, courts will assess its role in the crime to determine whether K L V it was an instrumentality. Compare United States v. Markis, 352 F.2d 860, L M V 86465 (2d Cir. 1965) (telephone used to take bets by operators of M N V illegal wagering business was an instrumentality because it was integral N O V to the criminal enterprise), vacated without opinion, 387 U.S. 425 FO P W W p (P " " W H F(1967), with United States v. Stern, 225 F. Supp. 187, 192 (S.D.N.Y. P Q W 1964) (Rolodex file was not instrumentality where it contained names of Q R W0 individuals involved in tax fraud scheme). As stated by the Southern R S W@ District of New York: S T WP T U W` Not every article that plays some part in the commission of the alleged U V Wp crime is a means of committing it. .... Although it is not necessary V W W that the crime alleged could not have been committed but for the use of W X W the article seized, after a consideration of all the circumstances it X Y W must appear that the article played a significant role in the commission Y Z W of the crime alleged. Z [ W [ \ W [page 29] \ ] W ] ^ W Stern, 225 F. Supp. at 192 (emphasis in original). ^ _ X Before the Supreme Court's decision in Warden v. Hayden, 387 U.S. 294 _ ` X (1967), courts held that seizable property included instrumentalities, ` a X but did not include mere evidence. See generally 3 Wright & Miller, a b X0 Federal Practice and Procedure: Criminal 2d 664 (1982). In practice, b c X@ however, judges were reluctant to suppress useful pieces of evidence at c d XP trial, preferring instead to interpret the term "instrumentality" broadly d e X` enough to encompass items of evidentiary value. For example, the district e f Xp court in United States v. Robinson, 287 F. Supp. 245 (N.D. Ind. 1968), f g X upheld the seizure of the following items, all of which connected the g h X defendant to the murder of a federal narcotics agent, as h i X "instrumentalities" of the crime and not "mere evidence": a pair of i j X shoes, a shirt, a jacket, handkerchiefs, spent shell casings, and wet j k X washcloths. Such legal gymnastics were abandoned when the Supreme Court k l X held, in Hayden, that the Fourth Amendment principally protected privacy l m X rights, not property rights, and secured "the same protection of privacy m n X whether the search is for 'mere evidence' or for fruits, n o Y instrumentalities or contraband." Hayden, 387 U.S. at 30607. o p Y Although items that are evidence of crime may now be seized along with p q Y instrumentalities, fruits, and contraband, this historical perspective is q r Y0 important for understanding why some early decisions may have categorized r s Y@ evidentiary items as instrumentalities. Moreover, the distinction between s t YP "an instrumentality" and "mere evidence" remains critical in computer t u Y` crime cases because it may determine the government's ability to seize u v Yp hardware. If a computer and all its peripherals are instrumentalities of v w Y a crime, the warrant should authorize the seizure of these items. But if Fw x Y Y p (x # # Y H Fwe are seeking the computer only for the documents (mere evidence) it x y Y contains, it may be more difficult to justify the seizure or retention of y z Y hardware. z { Y Applying the independent component doctrine to the rule permitting { | Y seizure of instrumentalities will, in most cases, not be difficult. For | } Y example, if an individual engaging in wire fraud printed out thousands of } ~ Z phony invoices on his home computer, it would be reasonable to take the ~ Z computer, monitor, keyboard, and printer. If the individual Z electronically mailed these invoices to his victims, it would also be Z0 appropriate to seize his external modem (if the modem were internal it Z@ would, of course, be seized when the agents took the computer itself). ZP If, instead of using electronic mail, he used a conventional fax machine, Z` it would be reasonable to seize the fax as it, too would have played a Zp significant role in the commission of the offense. Z Z [page 30] Z Z D. HARDWARE AS EVIDENCE OF AN OFFENSE Z 1. Authority for Seizing Evidence Z In 1972, Federal Rule of Criminal Procedure 41(b) was amended to Z authorize seizing "mere evidence" of a crime. In relevant part, the Rule Z now states: "A warrant may be issued under this rule to search for and [ seize any (1) property that constitutes evidence of the commission of a [ criminal offense...." [ [0 2. Evidence Defined [@ A physical item is evidence if it will aid in apprehending or convicting [P a person who has committed a crime. The evidence seized need not be [` admissible at trial. [p Courts will evaluate a seizure under this test according to what a [ reasonable person would believe under the circumstances, and law [ enforcement officers will not be judged afterthefact on how helpful the [ seized evidence actually was in apprehending or convicting a suspect. See [ Andresen v. Maryland, 427 U.S. 463, 483 (1976) (holding that the "trained [ special investigator reasonably could have believed" the seized evidence [ could be used to show criminal intent); United States v. Truitt, 521 F.2d [ 1174, 117678 (6th Cir. 1975) (holding that a reasonably cautious police [ officer could have believed under the circumstances that a sawedoff \ shotgun, although legal if registered, was incriminating evidence). \ Of course, simply because an item is "evidence of a crime" does not mean F \ \ p ( $ $ \0 H Fthat other restrictions may not apply. Law enforcement officials should \@ be aware of other limits imposed by the Constitution, statutes, and \P regulations upon the seizure of evidence. See, e.g., Guidelines on \` Methods of Obtaining Documentary Materials Held by Third Parties, 28 \p C.F.R. 59.1.6 (governing the application for search warrants for \ documentary evidence held by nonsuspect third parties). \ \ [page 31] \ \ Although computers commonly contain evidence, sometimes they are \ evidence. If an extortionist sent a letter to his victim with unique \ print characteristics (e.g., the top half of the letter "W" was missing), \ his daisy~wheel printer would constitute evidence which could be seized. ] ] E. TRANSPORTING HARDWARE FROM THE SCENE ] ]0 Whether a computer is seized as contraband, an instrumentality, or ]@ evidence, it is important to transport it properly. With some simple ]P computers, moving the equipment is a straightforward proposition. But ]` computer systems are becoming so increasingly complex and diverse that it ]p is harder than ever for technically untrained agents to avoid mistakes. ] These Guidelines cannot possibly substitute for the expertise that comes ] from special training courses in seizing, searching, and preserving ] electronic evidence. Indeed, the discussion that follows is meant only as ] introduction and orientation to these issues, and not as a comprehensive ] guide to all the technical contingencies which may arise during a search. ] The team for a computerrelated search should, if possible, include at ] least one technically trained agent to act as a leader in these areas. ] Clearly, as complex computer systems become increasingly common, law ^ enforcement agencies will need more trained agents at almost every crime ^ scene. In the meantime, the following discussion may help prosecutors and ^ investigators to anticipate the problems which can confront them. ^0 ^@ First, agents must protect the equipment from damage. Second, to the ^P extent they are transporting information storage devices (e.g., hard ^` drives, floppy disks), improper handling can cause loss of data. Third, ^p it may be impossible to make the system work in the field office, ^ laboratory, or courtroom if the seizing agents did not carefully pack and ^ move the computer system so that it can be successfully reassembled ^ later. F ^ ^ p ( % % ^ H Fܿ ^ Before the search begins, the search leader should prepare a detailed ^ plan for documenting and preserving electronic evidence, and should take ^ time to carefully brief the entire search team to protect both the _ identity and integrity of all the data. At the scene, agents must _ remember to collect traditional types of evidence (e.g., latent _ fingerprints off the keyboard) before touching anything. They must _0 remember, too, that computer data can be destroyed by strong magnetic _@ fields. (Low density magnetic media is more susceptible to such _P _` [page 32] _p _ interference than high density media.) Last, some computer experts will _ not examine evidence if anyone else has already tried to search or _ manipulate the data. Their chainofcustody and integrityofevidence _ procedures will not allow them to examine the computer if its original _ crimescene seal has been broken. _ _ The agents executing the actual search must take special precautions when _ disassembling and packing computer equipment. This careful approach ` protects not only the hardware items, but also the integrity and ` accessibility of the data inside. Before disconnecting any cables, it is ` helpful to videotape or photograph the site (including the screen, if `0 possible, and all wiring connections) and prepare a wiring schematic. `@ This will document the condition of the equipment upon the agents' `P arrival and show how the system was configured. Agents should disconnect `` all remote access to the system (e.g., unplug the telephone cord, not the `p power cord, from the modem) and disconnect network cables from the ` servers so that no one can alter or erase information during the search. ` Investigators need to accurately label each cable and the device and port ` to which the cable connects before disconnecting anything. It is a good ` idea to attach tags at every connection point on every cable to record ` all relevant information. It is especially important to label every ` vacant port as "vacant" so that there is no confusion later. (If vacant ` ports are not labeled, it is impossible for an expert to tell whether the ` unlabeled port was in fact vacant, or whether an important label simply a fell off.) Once this is done, agents are ready to disassemble, tag and a inventory the equipment. a a0 Investigators must determine which drives, disks, and other magnetic F a@ a@ p ( & & aP H Fmedia need to be protected. If a hard disk drive is being moved, they a` must insure that the read/write heads are secured to prevent damage. Some ap systems secure (park) the heads automatically whenever the machine is not a in use, but other systems may require that a specific command be executed a or that the heads be secured mechanically. The manufacturer's operating a manual should specify the proper procedure for each system. a a Agents should protect floppy disk drives according to manufacturer's a recommendations. Some suggest inserting a new diskette or piece of a cardboard in the drive slot; others do not. (As with hard drives, each a manufacturer's instructions may be found in the system manual). b Investigators must also label diskettes (either individually or in b groups), mark them as evidence and place them in nonplastic evidence b containers. b0 b@ [page 33] bP b` Agents must be conscious of static electricity buildup during the bp execution of the warrant since static electricity can "zap" a disk and b damage data. So can degaussing equipment (an electronic appliance that b creates a strong magnetic field and can be used to effectively erase a b magnetic tape or disk). A wellknown story in law enforcement circles b involves a hacker who allegedly magnetized his metal door frame, thus b creating a magnetic field that erased magnetic media as agents carried it b through the doorway. This story has not been verified and, even if true, b such an event is unlikely to occur now because high density media is not b easily disrupted by magnetic fields. Nonetheless, a device to measure c magnetic fields (a compass or, even better, a gaussmeter) can determine c whether such fields exist and, as a general rule, agents should avoid c placing magnetic media near any strong magnetic field. Magnetic fields c0 may be created by telephones, radio transmitters, and photocopiers. c@ Additionally, although magnetic media has often been taken through cP airport metal detectors and Xray machines without damage, it is wiser c` not to take magnetic media through these devices. (It is the motor cp driving the conveyor belt on the Xray machine, not the fluoroscope c itself, that creates the magnetic field which causes the damage.) c c Transporting agents should keep all hardware and software in dustfree, c climatecontrolled environments. Computerrelated evidence is sensitive c to heat and humidity and should not be stored in the back seat or trunk F c c p ( ' ' c H Fof a car without special precautions. Temperature extremes may render c magnetically stored evidence unreadable, and various types of d contamination can damage electronic equipment. A safe range for storing d magnetic media is between 4090F and 20%80% humidity, free of dust and d tobacco smoke. d0 d@ [no page 34] [page 35] dP d` IV. SEARCHING FOR AND SEIZING INFORMATION ! dp ! " d A. INTRODUCTION " # d # $ d Hardware searches are not conceptually difficult. Like searching for $ % d weapons, the items sought are tangible. They occupy physical space and % & d can be moved in familiar ways. Searches for data and software are far & ' d more complex. For purposes of clarity, these types of searches must be ' ( d examined in two distinct groups: (1) searches where the information ( ) d sought is on the computer at the search scene and (2) searches where the ) * e information sought has been stored offsite, and the computer at the * + e search scene is used to access this offsite location.3 + , e , - e0 In some cases, the distinction is insignificant, and many topics covered - . e@ in this section apply equally to both types of searches. On the other . / eP hand, there are certain unique issues that arise only when the computer / 0 e` is part of a network. For example, since Fed. R. Crim. P. 41(a) requires 0 1 ep that a search warrant be issued by a court in the district where the 1 2 e property is located, agents may have to get a second warrant in another 2 3 e district if the target has sent data to a distant computer. See 3 4 e "Describing the Place to be Searched," infra p. 92. 4 5 e 5 6 e Although "property" is defined in Federal Rule of Criminal Procedure 6 7 e 41(h) to include "documents, books, papers and other tangible objects," 7 8 e (emphasis added), courts have held that intangible property such as 8 9 e information may be seized. In United States v. Villegas, 899 F.2d 1324, 9 : f 133435 (2d Cir.), cert. denied, 498 U.S. 991 (1990), the Second Circuit : ; f noted that warrants had been upheld for intangible property such as ; < f telephone numbers called from a given phone line and recorded by a pen < = f0 register, conversations overheard by means of a microphone touching a = > f@ heating duct, the movement of property as tracked by locationmonitoring > ? fP beepers, and images seized with video cameras and telescopes. The court F? @ f` f` p (@ ( ( fp H Fin Villegas upheld a warrant which authorized agents to search a cocaine @ A f factory and covertly take photographs without authorizing the seizure of A B f any tangible objects. But see United States B C f C D f D E f E F f 3 Any home PC can be connected to a network simply by adding a modem. F G f Thus, in any ease where a modem is present, agents should consider the G H f possibility that the computer user has stored valuable information at H I g some remote location. I J g J K g [page 36] K L g0 L M g@ v. Johns, 948 F.2d 599 (9th Cir. 1991), cert. denied, 112 S. Ct. 3046 M N gP (1992) (a "sneak and peek" warrant executed without giving notice to the N O g` defendants that the search had occurred violated Rule 41(d)). O P gp P Q g B. INFORMATION AS CONTRABAND Q R g R S g The same theories which justify seizing hardwarecontraband or fruit of S T g crime, instrumentality, or evidencealso apply to seizing information. T U g See "Authority for Seizing Contraband or Fruits of Crime," supra p. 26. U V g Because individuals often obtain copies of software in violation of V W g copyright laws, it may be appropriate to seize that software as well as W X g any documentation (such as photocopied software manuals) because they X Y h are likely to be illegally obtained. (Software producers may allow a Y Z h purchaser to make a backup copy of the software bought, but these copies Z [ h may not be disseminated because of copyright laws.) Lists of telephone [ \ h0 card access codes and passwords for government computer networks may also \ ] h@ be considered contraband, because their possession is prohibited by ] ^ hP statute if the possessor has the requisite mens rea. 18 U.S.C. ^ _ h` 1029(a)(3), 18 U.S.C. 1030(a)(6). _ ` hp ` a h C. INFORMATION AS AN INSTRUMENTALITY a b h b c h Rule 41(b) broadly defines what may be seized as an instrumentality: any c d h "property designed or intended for use or which is or has been used as d e h the means of committing a criminal offense." Fed. R. Crim. P. 41(b)(3). e f h This includes both tangible and intangible property. See United States f g h v. Villegas, supra, p. 35. Thus, in some cases, informational documents Fg h h h p (h ) ) i H Fand financial instruments which have been used in the commission of an h i i offense may be seized as instrumentalities of crime. Compare Abel v. i j i United States, 362 U.S. 217, 2379 (1960) (documents used in connection j k i0 with suspect's illegal alien status were instrumentalities, including k l i@ phony birth certificates, bank records, l m iP m n i` [page 37] n o ip o p i and vaccination records) with Application of Commercial Inv. Co., 305 F. p q i Supp. 967 (S.D.N.Y. 1969) ($5 million in securities were not q r i instrumentalities where the government suspected improprieties with an r s i $18,000 brokerage account and the securities were at most "incidental" to s t i the offense). t u i u v i Likewise, investigators should seize objects if they are "designed or v w i intended for use" as instrumentalities. Fed. R. Crim. P. 41(b)(3). w x j Sometimes an item will obviously fit that description (like software x y j designed to help hackers crack passwords or lists of stolen credit card y z j numbers) but, at other times, it may not be so simple. Even so, as long z { j0 as a reasonable person in the agent's position would believe the item to { | j@ be an instrumentality, the courts will probably respect the agent's | } jP judgment. This is, after all, the same test used to determine when an } ~ j` object would aid apprehension or conviction of a criminal. See Andresen ~ jp v. Maryland, 427 U.S. 463, 483 (1976). As such, the particular facts of j the case are very important. For example, if an agent investigating the j sysop of an illegal bulletin board knows that the board only operates on j one personal computer, a second computer sitting in the same room is j probably not an instrumentality. But if the agent has heard from a j reliable informant that the suspect has boasted about expanding his j operation to a second board, that second computer is probably "intended" j as an instrumentality, and the agent should take it. Additionally, if the j suspect has substantially modified a personal computer to enhance its k usefulness for a particular crime (perhaps by installing k passwordcracking software), an agent might well reasonably believe that k the computer and the software was "designed" for criminal activity. k0 k@ D. INFORMATION AS EVIDENCE kP k` Before the Supreme Court's rejection of the "mere evidence" rule in kp Warden v. Hayden, 387 U.S. 294, 300301 (1967), courts were inconsistent F k k p ( * * k H Fin ruling whether records that helped to connect the criminal to the k offense were instrumentalities of crime (and thus seizable), or were k instead merely evidence of crime (and thus not seizable). Compare Marron k v. United States, 275 U.S. 192 (1927) (approving prohibition agent's k seizure of bills and ledger books belonging to speakeasy operators as k instrumentalities of crime) with United States v. Lefkowitz, 285 U.S. 452 k (1932)(disapproving prohibition agent's seizure of papers intended to l solicit orders for illegal liquor). Indeed, several courts have concluded l that, when it comes to documents, it is impossible to l l0 [page 38] l@ lP separate the two categories. See Hayden, 387 U.S. at 302 (stating that l` the distinction between mere evidence and instrumentalities "is wholly lp irrational, since, depending on the circumstances, the same `papers and l effects' may be `mere evidence' in one case and `instrumentality' in l another"); United States v. Stern, 225 F. Supp. 187, 191 (S.D.N.Y. 1964) l ("It would be hazardous to attempt any definition [of papers that are l instrumentalities of crime and not mere evidence]; we shall not."). Now l that evidence of crime may be seized in the same way as instrumentalities l of crime, it is useful to acknowledge that, in most instances, documents l and other information connecting the criminal to his offense should be l viewed as evidence of the crime, and not as instrumentalities. For m example, in United States v. Lindenfield, 142 F.2d 829, 83032 (2d Cir.), m cert. denied, 323 U.S. 761 (1944), the prescription records of a doctor m who illegally prescribed morphine to "patients" were classified as m0 evidence, not as instrumentalities. m@ mP The prescription records in Lindenfield illustrate the sort of document m` that may be seized as evidence: records that reveal the operation of the mp criminal enterprise over time. Other examples include the customer lists m of narcotics traffickers, telephone bills of hackers who break into m computer networks, and plans for the fraud or embezzlement of corporate m and financial targets. This documentary evidence may be in paper or book m form, or it may be stored electronically in a computer or on a backup m tape. As with other types of evidence, documents may be seized if they m aid in showing intent and the absence of mistake on the suspect's part, m even though they may not relate directly to the commission of the crime, m but to some other similar transaction instead. See Andresen v. Maryland, n 427 U.S. 463, at 48384 (1976)(approving seizure of documents about a F n n p ( + + n H Fsecond transaction because they showed criminal intent and absence of n0 mistake in the first transaction). n@ nP 1. Evidence of Identity n` np Evidence of a crime also includes various types of identification n evidence. For example, courts have recognized that clothing seen worn by n a criminal during the commission of the offense constitutes evidence of n the crime, n n [page 39] n n because it helps to tie the suspect to the crime. See, e.g., United n States v. Korman, 614 F.2d 541, 547 (6th Cir.)(approving the seizure of a o green ski jacket as both evidence of and an instrumentality of the o crime), cert. denied, 446 U.S. 952 (1980). o o0 Documents that incriminate a suspect's coconspirators also may be seized o@ as evidence because they help identify other involved parties and connect oP them with the suspect. See, e.g., United States v. Santarsiero, 566 F. o` Supp. 536, 544 (S.D.N.Y. 1983) (approving the seizure of the suspect's op notebook in a counterfeit credit card investigation where others were o working with or purchasing cards from him, and the notebook contained o telephone numbers that the investigating officers could reasonably o believe would help in identifying and connecting others with the o suspect's crimes). In many computer crimes, we have found that hackers o work jointly and pool hacking information. In these cases, telephone o records may prove this connection. Moreover, agents may seize evidence o that helps identify the occupant of a home or office connected to the o crime, where the home or office is used regularly by more than one p person. See, e.g., United States v. Whitten, 706 F.2d 1000, 100809 (9th p Cir. 1983)(approving the seizure of telephone books, diaries, photos, p utility bills, telephone bills, personal property, cancelled mail, keys, p0 rent receipts, deeds, and leases that helped establish who owned and p@ occupied premises used for a large scale narcotics operation, where the pP premises were used by more than one person and the warrant authorized p` seizing items "indicating the ownership or occupancy of the residence"), pp cert. denied, 465 U.S. 1100 (1984). As with houses and offices, computers p are often used by more than one person, and this sort of evidence may p help establish just who used the computer or computers to commit the F p p p ( , , p H Fcrime. p p 2. Specific Types of Evidence p p a. Hard Copy Printouts q q Any information contained in a computer system may have been printed out q by the target of the investigation. Finding a printed copy may be q0 valuable for a number of reasons. First, a printout may display an q@ earlier version of qP q` [page 40] qp q data that has sincebeen altered or deleted. Second, in certain q electronic environments (such as bulletin boards), individuals may claim q to lack knowledge about what information is electronically stored in the q computer (e.g., a bulletin board operator may disavow any knowledge that q his board contained illegal access codes that were posted and downloaded q by others). Finding printed copies in someone's possession may negate q this defense. Third, the printouts may tie the crime to a particular q printer which, in turn, may be seizable as an instrumentality (e.g., the r printouts may reveal that extortionate notes were printed on a certain r printer, thus warranting seizure of the printer). r r0 b. Handwritten Notes r@ rP Finally, agents should be alert for notes in manuals, on the equipment, r` or in the area of the computer. These may provide critical keys to rp breaking passwords, finding the file or directory names of important r data, operating the hardware or software, identifying the suspect's r electronic or telephone connections with coconspirators and victims, or r finding login names or accounts. r r E. PRIVILEGED AND CONFIDENTIAL INFORMATION r r 1. In General r s Warrants to search computers which contain privileged information must s meet the same requirements as warrants to search for and seize paper s documents under similar conditions; that is, the warrant should be F s0 s0 p ( - - s@ H Fnarrowly drawn to include only the data pertinent to the investigation, sP and that data should be described as specifically as possible. See, e.g. s` Klitzman v. Krut, 744 F.2d 955 (3d Cir. 1984). Since a broad search of sp computers used by confidential fiduciaries (e.g., attorneys or s physicians) is likely to uncover personal information about individuals s who are unconnected with the s s [page 41] s s investigation, it is important to instruct any assisting forensic s computer experts not to examine files about uninvolved third parties any s more than absolutely necessary to locate and seize the information t described in the warrant. t t a. Doctors, Lawyers, and Clergy t0 t@ Federal law recognizes some, but not all, of the common law testimonial tP privileges. Fed. R. Evid. 501. Indeed, Congress has recognized a "special t` concern for privacy interests in cases in which a search or seizure for tp .... documents would intrude upon a known confidential relationship such t as that which may exist between clergyman and parishioner; lawyer and t client; or doctor and patient." 42 U.S.C. 2000aa11(1)(3). At Congress's t direction, see 42 U.S.C. 2000aa11(a), the Attorney General has issued t guidelines for federal officers who want to obtain documentary materials t from disinterested third parties. 42 U.S.C. 2000aa11. Under these ! t rules, they should not use a search warrant to obtain documentary ! " t materials believed to be in the private possession of a disinterested " # t third party physician, lawyer, or clergyman where the material sought or # $ u likely to be reviewed during the execution of the warrant contains $ % u confidential information on patients, clients, or parishioners. 28 C.F.R. % & u 59.4(b). A search warrant can be used, however, if using less intrusive & ' u0 means would substantially jeopardize the availability or usefulness of ' ( u@ the materials sought; access to the documentary materials appears to be ( ) uP of substantial importance to the investigation; and the application for ) * u` the warrant has been recommended by the U.S. Attorney and approved by the * + up appropriate Deputy Assistant Attorney General. 28 C.F.R. 59.4(b)(1) and + , u (2). , - u - . u b. Publishers and Authors . / u F/ 0 u u p (0 . . u H FAdditionally, Congress has expressed a special concern for publishers and 0 1 u journalists in the Privacy Protection Act, 42 U.S.C. 2000aa. Generally 1 2 u speaking, agents may not search for or seize any "work product materials" 2 3 v (defined by statute) from someone "reasonably believed to have a purpose 3 4 v to disseminate to the public a newspaper, book, broadcast, or other 4 5 v similar form of public communication." 42 U.S.C. 2000aa(a). In 5 6 v0 addition, as an even 6 7 v@ 7 8 vP [page 42] 8 9 v` 9 : vp broader proposition, government officers cannot search for or seize : ; v "documentary materials" (also defined) from someone who possesses them in ; < v connection with a purpose to similarly publish. 42 U.S.C. 2000aa(b). < = v These protections do not apply to contraband, fruits of a crime, or = > v things otherwise criminally possessed. 42 U.S.C. 2000aa7. > ? v ? @ v Although this provision may seem, at first blush, to have a somewhat @ A v limited application for law enforcement, it has emerged as a frequent A B v issue in computer searches. Because even a standalone computer can hold B C w thousands of pages of information, it is common for users to mix data so C D w that evidence of crime is commingled with material which is innocuousor D E w even statutorily protected. And as a technical matter, analysts sometimes E F w0 cannot recover the electronic evidence without, in some manner, briefly F G w@ searching or seizing the protected data. Moreover, this problem becomes G H wP exponentially more difficult, both legally and practically, if the target H I w` computers are part of a network which holds the work of many different I J wp people. The larger the network and the more varied its services, the J K w harder it is to predict whether there might be information on the system K L w which could arguably qualify for statutory protection. (This complex area L M w of the law is discussed in detail at "THE PRIVACY PROTECTION ACT, 42 M N w U.S.C. 2000aa," infra p. 72. It is critical that prosecutors and agents N O w read this section and the statute with care before undertaking a search O P w which may intrude on protected materials.) P Q w Q R w 2. Targets R S x S T x If the person who holds the documents sought is not "disinterested" but a T U x target of the investigation, the rules are understandably different. In U V x0 those cases, agents may get a warrant to search the files for V W x@ confidential information (regardless of whether that information is FW X xP xP p (X / / x` H Ftechnically "privileged" under Federal law), but the warrant should be X Y xp drawn as narrowly as possible to include only information specifically Y Z x about the case under investigation. Z [ x [ \ x When the target of an investigation has complete control of the computer \ ] x to be searched (such as a standalone PC), it may be difficult to find ] ^ x all the evidence without examining the entire disk drive or storage ^ _ x diskettes. Even in situations like these, it may be possible to get other _ ` x people in the suspect's office to help locate the pertinent files without ` a x examining everything. When a a b y b c y [page 43] c d y d e y0 computer must be removed from the target's premises to examine it, agents e f y@ must take care that other investigators avoid reading confidential files f g yP unrelated to the case. Before examining everything on the computer, g h y` analysts should try to use other methods to locate only the material h i yp described in the warrant. Finally, as experts comb for hidden or erased i j y files or information contained between disk sectors, they must continue j k y to protect the unrelated, confidential information as much as possible. k l y l m y 3. Using Special Masters m n y n o y In rare instances, the court may appoint a special master to help search o p y a computer which contains privileged information. See, e.g., DeMassa v. p q y Nunez, 747 F.2d 1283 (9th Cir. 1984). A neutral master would be q r z responsible to the court, and could examine all the documents and r s z determine what is privileged. If the court appoints a master, the s t z government should ask for a neutral computer expert to help the master t u z0 recover all the data without destroying or altering anything. In cases u v z@ like these, the computer expert needs detailed instructions on the search v w zP procedures to be performed. In no event should the target of the search w x z` or his employees serve as the master's computer expert. x y zp y z z F. UNDERSTANDING WHERE THE EVIDENCE MIGHT BE: STAND ALONE PCs, NETWORKS z { z AND FILESERVERS, BACKUPS, ELECTRONIC BULLETIN BOARDS, AND ELECTRONIC { | z MAIL | } z } ~ z 1. StandAlone PCs ~ z F z z p ( 0 0 z H FWhen searching for information, agents must not overlook any storage { devices. This includes hard drives, floppy disks, backup tapes, CDROMs4, { { [page 44] {0 {@ WORM drives 5, and anything else that could hold data. In addition, {P notwithstanding the hightech nature of computer searches, investigators {` must remember basic evidentiary techniques. If identification is an {p issue, they should look for fingerprints or other handwritten notes and { labels that may help prove identity. If data is encrypted, a written copy { of the password is clearly important. { { ܖ { { 4 CDROM stands for Compact DiskRead Only Memory. Much like a compact { disk for music, it allows the user to search for and read information { without being able to alter it. | | 5 WORM stands for Write Once Read Many. The user can write large amounts | of information to a platter (a large disk); but once written, the platter |0 can only be read, not altered. |@ |P a. Input/Output Devices: Do Monitors, Modems, Printers, and Keyboards |` Ever Need to be Searched? |p | Prosecutors must always keep in mind the independent component doctrine ( | supra p. 25); that is, there must be a basis for seizing each particular | item. If agents are only searching for information, it may be senseless | to seize hardware that cannot store information. | | That said, it is important to remember that information can be retrieved | from many hardware devices, even those not normally associated with a | storage function. Generally speaking, input and output (I/O) devices such } as keyboards, monitors, and printers do not permanently store data. Most } data is stored on devices such as hard drives, CDROMs, and floppy disks. } By contrast, I/O devices are used to send data to, and receive data from, }0 the computer. Once the computer is turned off, I/O devices do not store }@ information. For example, when a computer is turned off, the information }P on the screen is lost unless it has been saved to a storage device. }` F }p }p p ( 1 1 } H FHowever, there are significant exceptions to this general rule. A trained } computer specialist, using specialized techniques, may find data or other } evidence even on I/O devices. The following list is not allinclusive, } but rather offers some examples of I/O devices that may provide useful } evidence even after they have been turned off. } } (1) Laser printers It may be possible to search for images of the last } page printed on laser printers. This technique requires planning because ~ the expert must examine the printer before it is moved. If this type of ~ evidence may be needed, a computer expert must be ready at the ~ ~0 [page 45] ~@ ~P scene with the necessary equipment. Additionally, paper containing ~` information may still be inside a laser printer due to a paper jam that ~p was not cleared. ~ ~ (2) Hard disk print buffers Some laser printers have five or ~ tenmegabyte hard drives that store an image before it prints, and the ~ information will stay on the drive until the printer runs out of memory ~ space and writes over it. One example of a printer that may have an ~ internal hard drive is the Qume 1000 Color Printer. An expert would be ~ able to search the hard drive for information sent to and stored by that ~ printer. (3) Print Spooler Device This device holds information to be printed. The spooler may be holding a print job if the printer was not ready to 0 print when the print command was given (e.g., the printer was not turned @ on or was out of paper). This device should be handled at the scene since P the information will be lost when power is disrupted. ` p (4) Ribbon printers Like old typewriter ribbons, printer ribbons contain impressions from printed jobs. These impressions can be recovered by examining the ribbon. (5) Monitors Any burning of the screen phosphorus may reveal data or graphics commonly left on the screen. (6) Keyboards Although they do not normally store information, some unusual keyboards are actually computer workstations and may contain an F p ( 2 2 H Finternal diskette drive. 0 (7) Hard Cards These appear to be a typical function board but they @ function like a hard disk drive and store information. P ` (8) Scanner Flatbed type scanners may have hard paper copy underneath p the cover. (9) Fax machines Although some kinds of standalone fax machines simply scan and send data without storing it, other models can store the data (e.g., on a hard drive) before sending it. Significantly, the data remains in the machine's memory until overwritten. Some fax machines contain two or more megabytes of memoryenough to hold hundreds of pages of information. [page 46] b. Routine Data Backups Even on standalone systems, computer users often make backup copies of 0 files to protect against hardware failure or other physical disruptions. @ If the computer has any sort of failure which destroys the original copy P of data or programs (e.g., a hard disk failure), the data can then be ` restored from the backups. How often backups are made is solely up to the p user. As a practical matter, however, most computerliterate users will back up data regularly since mechanical failures are not uncommon and it is often difficult and time~consuming to recreate data that has been irretrievably lost. Backup copies can be made on magnetic tape, disks, or cartridges. 2. Networked PCs Increasingly, computers are linked with other computers. This can be done with coaxial cable in a local area network, via common telephone lines, or even through a wireless network, using radio frequency (RF) communications. Due to this interconnectivity, it has become more 0 important than ever to ascertain from sources or surveillance what type @ of system agents will encounter. Without knowing generally what is there P before the search, investigators could end up with nothing more than a ` "dumb terminal" (no storage capability) connected to a system which p stores the files in the next county or state. It would be akin to executing a search warrant for a book~making operation on a vacant room F p ( 3 3 H Fthat only has a phone which forwards calls to the actual operation site. During the planning stage of a search, the government must consider the possibility of offsite storage locations. The following are systems or devices which make it possible for a suspect to store data miles, or even continents, away from her own computer: FILE SERVER: A file server is a computer on a network that stores the programs and data files shared by the users of the network. A file server 0 acts like a remote disk drive, enabling someone to store information on a @ computer system other than his own. It can be located in another judicial P district from the target machine. [page 47] ` p ELECTRONIC MAIL: Electronic mail provides for the transmission of messages and files between computers over a communications network. Sending information in this way is similar in some ways to mailing a letter through the postal service. The messages are sent from one computer through a network to the electronic address of another specific computer or to a series of computers of the sender's choice. The transmitted messages (and attached files) are either stored at the computer of the addressee (such as someone's personal computer) or at a mail server (a machine dedicated, at least in part, to storing mail). If the undelivered mail is stored on a server, it will remain there until the addressee retrieves it. When people "pick up" email from the mail server, they usually receive only a copy of their mail, and the stored 0 message is maintained in the mail server until the addressee deletes it @ (some systems allow senders to delete mail on the server before P delivery). Of course, deleted mail may sometimes be recovered by ` undeleting the message (if not yet overwritten) or by obtaining a backup p copy (if the server was backed up before the message was deleted). ELECTRONIC BULLETIN BOARD SYSTEMS (BBS): A bulletin board system is a computer dedicated, in whole or in part, to serving as an electronic meeting place. A BBS computer system may contain information, programs, and email, and is set up so that users can dial the bulletin board system, read and leave messages for other users, and download and upload software programs for common use. Some BBSs also have gateways which allow users to connect to other bulletin boards or networks. A BBS can have multiple telephone lines (so that many people can use it at the same time) or a single line where a user's access is firstcome, firstserved. F p ( 4 4 0 H FBBSs can have several levels of access, sometimes called "subboards" or ! @ "conferences." Access to the different conferences is usually controlled ! " P by the system operator with a password system. A single user may have " # ` several different passwords, one for each different level or conference. # $ p A user may store documents, data, programs, messages, and even $ % photographs in the different levels of the BBS. % & & ' A bulletin board system may be located anywhere telephone lines go. ' ( Therefore, if a suspect may have stored important information on a BBS, a ( ) pen register on the suspect's phone may reveal the location of these ) * stored files. Agents must be careful, though, because sysops have been * + known to forward incoming calls through a simple phone in one spot to + , , - [page 48] - . . / their BBS computers somewhere else. Sometimes these calls hop between / 0 0 houses, and sometimes, between jurisdictions. Investigators cannot assume 0 1 @ that the phone number called by the suspect is always the end of the 1 2 P line. 2 3 ` 3 4 p VOICEMAIL SYSTEMS: A voicemail system is a complex phone answering 4 5 machine (computer) which allows individuals to send and receive telephone 5 6 voice messages to a specific "mailbox" number. A person can call the 6 7 voicemail system (often a 1800 number) and leave a message in a 7 8 particular person's mailbox, retrieve messages left by other people, or 8 9 transfer one message to many different mailboxes in a list. Usually, 9 : anyone can leave messages, but it takes a password to pick them up or : ; change the initial greeting. The system turns the user's voice into ; < digital data and stores it until the addressee erases it or another < = message overwrites it. Criminals sometimes use voice mailboxes = > (especially mailboxes of unsuspecting people, if the criminals can beat > ? the mailbox password) as remote deaddrops for information which may be ? @ 0 valuable in a criminal case. Voice mailboxes are located in the message @ A @ system computer of the commercial vendor which supplies the voicemail A B P service, or they can be found on the computer at the location called. B C ` Voice mail messages can be written on magnetic disk or remain in the C D p computer's memory, depending on the vendor's system. D E E F Of course, all networked systems, whether data or voice, may keep routine F G and disaster backups. FG H p (H 5 5 H Fܿ H I a. Routine Backups I J J K Making backups is a routine, mandatory discipline on multiuser systems. K L On larger systems, backups may be created as often as two to three times L M per working shift. Usually backups are made once per day on larger M N systems and once per week on smaller ones. Backups are usually stored in N O 0 a controlled environment to protect the integrity of the data (e.g., O P @ locked in a file cabinet or safe). The system administrators will usually P Q P have written procedures which set out how often backup copies will be Q R ` made and where they will be kept. Backups for large systems are often R S p stored at remote locations. S T T U [page 49] U V V W b. Disaster Backups W X X Y These are additional backups of important data meant to survive all Y Z contingencies, such as fire, flood, etc. As extra protection, the data is Z [ stored offsite usually in another building belonging to the business or [ \ in rented storage space. It would be unusual to find the disaster backups \ ] near the routine backups or original data. Again, these copies can be ] ^ stored on diskettes, magnetic tape, or cartridge. ^ _ 0 _ ` @ G . SEARCHING FOR INFORMATION ` a P a b ` 1. Business Records and Other Documents b c p c d Obtaining records from a multiuser computer system raises certain issues d e that are uncommon in the paper world. When dealing with papers stored in e f filing cabinets, agents can secure the scene and protect the integrity of f g the evidence by physically restricting access to the storage container g h and its papers. Electronic records are, of course, easier to alter or h i destroy. More important, such alteration or destruction may occur while i j the agent is looking at a copy of the document on A workstation terminal. j k Therefore, it is important to control remote access to data while the k l search is being conducted. This can often be done by prohibiting access l m to the file or file server in question, either by software commands or by m n physically disconnecting cables. This should only be done by an expert, n o 0 however, because altering the system's configuration may have significant Fo p @ @ p (p 6 6 P H Funintended results. p q ` q r p If the system administrator is cooperating with investigators, the task r s becomes much easier, and agents should use the least intrusive means s t possible to obtain the data (e.g., a request, grand jury subpoena, or t u administrative subpoena). Of course, if the entire business is under u v investigation or there is reason to believe that records may be altered v w or destroyed, a search warrant should be used. w x x y [page 50] y z z { 2. Data Created or Maintained by Targets { | | } Targets of criminal investigations, particularly computer crimes, may } ~ 0 have data on a multiuser computer system. Where the target owns or ~ @ operates the computer system in question, it is safest to use warrants, P although subpoenas may be appropriate in the right case. ` p Where the target does not control the system but merely has data on it, the sysop may be willing to provide the requested data assuming he has the authority to do so. Never forgetting the legal restraints of 18 U.S.C. 2702 (see "Stored Electronic Communications," infra p. 85), the sysop can, as a practical matter, probably retrieve the needed data rather easily. Ordinarily, a multiuser computer system will have specific accounts assigned to each user or groups of users. While the various "users" may not be able to get into each others' files, the system operator (like a landlord with passkeys) can usually examine and copy any file in the computer system. (Typically, the sysop has what is called "superuser" authority or "root" access.) 0 Some systems, by their rules, may prohibit the system managers or @ operators from reading files in specific data areas or may expressly P limit the purposes for which sysops may exercise their access. In those ` cases, sysops may insist on a court order or subpoena. If, on the other p hand, users have consented to complete sysop access in order to use the system, a request to the sysop for the information may be all that is required. In either event, rarely will it be wise for investigating agents to search large computer systems by themselves. Without the sysop's help, it may be difficult (if not impossible) for agents to comb a multiuser computer system the way they search file cabinets for paper F p ( 7 7 H Frecords. When using a subpoena with a future return date, agents should specifically ask for the computerized records as they exist at time of service, and state clearly that service of the subpoena obliges the 0 recipient to preserve and safeguard the subpoenaed information by @ making a copy. Investigators should explain that even if the recipient P contests the subpoena, he must not only copy the data "as is," but must ` also confirm to the agent that the copy has been made. The subpoena p should also say that failure to preserve the subpoenaed information may subject the recipient to sanctions for contempt. In some [page 51] circumstances, a "forthwith subpoena" may even be appropriate. If all this is not done, the data may be altered or eraseddeliberately, accidentally, or in the normal course of businessbefore the return date on the subpoena. 3. Limited Data Searches 0 Once analysts have determined the operating system and have taken @ precautions to protect the integrity of the data, they will select tools P to aid in the search. Using specially designed software called ` "utilities" will greatly help, because analysts can tailor the search to p look for specified names, dates, and file extensions. They can scan disks for recently deleted data and recover it in partial or sometimes complete format. They can also identify and expose hidden files. In some cases, analysts may find files that are not in a readable format; the data may have been compressed to save space or encrypted to control access to it. Here again, utility packages will help recover the data. In designing the data search, they might use a variety of utilities. Some are off~theshelf software available from most computer retailers. But utility software can also be custommade, especially designed to perform specific search functions that are specified in standard laboratory procedures. Obviously, agents should rely upon experts for this kind of analysis. (See APPENDIX C, p. 143, for a list of federal sources for 0 experts.) @ P There are several reasons why analysts will probably want to do a limited F ` ` p ( 8 8 p H Frather than a complete search through the data. First of all, the law in general prefers searches of all thingscomputer data includedto be as discrete and specific as possible. Second, the warrant may specify particular files, directories, or subdirectories, or certain categories of data. Finally, even if the facts of a case give an analyst free rein to search all the data, the economies of scale usually require a more systematic approach. At the least, analysts should plan for a methodical inventory of directories and subdirectories and prepare to document all the steps taken in the search. Because data is so easy to alter or destroy, analysts must have a careful record so that their efforts can be re~created for a court. In examining the data, analysts will probably have to do some sortingexamining things that could be relevant and 0 bypassing the unrelated items. Only rarely will they be allowed to or @ even want to read everything on the computer system being searched. Even P so, caution is advised, because directory headings and file names may ` often be misleading. p [page 52] In addition to searching by file, subdirectory, or directory, the power of the computer allows analysts to design a limited search in other ways as well. Computer experts can search data for specific names (like names of clients, co~conspirators, or victims), words (like "drugs," "tax," or "hacking"), places (either geographic locations or electronic ones), or any combination of them. As legal researchers know, if the keyword search is well defined, it can be the most efficient way to find the needle in the haystack. But unless analysts are working from a tip and know how the data is organized, there will probably be some trial and error before 0 they can find the key words, names, or places. In addition, technical @ problems may complicate a keyword search. For example, encryption, P compression, graphics, and certain software formatting schemes may leave ` data difficult to search in this fashion. p In the list of files contained in a directory or subdirectory, there will be other kinds of information that may indicate whether a particular file should be searched. The names of files in a directory often carry extensions that indicate what sort of file is or what it does. These file extensions are often associated with common applications software, such as spreadsheets (that could hold accounting data), databases (that can have client information), word processing (which could hold any sort of F p ( 9 9 H Falphanumeric text), or graphics. There will also be a date and time listed for every file created. Although this information can easily be altered and may be misleading, in some cases it may accurately reflect 0 the last time the file was revised. @ P Further, the kind of software found loaded on a computer may reveal how ` the computer has been used. If there is communications software, for p example, the computer may have been used to send incriminating data to another computer system at another location. A modem or other evidence of remote access should also tip off the searcher to this possibility, which may expand the investigation and create a need for a new warrant. For example, the original search may disclose phone bills indicating frequent longdistance calls to one particular number. If a call to this number reveals a modem tone, then further investigation would be warranted. Clearly, the person conducting a computer search should have highlevel technical skills to ensure success. Moreover, a wellmeaning investigator with amateur skills could inadvertently, but irretrievably, damage the data. When in doubt, rely only on experts. 0 @ [page 53] P ` 4. Discovering the Unexpected p a. Items Different from the Description in the Warrant The Fourth Amendment requires specific descriptions of the places, people, and things to be searched as well as the items to be seized. Specificity has two aspectsparticularity and overbreadth. "Particularity" is about detail: the warrant must clearly describe what it seeks. "Breadth" is about scope: the warrant cannot include items for which there is no probable cause. Together, the particularly and breadth limitations prevent general searches of a person's properly. Thus, generic classifications in a warrant are acceptable only when a more precise description is not possible. In Re Grand Jury Subpoenas, 926 F.2d 0 847, 8567 (9th Cir. 1991). @ P Despite defense objections, the court upheld the seizure of computer ` disks not named in the warrant in United States v. Musson, 650 F. Supp. p 525, 532 (D. Colo. 1986). The warrant in that case authorized agents to F p ( : : H Fseize various specific records, and the court reasoned that because of the changing technology, the government could not necessarily predict what form the records would take. See also United States v. Reyes, 798 F.2d 380, 383 (10th Cir. 1986); United States v. Lucas, 932 F.2d 1210, 1216 (8th Cir.), cert. denied, 112 S. Ct. 399 (1991). In these days, the safest course is always to assume that particular, clearly described "records" or "documents" may be in electronic form and to provide for this possibility in the warrant. (See "SAMPLE COMPUTER LANGUAGE FOR SEARCH WARRANTS," APPENDIX A, p. 125.) 0 Other courts, however, have suppressed the results of search warrants @ which broadly covered electronic "records" in form, but were too vague P about their content. In Application of Lafayette Academy, Inc., 610 F.2d ` 1 (1st Cir. 1979), the court struck a warrant which expressly authorized p the seizure of computer tapes, disks, operation manuals, tape logs, tape layouts, and tape printouts. Although the warrant specified that the items must also be evidence of criminal fraud and conspiracy, that limit ! on content was not sufficiently particular to save the evidence. Id. at ! " 3. See also Voss v. Bergsgaard, 774 F.2d 402, 4045 (10th Cir. 1985). " # # $ [page 54] $ % % & b. Encryption & ' ' ( If agents have authority to search the data in a computer or on a disk ( ) and find it has been encrypted, how should they proceedboth legally and ) * 0 practically? * + @ + , P Although an encrypted computer file has been analogized to a locked file , - ` cabinet (because the owner is attempting to preserve secrecy), it is also - . p analogous to a document written in a language which is foreign to the . / reader. As both of these metaphors demonstrate, the authority granted by / 0 the warrant to search for and seized encrypted information also brings 0 1 the implied authority to decrypt: to "break the lock" on the cabinet or 1 2 to "translate" the document. Indeed, a warrant to seize a car and its 2 3 contents implicitly authorizes agents to unlock it. 3 4 4 5 Of course, the rule may be different if the search is based upon consent. 5 6 A court might well find that a target who has encrypted his data and has 6 7 not disclosed the necessary password has tacitly limited the scope of his F 7 8 p ( 8 ; ; H Fconsent. In that case, the better practice is to ask explicitly for 8 9 0 consent to search the encrypted material, as well as the password. If the 9 : @ target refuses, agents should obtain a warrant for the encrypted data. : ; P ; < ` In United States v. David, 756 F. Supp. 1385 (D. Nev. 1991), the < = p defendant was cooperating with the government by giving them drugdealing = > information from encrypted files in his computer memo book. During one > ? interview, the agent learned the defendant's password by standing over ? @ his shoulder and watching as he typed it. Later, when the defendant @ A stopped cooperating and started destroying information in the notebook, A B the agent seized it and used the defendant's password to access the B C remaining information. The court reasoned that the agent's learning the C D password was like his picking up the key to the container. When the D E defendant withdrew his consent to give more information from the memo E F book, the act which required a warrant was looking inside the F G containerwhether locked or unlockednot the acquisition or even the G H use of the key. If the agent did not have authority to search the data, H I 0 then knowing the password would not confer it. Id. at 1391. Conversely, I J @ if the agent does have a warrant for the data, she may break the "lock" J K P to search it. For more comment on the consent issues in the David case, K L ` see the discussion at p. 14. L M p M N [[page 55] N O O P As a practical matter, getting past the encryption may not be easy, but P Q there are several approaches to try. First of all, the computer crime lab Q R or the software manufacturer may be able to assist in decrypting the R S file. Investigators should not be discouraged by claims that the password S T "can't be broken," as this may simply be untrue. Some can be done easily T U with the right software. If that fails, there may be clues to the U V password in the other evidence seizedstray notes on hardware or desks; V W scribbles in the margins of manuals or on the jackets of disks. Agents W X should consider whether the suspect or someone else will provide the X Y 0 password if requested. In some cases, it might be appropriate to compel a Y Z @ third party who may know the password (or even the suspect) to disclose Z [ P it by subpoena (with limited immunity, if appropriate). [ \ ` \ ] p H. DECIDING WHETHER TO CONDUCT THE SEARCH ONSITE OR TO REMOVE HARDWARE ] ^ TO ANOTHER LOCATION ^ _ F _ ` p ( ` < < H FIt is possible for analysts to search for electronic evidence in several ` a places: onsite, at an investigative agency field office, or at a a b laboratory. The key decision is whether to search at the scene or b c somewhere else, since an off~site search will require packing and moving c d the property and may constitute a greater intrusion on the property d e rights of the computer owner/user.6 In addressing this issue, it is e f necessary to consider many factors such as the volume of evidence, the f g scope of the warrant, and the special problems that may arise when g h 0 attempting to search computers. h i @ i j P Although it may, practically speaking, be necessary to remove the j k ` computer in order to search it, that logistical reality does not expand k l p the theoretical basis of probable cause. This is a completely separate l m issue, and agents must not write broad warrants simply because, in m n reality, it will be necessary to seize the entire filing cabinet or n o computer. Rather, they should draft the warrant for computer records as o p specifically as possible (akin to a search warrant papers in a file p q cabinet) by focusing on the content of the record. Then, as a separate q r logical step, they should address the practical aspects of each case: r s whenever searching data "containers" on site would be unreasonable, s t agents should explain in the affidavit why this is true and ask for t u u v [page 56] v w w x 0 permission to seize the containers in order to find the relevant x y @ documents. (See "DRAFTING A WARRANT TO SEIZE INFORMATION: Describing the y z P Items to be Seized," infra p. 97.) (If the particular computer storage z { ` devices which contain the evidence may also hold electronic mail { | p protected by 18 U.S.C. 2701, et seq., see STORED ELECTRONIC | } COMMUNICATIONS," infra p. 85. If they may contain material covered by the } ~ Privacy Protection Act, 42 U.S.C. 2000aa, see "THE PRIVACY PROTECTION ~ ACT," infra p. 72.) 1. Seizing Computers because of the Volume of Evidence Since any document search can be a timeconsuming process, cases discussing file cabinet searches are helpful. Although not technically complex, it can take days to search a file cabinet, and courts have sustained offsite searches when they are "reasonable under the circumstances." The key issues here are: (1) how extensive is the F 0 0 p ( = = @ H Fwarrant and (2) what type of place is to be searched. P ` ܖ p 6. If hardware is going to be removed from the site, refer to the suggestions on packing and moving hardware, supra p. 31. a. Broad Warrant Authorizes Voluminous Seizure of Documents In determining whether agents may take documents from the scene for later examination, they must consider the scope of the warrant. When the warrant directs agents to seize broad categories of records, or even all records (because the suspect's business is completely criminal or infected by some pervasive, illegal scheme), then it is not difficult to 0 argue all papers and storage devices should be seized. In these cases, @ courts have supported the carting off of whole file cabinets containing P pounds of unsorted paper. U.S. Postal Service v. C.E.C. Services, 869 ` F.2d 184, 187 (2d Cir. 1989); United States v. Sawyer, 799 F.2d 1494, p 1508 (11th Cir. 1986), cert. denied sub nom. Leavitt v. U.S. , 479 U.S. 1069 (1987). "When there is probable cause to seize all [items], the warrant may be broad because it is unnecessary to distinguish things that may be taken from things that must be left undisturbed." U.S. v. Bentley, 825 F.2d 1104, 1110 (7th Cir.), cert. denied, 484 [page 57] U.S. 901 (1987). In such cases, it is not necessary to carefully sort through documents at the scene to insure that the warrant has been properly executed. 0 This rationale has been extended to computers. In U.S. v. Henson, 848 @ F.2d 1374 (6th Cir. 1988), cert. denied, 488 U.S. 1005 (1989), agents P searched several used car dealerships for evidence of an interstate ` odometer rollback scheme. The warrant authorized agents to seize, among p other things, "modules, modems and connectors, computer, computer terminals, hard copy user documentation pertaining to files and/or programs, cables, printers, discs, floppy discs, tapes, vendor phone numbers, all original and backup tapes and discs, any other informational data input, all vendor manuals for hardware and software, printouts...." F p ( > > H FId. at 1382. The warrant did not require onsite sorting, and the defendants later accused agents of going on a "seizing frenzy." The court, however, sustained the search, observing that the extensive seizures were authorized by the warrant, and the warrant was broad because so was the criminality. The court relied on the rule of reasonableness in concluding that officers were right not to try to sort 0 through everything at the scene. Since the extensive seizure of records @ was authorized by the terms of the warrant, it was inevitable that the P officers would seize documents that were not relevant to the proceedings ` at hand. We do not think it is reasonable to have required the officers p to sift through the large mass of documents and computer files found in the Hensons' office, in an effort to segregate those few papers that were outside the warrant. Id. at 13834 (emphasis added). Although the Henson defendants argued that agents seized items not covered by the warrant, this did not invalidate the search. As noted by the court, A search does not become invalid merely because some items not covered by a warrant are seized.... Absent flagrant disregard for the limitations 0 of a search warrant, the items covered by the warrant will be admissible. @ P Id. at 1383 (citations omitted). See also U.S. v. Snow, 919 F.2d 1458, ` 1461 (10th Cir. 1990). p [page 58] The Eleventh Circuit expressed a similar rule of reasonableness in United States v. Wuagneux, 683 F.2d 1343, 1353 (11th Cir. 1982), cert. denied, 464 U.S. 814 (1983). In Wuagneux, a dozen agents searched the records of a business for a day and a half, and seized between 50,000 and 100,000 documents (approximately one to two percent of those on the premises). Defendants complained that the agents should not have removed whole files or folders in order to take a particular document, but the court disagreed: "To require otherwise `would substantially increase the time required to conduct the search, thereby aggravating the intrusiveness of 0 the search,' " citing United States v. Beusch, 596 F.2d 871, 8767 (9th @ Cir. 1979). The Eighth Circuit reached the same conclusion in Marvin v. F P P p ( ? ? ` H FU.S. , 732 F.2d 669 (8th Cir. 1984), where agents searched a clinic for p financial information related to tax fraud. The agents seized many files without examining the contents at the scene, intending to copy and sort them later. Although the agents seized some files that were completely outside the warrant, the district court's remedy, upheld on appeal, was to order return of the irrelevant items. The agents' decision not to comb through all the files at the scene, the court noted, was "prompted largely by practical considerations and time constraints." Id. at 675. Accord Naugle v. Witney, 755 F. Supp. 1504, 1516 (D. Utah 1990)(Removing an entire filing cabinet, including items not described in the warrant, was reasonable since the alternative would require officers to remain on the premises for days, a result less reasonable and more intrusive.) 0 b. Warrant is Narrowly Drawn but Number of Documents to be Sifted @ through is Enormous P ` The more difficult cases are those in which the soughtafter evidence is p far more limited and the description in the warrant is (and should be) more limited as well. "When the probable cause covers fewer documents in a system of files, the warrant must be more confined and tell the officers how to separate the documents to be seized from others." United States v. Bentley, supra, at 1110. The problem of the narrowly drawn, tightly focused warrant is illustrated by U.S. v. Tamura, 694 F.2d 591 (9th Cir. 1982). Because agents knew exactly what records they sought at a particular business, they were able (and it was reasonable for them) to draft the warrant very specifically. But it 0 [page 59] @ P was much easier to describe the records than to find them, especially ` when the company employees refused to help. In the end, the agents simply p took all the records including eleven boxes of computer printouts, 34 file drawers of vouchers, and 17 drawers of cancelled checks. Unlike most other cases that address these issues, this court faced a seizure where most of the documents taken were outside the warrant. It concluded, therefore, that "the wholesale seizure for later detailed examination of records not described in a warrant is significantly more intrusive, and has been characterized as `the kind of investigatory dragnet that the F p ( @ @ H FFourth Amendment was designed to prevent.'" Id. at 595 (citations omitted). Although the court found reversal was not compelled (because the government had been "motivated by considerations of practicality"), it also found this a "close case." Their advice for law enforcement is 0 concrete: @ P In the comparatively rare instances where documents are so intermingled ` that they cannot feasibly be sorted on site, we suggest that the p Government and law enforcement officials generally can avoid violating Fourth Amendment rights by sealing and holding the documents pending approval by a magistrate of a further search, in accordance with the procedures set forth in the American Law Institute's Model Code of PreArraignment Procedure. If the need for transporting the documents is known to the officers prior to the search, they may apply for specific authorization for largescale removal of material, which should be granted by the magistrate issuing the warrant only where onsite sorting is infeasible and no other practical alternative exists. Id. at 5956 (footnote omitted). 0 c. Warrant Executed in the Home @ P When a search is conducted at a home instead of a business, courts seem ` more understanding of an agent's predilections to seize now and sort p later. In United States v. Fawole, 785 F.2d 1141, 1144 (4th Cir. 1986), ten agents had searched the defendant's home for three and a half hours removing, among other things, 350 documents. Almost half of those papers were in a briefcase, which the agents seized without sorting. Although many things in the briefcase [page 60] were outside the scope of the warrant, the court found that, under the ! circumstances, the seizure did not amount to a general, exploratory ! " rummaging in a person's belongings. " # # $ 0 Even more extensive were the seizures in United States v. Santarelli, $ % @ 778 F.2d 609 (11th Cir. 1985). In that case, agents searched the home of % & P a suspected loanshark, confiscating the entire contents of a fourdrawer & ' ` file cabinet. In the end, they left with eight large boxes of items which F ' ( p p p ( ( A A H Fthey inventoried at the local FBI office. When the defendant objected to ( ) this process, the court strongly disagreed: ) * * + Given the fact that the search warrant entitled the agents to search for + , documents .... it is clear that the agents were entitled to examine each , - document in the bedroom or in the filing cabinet to determine whether it - . constituted evidence.... It follows that Santarelli would have no cause . / to object if the agents had entered his home to examine the documents and / 0 remained there as long as the search required. The district court 0 1 estimated that a brief examination of each document would have taken 1 2 several days. Under these circumstances, we believe that the agents acted 2 3 0 reasonably when they removed the documents to another location for 3 4 @ subsequent examination.... [T]o require an onpremises examination under 4 5 P such circumstances would significantly aggravate the intrusiveness of the 5 6 ` search by prolonging the time the police would be required to remain in 6 7 p the home. 7 8 8 9 Id. at 6156 (citation omitted). 9 : : ; d. Applying Existing Rules to Computers ; < < = Clearly, the Tamura court could not have anticipated that the explosion = > in computers would result in the widespread commingling of documents. > ? While computers are often set up with directories and subdirectories ? @ (much like a file cabinet is set up with file folders), many users put @ A data on disks in random fashion. Thus, a particular letter or file could A B be anywhere on a hard disk or in a box of floppies. B C 0 C D @ [page 61] D E P E F ` Most important, all of the filecabinet cases discussed above implicitly F G p rely on the premise that "documents" are readily accessible and G H ascertainable items; that any agent can find them and (unless the subject H I is quite technical) can read, sort, and copy those covered by warrant. I J The biggest problem in the paper cases is time, the days it takes to do a J K painstaking job. But computer searches have added a formidable new K L barrier, because searching and seizing are no longer as simple as opening L M a file cabinet drawer. When agents seize data from computer storage M N devices, they will need technical skill just to get the file drawer open. N O While some agents will be "computer literate," only a few will be F O P p ( P B B H Fexpert; and none can be expert on every sort of system. Courts have not P Q yet addressed this reality. In the meantime, search warrant planning in Q R 0 every computer case should explore whether agents will ask for offsite R S @ search authority in the warrant application. S T P T U ` 2. Seizing Computers because of Technical Concerns U V p V W a. Conducting a Controlled Search to Avoid Destroying Data W X X Y The computer expert who searches a target's computer system for Y Z information may need to know about specialized hardware, operating Z [ systems, or applications software just to get to the information. For [ \ example, an agent who has never used Lotus 123 (a spreadsheet program) \ ] will not be able to safely retrieve and print Lotus 123 files. If the ] ^ agent entered the wrong computer command, he could unwittingly alter or ^ _ destroy the data on the system. This sort of mistake not only alters _ ` evidence, but could create problems for the system's owner as well. Since ` a it is the government's responsibility to recover evidence without a b 0 altering data, the safest course is to rely on experts working in b c @ controlled environments. c d P d e ` Additionally, savvy computer criminals may know how to tripwire their e f p computers with "hot keys" or other selfdestruct programs that could f g erase vital evidence if the system were examined by anyone other than an g h expert. For example, a criminal could write a very short program that h i would cause the computer to demand a password periodically and, if the i j correct password is not entered within ten seconds, it would destroy data j k automatically. In some cases, k l l m [page 62] m n n o valuable evidence has been lost because of the way the computers were o p handled. Therefore, this concern may make it doubly important to remove p q the computers, unless an expert determines that an onsite search will be q r 0 adequate. r s @ s t P Quite obviously, some computers (such as large mainframes) are not easily t u ` moved. And some defendants will no doubt argue that if the government can u v p search a mainframe computer on site, it can search PCs on site as well. v w Even so, the test should not be what is arguably possible, but rather F w x p ( x C C H Fwhat is the most reasonable, most reliable, and least intrusive way to x y search each system. The fact that mainframes may pose unique problems y z should not lead courts to adopt impractical rules for other searches. z { { | In sum, there is ample authority to justify removing computer systems (or | } the relevant parts of them) to a field office or laboratory in order to } ~ search them for information. This is especially true where the warrant is ~ broad, an onsite search will be intrusive, or technical concerns warrant moving the system to a lab. This will not always be the case, however, 0 and agents and their experts should explore searching on site (or making @ exact copies to search later) whenever it is appropriate. Before agents P ask for authority to seize any hardware for an offsite data search, they ` should analyze the reasons and set them out clearly for the magistrate. p b. Seizing Hardware and Documentation so the System Will Operate at the Lab With an everincreasing array of computer components on the marketand with existing hardware and software becoming obsoleteit may be impossible to seize parts of a computer system (e.g., the CPU and hard drive) and operate them at the laboratory. In fact, there may be times when agents will need to seize every component in the computer system and later have a laboratory computer specialist determine whether or not each piece can be returned. Many hardware incompatibilities exist (even within a given computer family such as IBMcompatible PCs), and the laboratory 0 experts may need to properly reconfigure the system back at the lab in @ order to read data from it. P ` [page 63] p Peripherals such as printers and special input and display devices may be necessary to operate and display certain software applications. Agents should attempt to learn as much about the system to be searched as possible so that appropriate seizure decisions can be made. If certain peripherals must be seized to insure that the data can be retrieved from storage devices, this should be articulated in the warrant affidavit and covered in the warrant. Then an expert should examine the seized equipment as soon as practicable to determine whether the peripheral devices need to be retained. This approach relies completely on the facts of each case. It will seem reasonable and temperate when the I/O devices F p ( D D 0 H Fseized are essential, but not when the items seized are commercially @ available and the only justification for the seizure/retention is P convenience and not necessity. If in doubt, agents should seek permission ` to seize the peripherals, and then insure a prompt review at the lab. p Similarly, when agents search and seize a computer system, they should ask for authority to seize any documentation that explains the hardware and software being seized. Documentation found at the scene may be a key in re~assembling the computer, operating it, or using the software on the machine properly. If the computer's user is experienced, he may have customized the software, and the documentation may be required to retrieve data. Although a computer lab may have or be able to obtain many standard varieties of documentation, some of it may not be easily available for purchase. As with hardware or software, the documentation should not be seized unless needed and, if seized, should be returned when no longer required. 0 @ I. EXPERT ASSISTANCE P ` 1. Introduction p While planning is important to the success of any search, it is critical in searching and seizing information from computers. Agents should determine, to the extent possible, the type of computer involved, what operating system it uses, and whether the information sought can be accessed by, or is controlled by, a computer literate target. [page 64] Answering these questions is key, because no expert can be expert on all systems. Mainframes, for example, are made by various companies (e.g., IBM, DEC, Cray) and often run unique, proprietary operating systems. Even 0 the PC market offers significantly different hardware/software @ configurations. Although the most common desktop computer is an IBM or P IBMcompatible system, it runs a range of operating systems including DOS ` (with or without Windows), OS/2, and UNIX. Apple Computers are also p popular and run their own unique operating system. Computer literate targets may attempt to frustrate the proper execution of a search warrant. For example, an ingenious owner might have installed F p ( E E H Fhidden commands that could delete important data if certain startup procedures are not followed. If this might be the case, experts will take special precautions before the search: they will, for example, start (or "boot") the computer from a "clean" system diskette in a floppy drive, not from the operating software installed on the system. These hidden traps, as well as passwords and other security devices, are all obstacles that might be encountered in a search. 0 @ In sum, since computer experts cannot possibly be expert on all systems, P it is important lo have the correct expert on the scene. Knowing the type ` of computer to be searched, and the type of operating system being used, p will allow the appropriate expert to be selected. This, in turn, will streamline the search process, since the expert may be familiar with the software and file structures on the target machine. 2. Finding Experts Most situations will require an expert to retrieve, analyze, and preserve data from the computers to be searched. Oftentimes the job may not be so complex: the records may be stored with a standard brand of software using the DOS (Disk Operating System) format. Some of the most common software programs are WordPerfect (for text), Lotus (for spreadsheets), and dBase (for databases). If it is more complicated than this, however, 0 only an expert in the hardware and software at hand should do the work. @ P ` [page 65] p To determine what type of expert will be needed, agents should get as much information about the targeted system as possible. Sources like undercover agents, informants, former employees, or mail covers can provide information about the system at the search site. Once the computer systems and software involved have been identified, an appropriate expert can be found from either the federal or private sector. Ultimately, the expert must use sound scientific techniques to examine any computer evidence. a. Federal Sources 0 The best place to find an expert may be in the investigating agency F @ @ p ( F F P H Fitself. Many federal agencies have experienced people on staff who can ` help quickly when the need arises, and the list at APPENDIX C provides p contact points for various agencies. If the investigating agency lacks an expert in the particular system to be searched, other federal agencies may be able to assist. The trick, of course, is to find the expert while planning for the search and not to start looking after the agents execute the warrant. Prosecutors must allow time to explore the federal network and find the right person. Most of the federal agencies that routinely execute search warrants for computer evidence have analysts at central laboratories or field experts who can search the seized computer evidence. Many of them will also work on evidence from other federal or state agencies as time permits. It is important to call early to get specific instructions for handling the 0 evidence, and these experts can provide other technical assistance as @ well. For example, there are many kinds of software (both government and P private) which will help process evidence, break passwords, decrypt ` files, recover hidden or deleted data, or assist investigators in other p important ways. Because these utilities are constantly changing, it is important to consult with experts who have them and know how to use them. Each agency organizes its computer experts differently. For example, the Computer Analysis and Response Team (CART) is a specialized team within the central FBI Laboratory in Washington, D.C., that examines various types of computer evidence for FBI agents nationwide. The IRS, on the other hand, has about seventy decentralized experts, called Seized Computer Evidence Recovery (SCER) Specialists who work in controlled environments [page 66] 0 @ across the country. Almost every IRS District has at least one SCER P Specialist, and many have two. The Drug Enforcement Administration's ` forensic computer experts are also experienced in all phases of computer p operations related to criminal cases, including data retrieval from damaged media and decryption. The U.S. Secret Service has approximately twelve special agents who are members of the Electronic Crimes Special Agent Program (ECSAP). These agents are assigned to field offices on a regional basis and are trained in the area of computer investigations and computer forensics. (For a list of federal sources for computer experts, F p ( G G H Fsee APPENDIX C, p. 143.) b. Private Experts Whatever the source of a private expert, the affidavit should ask 0 permission to use nonlawenforcement personnel during the execution of @ the search warrant. The issuing magistrate should know why an expert is P needed and what his role will be during the search. Agents must carefully ` monitor the expert to insure that he does not exceed the limits described ! p in the search warrant. Certain expertsthose not familiar with the ! " judicial systemare not likely to be expert on how to execute a search " # warrant, protect chainof~custody, or resolve search issues that may # $ affect the evidence's admissibility at trial. Thus, a private expert $ % should be paired with an experienced agent every step of the way. In % & addition, the expert's employment contract should address confidentiality & ' issues, and include a nondisclosure clause and a statement of Privacy ' ( Act restrictions. If the contracting agency is the IRS, pay special note ( ) to Internal Revenue Code provisions at 26 U.S.C. 6103, which address ) * rules for confidentiality and nondisclosure of tax return information. * + + , (1) Professional Computer Organizations , - 0 - . @ Many professional computer organizations have members who are experts in . / P a wide variety of hardware and software. Computer experts from the / 0 ` government are a good source for finding a private expert, for the 0 1 p organizations and contacts between them change almost as fast as the 1 2 technology. Also, one advantage of using a professional organization as 2 3 the source of an expert is that 3 4 4 5 [page 67] 5 6 6 7 these organizations usually have members who work routinely with federal 7 8 or state law enforcement and are therefore familiar with handling 8 9 evidence and testifying. 9 : : ; (2) Universities ; < < = 0 Another source for experts is a university, especially for hightech = > @ crimes involving rare kinds of hardware or software. The academic > ? P environment attracts problemsolvers who may have skills and research F ? @ ` ` p ( @ H H p H Fcontacts unavailable in law enforcement. @ A A B (3) Computer and Telecommunications Industry Personnel B C C D In some cases, the very best expert may come from a vendor or service D E provider, particularly when the case involves mainframes, networks, or E F unusual systems. Many companies such as IBM and Data General employ some F G experts solely to assist various law enforcement agencies on search G H warrants. H I I J (4) The Victim J K K L 0 Finally, in some circumstances, an expert from the victim organization L M @ may be the best choice, especially if the hardware configuration or M N P software applications are unique to that organization. Agents and N O ` prosecutors must, of course, be sensitive to potential claims of bias. O P p Many relevant issues, such as estimates of loss, may pose a considerable P Q gray area. Even if the victimexpert is completely dispassionate and Q R neutral in her evaluation, her affiliation with and loyalty to the victim R S organization may create a bias issue later at trial. S T T U U V [page 68] V W W X 3. What the Experts Can Do X Y Y Z a. Search Planning and Execution Z [ [ \ 0 Agents and prosecutors who anticipate searching and seizing computers \ ] @ should include a computer expert in the planning team as early as ] ^ P possible. Experts can help immeasurably in anticipating the technical ^ _ ` aspects of the search. This not only makes the search smoother, it is _ ` p important information for designing the scope of the warrant. In ` a particular, if agents can give the expert any information about the a b target's specific computer system, the expert may be better able to b c predict which items can be searched at the scene, which must be seized c d for later analysis, and which may be left behind. d e e f Further, if the computer system is unusual or complex, technical experts f g can be invaluable help at the scene during the search. Particularly when F g h p ( h I I H Fevidence resides on computer networks, backup tapes, or in h i customtailored systems, the evidence will be safest in the hands of an i j expert. j k 0 k l @ b. Electronic Analysis l m P m n ` The experts will examine all the seized computer items (so long as they n o p are properly preserved and sealed) and will recover whatever evidence o p they can. Most forensic computer examiners will perform at least the p q following: (1) make the equipment operate properly; (2) retrieve q r information; (3) unblock "deleted" or "erased" data storage devices; r s (4) bypass or defeat passwords; (5) decipher encrypted data; and (6) s t detect the presence of known viruses. t u u v The data to be searched can consist of hundreds or even thousands of v w files and directories. In some cases, there will be evidence in most of w x the files seized, and in others, only a small fraction of them. Once the x y analyst has protected the original data from change, she must begin to y z search for the relevant material. z { 0 { | @ | } P [page 69] } ~ ` ~ p A good first step is to print out a directory of the information contained on a hard drive or floppy disk. Directories give valuable information about what is in the files, when they were created, and how long they are. Of course, analysts will not entirely trust file names, as hackers have been known to hide highly incriminating material in files with innocuous names and misleading dates. Once the analyst has printed a directory, he will probably log onto the hard or floppy drive and look at each file, noting on the printed directory (or a separate log sheet if available) the type of information in each file and whether it appears relevant. Relevant files can be copied onto a separate disk or printed out in hard copy. It is a good 0 idea always to review files from bitstream copies (which record each @ separate bit of information, including hidden files) or in "read only" P mode so that the reviewer can read the document but cannot edit it. This ` way, the agents can later testify that the seized material could not have p been mistakenly altered during the review. Of course, there is more than F p ( J J H Fone "right way" to analyze electronic evidence, and experts must deal with the circumstances of each case. Ultimately the analyst must adhere to sound scientific protocols in recovering and examining computerrelated evidence, and keep clear and complete records of the process. c. Trial Preparation Computer forensic experts can help prosecute the case with advice about how to present computerrelated evidence in court. Many are experienced 0 expert witnesses and they can (1) help prepare the direct case; and (2) @ anticipate and rebut defense claims. In addition, computer experts can P assist prosecutors in complying with the new federal rules pertaining to ` expert witnesses, Fed. R. Evid. 16(a)(1)(E) and 16(b)(1)(C), effective p December 1, 1993. Under these rules, the government must provide, upon request, a written summary of expert testimony which it intends to use during its case in chief. There is a reciprocal requirement for the summary of defense expert witness testimony, as long as the defense has requested a summary from the government, and the government has complied. [page 70] d. Training for Field Agents Before a computer case ever arises, experts can train agents and 0 prosecutors about computer search problems and opportunities. They can @ teach investigators how to preserve and submit computer evidence for P examination, and many will also provide field support as time permits. ` p [page 71] V. NETWORKS AND BULLETIN BOARDS A. INTRODUCTION Electronic Bulletin Board Services (BBSs) are computers set up to serve in the electronic world as places where users can post and read messagesmuch like traditional bulletin boards. In addition, however, a BBS may also permit users to communicate via private electronic mail, to F p ( K K H Fengage in "chat sessions" (realtime conversations where the "speakers" 0 talk by using their keyboards instead of their voices), to upload and download files, and to share information on topics of common interest (e.g., a newsletter on stamp collecting). A sysop runs the bulletin board, and BBS users access it with their computers over regular telephone lines. Some bulletin boards, known as "pirate bulletin boards," are maintained for illegal purposes such as distributing copyrighted software, credit card numbers, telephone access codes, and pornography. A BBS dedicated to phone fraud is also called a "phone phreaker board," and those which @ distribute child pornography and adult obscenity are called, not P surprisingly, "porn boards." The illegal material on these boards is not ` protected by the First Amendment since such items are "fruits of crime" p and "contraband" and do not convey any thought, opinion, or artistic expression. Nor can these operations claim some sort of "press protection" for publishing these items, since the Constitution does not shield the press against laws of general applicability. In short, the First Amendment is not a license to commit crimes. See Securities and Exchange Commission v. McGoff, 647 F.2d 185 (D.C. Cir.), cert. denied, 452 U.S. 963 (1981); Cf. Pell v. Procunier, 417 U.S. 817, 8335 (1974)(the right to speak and publish does not carry an unrestrained right to gather information; a prison may restrict the press's access to F p ( d d 0 H Fits inmates in accord with the state's legitimate incarceration policy @ objectives). P ` It gets more complex, however, because many bulletin boards are not p devoted solely to illegal activities, but are hybrid boards: they contain both illegal and legal material. To complicate matters further, the legitimate material on the board (or stored on the same computer which runs the board) may be statutorily protected. For example, some private electronic mail may be covered under 18 U.S.C. 2701, et seq., Stored Wire [page 72] and Electronic Communications. (For further discussion, see "STORED 0 ELECTRONIC COMMUNICATIONS," infra p. 85). Even more difficult, some @ material may be specifically protected from search and seizure by a P complex statute called the Privacy Protection Act, 42 U.S.C. 2000aa. In ` order to understand the scope and intricacy of this statute and how it might apply to computer searches, it helps to begin with the case which prompted it. B. THE PRIVACY PROTECTION ACT, 42 U.S.C. 2000aa 1. A Brief History of the Privacy Protection Act On April 9, 1971, nine police officers in California responded to Stanford University Hospital to disperse a large group of demonstrators. The demonstrators resisted, and they ultimately attacked and injured all @ nine officers. Two days later, on April 11, The Stanford Daily, a student ` newspaper, carried articles and photographs devoted to the student p protest and the clash between these protestors and the police. Believing that The Stanford Daily might possess additional photographs that would F p ( e e H Fidentify other protestors, the police sought and obtained a search warrant to search the newspaper's offices. A month after the search, The Stanford Daily brought a civil action alleging violations of the First, Fourth and Fourteenth Amendments. In support of their claims, the plaintiffs alleged that (1) the Fourth Amendment forbade the issuance of search warrants for evidence in the 0 possession of those not suspected of criminal activity and (2) the First P Amendment prohibited the use of search warrants against members of the ` press and, instead, required the use of subpoenas duces tecum. Zurcher v. Stanford Daily, 436 U.S. 547 (1978). The Supreme Court disagreed with both claims, holding that the use of a search warrant, even for the pursuit of "mere evidence," was permitted on both non~suspect third parties and members of the news media. [page 73] In response to Zurcher, Congress passed the Privacy Protection Act of 1980, 42 U.S.C. 2000aa (hereinafter the PPA). The purpose of this 0 legislation, as stated in the Senate Report, is to afford "the press and @ certain other persons not suspected of committing a crime with P protections not provided currently by the Fourth Amendment." S. Rep. No. ` 874, 96th Cong., 2d Sess. 4 (1980). As the legislative history indicates, the purpose of this statute is to limit searches for materials held by persons involved in First Amendment activities who are themselves not suspected of participation in the criminal activity for which the materials are sought, and not to limit the ability of law enforcement officers to search for and seize materials held by those suspected of committing the crime under investigation.7 Id. at 11. The PPA protects two classes of materialsdefined as "work product materials" and "documentary materials"by restricting beyond the 0 existing limits of the Fourth Amendment when government agents can 6 @ p ( f f P H 6get @ warrants to search for or seize them. p It is important to note that, although victims of a search which violates the PPA may not move to suppress the results, the statute does create civil remedies. Moreover, the PPA specifically precludes the government from asserting a good faith defense to civil claims, so in this respect 2000aa is a strict liability statute. 2. Work Product Materials 0 In general terms, the first category of protected material covers @ original work in the possession of anyone (including authors and P publishers) who intends (from an objective view) to publish it. In ` construing this statute, the exact language of the definitions is p important. Specifically, "work product materials" are defined in 42 U.S.C. 2000aa7(b) as 7 The Department had previously promulgated regulations on issuing subpoenas directly to members of the news media or indirectly for their telephone toll records. The regulations also addressed interrogating, indicting, or arresting members of the press. See 28 C.F.R. 50.10. [page 74] ! 0 materials, other than contraband or the fruits of a crime or things " @ otherwise criminally possessed, or property designed or intended for use, # P or which is or has been used, as the means of committing a criminal $ p offense, and % & (1) in anticipation of communicating such materials to the public, are ' prepared, produced, authored, or created, whether by the person in ( possession of the materials or by any other person; ) F * p ( g g H F(2) are possessed for the purposes of communicating such materials to the + public; and , - (3) include mental impressions, conclusions, opinions, or theories of the . 0 person who prepared, produced, authored, or created such material. / P 0 ` When "work product materials" are involved, Title 42, Section 2000aa(a) 1 " p provides that: 2 # 3 $ Notwithstanding any other law, it shall be unlawful for a government 4 % officer or employee, in connection with the investigation or prosecution 5 ' of a criminal offense, to search for or seize any work product materials 6 ) possessed by a person reasonably believed to have a purpose to 7 * disseminate to the public a newspaper, book, broadcast, or other similar 8 , form of public communication, in or affecting interstate or foreign 9 - 0 commerce. . (emphasis added). . .[unless] : . @ ; / P (1) there is probable cause to believe that the person possessing such < 0 ` materials has committed or is committing the criminal offense to which = 2 p the materials relate: Provided, however, That a government officer or > 3 employee may not search for or seize such materials under the provisions ? 5 of this paragraph if the offense to which the materials relate consists @ 6 of the receipt, possession, communication, or withholding of such A 7 materials or the information contained therein (but such a search or B 8 seizure may be conducted under the provisions of this paragraph if the C : offense consists of the receipt, possession, or communication of D ; information relating to the national defense, classified information, or E < restricted data under the provisions of section 793, 794, 797, or F = 0 G > @ [page 75] H ? P F I @ ` ` p (@ h h p H F798 of Title 18, or section 2274, 2275 or 2277 of this title, or section J A 783 of Title 50); or K B L C (2) there is reason to believe that the immediate seizure of such M D materials is necessary to prevent the death of, or serious bodily injury N F to, a human being. O G P H Thus, under 2000aa(a), there are three situations in which government Q J agents may search for or seize these materials without running afoul of R L the statute. First, the definition itself specifically excludes S M @ contraband or the fruits or instrumentalities of a crime. 42 U.S.C. T N P 2000aa7(b). As the drafting Committee noted, U O ` V P p [T]hese kinds of evidence are so intimately related to the commission of W R a crime, and so often essential to securing a conviction, that they X S should be available for law enforcement purposes, and, therefore, must Y U fall outside the no search rule that is applied to work product. Z V [ W S. Rep. 96874, 96th Cong., 2d Sess. 17, reprinted in 1980 U.S. Code \ X Cong. & Admin. News 3964. In BBS cases, the most common objects of the ] Z warrantstolen access codes, child pornography, and illegally copied ^ [ softwarewould clearly fall within the contraband exclusion, so the PPA _ ] 0 would not affect a warrant drawn for these materials. ` ^ P a _ ` In addition, as quoted above, the PPA creates two exceptions to the b ` p general prohibition against seizing "work product." One excepts c a situations in which life and limb are at stake. The other applies when d b (1) the work product is evidence of crime, and (2) the person who e c possesses the materials probably committed it. Even so, this f d evidenceofcrime exception does not apply if the particular crime g e "consists of the receipt, possession, communication or withholding of h f such material....'' unless the work product was classified or i g restricted, and the offense is specifically listed in the PPA. 42 U.S.C. F j h p (h i i H F2000aa(a)(1) and (b)(1). This general evidenceofcrime exception was k i intended to l j m k 0 codify a core principle of this section, which is to protect from search n l @ only those persons involved in First Amendment activities who are o m P themselves not implicated in the crime under investigation, and not to p n ` shield those who participate in crime. q o p r p [page 76] s q t r H.R. Rep. No. 1064, 96th Cong., 2d Sess. 7. To trigger the exception, u s however, law enforcement officials are held to a higherthanusual v t requirement: they must show probable cause to believe the person who w v holds the evidentiary materials is a suspect of the crimethe same x w showing of cause required for an arrest warrant. S. Rep. No. 874, 96th y x Cong., 2d Sess. 11, reprinted in 1980 U.S. Code Cong. & Admin. News 3950, z z 3957. { { 0 | | @ It may, of course, be difficult to invoke this evidenceofcrime } } P exception, particularly at early stages of the investigation. As the ~ ~ ` Supreme Court noted in Zurcher (and a number of commentators have p reiterated since), a search warrant is often most useful early in an investigation when agents have probable cause to believe there is evidence on the premises, but are not ready to arrest any particular person. See Zurcher v. Stanford Daily, 436 U.S. at 561; Testimony of Richard J. Williams, Vice President, National District Attorney's Association, in Hearing before the Committee on the Judiciary, United States Senate, 96th Cong., 2d Sess. on S. 115, S. 1790, and S. 1816 (Mar. 28, 1980) Serial No. 9659, at 1523. The receivingstolenproperty exemptionwhich prevents agents from using the evidenceofcrime exception when the crime is receipt, possession, @ communication, or withholding of the same work product materials was ` included to prevent law enforcement officials from classifying work F p ( j j H Fproduct as "stolen goods" to justify seizing it. The Committee report gave as its primary example the case of a reporter who receives an underthetable copy of a corporate memo discussing a defective product. Knowing the report to be stolen, the reporter might be guilty of receiving or possessing stolen property and thus unprotected by the PPA. The Committee believed that it would unduly broaden the suspect exception to use the reporter's crime of simple "possession" or "receipt" of the @ materials (or the similar secondary crimes of "withholding" or P "communicating" the materials) as a vehicle for invoking the exception ` when the reporter himself had not participated in the commission of the crimes through which the materials were obtained H. Rep. No. 1064, 96th Cong., 2d Sess. 7 (emphasis added). In light of Congress's stated concern, perhaps this counterexception does not apply when anything more than simple possession is involved: that is, possession is combined with the mens rea necessary to constitute some other offense (e.g., 0 [page 77] @ P possession with intent to defraud). See 18 U.S.C. 1029(a)(3) (making it ` a crime to "knowingly and with intent to defraud" possess fifteen or more p devices which are counterfeit or unauthorized access devices); 18 U.S.C. 1030(a)(6) (making it a crime to "knowingly and with intent to defraud" traffic in any password or similar information through which a computer may be accessed without authorization). 3. Documentary Materials F p ( k k H Fܿ 0 In addition to protecting work product, the PPA covers a second, larger @ class of items called "documentary materials." The statute defines this ` term in extraordinarily broad fashiona definition which covers almost all forms of recorded information which are "... possessed by a person in connection with a purpose to disseminate to the public a newspaper, book, broadcast, or other similar form of public communication...." 42 U.S.C. 2000aa(b) (emphasis added). Specifically, "documentary materials" encompass materials upon which information is recorded, and includes, but is not limited to, written or printed materials, photographs, motion picture 0 films, negatives, video tapes, audio tapes, and other mechanically, @ magnetically or electronically recorded cards, tapes, or discs, but does P not include contraband or the fruits of a crime or things otherwise p criminally possessed, or property designed or intended for use, or which is or has been used as, the means of committing a criminal offense. 42 U.S.C. 2000aa7(a). As with "work product materials," the statute excludes from the definition of "documentary materials" any items which are contraband or the fruits or instrumentalities of a crime. 42 U.S.C. 2000aa7(a). Further, the two exceptions to the workproduct search prohibition, discussed above, also apply to searches for documentary materials: they 0 may be searched and seized under warrant in order to (1) prevent death or P serious injury; or (2) to search for evidence of crime held by a suspect p of that crime. (This last exception includes all its attendant internal exemptions, examined above, relating to crimes of possession or receipt.) F p ( l l H Fܿ [page 78 Additionally, the PPA allows agents to get a warrant for documentary materials under two more circumstances found at 42 U.S.C. 2000aa(b): 0 (3) there is reason to believe that the giving of notice pursuant to a @ subpena duces tecum would result in the destruction, alteration, or P concealment of such materials; or ` p (4) such materials have not been produced in response to a court order directing compliance with a subpena duces tecum, and (A) all appellate remedies have been exhausted; or (B) there is reason to believe that the delay in an investigation or trial occasioned by further proceedings relating to the subpena would threaten the interests of justice. In drawing these additional exceptions, Congress anticipated some of the factors a court might consider in determining whether relevant @ documentary materials could be lost to the government. These factors P include whether there is (1) a close relationship (personal, family, or ` business) between the suspect and the person who holds the material, or p (2) evidence that someone may hide, move, or destroy it. S. Rep. 96 874, 96th Cong., 2d Sess. 13, reprinted in U.S. Code Cong. & Admin. News 3950, 395960. 4. Computer Searches and the Privacy Protection Act The Privacy Protection Act only applies to situations where law enforcement officers are searching or seizing (1) work product 6 0 p ( m m @ H 6materials 0 possessed by a person reasonably believed to have a purpose to ` disseminate to the public a newspaper, book, broadcast, or other similar p form of public communication; or (2) documentary materials possessed by a person in connection with a purpose to disseminate to the public a newspaper, book, broadcast, or other similar form of public communication. 42 U.S.C. [page 79] 2000aa(a) and (b). Before the computer revolution, the statute's most obvious application was to traditional publishers, such as newspaper or book publishers. The legislative history makes clear, however, that the @ PPA was not intended to apply solely to the traditional news media but ` was meant to have a more sweeping application. As thenAssistant Attorney General for the Criminal Division Phillip B. Heymann testified: While we considered the option of a pressonly bill, this format was rejected partially because of the extreme difficulties of arriving at a ! workable definition of the press, but more importantly because the First # Amendment pursuits of others who are not members of the press $ establishment are equally as important and equally as susceptible to the & chilling effect of governmental searches as are those of members of the ( 0 news media. ) P * ` H. Rep. No. 1064, 96th Cong., 2d Sess., Transcript of Statement on File, + p at 4. , - With the widespread proliferation of personal computers, desktop . publishing, and BBS services, virtually anyone with a personal computer F 0 p (0 n n H Fand modem can disseminate to other members of the public (especially 2 those who have appropriate hardware and software) a "newspaper ... or 4 other similar form of public communication." Thus, the scope of the PPA 6 may have been greatly expanded as a practical consequence of the 7 @ revolution in information technologya result which was probably not 9 P envisioned by the Act's drafters. : p ; Before searching any BBS, therefore, agents must carefully consider the = restrictions of the PPA, along with its exceptions. Additionally, they > should include any information bearing on the applicability of this ? statute (and its many exceptions and subexceptions) in the warrant @ affidavit. That said, it is also important to recognize that not every A sysop who possesses information necessarily has an intent to disseminate C it to the public. Nor is every BBS engaged in a "similar form of public D communication." E F 0 a. The Reasonable Belief Standard G @ H P When addressing work product materials, the statute, by its terms, only J ` applies when the materials are possessed by a person "reasonably believed L M [page 80] N O to have a purpose to disseminate to the public a newspaper, book, P broadcast, or other similar form of public communication." 42 U.S.C. Q 2000aa(a). In non~computer contexts, the courts have concluded that it is S not enough just to possess materials a professional reporter might T possess. In addition, there must be some indication the person intended ! V to disseminate them. In Lambert v. Polk County, Iowa, 723 F. Supp. 128 F " X @ P p (X o o ` H F(S.D. Iowa 1989), for example, the plaintiff Lambert captured a fatal # Y p beating on videotape. Police investigating the incident seized the tape $ Z from Lambert and, shortly thereafter, Lambert contracted to sell the tape % \ to a local television station. After the police refused to relinquish the & ] tape, the television station and Lambert sued for injunctive relief ' ^ claiming, among other things, a violation of 42 U.S.C. 2000aa. While the ( ` district court granted relief on other grounds, it held that neither the ) a television station nor Lambert was likely to prevail on a 42 U.S.C. * b 2000aa claim. The television station was not the aggrieved party, and + c "there was nothing about the way Lambert presented himself [to the , d officers] that would have led them to reasonably believe that Lambert's - f 0 purpose was to make a dissemination of the videotape to the public." . g P Lambert, 723 F. Supp. at 132. But cf. Minneapolis Star & Tribune Co. v. / h ` United States, 713 F. Supp. 1308 (D. Minn. 1989)(plaintiffs from whom 0 i p videotapes were seized at robbery scene were successful in PPA claim 1 j because agents apparently had independent knowledge that plaintiffs 2 k represented the established media). 3 l 4 m The reasonable belief standard was also important in the district court 5 o opinion in Steve Jackson Games v. United States, 816 F. Supp. 432 (W.D. 6 p Tex. 1993), appeal filed on other grounds, (Sept. 17, 1993). To 7 q understand the scope of this opinion, it is important to put it in the 8 r context of its facts. In early 1990, the United States Secret Service 9 s began investigating potential federal computer crimes under 18 U.S.C. : t 1030. The Secret Service learned that a Bell South computer system had ; v 0 been invaded, and that the computer hackers were attempting to decrypt < x P passwords which would allow them into computer systems belonging to the = z p Department of Defense. > { ? | During the course of this investigation, the Secret Service received @ } information implicating an individual who was employed by Steve Jackson A Games, a Texas company that published books, magazines, box games, 6 p ( p p H 6and B related products. Steve Jackson Games used computers for a variety of C business purposes, including operating an electronic bulletin board D 0 system ("BBS"). The Secret Service was informed that the suspect was one E @ of the sysops of the Steve Jackson Games BBS, and that he could delete F ` any documents or information in the Steve Jackson Games computers and G bulletin H I [page 81] J K board. Even so, none of the other sysops nor the company itself was ever L a suspect in the investigation. M N On February 28, 1990, the Secret Service obtained a federal warrant to O search the offices of Steve Jackson Games and to seize various computer P @ materials. The warrant covered: Q ` R p Computer hardware * * * and computer software * * * and written material S and documents relating to the use of the computer system, documentation T relating to the attacking of computers and advertising the results of U computer attacks * * *, and financial documents and licensing information V relative to the computer programs and equipment at [the company's W offices] which constitute evidence, instrumentalities and fruits of X ! federal crimes, including interstate transportation of stolen property Y ! (18 U.S.C. 2314) and interstate transportation of computer access Z ! information (18 U.S.C. 1030(a)(6)). This warrant is for the seizure of [ !0 the above described computer and computer data and for the authorization \ !@ to read information stored and contained in the above described computer F ] !` !p p ( q q ! H Fand computer data. ^ ! _ ! The Secret Service executed the warrant on March 1, 1990. The agents ` ! seized two of thirteen functioning computers, and one other computer that a ! was disassembled for repair. The Secret Service also seized a large b ! number of floppy disks, a printer, other computer components, and c ! computer software documentation. Steve Jackson Games immediately d " requested the return of the seized materials, but the agency retained e " most of the materials for several months before returning them. No f " criminal charges were brought as a result of this investigation. g "0 h "@ In May 1991, plaintiffs (Steve Jackson Games; the company's owner and i "P sole shareholder, Steve Jackson; and several individual users of the j "p company's BBS) filed suit against the Secret Service and the United k " States, alleging violations of the Privacy Protection Act. They also l " claimed violations of the Stored Electronic Communications Statute, m " discussed in greater detail at "STORED ELECTRONIC COMMUNICATIONS," infra n " p. 85. o " p " Following a bench trial, the court determined that the defendants had q " violated the Privacy Protection Act. The court held that the materials r # seized by the Secret Service (in particular, the draft of a book about to s # be published) t #0 u #@ [page 82] v #P w #` included "work product materials" and "documentary materials" protected x #p by the Privacy Protection Act. The court decided that seizing these y # materials did not immediately violate the statute, however, because at z # the time of the seizure, the agents did not (in the language of the { # statute) "reasonably believe[]" that Steve Jackson Games "ha[d] a purpose | # to disseminate to the public a news~paper, book, broadcast, or other } # similar form of public communication * * * ." This was true even 6 $ p ( r r $ H 6though ~ $ "only a few hours of investigation" would have revealed it. Id. at 440 $0 n.8. However, the court held that a violation did occur on the day after $@ the search when at least one agent learned the materials were protected $` by the statute and failed to return them promptly. $ $ b. Similar Form of Public Communication $ $ As noted above, the PPA applies only when the materials are possessed by $ a person reasonably believed to have a purpose to disseminate to the $ public "a newspaper, book, broadcast, or other similar form of public $ communication." 42 U.S.C. 2000aa (emphasis added). Not every BBS will % satisfy this standard. For example, a BBS that supplies unauthorized % access codes to a small group of phone phreakers is not disseminating %0 information to the public, nor is it engaging in a form of public %@ communication similar to a newspaper. (Of course, the contraband %P exception will probably also apply in such a case). %` %p The exact scope of the PPA remains uncertain, and the recent opinion in % Steve Jackson Games does not clarify the issue. There the court found a % cognizable PPA violation arising from the Secret Service's search and % prolonged seizure of the successive drafts of a book Steve Jackson was % soon to publish. But, just as important, the court did not hold that % seizing the Steve Jackson BBS likewise violated the statute. Instead, the & court held that "[i]n any event, it is the seizure of the 'work product & materials' that leads to the liability of the United States Secret &0 Service and the United States in this case." 816 F. Supp at 441. Indeed, &@ one of the attorneys who represented Steve Jackson Games reached a &P similar conclusion: &` &p Though the results in the SJG case were very good on balance, a couple of F & & p ( s s & H Fmajor BBS issues were left for better resolution on another day.... [One & issue] is the finding that SJG was a & & [page 83] & ' 'publisher' for purposes of the PPA. This holding ... leaves the ' applicability of the PPA largely undetermined for other BBS'. Steve ' Jackson Games was a print publisher, and its computers were used to '0 support the print publishing operation. What about BBS' that publish '@ their information in electronic form only? What about BBS' that do not 'P publish anything themselves in the traditional sense, but host public '` conferences? The SJG case simply does not give guidance on when a 'p nonprinting BBS qualifies as a publisher or journalistic operation for ' purposes of PPA protection. Rose, Steve Jackson Games Decision Stops the ' Insanity, Boardwatch, May 1993, at 53, 57. ' ' c. Unique Problems: Unknown Targets and Commingled Materials ' ' Applying the PPA to computer BBS searches is especially difficult for two ' reasons. First, early in an investigation, it is often impossible to tell ( whether the BBS sysop is involved in the crime under investigation. But ( unless agents have probable cause to arrest the sysop at the time of the (@ search, the evidenceheldbyatarget exception in 42 U.S.C. 2000aa (` would not apply. (p ( Second, because most computers store thousands of pages of information, ( targets can easily mix contraband with protected work product or ( documentary materials. For example, a BBS trafficking in illegally copied ( software (which, along with the computers used to make the copies, is ( subject to forfeiture) may also be publishing a newsletter on stamp ) collecting. If agents seized the computer (or even all the data), the ) seizure would necessarily include both the pirated software and the F ) ) p ( t t )0 H Fnewsletter. Assuming the stampcollectors' newsletter was completely " )@ unrelated to the criminal copyright violations and also that it qualified # )` as a "similar form of public communication," the seizure might violate $ )p the plain wording of the PPA. % ) & ) There are, as yet, no cases addressing the status of PPAprotected ' ) materials which are commingled with contraband or evidence of crime. ) ) However, in construing the Fourth Amendment, the courts have recognized + ) that there is sometimes no practical alternative to seizing , ) nonevidentiary items and sorting them out later. See National City - * Trading Corp. v. United States, 635 . * / * [page 84] 0 *0 1 *@ F.2d 1020 (2d Cir. 1980)(space used by a law office and by a targeted 2 *P business operation was so commingled that the entire suite, really being 4 *` one set of offices, was properly subject to search); United States v. 5 * Hillyard, 677 F.2d 1336, 1340 (9th Cir. 1982)("Cases may arise in which 6 * stolen goods are intermingled with and practically indistinguishable from 8 * legitimate goods. If commingling prevents on site inspection, and no 9 * practical alternative exists, the entire property may be seizable, at : * least temporarily."); United States v. Tropp, 725 F. Supp. 482, 48788 ; * (D. Wyo. 1989)("Some evidence not pertinent to the warrant was seized ... = * only because it had been commingled or misfiled with relevant documents. ? + That evidence was returned.... In sum, the search warrant comported with A +0 the mandate of the Fourth Amendment and the search conducted pursuant C +P thereto was not unreasonable."). (For a more extensive discussion of D +p commingled materials and offsite searches, see "DECIDING WHETHER TO F + CONDUCT THE SEARCH ONSITE OR TO REMOVE HARDWARE TO ANOTHER LOCATION," F H + + p (H u u + H Fsupra p. 55.) Of course, these commingling cases involve the Fourth I + Amendment, not 42 U.S.C. 2000aa, and it remains to be seen whether these K + holdings will apply to the Privacy Protection Act L , M , 5. Approval of Deputy Assistant Attorney General Required N , O ,0 On September 15, 1993, Deputy Attorney General Philip B. Heymann issued a Q ,@ memorandum which requires that all applications for a warrant issued R ,` under 42 U.S.C. 2000aa(a) must be authorized by the Assistant Attorney T ,p General for the Criminal Division (AAG), upon the recommendation of the V , U.S. Attorney or (for direct Department of Justice cases) the supervising X , Department of Justice attorney. Y , Z , On December 9, 1993, Jo Ann Harris, the Assistant Attorney General (AAG) \ , for the Criminal Division, delegated this authority by memorandum to the ^ - Deputy Assistant Attorneys General of the Criminal Division. There are _ -0 emergency procedures for expediting the approval in cases which require a -@ it. All requests for authorizationemergency or routineshould be b -` directed to the Chief, Legal Support Unit of the Office of Enforcement c -p Operations in the Criminal Division (2025140856). d - e - If agents or prosecutors are planning a search and seizure of electronic g - evidence in a case in which the PPA may apply, we urge them to contact i - the j - k - [page 85] l . m . Computer Crime Unit (2025141026) immediately to discuss the n . investigation and any new legal developments in this area. o .0 F p .@ .@ p (p v v .P H FC. STORED ELECTRONIC COMMUNICATIONS q .` r .p There are special statutory rules protecting some electronic s . communications in electronic storage. Anyone who provides an electronic u . communication service or remote computing services to the public, is v . prohibited by 18 U.S.C. 2702 from voluntarily disclosing the contents of x . the electronic communications it stores or maintains on the service. A y . "remote computing service" means the provision to the public of computer { . storage or processing services by means of an electronic communications } / system. 18 U.S.C. 2711(2). ~ /0 /@ It is not entirely clear what sorts of electronic communications services /P will be found to provide "public" service. Generally speaking, "public" /p means available to all who seek the service, even if there is some / requirement, such as a fee. It is probably safe to assume that any / service permitting "guest" or "visitor" access is "public." On the other / hand, the term should not be read to cover business networks open only to / employees for company business. If that business network is connected to / the Internet (an extensive worldwide network), it may be part of a / "public" system, but this does not necessarily mean that the corporate 0 LAN (localarea network) becomes a "public" service. 0 00 There are several important exceptions to 2702's nondisclosure rule, 0@ including (1) a provision under 18 U.S.C. 2702(b)(3) allowing a person 0P or entity to disclose the contents of a communication with the lawful 0` consent of the originator, an addressee, or the intended recipient of 0p such communication (or the subscriber in the case of a remote computing 0 service), and (2) a provision under 18 U.S.C. 2702(b)(6) allowing 0 disclosure to a law enforcement agency if the contents were inadvertently 0 obtained and appear to pertain to the commission of a crime. F 0 0 p ( w w 0 H Fܿ 0 For the government to obtain access to a "stored electronic 1 communication," it must follow the dictates of 18 U.S.C. 2703, which 1 sets out different rules depending upon how long the particular 1 communication has been in electronic storage. That section provides that 10 "a governmental entity 1P 1` [pshr 86] 1p 1 may require the disclosure by a provider of electronic communication 1 service of the contents of an electronic communication, that is in 1 electronic storage ... for one hundred and eighty days or less, only ! 1 pursuant to a warrant issued under the Federal Rules of Criminal " 1 Procedure or equivalent state warrant." 18 U.S.C. 2703(a) (emphasis # 1 added). If the information has been stored for more than 180 days, $ 1 prosecutors may use either a Rule 41 search warrant (without notice to % 1 the customer or subscriber) or an administrative subpoena, grand jury & 2 subpoena, trial subpoena, or a court order pursuant to 18 U.S.C. 2703(d) ' 2 (with notice to the customer or subscriber). ( 2@ ) 2P The two terms underlined above merit further discussion. First of all, it * 2` is important to note that not all electronically stored communications + 2 are covered by this section. The electronic communication must be , 2 transmitted on a system that affects interstate or foreign commerce, 18 - 2 U.S.C. 2510(12), and must be in electronic storage. "Electronic storage" . 2 means any temporary, intermediate storage of a wire or electronic / 2 communication incidental to the electronic transmission thereof or any 0 2 backup of this communication. 18 U.S.C. 2510(17). 1 3 2 3 To understand the importance of this definition, it is critical to know 3 30 how electronic mail works. Generally speaking, email messages are not 4 3@ transmitted directly from the sender's machine to the recipient's F5 3` 3` p ( x x 3p H Fmachine; rather, the email message goes from the sending machine to an 6 3 email server where it is stored (i.e., kept in "electronic storage"). A 7 3 message is then sent from the server to the addressee indicating that a 8 3 message for the addressee has been stored. The actual message remains on 9 3 the server, however, until the addressee retrieves it by having a copy : 3 sent to his machine. Often, both the sender and receiver can delete the ; 4 email from the server. < 4 = 40 Section 2703 protects the electronic communication while it is stored in > 4@ the server in this intermediate state.8 Once a message is opened, ? 4` however, its storage is no longer "temporary" nor "incidental to. . @ 4p .transmission," and it thus takes on the legal character of all other A 4 stored data. Therefore, the statute B 4 C 4 [page 87] D 4 E 4 8 When a sysop backs up the mail server to protect against system F 4 failure, all emails stored on the server will be copied. Thus, if the G 4 email is later deleted from the server, the backup copy remains. The H 4 statute protects this copy as well. 18 U.S.C. 2510(17)(B). I 5 J 5 does not apply to all stored communications, such as word processing K 5 files residing on a hard drive, even when these files were once L 50 transmitted via e~mail. M 5@ N 5P The other highlighted term"require the disclosure"seems to suggest O 5` that 2703 only applies when the government seeks to compel the service P 5 provider to produce the electronic mail, not when government agents Q 5 actually seize it. With this in mind, the statute's crossreference to R 5 Rule 41 is confusing, because Rule 41 authorizes the government to S 5 "seize" items, not to "require [their] disclosure." To speak in terms of T 5 requiring the disclosure of electronic mail, rather than of seizing it, U 5 seems to connote a process of serving subpoenas, not of executing FV 5 5 p ( y y 6 H Fwarrants. W 6 X 6 On the other hand, Congress may have simply assumed that most system Y 60 providers would be disinterested in the "search," and that, as a Z 6P practical matter, the service provider would actually retrieve and turn [ 6` over to the government those files of suspectusers listed in the \ 6 warrant. In mentioning Rule 41, Congress may not have been focusing on ] 6 who would actually do the retrieval, but rather on what level of proof ^ 6 would be required before electronic communications in electronic storage _ 6 could be procured for a criminal investigation. Therefore, the statute's ` 6 references to warrants and Rule 41 seem designed to insure that, no a 6 matter who actually searches the system, the government will be held to a b 7 probablecause standardeven if the system provider would have been just c 7 as willing to honor a subpoena. See H.R. Rep. No. 647, 99th Cong., 2d d 7@ Sess., at 68 ("The Committee required the government to obtain a search e 7P warrant because it concluded that the contents of a message in storage f 7p were protected by the Fourth Amendment.... To the extent that the record g 7 is kept beyond [180 days] it is closer to a regular business record h 7 maintained by a third party and, therefore, deserving of a different i 7 standard of protection."). j 7 k 7 Indeed, it is entirely reasonable to read this statute as Congress's l 7 effort to regulate primarily the duties of service providers to protect m 8 the privacy of their subscribers in regard to all third parties, n 8 including law enforcement. The statute may not have fully contemplated o 8 those cases in which the system provider (rather than the subscriber) is, p 8@ or may be, implicated in the criminal investigation. q 8` r 8p There is, unfortunately, no case law clearly addressing this issue. In a Fs 8 8 p ( z z 8 H Frecent civil suit, the government was held liable for seizing electronic t 8 mail on u 8 v 8 [page 88] w 8 x 8 an electronic bulletin board service (BBS), even though the agents had a y 8 valid warrant.9 Steve Jackson Games. Inc. v. U.S. Secret Service, 816 F. z 9 Supp. 432 (W.D. Tex. 1993), appeal filed on other grounds, (Sept. 17, { 9 1993). In that case, plaintiffs sued following a search by the Secret | 90 Service of computers and other electronic storage devices which belonged } 9@ to the company. (For a more complete description of the facts of the ~ 9` case, see the discussion at p. 80.) One of the computers seized by the 9p Secret Service was the computer used by Steve Jackson Games to operate 9 its BBS. The hard disk of the BBS computer contained a number of private " 9 email messages, some of which had not yet been accessed by their # 9 addressees. The district court found that the Secret Service read e mail % 9 messages on the computer and subsequently deleted certain information and ' 9 communications, either intentionally or accidentally, before returning ( : the computer to Steve Jackson Games. Id. at 441. Here, the court held ) : that the Secret Service "exceeded the Government's authority under the + :0 statute" by seizing and examining the contents of "all of the electronic - :P communications stored in the [company's] bulletin board" without . :p complying with the statute's requirements for government access. The 0 : court's opinion never addressed, however, the interplay between 2703 and 2 : Rule 41, so it sheds no light on the proper interpretation of 2703(a). 3 : In fact, the court never cited 2703(a) at all. Instead, the court 4 : discussed the requirements of 2703(d), a provision that allows the 5 : government to get a court order, upon a showing that the communication 7 : sought is relevant to a legitimate law enforcement inquiry, when the F 8 ; ; p (8 { { ; H Fcommunication has been in storage more than 180 days or is held by a 9 ;0 remote computing service. (The court did not find how long the searched ; ;@ communications were in storage, but did hold that Steve Jackson was a = ;` remote computing service.) Even under this lesser standard 2703(a) > ; requires a search warrant based upon probable causethe court held that @ ; the government's search was improper, noting that the government did not B ; advise the magistrate, by affidavit or otherwise, that the BBS contained D ; private electronic communications between users, nor how the disclosure F ; of the contents of those communications related to the investigation. G < H < In most cases, of course, the electronic communications sought will be in J <0 storage 180 days or less, and, therefore, may be obtained "only pursuant L
VI. DRAFTING THE WARRANT f > g > A. DRAFTING A WARRANT TO SEIZE HARDWARE h >0 i >@ If a computer component is contraband, an instrumentality of the offense, k >P or evidence, the focus of the warrant should be on the computer component m >p itself and not on the information it contains. The warrant should be as n > specific as possible about which computer components to seize and, o > consistent with other types of warrants, it should describe the item to q > be seized in as much detail as possible, especially if there may be two r > or more computers at the scene. Include, where possible, the s > manufacturer, model number, and any other identifying information t > regarding the device. (For further information, see "SAMPLE COMPUTER u ? LANGUAGE FOR SEARCH WARRANTS," APPENDIX A, p. 125.) v ? w ? It may also be appropriateto seek a "noknock" warrant in cases where y ?0 knocking and announcing may cause (1) the officer or any other individual { ?P to be hurt; (2) the suspect to flee; or (3) the evidence to be destroyed. | ?p (See "Seeking Authority for a NoKnock Warrant," infra p. 100.) } ? ~ ? In computer cases, the evidence is especially perishable, and agents ? should never underestimate the subjects of the investigation. They may be ? knowledgeable about telecommunications and may have anticipated a search. ? As a result, computers and memory devices on telephone speed dialers may ? be "boobytrapped" to erase if they are improperly entered or if the @ power is cut off. @ F @0 @0 p ( } } @@ H F[page 92] @P @` B. DRAFTING A WARRANT TO SEIZE INFORMATION @p @ 1. Describing the Place to be Searched @ @ Until recently, when a warrant specified where a search was to occur, the @ exercise was bound by physical laws: agents took objects they could carry @ from places they could touch. But computers create a "virtual" world @ where data exists "in effect or essence though not in actual fact or A form." The American Heritage Dictionary, (2d ed. 1983). A A Rule 41(a) failed to anticipate the creation of this "virtual" world. By A0 its very terms, a warrant may be issued "for a search of property ... A@ within the district." Specifically, it provides that, AP A` Upon the request of a federal law enforcement officer or an attorney for Ap the government, a search warrant authorized by this rule may be issued A (1) by a federal magistrate, or a state court of record within the A federal district, for a search of property or for a person within the A district and (2) by a federal magistrate for a search of property or for A a person either within or outside the district if the property or person A is within the district when the warrant is sought but might move outside A the district before the warrant is executed. B B Fed. R. Crim. P. 41(a)(emphasis added). B0 B@ In a networked environment, however, the physical location of stored BP information may be unknown. For example, an informant indicates that the B` business where he works has a duplicate set of books used to defraud the B Internal Revenue Service. He has seen these books on his computer B terminal in his Manhattan office. Based upon this information, agents B obtain a warrant in the Southern District of New York authorizing a F B B p ( ~ ~ B H Fsearch for, and seizure of, these records. With the informant's help, B agents access his computer workstation, bring up the incriminating B documents, and copy them to a diskette. C C [page 93] C C0 Unfortunately, unbeknownst to the agents, prosecutor, or informant, the C@ file server that held those documents was physically located in another C` office, building, district, state, or country.10 C C There are, under Rule 41, at least three variations on this problem. C First, information is stored offsite, and agents know this second site C is within the same district. Second, information is stored offsite, but C this second site is outside the district. Third, information is stored C offsite, but its location is unknown. C C a. General Rule: Obtain a Second Warrant D D Whenever agents know that the information is stored at a location other D than the one described in the warrant, they should obtain a second D@ warrant. In some cases, that will mean going to another federal DP districtnearby or across the country. If the data is located overseas, D` the Criminal Division's Office of International Affairs (2025140000) D and our foreign law enforcement counterparts can assist in obtaining and D executing the foreign warrant. The Computer Crime Unit (202514 1026) can D help in expediting international computer crime investigations. D D b. Handling Multiple Sites within the Same District D E Assuming that the server was simply in another office on the same floor, E the warrant might well be broad enough to cover the search. Indeed, even E0 with physical searches, courts have sometimes allowed a second but F EP EP p ( E` H Frelated search to be covered by one warrant. In United States v. Judd, Ep 687 F. Supp. 1052, 10579 (N.D. Miss. 1988), aff'd 889 F.2d 1410 (5th E Cir. 1989), cert. denied, E E 10 In this example, the storage of information in an outofdistrict E server was fortuitous; i.e., a product of the network architecture. In E fact, hackers may deliberately store their information remotely. This E allows them to recover after their personal computers fail (essentially E by creating offsite backup copies). Additionally, if agents seize a F hacker's personal computer, no evidence will be found, and the hacker can F still copy or destroy the remotely stored data by accessing it from F0 another computer. F@ FP F` [page 94] Fp F 494 U.S. 1036 (1989), the FBI executed a search warrant for records at F Address #1, and learned that additional records were located at Address F #2. Without obtaining a second warrant, and relying only on the first, ! F the agents entered Address #2 and seized the additional records. " F # F The district court framed the question like this: was the partially $ F incorrect description in the warrant sufficient to include both business % G addresses, which in this case, happened to be in the same building? The & G court held that since Address #2 was "part" of Address #l, and since they ' G@ were both used for the business pursuits of the same company, the search ( G` was proper. See also United States v. Prout, 526 F.2d 380, 388 (5th Cir.) ) G (search of adjacent separate apartment that was omitted from the warrant * G was proper), cert. denied, 429 U.S. 840 (1976). + G , G It becomes more problematic when the server is in another building, 6 G p ( G H 6one - G clearly not described in the warrant. In situations where a second . H warrant was not obtained, there is still an argument that remotely / H accessing information from a computer named in the warrant does not 0 H0 violate Fourth Amendment law. See discussion of United States v. 1 HP Rodriguez, infra. 2 H` 3 Hp c. Handling Multiple Sites in Different Districts 4 H 5 H What if, unbeknownst to the agents executing the search warrant, the 6 H property seized was located in another district? Although the defense 7 H could argue that the court lacked jurisdiction to issue the warrant, the 8 H agents executing the warrant never left the district in which the warrant 9 H was issued. Moreover, in some cases, it may be difficult, if not : I impossible, to ascertain the physical location of a given file server and ; I obtain the evidence any other way. In these cases, prosecutors should < I@ argue that the warrant authorized the seizure. = I` > Ip If agents have reason to believe the second computer may be in a ? I different district, however, the issue should be addressed with the @ I magistrate. While some courts may strictly construe the language of Rule A I 41 and require data to be retrieved only from the district where it B I permanently resides, other courts may follow the logic of the recent C I Second Circuit case United States v. Rodriguez, 968 F.2d 130 (2d Cir.), D I cert. denied, 113 S. Ct. 140 (1992). Although that case addressed the E I issue of "place" under the wiretap statute (18 F ! J G " J [page 95] H # J I $ J0 U.S.C. 2518) and not under Rule 41, the constraints of the statute were J & J@ quite similar. ("Upon such application the judge may enter an ex parte K ' J` order ... approving interception ... within the territorial jurisdiction FL ( Jp Jp p (( J H Fof the court in which the judge is sitting.... ") M ) J N * J In Rodriguez, the Second Circuit held that a wiretap occurs in two places O , J simultaneously: the place where the tapped phone is located and the place P . J where law enforcement overhears it. If those two places are in different Q 0 J jurisdictions, a judge in either one can authorize the interception. In R 1 K this case, the DEA was tapping several phones in New York from its S 2 K Manhattan headquarters. In addition, they tapped a phone in New Jersey by T 4 K0 leasing a phone line from the service carrier and running it to the same U 6 KP New York office from which they monitored all the calls on all the lines. V 8 Kp The court cited "sound policy reasons" for allowing one court to W 9 K authorize all the taps, since all the reception and monitoring occurred X : K in that same jurisdiction. Y ; K Z < K If the DEA can lease a phone line running from New Jersey to New York in [ > K order to consolidate its efforts, courts may also find it completely \ ? K reasonable lo conclude that computer network data searches, like ] @ L telecommunications interceptions, can occur in more than one place. ^ A L _ B L d. Information at an Unknown Site ` C L0 a D L@ Unfortunately, it may be impossible to isolate the location of b E LP information. What then? Does a warrant authorizing the search and seizure c G L` of one computer automatically allow agents to search and seize any data d I L that it has sent to other computers? If the original warrant does not e J L allow investigators to physically enter another building and search f K L another computer, does it permit them to "go" there electronically, using g M L as their vehicle only the computer that they have been authorized to h N L search? What if the other computer is physically located in another i O L district? Finally, if the warrant does not authorize seizing the offsite Fj P M M p (P M H Fdata (no matter how it is obtained), are there circumstances under which k R M it could be taken without a warrant? l S M@ m T MP If agents have reason to believe there is offsite storage but no way to n V M` identify the site, they should tell the magistrate. Of course, the o W M standard to use in evaluating a description in the warrant is whether p X M "the description is such q Y M r Z M [page 96 s [ M t \ M that the officer with a search warrant can, with reasonable effort u ] M ascertain and identify the place intended." Steele v. United States, 267 v _ M U.S. 498, 503 (1925). See also United States v. Darensbourg, 520 F.2d w ` N 985, 987 (5th Cir. 1975), quoting United States v. Sklaroff, 323 F. Supp. x a N 296, 321 (S.D. Fla. 1971). y b N0 z c N@ Drawing upon Steele, it may be prudent for the warrant to specifically { d NP include any data stored offsite in devices which the subject computer | f N` has been configured by its operator to readily access, and which have } g N been regularly used as a component of the subject computer. This is more ~ i N likely to be upheld if the government has reason to believe the suspect k N is using an offsite computer and has no way to determine where it is, m N either geographically or electronically, until the suspect's computer is n N examined. In such cases, the affidavit should indicate why a complete o O address is not available, including any attempts that have been made to q O get the information (e.g., informants, undercover agents, pen registers, s O0 electronic or video surveillance) on the subject computer. It will be t OP important to show a clear relationship between the computer described in v O` the warrant and the second computer at the different location. If the w O second computer is somewhere in the same district, that also holds 6 O p (x O H 6the y O second data search closer to the physical terms of Rule 41. z O { O e. Information/Devices Which Have Been Moved | O } O What happens if the targets: (1) move computers and storage devices (disk P drives, floppies, etc.) between two or more districts (e.g., a laptop P computer); or (2) transmit data to offsite devices located in another P0 district? P@ PP Under Rule 41(a)(2), a magistrate in one district can issue a warrant to P` be executed in another district provided the property was "within" Pp District A when the warrant was issued. Again, this rule is relatively P easy to apply when physical devices are the object of the search. But how P does that rule apply to electronic data? If a suspect creates data in P District A and uploads11 that data P P 11 "Upload" means to transfer data from a user's system to a remote P computer system. Wehster's, supra. Of course, only a copy is transferred, P and the original remains on the user's machine. It may be significant to Q search for the uploaded data even if the original has been seized. For Q0 example, the user may have altered the original. Q@ QP Q` [page 97] Qp Q to a computer in District B, has he "moved" it between districts, thus Q authorizing a District A magistrate to issue a warrant for a search of Q the District B computer, even though the District B computer was never Q physically transported from or even located in District A? Q Q The key to resolving these issues is understanding what agents are Q seizing. If they are going to seize the computer hardware in District B R to get the data, they must get a warrant in District B (after all, the R District B computer was never moved). If agents are simply copying 6 R p ( R0 H 6data, R however, it could be argued that the data uploaded from District A to RP District B is property that has been moved. Since the item to be seized R` is data and not its storage device, the "within the district" requirement Rp is fulfilled. R R 2. Describing the Items to be Seized R R When the evidence consists of information in a computer system, but the R computer itself is not an instrumentality of the offense or otherwise R seizable, the hardware is simply a storage device. First and foremost, S all technical matters aside, searching the computer is conceptually S similar to searching a file cabinet for papers. One important difference S is that while the storage capacity of a file cabinet is limited, the S@ storage capacity of computers continues to increase. A standard SP 40megabyte hard drive contains approximately 20,000 pages of S` information, and 200+ megabyte drives are already quite common. Sp Therefore, although the computer itself is no more important to an S investigation than the old cabinet was, the technology may complicate S enormously the process of extracting the information. S S Bearing this analogy in mind, if agents have probable cause only for the S documents in the computer and not for the box itself, they should draft S the warrant with the same degree of specificity as for any other document T or business record in a similar situation. For example, the detail used T0 to describe a paper sales receipt (for a certain product sold on a T@ certain date) should not be any less specific merely because the record TP is electronic. Tp T As with other kinds of document cases, the breadth of a warrant's T authority to search through a suspect's computer will depend on the T breadth of the criminality. Where there is probable cause to believe 6 T p ( T H 6that T an enterprise T T [page 98] U U is pervasively illegal, the warrant will authorize the seizure of records U (both paper and electronic) far more extensively than if probable cause U@ is narrow and specific. "When there is probable cause to seize all U` [items], the warrant may be broad because it is unnecessary to Up distinguish things that may be taken from things that must be left U undisturbed." United States v. Bentley, 825 F.2d 1104, 1110 (7th Cir.), U cert. denied, 484 U.S. 901 (1987). But by the same token, "[w]hen the U probable cause covers fewer documents in a system of files, the warrant U must be more confined and tell officers how to separate documents to be U seized from others." Id. at 1110. See also Application of Lafayette U Academy, Inc., 610 F.2d 1 (lst Cir. 1979). There is nothing about the V nature of searching for documents on a computer which changes this V underlying legal analysis. Each warrant must be crafted broadly or V specifically according to the extent of the probable cause, and it should V0 focus on the content of the relevant documents rather than on the storage VP devices which may contain them. Vp V The difficulties arise when, armed with a narrow and specific warrant, V agents begin the search. If agents know exactly what they are looking for V (a certain letter; a voucher filed on a particular date), it may be V simple enough to state it in the warrant. But because computers, like V file cabinets, can store thousands of pages of information, the specific V letter may be much easier to describe than to find. Some may argue, with W good reason, that the sheer volume of evidence makes it impractical to W search on site. (For a more extensive discussion of these issues, see F W@ W@ p ( WP H F"DECIDING WHETHER TO CONDUCT THE SEARCH ONSITE OR TO REMOVE HARDWARE TO W` ANOTHER LOCATION," supra p. 55.) W W Even so, the volumeofevidence argument, by itself, may not justify W seizing all the information storage devicesor even all of the W information on themwhen only some of it is relevant. In In Re Grand W Jury Subpoena Duces Tecum Dated November 15. 1993, 846 F. Supp. 1 1 W (S.D.N.Y. 1994), the district court applied a similar analysis to a grand W jury subpoena for digital storage devices. In that case, the government W had subpoenaed the central processing units, hard disks, floppy disks, X and any other storage devices supplied by the target corporation ("X X Corporation") to specified officers and employees of the corporation. Of X0 course, these storage devices also contained unrelated information, XP including some that was quite personal: an employee's will and individual X` financial records and information. When "X Corporation" moved to quash X the subpoena, the government acknowledged that searching the storage X devices by 'key word' would identify the relevant documents for the grand X jury's investigation. Even so, prosecutors continued to argue for X X [page 99] Y Y enforcement of the subpoena as written, particularly because the grand Y jury was also investigating the corporation for obstruction of justice. Y@ In quashing the subpoena, the judge clearly distinguished between YP documents or records and the computer devices which contain them. Y` Yp The subpoena at issue here is not framed in terms of specified categories Y of information. Rather, it demands specified information storage Y devices.... Implicit in [an earlier case] is a determination that Y subpoenas properly are interpreted as seeking categories of paper Y documents, not categories of filing cabinets. Because it is easier in 6 Y p ( Y H 6the Y computer age to separate relevant from irrelevant documents, [the] Z ontological choice between filing cabinets and paper documents has even Z greater force when applied to the modern analogues of these earlier Z0 methods of storing information. Z@ ZP Although the judge found that investigating the corporation for Z` "obstruction and related charges indeed justifies a commensurately ! Zp broader subpoena ...," he declined to modify, rather than quash, the " Z subpoena at issue because "this Court does not have sufficient # Z information to identify relevant documents (including directory $ Z files)...." The court's reference to directory files seems to imply that % Z the directory would necessarily list everything in the storage & Z devicewhich is, of course, not true. A directory would not display ' Z hidden, erased, or overwritten files which could still be recoverable by ) Z a computer expert. Perhaps the judge's conclusion might have been * [ different if the government had proceeded by search warrant rather than , [ subpoena. In any case, it is interesting to note that the court, in - [0 trying to find a balance, suggested that when a grand jury suspects "that / [@ subpoenaed documents are being withheld, a courtappointed expert could 1 [` search the hard drives and floppy disks." 2 [ 3 [ 3. Removing Hardware to Search OffSite: Ask the Magistrate for Explicit 5 [ Permission. 6 [ 7 [ Because the complexities of computer data searches may require agents to 9 [ remove computers from a search scene, agents and prosecutors should ; \ anticipate this issue and, whenever it arises, ask for the magistrate's < \ express ! = \0 " > \@ [page 100] # ? \P F$ @ \` \` p (@ \p H Fpermission. Obviously, the more information they have to support this % A \ decision, the betterand the affidavit should set out all the relevant & B \ details. It will be most important to have this explicit permission in ' C \ the warrant for those cases where (as in Tamura, supra p. 58) agents must ( E \ seize the haystack to find the needle. ) F \ * G \ If the original warrant has not authorized this kind of seizure, but the + H \ agent discovers that the search requires it, she should return to the , I ] magistrate and amend the warrant, unless exigencies preclude it. - J ] . K ] 4. Seeking Authority for a NoKnock Warrant / L ]0 0 M ]@ a. In General 1 N ]P 2 O ]` Under 18 U.S.C. 3109, an agent executing a search warrant must announce 3 Q ]p his authority for acting and the purpose of his call. See, e.g., United 4 R ] States v. Barrett, 725 F. Supp. 9 (D.D.C. 1989)("Police, search warrant, 5 S ] open up"). This knockandannounce requirement, although statutory, has 6 U ] been incorporated into the Fourth Amendment, United States v. 7 V ] BustamanteGamez, 488 F.2d 4, 1112 (9th Cir. 1973), cert. denied, 416 8 X ] U.S. 970 (1974), and therefore a statutory violation may also be a 9 Y ^ constitutional one. United States v. Murrie, 534 F.2d 695, 698 (6th Cir. : Z ^ 1976); United States v. Valenzuela, 596 F.2d 824, 830 (9th Cir.), cert. ; [ ^ denied, 441 U.S. 965 (1979). The knock~andannounce rule is designed to < ] ^0 reduce the possibility of violence (the occupant of the premises may = ^ ^P believe a burglary is occurring), reduce the risk of damage to private > _ ^` property (by allowing the occupant to open the door), protect the ? ` ^p innocent (the agent may be executing the warrant at the wrong location), @ b ^ and symbolize the government's respect for private property. A c ^ B d ^ Of course, if no one is present, there is no one to notify, and agents C e ^ can search the place without waiting for its occupant. United States v. D f ^ Brown, 556 F.2d 304 (5th Cir. 1977). The knockandannounce requirement FE h ^ ^ p (h _ H Falso does not apply when the door is open. United States v. Remigio, 767 F j _ F.2d 730 (10th Cir.), cert. denied, 474 U.S. 1009 (1985). It is unclear G k _0 whether the rule applies to businesses, as different courts have reached H m _@ different conclusions. I n _` J o _p [page 101] K p _ L q _ Cf. United States v. Agrusa, 541 F.2d 690 (8th Cir. 1976)( 3109 applies M r _ to businesses), cert. denied, 429 U.S. 1045 (1977), with United States v. N t _ Francis, 646 F.2d 251 (6th Cir.)( 3109 applies only to dwellings), cert. O u _ denied, 454 U.S. 1082 (1981). P v _ Q w _ After knocking and announcing, agents must give the occupants a R x ` reasonable opportunity to respond, although exigent circumstances may S z ` justify breaking in without an actual refusal. Compare United States v. T | `0 Ruminer, 786 F.2d 381 (10th Cir. 1986)(breakin authorized where police U ~ `P waited five seconds and saw people running in house), with United States V `p v. Sinclair, 742 F. Supp. 688, 6901 (D.D.C. 1990)(one to twosecond W ` delay, even with noise inside, was insufficient to warrant breakin). X ` Y ` Moreover, exigent circumstances may justify forcible entry without Z ` "knocking and announcing" at all. Circumstances are exigent if agents [ ` reasonably believe that giving notice to people inside could cause (1) \ ` the officer or any other individual to be hurt; (2) a suspect to flee; or ] ` (3) the evidence to be destroyed. Additionally, investigators need not ^ a knock and announce when it would be a "useless gesture" because the _ a people inside already know their authority and purpose. ` a0 a a@ b. In ComputerRelated Cases b aP c a` In many computer crime cases, the primary concern will be preserving the Fd ap a p ( a H Fevidence. Technically adept suspects may "hotwire" their computers in an e a effort to hide evidence. Although there are many ways to do this, two f a more common practices involve "hot keys" and timedelay functions. A "hot g a key" program is designed to destroy evidence, usually by overwriting or h a reformatting a disk, when a certain key is pressed.12 Thus, when officers i b knock at the door and announce their presence, the subject of the search j b0 can hit the key that activates the program. A timedelay function is a k bP program that monitors the keyboard to determine whether the user has l b` pressed any key. If no key is m b n b 12 Of course, the fact that this occurs does not mean the evidence cannot o b he salvaged. Experts can often recover data which has been deleted or p b overwritten. q b r b [page 102] s c t c pressed within a certain period of time, such as 30 seconds, the program u c activates and destroys data. A target may, therefore, answer the door v c@ slowly and attempt to delay the agent's access to the machine. w c` x cp These problems, which may be present in every computer crime y c investigation, are not, standing alone, sufficient to justify dispensing z c with the knockandannounce rule. Most courts have required agents to { c state specifically why these premises or these people make it either | c dangerous or imprudent to knock and announce before a search. See United } c States v. Carter, 566 F.2d 1265 (5th Cir. 1978)(someone inside yelled ~ c "It's the cops" and the agent, who had a warrant to search for heroin, d heard running inside), cert. denied, 436 U.S. 956 (1978); United States F d d p ( d H Fv. Stewart, 867 F.2d 581 (10th Cir. 1989)(collecting cases). But cf. d0 United States v. Wysong, 528 F.2d 345 (9th Cir. 1976)(mere fact that d@ police knew defendant was trafficking in an easily destroyable liquid dP narcotic created exigent circumstance that justified entry without d` knocking and announcing). dp d In short, most cases hold that agents must have some reasonable, d articulable basis to dispense with the knockandannounce requirement. d Moreover, in light of the salutary purposes served by the rule, they d should have very good reasons before deviating from it. In appropriate d cases, however, a noknock warrant should be obtained. In deciding d whether to seek a noknock warrant, agents should consider, among other e things: (1) what offense is being investigated (is it a narcotics case e where the subjects may be armed, or is it nonviolent hacking?); (2) is e0 there information indicating evidence will be destroyed (in one recent e@ hacker case, the targets talked about destroying evidence if raided by eP the police); (3) the age and technical sophistication of the target; and e` (4) whether the target knows, or may know, he is under investigation. ep e [page 103] e e VII. POSTSEARCH PROCEDURES e e A. INTRODUCTION e e As noted above, the government is permitted to search for and to seize e property that is contraband, evidence, or an instrumentality of the f offense. The law does not authorize the government to seize items which f do not have evidentiary value, and generally agents cannot take things f@ from a search site when their nonevidentiary nature is apparent at the f` time of the search. f f With computer crimes, however, it is not always possible to examine 6 f p ( f H 6and f separate wheat from chaff at the search location. There may be thousands f of pages of data on the system; they may be encrypted or compressed (and f thus unreadable); and searching computers frequently requires expert g computer skills and equipment. All these factors contribute to the g impracticality of onsite processing. Accordingly, agents will often g0 seize evidentiary materials that are mixed in with collateral items. (See g@ "DECIDING WHETHER TO CONDUCT THE SEARCH ONSITE OR TO REMOVE HARDWARE TO g` ANOTHER LOCATION," supra p. 55.) g g For several reasons, it is important to separate evidence (and g contraband, fruits, and instrumentalities) from irrelevant items. First, g as noted above, the law does not generally authorize seizing g nonevidentiary property. But to the extent agents sort and return these g materials after a search, the courts are less likely to require that g large amounts of data be sorted at the scene. Put another way, if law h enforcement authorities routinely retain boxes of property that are not h evidence, the courts surely will become less sympathetic in those cases h0 where it is, in fact, appropriate to seize entire systems and analyze hP them later at the lab. h` hp A second reason to promptly sort seized evidence is that the process will h help to organize the investigation. Agents and prosecutors will obviously h want to focus on the evidence when preparing complaints or indictments. h Getting a handle on the items that advance the case will help agents h assess quickly and accurately where the case should go. As much as h overbroad seizures offend the i i [page 104] i F i0 i0 p ( i@ H Flaw, they are just as bad for the investigation. Investigators should iP cull out the things that do not help the case right away to avoid i` endlessly sifting through unimportant materials as the investigation ip progresses. i i Procedures for sorting, searching, and returning seized items will depend i in part upon the type of evidence involved. There are, however, certain i basic concepts that apply across the board. The basics include the i following. i j B. PROCEDURES FOR PRESERVING EVIDENCE j j 1. Chain of Custody j0 j@ Computer evidence requires the same chain of custody procedures as other jP types of evidence. Of course, the custodian must strictly control access jp and keep accurate records to show who has examined the evidence and when. j (For a further discussion of this issue, see "EVIDENCE: Chain of j Custody," infra p. 119.) j ! j 2. Organization " j # j As with other parts of the investigation, the sorting process should be $ k as organized as possible. If there are only a few agents involved, each & k with discrete tasks, the job is likely to be quick and efficient. Many ' k0 agents, unsure of their tasks, are more likely to misplace or overlook ( k@ evidence. An organized review process, which is part of a larger, ) kP wellbriefed search plan, is also easier to describe and defend in court. + k` , k - k [page 105] . k / k 3. Keeping Records F 0 k k p (0 k H Fܿ 1 k Agents should always document their investigative activities. This allows 3 k other agents and attorneys to keep track of complex investigations, and 5 l will help the case agent reconstruct the sorting process at a later time 7 l0 if necessary. A log should be kept that describes each item seized, 8 lP whether it was examined, and whether it contained evidence. 9 l` : lp When items are returned, a receipt should set out: (a) a clear ; l description of the item, (b) the person who received it (with a signature = l and identification), and (c) when the item was released. It often makes ? l sense to return all items at one time rather than to do it piecemeal. @ l Also, it is a good idea to keep photographs of the property returned in A l order to avoid disputes. B l C m 4. Returning Seized Computers and Materials D m E m Once agents have removed the computer system from the scene, an expert G m0 should examine the seized material as soon as practicable. This H mP examination may be conducted by a trained field office agent, a special J m` agent sent to the field office for this purpose, or by a K m properlyqualified private expert. Some agencies may require that the L m computer system be shipped to a laboratory. Each agency should establish N m and follow a reasonable procedure for handling computerized evidence. P m Q m Once the analyst has examined the computer system and data and decided S m that some items or information need not be kept, the government should U n return this property as soon as practicable. The courts have acknowledged W n0 an individual's property interest in seized items, and the owner of F X nP nP p (X n` H Fseized property can move the court for a return of property under Fed. R. Z np Crim. P. 41(e). That remedy is available not only when the search was [ n illegal, but also if the person simply alleges a "deprivation of property \ n by the Government." In Re Southeastern Equipment Co. Search Warrant, 746 ^ n F. Supp. 1563 (S.D. Ga. 1990). _ n ` n [page 106] a n b o Agents and prosecutors must remember that while a computer may be c o analogous to a filing cabinet for the agents who search it, it is much d o more to most computer users. It can be a data processor, graphics e o0 designer, publisher, and telecommunications center. Courts will no doubt g o@ recognize the increasingly important role computers play in our society, i o` and the public's extensive reliance on these computers to support the way k o we live and do business. As a result, law enforcement should be prepared m o to look carefully at the circumstances of each case and to seize n o computers only as needed, keeping them only as necessary. o o p o a. Federal Rules of Criminal Procedure: Rule 41(e) q o r p While computerowners may be especially eager for return of their s p hardware, software, data, and related materials, the issue of whether to u p retain or return lawfully seized property before trial is not unique to v p@ computers. Rule 41(e) of the Federal Rules of Criminal Procedure sets out x pP the standards and procedures for returning all property seized during the z pp execution of a search warrant. The Rule, in general, provides that a { p party who is "aggrieved by an unlawful search and seizure or by the | p deprivation of property" may file a motion for the return of the property ~ p on the ground that the party is entitled "to lawful possession of the p property." 13 F p p p ( p H Fܿ q A Rule 41(e) motion for return of property can be made either before or q after indictment. However, a district court's jurisdiction over a q0 preindictment motion is more limited than if the indictment has been q@ returned. Preindictment remedies are equitable in nature and must only qP be exercised with "caution and restraint." Floyd v. United States, 860 qp F.2d 999, 1003 (10th Cir. 1988). The Tenth Circuit, the only Circuit to q address this issue, held that two conditions must be satisfied before a ! q district court may assume jurisdiction over a pre~indictment Rule 41(e) " q motion: "a movant must demonstrate that being deprived # q $ q 13 Rule 41(e) does not distinguish according to how the property was used % q in the offense; thus, a computer used as an instrumentality of an offense & r (e.g., to duplicate copyrighted software or hack into other systems) is ' r not treated differently for Rule 41 analysis from a computer used as a ( r0 "storage cabinet" for documents. Of course the government's interest in ) r@ seizing and keeping the computer in each case is different and, thus, * r` from a realistic standpoint, how the computer was used in the offense is + rp important in determining whether to retain or return it. , r - r [page 107] . r / r of actual possession of the seized property causes 'irreparable injury' 0 r and must be otherwise without adequate remedy at law." Matter of Search 1 r of Kitty's East, 905 F.2d 1367, 1371 (1Oth Cir. 1990). 2 s 3 s Because of the paucity of cases in this area, it is very difficult to say 4 s what facts will satisfy this twopart test. However, the reported 5 s0 decisions do offer guidance in responding to a request for the return of 6 s@ seized property. The Tenth Circuit in Kitty's East held that the 7 s` "irreparable injury" element is not satisfied by the threat of an F8 sp sp p ( s H Fimminent indictment. 905 F.2d at 1371, citing Blinder, Robinson & Co. v. 9 s United States, 897 F.2d 1549, 1557 (1Oth Cir. 1990). The appellate court : s in Kitty's East upheld the district court's decision to take jurisdiction ; s because the nature of the seized materialspornographic < s videotapesinvoked the First Amendment right of free speech. "Although = s the interests of the commercial speech at issue here may not equate with > t those of political speech, we agree that the special protections of the ? t First Amendment justified the exercise of equitable jurisdiction in this @ t0 case." Id. Conversely, the Blinder court rejected the movant's contention A t@ that it was irreparably injured by the government's failure to return B t` original documents: "[T]he record strongly suggests that [the movant] is C tp able to operate with photocopies of the documents seized by the D t government and either has copies or can make copies of all the property E t that the government seized." Blinder, 897 F.2d at 1557. F t G t Once jurisdiction has been established, Rule 41(e), according to the H t Tenth Circuit, requires the party to also show that the retention of the I t property by the government is unreasonable: J u K u Reasonableness under all of the circumstances must be the test when a L u person seeks to obtain the return of property. If the United States has a M u@ need for the property in an investigation or prosecution, its retention N u` of the property generally is reasonable. But, if the United States' O up legitimate interests can be satisfied even if the property is returned, P u continued retention of the property would become unreasonable. Q u R u Id., quoting Committee Note to 1989 Amendment at 30, 124 F.R.D. at 428. S u T u As described, the Kitty's East court initially held the district court U u had properly exercised jurisdiction over the motion because of the V u possibility that the movant's First Amendment rights would be 6 v p ( v H 6impaired. W v However, the court then denied the Rule 41(e) motion for the return of X v0 the seized property. The Y vP Z v` [page 108] [ vp \ v court held that Kitty's East failed to demonstrate that it was aggrieved ] v by an unreasonable retention of the property: ^ v _ v With regard to the videotapes seized, Kitty's has made no argument that ` v the seizure has precluded all exhibition or rental of the videotapes in a v question. Kitty's First Amendment rights are not sufficiently infringed b w by the government's seizure for evidence of a few copies of a limited c w number of videotapes to be 'aggrieved' under Rule 41(e).... Further, d w return of the videotapes would pose too great a risk of loss of potential e w0 evidence. As the Supreme Court has noted, 'such films may be compact, f wP readily transported for exhibition in other jurisdictions, easily g wp destructible, and particularly susceptible to alteration by cutting and h w splicing critical areas of film.' We hold therefore, that the i w government's retention of no more than two evidentiary copies of each j w film is reasonable and does not 'aggrieve' Kitty's under Rule 41(e). k w l w 905 F.2d at 1376 (citations omitted). m w n w In United States v. Taft, 769 F. Supp. 1295, 1307 (D. Vt. 1991) the court o x relied on Kitty's East to deny a motion for the return of two firearms p x which had been legally seized by the government during the execution of a q x search warrant. Moreover, the court refused to second guess the r x@ government about the evidentiary value of the guns: "[H]aving decided s xP that the government legally seized the two firearms, this court will not t xp opine as to the evidentiary value of the guns in the instant 6 x p ( x H 6prosecution u x for cultivation of marijuana." v x w x The decisions addressing Rule 41(e) impose a heavy burden on a party x x seeking the return of property, including computers, lawfully seized by y x the government. However, unless there is a reason not to do it, agents z y should explore giving the computer owner copies of the computer disks { y0 seizedeven when Rule 41(e) does not require it. This is especially true | yP if the owner needs the data to run a business. Of course, if the } yp information stored on the disks is contraband or if copying the ~ y information would jeopardize the investigation, agents should not make y copies for the owner. y y Similarly, if the owner of a seized computer needs it for business, there y may be intermediate solutions. For example, using careful scientific y protocols and keeping exacting records, an analyst can make printouts z from the hard drives to have "original" records to admit in court. z Following the same process, the analyst can then make a mirror image (or z0 "bitstream") data copy zP z` [page 109] zp z of the hard drives for later analysis. Before returning the computers, z agents should explain the printout and copying processes used, and give z the defense an opportunity to object to the integrity and admissibility z of the printouts and copies at that time. Best practice is to ask the z defense counsel to sign an explicit waiver of those issues at the time z the computer is returned and to stipulate that printouts and electronic z copies will be admissible under Fed. R. Evid. 1001. (For a more extensive F { { p ( {0 H Fdiscussion of admitting electronic evidence, see "EVIDENCE," infra p. ! {@ 113.) If the defense refuses to concede the accuracy and admissibility of # {P the printouts and copies, the government should keep the computer. (For a % {p form "Stipulation for Returning Original Electronic Data," see APPENDIX & { A, p. 135). ' { ( { b. Hardware ) { * { In deciding whether to retain hardware, agents should consider several , { factors. Aspects that weigh in favor of keeping hardware include: (1) the . | hardware was used to commit a crime, was obtained through criminal / | activity, or is evidence of criminal activity, (2) the owner of the 0 |0 hardware would use it to commit additional crimes if it were returned, 2 |@ (3) the hardware is unique and is either essential for recovering data 3 |` from storage devices or difficult to describe without the physical item 4 |p present in court, and (4) the hardware does not serve legitimate 5 | purposes. Factors that weigh in favor of returning hardware include: (1) 7 | a photograph of the hardware would serve the same evidentiary purpose as 9 | having the machines in court, (2) the hardware is an ordinary, : | unspecialized piece of equipment such as a telephone, (3) the hardware is < | used primarily for legal purposes, and (4) the hardware is unlikely to be > } used criminally if returned. ? } @ }0 Although the result will depend on the precise facts of each case, some B }@ basic principles are clear. Where hardware was used to commit a crime D }` (instrumentality) or is the proceeds of crime (fruit) and it belongs to E } the suspect, agents should generally keep it. When the hardware clearly G } is not evidence of a crime (e.g. an electronic wristwatch which turns 6 } p (H } H 6out I } to have no memory), it should generally be returned. J } K } [page 110] L ~ M ~ The difficult situations arise when hardware was only tangential in the O ~ crime, played primarily a noncriminal role, or does not belong to the P ~@ suspect. In these cases, agents and prosecutors must balance the Q ~P government's need to retain the original items against the property R ~` owner's interest in getting them back. In any case, aggrieved property T ~p owners can ask the court to order the government to return even U ~ lawfullyseized items. See Fed. R. Crim. P. 41(e). V ~ W ~ c. Documentation X ~ Y ~ Warrants often include computer books, programming guides, user manuals [ ~ and the like. These items may have evidentiary significance in several \ ways: they may be proprietary (e.g. telephone company technical manual ^ for employees); they may indicate that software, hardware, or the manuals ` 0 themselves were obtained illegally; they may be necessary for searching a b P particular, customized machine also covered by the warrant; or they may d p contain handwritten notes about how the subject used the machine. In this f case, agents should treat the books and manuals as evidence and retain h them. i j Very often, however, books and manuals are not unique. Most of the time, l they will be publicly available user guides without significant m handwritten notes. They may be convenient references for investigators, o but they do not add anything that could not be commercially 6 @ p (p P H 6purchased. In q @ such cases, Rule 41(e) does not require subjects to supply such equipment s p or technical information, so these items (if they contain no evidence) t should be returned. u v d. Notes and Papers w x Notes and papers often contain extremely valuable information like y passwords, login sequences, and other suspects' telephone numbers or { names. Notes also tend to be rather cryptic, so agents will not always | know right away what they are. Accordingly, it may be appropriate to } retain notes and papers until they can be carefully examined, but agents 0 should return records that are clearly not evidence or instrumentality. P ` [page 111] p e. ThirdParty Owners The retainorreturn question is particularly delicate when the evidence (usually hardware) belongs to innocent third parties. While the government is clearly entitled to seize evidence no matter who owns it, Rule 41(e) of the Federal Rules of Criminal Procedure recognizes that the property owner may move for return of unreasonably held items. See Fed. R. Crim. P. 41(e) advisory committee note (1989)("reasonableness under @ all of the circumstances must be the test when a person seeks to obtain ` the return of property"). The committee notes further point out that the government's legitimate interests can often be satisfied "by copying documents or by conditioning the return on government access to the property at a future time." Id. F p ( H FWhen a third party claims ownership, it is important to evaluate competing claims before deciding what to do. The worst solution is to return property to someone who later turns out not to have been the rightful owner. Thus, whenever it is appropriate to return property, agents must verify ownership with documents or other reliable evidence. 0 If in doubt, it is best to retain the item and let the aggrieved parties P assert their various claims in court. This way, the government will not ` become embroiled in complicated ownership investigations, and will not p release property to the wrong party. [no page 112] [Page 113] VIII. EVIDENCE A. INTRODUCTION Although the primary concern of these Guidelines is search and seizure, the ultimate goal is to obtain evidence admissible in court. From the moment agents seize electronic evidence, they should understand both the legal and technical issues that this sort of evidence presents under the @ Federal Rules of Evidence. ` p It can be especially confusing to think about digital proof because, both in our current discussions and in early cases, legal analysts have tended to treat "computer evidence" as if it were its own separate, overarching evidentiary category. Of course, in some very practical ways electronic evidence is unique: it can be created, altered, stored, copied, and moved with unprecedented ease, which creates both problems and opportunities for advocates. But in many important respects, "computer evidence," like @ any other, must pass a variety of traditional admissibility tests. F ` ` p ( p H Fܿ Specifically, some commentary is not very clear whether admitting computer records requires a "best evidence" analysis, an authentication process, a hearsay examination, or all of the above. Advocates and courts have sometimes mixed, matched, and lumped these ideas together by talking simply about the "reliability" or "trustworthiness" of computer evidence in general, sweeping terms, rather than asking critically whether the evidence was "trustworthy" in all required aspects. 0 @ Part of the reason for this is probably that the first computer evidence P offered in court was information generated by businesses. Long before p most people used computers in their homes, telephone companies and banks were using them to record, process, and report information that their businesses required. Not surprisingly, many of the early decisions link computer evidence with the business records exception to the hearsay rule. Of course, that exceptionwhich is meant to address a substantive hearsay problemalso includes a sort of internal authentication analysis. (Fed. R. Evid. 803(6) 0 [Page 114] @ P requires a showing that a record was made "at or near the time by, or ` from information transmitted by, a person with knowledge. . ."). p But "computer evidence" as we know it today covers the universe of documentary materials, and is certainly not limited to business records. Computer evidence may or may not contain hearsay statements. It will always need to be authenticated in some way. And data that has been produced, processed, and retrieved under circumstances other than 6 p ( H 6the discipline of a business probably will not contain the qualities that make electronic evidence "reliable" as a business record. Even business ! 0 records, themselves, may require a closer look, depending on what the " P proponent wants to do with them at trial. # p $ The key for advocates will be in understanding the true nature of each % electronic exhibit they offer or oppose: for what purpose and by what & process (both human and technological) was it created? And what specific ' issues of evidence (rules of form? rules of substance?) does that ( particular electronic item raise? ) * B. THE BEST EVIDENCE RULE + , One of the issues that investigators and lawyers sometimes cite as - troublesome in working with electronic evidence turns out, on . 0 examination, to be a largely surmountable hurdle: the "best evidence / @ rule." This rule provides that "[t]o prove the content of a writing, 0 P recording, or photograph, the original writing, recording, or photograph 1 ` is required, except as otherwise provided in these rules or by Act of 2 Congress." Fed. R. Evid. 1002. 3 4 The impact of this rule is softened considerably by its reference to 5 other rules. Indeed, Fed. R. Evid. 1001 makes clear in two separate 6 provisions that when it comes to electronic documents, the term 7 "original" has an expansive meaning. First of all, Fed. R. Evid. 1001(1) 8 defines "writings and recordings" to explicitly include magnetic, 9 mechanical, or electronic methods of "setting down" letters, words, : numbers, or their equivalents. Clearly, then, when someone creates a ; document on a computer hard drive, for example, the electronic data < stored on that drive is an admissible writing. A proponent could = 0 obviously offer it to a court by producing the hard drive in court and > @ displaying ? P @ ` [Page 115] A p FB p ( H Fit with a monitor. But that somewhat cumbersome process is not the only C choice. In telling us what constitutes an "original" writing or D recording, Fed. R. Evid. 1001(3) says further that "[i]f data are stored E in a computer or similar device, any printout or other output readable by F sight, shown to reflect the data accurately, is an 'original."' Thus, so G long as they are accurate, paper printouts from electronic storage H devices qualify as "originals" under the rule, and there is clearly no I evidentiary need to haul computer equipment into a courtroom simply to J 0 admit a documentalthough there sometimes may be tactical reasons for K P doing so. L p M But even having set up that inclusive definition of "original" writing, N the Federal Rules go much further to relax the common law standard. Fed. O " R. Evid. 1003 provides that "[a] duplicate is admissible to the same P # extent as an original unless (1) a genuine question is raised as to the Q $ authenticity of the original or (2) in the circumstances it would be R % unfair to admit the duplicate in lieu of the original." Therefore, unless S & authenticity or some "unfairness" is at issue, courts may freely admit T ' duplicate electronic documents. "Duplicate" is defined in Fed. R. Evid. U ( 1001(4) as "a counterpart produced by the same impression as the original V * ... by mechanical or electronic rerecording ... or by other equivalent W + @ techniques which accurately reproduces (sic) the original." Many X , P investigative agencies analyze data evidence from exact electronic copies Y . ` (called "bitstream" copies) made with commercial or custommade Z / software. So long as the copies have been properly made and maintained, [ 1 the Federal Rules allow judges to accept these copies (or expert opinions \ 3 based on them) as readily as the originals. ] 4 ^ 5 Thus, the Federal Rules have, despite their nod to the best evidence _ 6 rule, made way for a lively courtroom use of electronic evidence in all ` 7 its many forms. Questions of admissibility turn not on whether the 6 p (8 H 6data a 9 before a court is on a hard drive, a duplicate floppy disk, or a printout b : @ of either one. Instead, courts must ask whether the original data is c ; P authentic and whether any copies offered are accurate. d < ` e = p C. AUTHENTICATING ELECTRONIC DOCUMENTS f > g ? Of course, every time trial lawyers offer any piece of evidence, they h @ must be ready to show that, as the authentication rule, Fed. R. Evid. i A 901(a), j B k C [Page 116] l D m E states, "the matter in question is what its proponent claims." Clearly, n F there are many ways to do this, including the ten illustrations offered o G by Fed. R. Evid. 901 (b). p H q I 0 1. "Distinctive" Evidence r J @ s K P One of the most common methods for authenticating evidence is to show the t M ` item's identity through some distinctive characteristic or quality. u N Indeed, the authentication requirement of Fed. R. Evid. 901(a) is v O satisfied if an item is "distinctive" in its "appearance, contents, w P substance, internal patterns, or other distinctive characteristics, taken x R in conjunction with circumstances." Fed. R. Evid. 901(b)(4). In fact, it y S is standard practice to use this method to authenticate some kinds of z T evidence which may now be digitally created, stored, and reproduced. For { V example, attorneys offering photographs into evidence invariably just ask | X a "witness with knowledge" (under Fed. R. Evid. 901(b)(1)) whether a } Y 0 particular photo is "a fair and accurate representation" of something or ~ [ @ someone. But should the process of authenticating photographs recognize ] ` that, with the advent of digital photography, it is now possible to alter _ an electronic image without leaving a trace? Consider the following F ` p (` H Fexample. a b Agents and prosecutors were shown a photograph of a bodytwisted on the d floor, a gaping wound in the chest. Across the room, on the floor, was a f large pistol. On the white wall above the victim's body, scrawled in the h victim's own blood, were the words, "I'll kill again. You'll never catch i @ me." j P k ` Unlike conventional photographs, however, this picture was not created m p with film, but with a digital camera. The entire picture was made up of o binary digits, ones and zeros, which could be altered without detection. q So two law enforcement agents, using commercially available software, s started rearranging the digits. They "cleaned" the wall, removing the t bloody words. They closed the chest wound, choosing instead to have blood v trickling from the victim's temple. Last, they moved the gun into the w victim's hand. The case was now solved: the report would claim, and the y 0 photograph would "prove," the victim committed suicide. z P { ` [Page 117] | p } This was, of course, only a demonstration, which took place in the summer of 1991 at a meeting of the Federal Computer Investigations Committee. The Committee had been established by a handful of federal and state law enforcement personnel who were among the first to appreciate how emerging technologies were both providing new opportunities for criminals and creating new challenges for law enforcement officials. For this group, the point of this demonstration was apparent: not only could ordinary F 0 0 p ( @ H Fphotographs not be trusted in the same old way to be reliable, but an P ordinary agent might be duped if he or she were not technologically ` astute enough to realize the potential for sophisticated digital p alteration. The key, of course, is that there is no negative, and the alteration leaves no tracks. Nor will these authenticity problems be limited to photographs. For example, some package delivery services now allow recipients to sign for their packages on a handheld device which creates a digital copy of the recipient's signature. Although this makes it easy to transfer the information to a computer, it also enables the computer to recreate the signature. If the hand~held device measures and records the pressure 0 applied by the signer and if the computer reprints that signature with an @ inkbased printer, the computer~generated copy will look absolutely ` authenticeven to the author. p Despite these examples, there will be many times when electronic evidencewhether photographs or documentswill indeed be identifiable based on distinctive characteristics alone. An eyewitness can just as easily identify a digital photograph of a person as he could a conventional photo. The question for both judge and jury will be the witness's ability and veracity in observing and recalling the original person, photo, scene, or document with which he compares the in court version. The fact that it is possible to alter a photofor example, to extend the skid marks at an accident sceneis far less significant if 0 the authenticating witness is independently sure from observing the site @ that the skid marks were, in fact, ten feet long. Similarly, the ` recipient of a discarded electronic ransom note may recall the content of p the original note well enough to authenticate a printout from the accused's computer. But to the extent that incourt photos or documents support 6 p ( H 6incomplete or fading witness memoriesor even substitute for witness memory altogetherlawyers must realize that "distinctive characteristics" in electronic evidence may be easy to alter, and may not, depending on the circumstances, satisfy a court. What witness can independently verify the 0 distinctive accuracy of long lists of names or numbers? Can he say that a P digital photo is "a fair and accurate p [Page 118] representation of a crime scene" in all detailsno matter how minor they may have seemed at the time? While he will probably be able to remember whether there was a knife sticking out of a body, will he be able to verify the precise location of a shoe across the room? An eyewitness who picked out the defendant at a lineup should be able to look at a photograph of the array and find the defendant again. But can she say for 0 sure, when testifying at a hearing on defendant's motion to suppress an P allegedly suggestive lineup, that all the other people in the picture p are exactly as she saw them? Has there been no mustache added in this picture, no height or weight changed in any way? And although the recipient of a ransom note may well be able to recall the exact words of the note, will he recall the type face? It is important to remember that the traditional process of authenticating an item through its uniqueness often carries an unspoken assumption that the thingthe murder weapon, the photo, or the letter, for exampleis a package deal. It either is or is not the thing the @ witness remembers. Thus, if the witness can identify particular 6 P p ( ` H 6aspects P of the item with certainty (such as the content of the ransom note), the other aspects (such as the type face) usually follow along without much debate. Of course, there are times, even with conventional photography, when an authenticating witness will be asked about internal details: "When you saw the crime scene at 5:30, were the shoes both on the right side of the room?" In those circumstances, attorneys and judges naturally tend to be more exacting in establishing that the witness can 0 authenticate not only part of the package, but all the parts that matter. @ ` But with digital photography, this rather minor problem of authentication p takes on a new life. Depending on the way electronic evidence has been produced, stored, and reproduced, the collection of ones and zeros that constitutes the "package" of the photograph is infinitely and independently variablenot by moving shoes at the crime scene, but by changing any digits at any time before the exhibit photo is printed. Perhaps judges will find themselves admitting digital photographs and documents based on "distinctive characteristics" if a witness with 0 knowledge can identify and authenticate the item in all relevant detail. @ But that, of course, requires a judge to know in advance which details ` will be relevant to the case and which are insignificant. If the p characteristic that makes the item distinctive is not the same one that makes it relevant, judges might and should be wary about admitting digital [Page 119] F p ( H Fevidence in this way. Even if judges are satisfied, attorneys who cross examine an authenticating witness on minute details of digital photographs may affect the witness's credibility with the jury, 0 especially if the attorney shows how easily the evidence could be @ altered. P ` One of the potential solutions to this problem which arises from the p nature of electronic evidence may actually be electronic: digital signatures. The Digital Signature Standard, proposed by the National Institute of Standards and Technology (NIST) in the Department of Commerce, would allow authors to encrypt their documents with a key known only to them. Assuming the author has not disclosed his password to others, this identifying key could serve as a sort of electronic evidence seal. In that event, the signature would be just the kind of distinctive characteristic the rules already recognize. For the time being, however, most computer evidence can still be altered 0 electronicallyin dramatic ways or in imperceptible detailwithout any P sign of erasure. But this does not mean that electronic evidence, having p become less distinctive, has become any less admissible. It simply may require us to authenticate it in other ways. 2. Chain of Custody When prosecutors present evidence to a court, they must be ready to show ! that the thing they offer is the same thing the agents seized. When that # evidence is not distinctive but fungible (whether little bags of cocaine, % 0 bullet shell casings, or electronic data), the "process or system" (to & P use the language of Fed. R. Evid. 901(b)(9)) which authenticates the item F ( ` p p (( H Fis a handtohand chain of accountability. ) * Although courts generally have allowed any witness with knowledge to , authenticate a photograph without requiring the photographer to testify, . that may not suffice for digital photos. Indeed, judges may now demand 0 that the proponent of a digital picture be ready to establish a complete 2 chain of custody from the photographer to the person who produced the 4 0 printout for trial. Even so, the printout itself may be a distinctive 5 P item when it bears the authenticator's initials, or some other 6 ` recognizable mark. If the photographer takes a picture, and then 7 p immediately prints and initials the image that becomes 8 9 [Page 120] : ; an exhibit, the chain of custody is just that simple. But if the exhibit < was made by another person or at a later time, the proponent should be > ready to show where the data has been stored and how it was protected @ from alteration. A ! B 3. Electronic Processing of Evidence " C 0 # D @ When data goes into computers, there are many methods and forms for $ F P getting it out. To the extent that computers simply store information for % H p later retrieval, a data printout may qualify as an original document & I under Fed. R. Evid. 1001(3). Where the computer has merely acted as a ' J technological file cabinet, advocates must be ready to authenticate the ( L incourt version of the document as genuine, but the evidentiary issues ) N (at least those connected to the computer) do not pertain to the * O substance or content of the document. F+ P p (P H Fܿ , Q But in many cases, attorneys want to introduce evidence that the computer - S 0 has not only stored, but has also processed in some fashion. If the . T P computer, its operating system, and its applications software have / U ` reorganized the relevant informationby comparing, calculating, 0 V p evaluating, regrouping, or selectively retrievingthis processing has 1 W altered at least the form of the information, and probably the substance 2 Y as well. 3 Z 4 [ The fact that the computer has changed, selected, or evaluated data 5 \ naturally does not make the resulting product inadmissible, but it does 6 ^ require another analytical step. The computer processing itself often 7 _ creates a new meaning, adds new informationwhich is really the 8 ` equivalent of an implicit statement. If an advocate wishes to introduce 9 b this processed product, he usually offers it for the truth of the : c @ conclusion it asserts. For example, when the telephone company compiles ; e P raw data into a phone bill for a subscriber, the bill is literally a < f p statement: "The following long distance calls (and no others) were placed = h from your phone to these numbers on these days and times." > i ? j If the computer has created a hearsay statement by turning raw evidence @ l into processed evidence, its proponent should be ready to show that the A n process is reliable. Computers process data in many different ways by B o running programs, which can be commercially or privately written. Any of C q these programs can contain logical errors, called "bugs," which could D r 0 significantly affect the accuracy of the computer process. And even if E s @ there is no error in F t P G u ` [Page 121] H v p I w the code, a technician may run the program in a way that creates a 6 p (x H 6false J y result. For example, a particular computer search program may be "case K { sensitive," which means that the upper and lowercase versions of any L } given letter are not interchangeable. If an author working in WordPerfect M (a popular word~processing program), searches a document for the word N "Evidence," the computer will not find the word "evidence," because the O @ letter "e" was not capitalized. What does it mean, then, when the P ` computer reports that the word was "not found"? Under what circumstances Q p should a computer's conclusion be admissible in court? R S Consider a failuretofile tax case. If a prosecutor asks the IRS to T search its databanks to see whether a taxpayer filed a return in a U particular year, the IRS may give her two very different products. If the V taxpayer filed electronically, the IRS can produce either an original W document from its computers (a printout of the filing) or an admissible X duplicate in the form of an electronic copy. In that case, the IRS Y computers simply acted as storage cabinets to hold and reproduce the Z 0 information that was entered by the taxpayer. Tax return in; tax return [ @ out. \ ` ] p But if, on the other hand, the IRS searches its databanks and finds ^ nothing, the IRS's negative report is clearly a hearsay statement which _ results from a computer processthe electronic search for the taxpayer's ` tax return. The hearsay rule (Fed. R. Evid. 803(10)) allows the absence a of a public record to be shown by testimony "that diligent search failed b to disclose the record ...." But testimony in what form? Will the c negative computer report suffice, or should the technician who ran the Fd p ( 0 H Fsearch testify? Must the technician explain not only what keystrokes he e @ entered to conduct the search, but also establish the errorfree logic of f ` the program he used? Must he know not only that the program searches for g both lower and uppercase versions of the taxpayer's name, but also h exactly how it accomplishes that task? While the absence of a record is i often admitted in evidence, prosecutors can expect that as attorneys j become more computerliterate, defense counsel will raise new challenges k in this area. Indeed, the accuracy or inaccuracy of the IRS's negative l report rests on many different components, including the reliability m (both human and technical) of the computer process. n o 0 Certainly, the mathematical validity of any program is a question of p @ facta question which the opponent of a piece of processed evidence q P should have an opportunity at some point to explore and to contest. r ` Similarly, the methods and safeguards involved in executing the program s p must also be fair ground for t u [Page 122] v w analysis and challenge. While it would clearly be both unnecessary and x burdensome to prove every step of a computer process in every case, y courts must also be ready to look behind these processes when the facts z warrant. As lawyers and judges learn more about all the variables { involved in creating evidence through computer processing, this area may | 0 become a new battleground for technical experts. } P ~ ` D. THE HEARSAY RULE p Most agents and prosecutors are familiar with the business records exception to the hearsay rule. Fed. R. Evid. 803(6). Generally speaking, any "memorandum, report, record, or data compilation" (1) made at or 6 p ( H 6near the time of the event, (2) by, or from information transmitted by, a person with knowledge, is admissible if the record was kept in the course of a regularly conducted business activity, and it was the regular practice of that business activity to make the record. 0 A business computer's processing and rearranging of digital information @ is often part of a company's overall practice of recording its regularly ` conducted activity. Information from telephone calls, bank transactions, p and employee time sheets is regularly processed, as a fundamental part of the business, into customer phone bills, bank account statements, and payroll checks. Logic argues that if the business relies on the accuracy of the computer process, the court probably can as well. This is different, however, from using a company's raw data (collected and stored in the course of business, perhaps) and electronically processing it in a new or unusual way to create an exhibit for trial. For example, banks regularly process data to show each accountholder's @ transactions for the month, and most courts would readily accept that P monthly statement as a qualifying business record. But may a court ` presume a similar regularity when the same bank runs a special data p search for all checks paid from the accountholder's account over the past year to an account in Switzerland? In this case, even though the report was not made at or near the time of the event, the document is probably admissible as a summary under Fed. R. Evid. 1006. That rule allows courts to admit a "chart, summary, or calculation" as a substitute for "voluminous writing, recordings, or photographs." Nonetheless, [Page 123] other parties still have the right to examine and copy the unabridged 0 original data, and to challenge the accuracy of the summary. Of 6 @ p ( P H 6course, @ this also opens the way to challenges of any computer process which p created the summary. In most other respects, of course, the hearsay rule operates with computer evidence exactly as it does with any other sort of evidence. For instance, statements for purposes of medical treatment, vital statistics, or statements against interest may all qualify as exceptions to the hearsay rule, whether they are oral, written, or electronic. Clearly, an electronic statement against interest must also be authenticated properly, but it does not fail as hearsay. Conversely, a correctly authenticated electronic message may contain all sorts of hearsay 0 statements for which there are no exceptions. @ P The key is that computer evidence is no longer limited to business ` records, and the cases that carry that assumption are distinguishable p when advocates work with other kinds of electronic evidence. But even with business records, a trial lawyer well versed in the technological world who knows how to ask the right questions may find that the "method or circumstances of preparation indicate lack of trustworthiness," under Fed. R. Evid. 803(6), to such a degree that a court will sustain, or at least consider, a challenge to the admissibility of the evidence. Computers and their products are not inherently reliable, and it is always wise to ask, in any particular case, what computers do and how they do it. @ P [no page 124] [Page 125] ` p IX. APPENDICES APPENDIX A: SAMPLE COMPUTER LANGUAGE FOR SEARCH WARRANTS IT IS ESSENTIAL to evaluate each case on its facts and craft the 6 p ( H 6language of the warrant accordingly. Computer search warrants, even more than most others, are never onesizefitsall products. The following paragraphs are a starting point for recurring situations, but may be adjusted in 0 infinite ways. If you have any questions about tailoring an affidavit and @ warrant for your case, please call the Computer Crime Unit at ` 2025141026 for more suggestions. ! p " Your affiant knows that computer hardware, software, documentation, $ passwords, and data security devices may be important to a criminal % investigation in two distinct and important respects: (1) the objects & themselves may be instrumentalities, fruits, or evidence of crime, and/or ( (2) the objects may have been used to collect and store information about * crimes (in the form of electronic data). Rule 41 of the Federal Rules of + Criminal Procedure permits the government to search and seize computer - hardware, software, documentation, passwords, and data security devices / @ which are (1) instrumentalities, fruits, or evidence of crime, or (2) 0 ` storage devices for information about crime. 1 p 2 1. Tangible Objects 3 4 a. Justify Seizing the Objects 5 6 Explain why, in this case, the tangible computer items are 7 instrumentalities, fruits, or evidence of crimeindependent of the 8 information they may hold. 9 : [Page 126] ; < Your affiant knows that [subject's] regional offices concertedly and = 0 systematically supplied various specialized computer programs to its > @ individual local offices. These computer programs were designed to ? P manipulate data in ways which would automatically add a few 6 ` p (@ p H 6pennies to A ` the amount billed to customers for each transaction. By using this B specially designed program in its computers, the [subject] was able to C commit a pervasive and significant fraud on all customers which would be E very difficult for any one of them to detect. F G * * * * * * * H I or * * * * * * * J K Your affiant knows that [subject] accessed computers without authority M 0 from his home by using computer hardware, software, related N P documentation, passwords, data security devices, and data, more O ` specifically described as follows: [ ]. P p Q * * * * * * * R S and T U * * * * * * * V W As described above, the [subject's] computer hardware, software, related Y documentation, passwords, data security devices, and data were integral [ tools of this crime and constitute the means of committing it. As such, \ 0 they are instrumentalities and evidence of the violations designated. ] @ Rule 41 of the Federal Rules of Criminal Procedure authorizes the ^ P government to seize and retain evidence and instrumentalities of a crime ` ` for a reasonable time, and to examine, analyze, and test them. a b b. List and Describe the Objects c d The tangible objects listed below may be named and seized as the objects f of the search when they are, themselves, instrumentalities, fruits, or g evidence of crime. Depending on the facts of the case, the list may be F h p (h H Flong or very i j [Page 127] k 0 l @ short. The affidavit should describe the specific tangible objects with m P as much particularity as the facts allow. The following paragraphs are n ` designed to be expansive and allinclusive for those cases in which the p p government has probable cause to search and seize all computer hardware, r software, documentation, and data security devices (including passwords) t on site. However, most cases will call for a much more limited list u v (1) Hardware w x Computer hardware consists of all equipment which can collect, analyze, z create, display, convert, store, conceal, or transmit electronic, { 0 magnetic, optical, or similar computer impulses or data. Hardware | @ includes (but is not limited to) any dataprocessing devices (such as } P central processing units, memory typewriters, and self~contained ~ ` "laptop" or "notebook" computers); internal and peripheral storage p devices (such as fixed disks, external hard disks, floppy disk drives and diskettes, tape drives and tapes, optical storage devices, transistorlike binary devices, and other memory storage devices), peripheral input/output devices (such as keyboards, printers, scanners, plotters, video display monitors, and optical readers); and related communications devices (such as modems, cables and connections, recording equipment, RAM or ROM units, acoustic couplers, automatic dialers, speed dialers, programmable telephone dialing or signaling devices, and 0 electronic tonegenerating devices); as well as any devices, mechanisms, @ or parts that can be used to restrict access to computer hardware (such ! ` as physical keys and locks). F" p ( H Fܿ # (2) Software $ % Computer software is digital information which can be interpreted by a & computer and any of its related components to direct the way they work. ' Software is stored in electronic, magnetic, optical, or other digital ( form. It commonly includes programs to run operating ) * 0 [Page 128] + @ , P systems, applications (like wordprocessing, graphics, or spreadsheet - ` programs), utilities, compilers, interpreters, and communications . p programs. / 0 (3) Documentation 1 2 Computerrelated documentation consists of written, recorded, printed, or 3 electronically stored material which explains or illustrates how to 4 configure or use computer hardware, software, or other related items. 5 6 (4) Passwords and Data Security Devices 7 8 0 Computer passwords and other data security devices are designed to 9 @ restrict access to or hide computer software, documentation, or data. : P Data security devices may consist of hardware, software, or other ; ` programming code. A password (a string of alphanumeric characters) < p usually operates as a sort of digital key to "unlock" particular data = security devices. Data security hardware may include encryption devices, > chips, and circuit boards. Data security software or digital code may ? include programming code that creates "test" keys or "hot" keys, which @ perform certain preset security functions when touched. Data security A software or code may also encrypt, compress, hide, or "boobytrap" B protected data to make it inaccessible or unusable, as well as reverse FC p ( H Fthe process to restore it. D 0 E @ 2. Information: Records, Documents, Data F P G ` For clarity, most "information" warrants need one paragraph listing all H p the kinds of evidence they seek (content). Then they need a separate I paragraph detailing all the various forms this evidence could take, so it J is clear that all forms apply to all records. Most warrants will need K another section (in appropriate cases) explaining why agents need to L seize data storage devices for M N [Page 129] O P offsite searches. It may also be necessary to ask the magistrate for Q permission to take some peripheral hardware and software even though it R 0 does not directly contain evidence. S P T ` a. Describe the Content of Records, Documents, or other Information U p V If the object of the search is information which has been recorded in W some fashion (including digital form), it is important to begin with the X content of the record and not with its form. Depending on the case, the Y probable cause may be limited to one very specific document or extend to Z every record in a wholly criminal enterprise. Describe the content of the [ document with the same specificity and particularity as for paper \ records. ] ^ 0 Based on the facts as recited above, your affiant has probable cause to _ @ believe the following records are located at [the suspect's] residence ` ` and contain evidence of the crimes described: a p b A letter dated July 31, 1991 from [the suspect] to his mother. c Fd p ( H FTax records and all accompanying accounts, records, checks, receipts, e statements, and related information for tax year 1991. f g Lists of illegal or unauthorized access codes or passwords, including h (but not limited to) telephone, credit card, and computer access codes. i j All records relating to [the suspect's] drug trafficking, including (but k 0 not limited to) lists of customers and related identifying information; l @ types, amounts, and prices of drugs trafficked as well as dates, places, m P and amounts of specific transactions; any information related to sources n p of narcotic drugs (including names, addresses, phone numbers, or any o other identifying information); any information recording [the suspect's] p q [Page 130] r s schedule or travel from 1988 to present; all bank records, checks, credit t card bills, account information, and other financial records. u v b. Describe the Form which the Relevant Information May Take w 0 x @ If you know the records are stored on a computer or in some other digital y P form, you should limit the scope of the search to digital records. If you z p cannot determine in advance the form of the records (or if the records { are in several different forms) the following language is a starting | point. BUT BE SURE TO ELIMINATE ANYTHING WHICH DOES NOT APPLY TO YOUR } CASE. Once again, because cases which have nothing else in common may all ~ have digital evidence, the following list is extremely broad. For example, in child pornography or counterfeiting cases, the nondigital evidence may be photographs, films, or drawings. But in drug cases, tax F 0 p ( @ H Fcases, or computer crimes, the agents may not be searching for graphics P or other pictures. p The terms "records," "documents," and "materials" include all of the foregoing items of evidence in whatever form and by whatever means such records, documents, or materials, their drafts, or their modifications may have been created or stored, including (but not limited to) any handmade form (such as writing, drawing, painting, with any implement on any surface, directly or indirectly); any photographic form (such as microfilm, microfiche, prints, slides, negatives, videotapes, motion pictures, photocopies); any mechanical form (such as phonograph records, printing, or typing); any electrical, electronic, or magnetic form (such @ as tape recordings, cassettes, compact discs, or any information on an P electronic or magnetic storage device, such as floppy diskettes, hard ` disks, backup tapes, CDROMs, optical discs, printer buffers, smart p cards, memory calculators, electronic dialers, Bernoulli drives, or electronic notebooks, as well as printouts or readouts from any magnetic storage device). [Page 131] ! " c. Electronic Mail: Searching and Seizing Data from a BBS Server under 18 $ U.S.C. 2703 % & In some situations, you may know or suspect that the target's computer is ( 0 the server for an electronic bulletin board service (BBS). If you need to * P seize the computer, the data on it, or backups of the data, consider the , p applicability of 18 U.S.C. 2703. (See "STORED ELECTRONIC - COMMUNICATIONS," supra p. 85.) If the statute applies and there is or may / be qualifying email on the computer, consider whether the 6 p (0 H 6government has 1 probable cause to believe that all or any of it is evidence of crime. 2 3 Your affiant has probable cause to believe that [the suspect]'s computer 5 operates, in part, as the server (or communications center) of an 6 0 electronic bulletin board service ("BBS"). This BBS [appears to] 7 @ provide[s] "electronic communication service" to other persons, and [may] 9 P contain[s] their "electronic communications," which may have been in : p "electronic storage" on [the suspect's] computer for less than 180 days < (as those terms are defined in 18 U.S. C. 2510). The affiant is aware of = the requirements of Title 18 U.S.C. 2703 describing law enforcement's > obligations regarding electronic communications in temporary storage ? incident to transmission, as defined in that statute. @ A (1) If All the EMail is Evidence of Crime B C If the whole BBS is dedicated to criminal enterprise (such as a specialty E "porn board" or "pirate board"), the facts may support searching and F 0 seizing all the email, including the electronic mail which qualifies G @ under the statute. H P I ` [Your affiant, as an undercover subscriber and user of (the suspect's) J p BBS network, has learned that it is dedicated to exchanging illegal K copies of computer software and stolen access codes among users. All L users are asked to furnish pirated software products and active access N codes (phone cards, credit cards, PBX codes, and computer passwords) in P return for the privilege of illegally downloading from the BBS other Q illegal software or codes they may choose. Your affiant has used the R electronic mail services of the BBS, and knows S T [Page 132] U V 0 that the subscribers use it primarily to share information about other W @ sources of illegal software and about how to use stolen access codes 6 P p (X ` H 6and Y P computer passwords. Thus, your affiant has probable cause to believe that [ any electronic mail residing on the system contains evidence of these \ illegal activities.] ] ^ (2) If Some of the EMail is Evidence of Crime _ ` If you have probable cause to believe that there will be evidence of a crime in the email of some users and not others, the affidavit and b warrant should distinguish and describe which will be searched and seized d and which will not. In most cases like this, the government will be e 0 focusing on the electronic communications of the suspect/sysop's f @ coconspirators. The affidavit should identify the particular g P individuals, if possible (by name or "hacker handle"), so that data h ` analysts will know which email to search and which to leave unopened. In j p some cases, the government may have probable cause to search e mail from l some "subboards" of the BBS, but not from others. In other cases, the n magistrate may allow the government to run "string searches" of all the p email for certain specified key words or phrases. There are too many q variations in these cases to draft useful models, but the wisest course s is to address this issue in the affidavit and set out a search and t seizure plan which the magistrate can approve. Please call the Computer v 0 Crime Unit (202514~1026) for more specific assistance. w P x ` (3) If None of the EMail is Evidence of Crime y p z In some cases. the suspect's criminal uses of his computer are quite { separate from and coincidental to his using it as the server for a BBS. | For example, a sysop who runs a legal bulletin board from his home may ~ ° also use the same computer to store personal copies of child pornography, F p ( H For records of his drugdealing business, or a deaththreat letter to the President of the United States. None of these criminal uses has anything to do with the legal (and perhaps statutorily protected) private @ electronic communications of his BBS subscribersexcept for the fact P that they reside on the same computer system. ` p [Page 133] À Ð And even when this computer system clearly is an instrumentality of the à suspect/sysop's crime, the government may be obliged to protect the unrelated, qualifying email of innocent third parties and set it aside, unopened. In any event, the government should consider and address this issue with the magistrate and devise a plan which will work in the case at hand. Call the Computer Crime Unit for more help. 0 d. Ask Permission to Seize Storage Devices when an Off~Site Search is @ Necessary P ` Based upon your affiant's knowledge, training and experience, and p consultations with [NAME AND QUALIFICATIONS OF EXPERT], your affiant Ā knows that searching and seizing information from computers often Đ requires agents to seize most or all electronic storage devices (along Ġ with related peripherals) to be searched later by a qualified computer İ expert in a laboratory or other controlled environment. This is true because of the following: 1) The volume of evidence. Computer storage devices (like hard disks, diskettes, tapes, laser disks, Bernoulli drives) can store the equivalent of thousands of pages of information. Additionally, a suspect may try to conceal criminal evidence; he or she might store it in random order with 0 deceptive file names. This may require searching authorities to examine P all the stored data to determine which particular files are evidence or F p p p ( ŀ H Finstrumentalities of crime. This sorting process can take weeks or Ő months, depending on the volume of data stored, and it would be Š impractical to attempt this kind of data search on site. Ű 2) Technical requirements. Searching computer systems for criminal evidence is a highly technical process requiring expert skill and a properly controlled environment. The vast array of computer hardware and software available requires even computer experts to specialize in some systems and applications, so it is difficult to know before a search 0 which expert is qualified to analyze the system and its data. In any @ event, however, data search protocols are exacting scientific procedures P designed to protect the integrity of the evidence p ƀ [Page 134] Ɛ Ơ and to recover even "hidden," erased, compressed, password~ protected, or ư encrypted files. Since computer evidence is extremely vulnerable to inadvertent or intentional modification or destruction (both from external sources or from destructive code imbedded in the system as a "booby trap"), a controlled environment is essential to its complete and accurate analysis. 0 @ e. Ask Permission to Seize, Use, and Return Auxiliary Items, as Necessary P p In cases where you must seize hardware, software, documentation, and data ǀ security devices in order to search and seize the data for which you have Ǡ probable cause, ask the magistrate's permission in the affidavit. The language which follows is general and will be most applicable to computers which are not part of an extensive network. Of course, if you have specific information in your case to support seizing auxiliary 6 p ( H 6items (e.g., the computer hardware is rare; the operating system is 0 customdesigned), cite those factors rather than using the general @ description which follows. P ` Based upon your affiant's knowledge, training and experience, and [NAME p AND QUALIFICATIONS OF EXPERT], your affiant knows that searching ! Ȑ computerized information for evidence or instrumentalities of crime " Ƞ commonly requires agents to seize most or all of a computer system's # Ȱ input/output peripheral devices, related software, documentation, and $ data security devices (including passwords) so that a qualified computer % expert can accurately retrieve the system's data in a laboratory or other & controlled environment. This is true because of the following: ' ( 0 The peripheral devices which allow users lo enter or retrieve data from ) @ the storage devices vary widely in their compatibility with other * ` hardware and software. Many system storage devices require particular + p input/output (or "I/O") devices in order to read the data on the system. , ɐ It is important that the analyst be able to properly re~configure the - ɰ system as it now operates in order to accurately retrieve the evidence . listed above. In addition, the analyst needs the relevant system software / (operating systems, interfaces, and 0 1 [Page 135] 2 3 0 hardware drivers) and any applications software which may have been used 4 @ to create the data (whether stored on hard drives or on external media), 5 ` as well as all related instruction manuals or other documentation and 6 ʀ data security devices. F7 ʐ ʐ p ( ʠ H Fܿ 8 ʰ If, after inspecting the l/O devices, software, documentation, and data 9 security devices, the analyst determines that these items are no longer : necessary to retrieve and preserve the data evidence, the government will ; return them within a reasonable time. < = 0 f. Data Analysis Techniques > @ ? P Data analysts may use several different techniques to search electronic @ ` data for evidence or instrumentalities of crime. These include, but are A ˀ not limited to the following: examining file directories and B ː subdirectories for the lists of files they contain; "opening" or reading C ˠ the first few "pages" of selected files to determine their contents; D ˰ scanning for deleted or hidden data; searching for key words or phrases E ("string searches"). F G 3. Stipulation for Returning Original Electronic Data H I In some cases, you may want to return data storage devices which contain J original electronic evidence to the suspect and keep "bitstream" or K @ "mirrorimage" copies for processing and for use at trial. For example, L P the suspect may be a large business which employs many innocent people M p and which needs its computers and data in order to run the business and N ̐ pay the employees. If you do wish to return the equipment and data before O ̰ trial, consider using some version of the following stipulation to avoid P evidentiary issues. Of course, whether the copies are, indeed, "exact" Q copies is a question of fact, and the defense will have to satisfy itself R that the government's copying process was accurate. But if, after S exploring the issue, the defense refuses to T FU p ( 0 H F[Page 136] V ! @ W " P sign a stipulation and cannot be satisfied about the reliability of the X # ` duplicates, you will probably need to keep the originals. (See "Returning Y % p Seized Computers and Materials," supra p. 105, and "EVIDENCE," supra p. Z ' ͐ 113.) (For a form stipulation, see p. 137.) [ ( Ͱ \ ) [Page 137] ] * ^ + UNITED STATES DISTRICT COURT _ , ` - In the Matter of the Search of ____ a . b / STIPULATION OF THE PARTIES. c 0 0 d 1 @ It is hereby stipulated and agreed between ____ and ____ as an individual e 3 P and as an agent for ____ that: f 4 p g 5 (1) the electronic information contained on the [Bernoulli 90MB disk, h 6 ΐ number ____] is a complete, exact, and accurate duplicate of i 7 Π the electronic information contained on [the hard drive of an IBM j 8 ΰ personal computer, serial number ____] [the hard drive of a personal k 9 computer identified as "Fred's" by an evidence tag attached to the top of l ; the CPU cover, said personal computer bearing no serial number or other m = identifying information] [a floppy disk marked with an evidence sticker n ? as "item number ____, and bearing the initials "_ _ _"]; which o @ 0 computers/floppy disk were/was seized from ____ on ____, 199_, by agents p B @ of the ____. q C ` r D p (2) the electronic information contained on the [Bernoulli 90MB disk, s E π number ____] accurately reproduces the original data described above as t G ϐ of____, 199_. Fu H ϰ ϰ p ( H H Fܿ v I Assistant U.S. Attorney Defendant w J x K Agency Attorney y L z M [No page 138] [Page 139] { N | O 0 APPENDIX B: GLOSSARY14 } P @ ~ Q P BBS See "Electronic Bulletin Board Systems." R ` S p CD ROM CD ROM stands for Compact Disk ReadOnly Memory. CD ROMs store U Ѐ and read massive amounts of information on a removable disk platter or W Р solid state storage chip. Unlike the data on hard drives and diskettes, X data on CD ROMs can only be readnot alteredby the user. Also called Z "firmware." [ \ CPU The central processing unit. ] ^ DATA "A formalized representation of facts or concepts suitable for _ 0 communication, interpretation, or processing by people or automated ` @ means." The term "data" is often used to refer to the information stored b P in the computer. c p d р DOCUMENTATION Documents that describe technical specifications for f ѐ computerrelated products and how to use hardware components and/or h Ѱ software applications. i j ELECTRONIC BULLETIN BOARD SYSTEMS (BBS) A bulletin board system is a l computer dedicated, in whole or in part, to serving as an electronic m meeting place. A BBS computer system may contain information, programs, o and email, and is set up so that users can dial the bulletin board F p @ @ p ( p P H Fsystem, read and leave messages for other users, and download and upload r ` software programs for common use. A BBS can have multiple telephone lines t Ҁ (so that many people can use it at the same time) or a single line where v Ҡ a user's access is firstcome, firstserved. BBSs can have several levels x of access, sometimes called "subboards" or "conferences." Access to the z different conferences is controlled by the system operator with a { password system. A single user may have several different passwords, one } for each different level or conference. A user may store documents, data, 0 programs, messages, and even photographs in the different levels of the P BBS. A bulletin board system may be located anywhere telephone lines go. p Ӑ 14 All quotations in this Glossary are taken from Webster's Dictionary of Ӡ Computer Terms (3d ed. 1988). [Page 140] ELECTRONIC MAIL Electronic mail provides for the transmission of messages and files between computers over a communications network. Sending information in this way is similar in some ways to mailing a 0 letter through the postal service. The messages are sent from one @ computer through a network server to the electronic address of another P specific computer or to a series of computers of the sender's choice. The p transmitted messages (and attached files) are either stored at the Ԑ computer of the addressee (such as someone's personal computer) or at the Ԡ mail server (a machine dedicated, at least in part, to storing mail), and F p ( H Fwill remain there until the addressee retrieves the mail from the server. When people "pick up" email from the mail server, they usually receive only a copy of their mail, and the stored message is maintained in the 0 mail server until the addressee deletes it. (Some systems allow senders @ to delete mail on the server before delivery.) Of course, deleted mail ` may sometimes be recovered by "undeleting" the message (if not yet p overwritten) or by obtaining a backup copy (if the server was backed up Հ before the message was deleted). ՠ հ FAX PERIPHERAL A device, normally inserted as an internal card, that allows the computer to function as a fax machine. (An abbreviation of "facsimile.") FILE SERVER A file server is a computer on a network that stores the programs and data files shared by the users of the network. A file server is the nerve center of the network, and also acts as a remote disk drive, @ enabling users to store information. It can be physically located in ` another judicial district from the suspect's machine. p ր FLOPPY DISK DRIVE A drive that reads from or writes to separate diskettes which the user inserts. Information is stored on the diskettes ֠ themselves, not on the drive. HARD DISK DRIVE A storage device based on a fixed, permanently mounted disk drive. It may be either internal (part of the computer itself) or external (a separate but connected component). Both applications and data may be stored on the disk. 0 @ HARDWARE "The physical components or equipment that make up a computer F P ` p ( p H Fsystem..." Examples include keyboards, monitors, and printers. ׀ א [Page 141] נ װ INPUT/OUTPUT DEVICE A piece of equipment which sends data to, or receives data from, a computer. Keyboards, monitors, and printers are all common I/O devices. LASER DISK Similar to a CD ROM drive but uses lasers to read and sometimes write information. 0 MODEM A device ("modulate/demodulate") which allows one computer to @ communicate with another computer, normally over standard telephone ` lines. It converts the computer's digital information to analogue signals for outgoing telephone transmission, and reverses the conversion for ؠ incoming messages. Modems may be either part of (internal) or external to ذ the computer. MOUSE A pointing device that controls input by moving a cursor or other figure on the screen. Normally, the user points to an object on the screen and then presses a button on the mouse to indicate her selection. @ NETWORK "A system of interconnected computer systems and terminals." P p PRINTER A number of technologies exist, using various techniques. The ـ most common types of computer printers are: ٠ ٰ 1. Band a rotating metal band is impacted as it spins; 2. Daisy wheel a small print wheel containing the form of each character rotates and hits the paper, character by character; F p ( H Fܿ 3. Dot matrix characters and graphics are created by pins hitting the ribbon and paper; 0 @ 4. Ink jet injects (sprays) ink onto the paper; P ` 5. Laser electrostatically charges the printed page and applies toner; p ڐ 6. Plotter moves ink pens over the paper surface, typically used for ڠ large engineering and architectural drawings. ڰ 7. Thermal a hot printer head contacts special paper that reacts to heat. [Page 142] SCANNER Any optical device which can recognize characters on paper and, using specialized software, convert them into digital form. @ P SERVER See "File Server." ` p SOFTWARE "The programs or instructions that tell a computer what to ۀ do." This includes operating system programs which control the basic ۠ functions of the computer system (such as Microsoft's Disk Operating ۰ System"MSDOS"that controls IBMcompatible PCs) and applications programs which enable the computer to produce useful work (e.g., a word processing program such as WordPerfect). SYSOP See "System Administrator." 0 SYSTEM ADMINISTRATOR The individual responsible for assuring that the @ computer network is functioning properly. He is often responsible for ` computer security as well. p F ܀ ܀ p ( ܐ H FSYSTEM OPERATOR See "System Administrator." ܠ ܰ VOICEMAIL SYSTEMS A voicemail system is a complex phone answering machine (run by a computer) which allows individuals to send and receive telephone voice messages to a specific "mailbox" number. A person can call the voicemail system (often a 1800 number) and leave a message in a particular person's mailbox, retrieve messages left by other people, or @ transfer one message to many different mailboxes in a list. Usually, ` anyone can leave messages, but it takes a password to pick them up or p change the initial greeting. The system turns the user's voice into ݐ digital information and stores it until the addressee erases it or ! ݠ another message overwrites it. Criminals sometimes use voice mailboxes # ݰ (especially, if they can beat the password, those of unsuspecting people) % as remote deaddrops for information that may be valuable in a criminal ' case. The server for the voice mailboxes is usually located in the ( message system computer of the commercial vendor which supplies the * voicemail service. Sometimes it can be found on the + @ customer~organization's computer server at the location called. Voice - P mail messages can be written on magnetic disk or remain in the computer's / p memory, depending on the vendor's system. 0 ސ ! 1 ޠ [No page 142] [Page 143] " 2 ް # 3 APPENDIX C: FEDERAL EXPERTS FOR COMPUTER CRIME INVESTIGATIONS $ 4 % 5 The following is a list of some federal resources in alphabetical order: & 6 ' 7 1. Bureau of Alcohol, Tobacco, and Firearms Forensic Science 6 p ( 8 H 6Laboratory ( 9 1401 Research Blvd. Rockville, MD 20850 3012175717 ) : @ * ; P 2. Drug Enforcement Administration Chief, Technical Operations Section + < ` 8199 Backlick Road Lorton, VA 20079 7035578250 , = p - > ߀ 3. Federal Bureau of Investigation Computer Crime Squad Washington . ? ߐ Metropolitan Field Office 7799 Leesburg Pike Suite 200, South Tower Falls / A ߠ Church, VA 22043 2023249164 0 B 1 C 4. Federal Bureau of Investigation Laboratory Division 9th and 2 D Pennsylvania Ave., N.W. Washington, DC 20535 2023243000 3 E 4 F 5. Internal Revenue Service SCER Program Coordinator Criminal 5 G Investigation Division CI:R:I Room 2246 1111 Constitution Ave., N.W. 6 H Washington, DC 20224 2025359130 7 I 0 8 J @ [Page 144] 9 K P : L ` United States Air Force Computer Crime Division Office of Special ; M p Investigations HQ AFOSI/IVSC Bolling Air Force Base Washington, DC < N 203326001 2027675847 = O > P United States Secret Service Electronic Crimes Branch 1310 L Street, N.W. ? R Washington, DC 20005 2024357700 @ S A T [Page 145] B U C V APPENDIX D: D W E X COMPUTER SEARCH AND SEIZURE WORKING GROUP F Y 0 G Z @ The following agencies and individuals contributed to these guidelines. H [ P * Designates those no longer in government service. I \ ` J ] p United States Department of Defense K ^ L _ United States Air Force FM ` p ( ` H Fܿ N a Computer Crime Division Office of Special Investigations HQ AFOSI/IVSC O b Bolling AFB Washington, DC 203326001 2027675847 P c Q d Jim Christy, Chief R e S f United States Department of Justice T g U h 0 Criminal Division V i @ W j P Kevin Di Gregory, Deputy Assistant Attorney General X k ` Y l p Robert Litt, Deputy Assistant Attorney General Z m [ n [Page 146] General Litigation and Legal Advice Section 1001 G Street, \ o N.W., Suite 200 Washington, DC 20001 2025141026 ] p ^ q Mary C. Spearing, Chief Scott Charney, Chief, Computer Crime Unit Martha _ s StansellGamm, Working Group Chair Laura Blumenfeld William D. Braun ` u William C. Brown Elena Duarte Gerald Grzenda Annette Long Stevan Mitchell a w Michael J. Rhim Daniel Schneider Joshua Silverman Phillip Talbert * Peter b y 0 Toren George Toscas Candice Will Paula Wolff c z P d { ` Office of Professional Development and Training 1001 G Street, N.W., e | p Suite 250 Washington, DC 20001 2025141323 f } g ~ Debra Crawford h i [Page 147] j k Drug Enforcement Administration l m Criminal Law Section Office of the Chief Counsel 700 Army Navy Drive, n West Bldg. Arlington, VA 22202 2023078014 o p Greg Mitchell Fq 0 0 p ( @ H Fܿ r P Federal Bureau of Investigation s ` t p Computer Analysis and Response Team Laboratory Division, Room 3218 9th u and Pennsylvania Ave., N.W. Washington, DC 20535 2023242104 v w Steve McFall, Chief Mike Noblett x y Computer Crime Squad Washington Metropolitan Field Office 7799 Leesburg z Pike Suite 200, South Tower Falls Church, VA 22043 2023249164 { | James Settle, Chief * } ~ 0 [Page 148] @ P Tax Division ` p Criminal Law Section Main Justice Bldg., Room 4625 10th and Constitution Ave., N.W. Washington, DC 20530 2025142832 Tony Whitledge United States Attorneys Offices Northern District of California 450 Golden Gate Ave., 11th Floor Box 36055 San Francisco, CA 94102 4155564229 Robert K. Crowe 0 @ Southern District of California 940 Front St., Room 5NI9 San Diego, CA P 921890150 6195576962 p Mitchell D. Dembin Northern District of Georgia Richard Russell Bldg., Room 1800 75 Spring Street Atlanta, GA 30335 4043316954 F p ( H Fܿ Kent Alexander, United States Attorney Randy Chartash [Page 149] Southern District of New York One St. Andrews Plaza New York, NY 10007 0 2127910055 P ` Steve Fishbein * p Eastern District of Virginia 600 E. Main St., Suite 1800 Richmond, VA 23219 8047712186 Win Grant United States Department of the Treasury Bureau of Alcohol, Tobacco, and Firearms Forensic Science Laboratory 1401 Research Blvd. Rockville, MD 20850 3012175717 0 @ John Minsek P ` Systems Operation/Software Engineering Support Branches 650 Massachusetts p Ave., N.W., Room 6004 Washington, DC 20226 2029276095 Dan Lofton Michael Park [Page 150] Internal Revenue Service Criminal Investigation Division 1111 Constitution Ave., N.W., Room 2246 Washington, DC 20224 2025359130 0 @ Timothy Whitley, Senior Analyst F P P p ( ` H Fܿ p Criminal Investigation Training Federal Law Enforcement Training Center Building 69, Third Floor Glynco, GA 31524 9122672378 Dan Duncan, Attorney Chuck Rehling, Special Agent Seized Computer & Evidence Recovery Specialists Computer Investigative Specialists 515 N. Sam Houston Pkwy., East Mail Stop 9123 NW Houston, TX 77060 7138785897 0 Ken Scales, Special Agent @ P United States Customs Service ` p Office of Investigative Programs Special Investigations Division 1301 Constitution Ave., N.W., Room 6130 Washington, DC 20229 202377 9283 John Seither, Senior Special Agent [Page 151] United States Secret Service Electronic Crimes Branch Financial Crimes Division 1310 L Street, N.W., Room 200 Washington, DC 20005 2024357700 0 @ Jack Lewis Tom Moyle P ` [No page 152] [Page 153] p APPENDIX E: STATUTORY POPULAR NAME TABLE Access Device Fraud Statute ..... . . . . . . . . . . . 18 U.S.C. 1029 Computer Fraud and Abuse Act .......................... 18 U.S.C. 1030 NoKnock Statute ........ .................. $ 18 U.S.C. 3109 Privacy Protection Act ....................... $ 42 U.S.C. 2000aa F p ( H FStored Communications Access ................. 18 U.S.C. 2701, et seq. Wiretap Statute ("Title III") ................ 18 U.S.C. 2510, et seq. [No page 154] [Page 155] 0 @ APPENDIX F: TABLE OF AUTHORITIES P ` Cases [number following case is page number on which case is cited] p Abel v. United States, 362 U.S. 217 (1960) 36 Aguilar v. Texas, 378 U.S. 108 (1964) 27 Andresen v. Maryland, 427 U.S. 463 (1976) 30, 37, 38 Application of Commercial Inv. Co., 305 F. Supp. 967 (S.D.N.Y. 1969) 37 Blair v. United States, 665 F.2d 500 (4th Cir. 1981) 11 Blinder. Robinson & Co. v. United States, 897 F.2d 1549, 46 CrL 1537 0 (10th Cir. 1990) 107 @ P DeMassa v. Nunez, 747 F.2d 1283 (9th Cir. 1984) 43 ` p Donovan v. A.A. Beiro Construction Co., Inc., 746 F.2d 894 (D.C. Cir. 1984) 21 Floyd v. United States, 860 F.2d 999 (1Oth Cir. 1988) 106 Frazier v. Cupp, 394 U.S. 731 (1969) 15 Horton v. California, 496 U.S. 128, 47 CrL 2135 (1990) 9 ! Illinois v. Rodriguez, 497 U.S. 177, 47 CrL 2177 (1990) 16, 17 " # In Re Grand Jury Subpoena Duces Tecum Dated November 15, 1993, 846 F. % 0 Supp. 11, 54 CrL 1506 (S.D.N.Y. 1994) 98 & P ' ` In Re Grand Jury Subpoenas, 926 F.2d 847 (9th Cir. 1991) 53 F ( p p p ( ( H Fܿ ) In Re Southeastern Equipment Co. Search Warrant, 746 F. Supp.1563 (S.D. + Ga. 1990) 105 , - Klitzman v. Krut, 744 F.2d 955 (3d Cir. 1984) 40 . / Lafayette Academy, Inc., Application of, 610 F.2d 1 (1st Cir. 1979) 53, 0 98 1 2 Lambert v. Polk County, Iowa, 723 F. Supp. 128 (S.D. Iowa 1989) 80 3 0 4 @ Marron v. United States, 275 U.S. 192 (1927) 37 5 P 6 ` Marvin v. United States, 732 F.2d 669 (8th Cir. 1984) 58 7 p 8 Matter of Search of Kitty's East, 905 F.2d 1367 (10th Cir. 1990) 106. 107 : ; Mincey v. Arizona, 437 U.S. 385 (1978) 10 < = Minneapolis Star & Tribune Co. v. United States, 713 F. Supp. 1308 (D. > Minn. 1989) 80 ? @ National City Trading Corp. v. United States, 635 F.2d 1020 (2d Cir. A 1980) 83 B C 0 National Federation of Federal Employees v. Weinberger, 818 F.2d 935 D @ (D.C. Cir. 1987) 19 E P ! F ` Naugle v. Witney, 755 F. Supp. 1504 (D. Utah 1990) 58 " G p # H O'Connor v. Ortega, 480 U.S. 709 (1987) 18, 19, 21 $ I % J Pell v. Procunier, 417 U.S. 817 (1974) 71 & K ' L Pleasant v. Lovell, 876 F.2d 787 (10th Cir. 1989) 24 ( M ) N Schneckloth v. Bustamonte, 412 U.S. 218 (1973) 12, 13 * O F+ P p ( P H FSecurities and Exchange Commission v. McGoff, 647 F.2d 185 (D.C. Cir.), , Q cert. denied, 452 U.S. 963 (1981) 71 - R 0 . S @ Steele v. United States, 267 U.S. 498 (1925) 96 / T P 0 U ` Steve Jackson Games. Inc. v. U.S. Secret Service, 816 F. Supp. 432 (W.D. 1 V p Tex. 1993), appeal filed on other grounds, (Sept. 17, 1993) 82, 83, 88 2 W 3 X Texas v. Brown, 460 U.S. 730 (1983) 11 4 Y 5 Z United States Postal Service v. C.E.C. Services, 869 F.2d 184 (2d Cir. 6 [ 1989) 56 7 \ 8 ] United States v. Agrusa, 541 F.2d 690 (8th Cir. 1976) cert. denied, 429 9 ^ U.S. 1045 (1977) 101 : _ ; ` United States v. Aguilar, 883 F.2d 662 (9th Cir. 1989), cert. denied, 498 < a U.S. 1046 (1991) 24 = b 0 > c @ United States v. Arias, 923 F.2d 1387 (9th Cir.), cert. denied, 112 S. ? d P Ct. 130 (1991) 10 @ e ` A f p United States v. Barrett, 725 F. Supp. 9 (D.D.C. 1989) 100 B g C h United States v. Bentley, 825 F.2d 1104 (7th Cir.), cert. denied, 484 D i U.S. 901 (1987) 56, 58, 98 E j F k United States v. Beusch, 596 F.2d 871 (9th Cir. 1979) 58 G l H m United States v. Bilanzich, 771 F.2d 292 (7th Cir. 1985) 20 I n J o United States v. Block, 590 F.2d 535 (4th Cir. 1978) 15, 18 K p L q United States v. Blok, 188 F.2d 1019 (D.C. Cir. 1951) 21 M r 0 N s @ United States v. Boyette, 299 F.2d 92 (4th Cir.), cert. denied, 369 U.S. O t P 844 (1962) 28 P u ` Q v p United States v. Brown, 556 F.2d 304 (5th Cir. 1977) 100 R w FS x p ( x H FUnited States v. BustamanteGamez, 488 F.2d 4 (9th Cir. 1973), cert. T y denied, 416 U.S. 970 (1974) 100 U z V { United States v. Caballos, 812 F.2d 42 (2d Cir. 1987) 13 W | X } United States v. Carter, 566 F.2d 1265 (5th Cir. 1978), cert. denied, 436 Y ~ U.S. 956 (1978) 102 Z [ United States v. Darensbourg, 520 F.2d 985 (5th Cir. 1975) 96 \ 0 ] @ United States v. David, 756 F. Supp. 1385 (D. Nev. 1991) 9, 11, 14, 54 ^ P _ ` United States v. Duran, 957 F.2d 499, 51 CrL 1009 (7th Cir. 1992) 17 ` p a United States v. Fawole, 785 F.2d 1141 (4th Cir. 1986) 59 b c United States v. Francis, 646 F.2d 251 (6th Cir.), cert. denied, 454 U.S. d 1082 (1981) 101 e f United States v. Gargiso, 456 F.2d 584 (2d Cir. 1972) 20 g h United States v. Griffin, 530 F.2d 739 (7th Cir. 1976) 13 i j United States v. Henson, 848 F.2d 1374 (6th Cir. 1988), k cert. denied, 488 U.S. 1005 (1989) 57 l 0 m @ United States v. Hillyard, 677 F.2d 1336 (9th Cir. 1982) 84 n P o ` United States v. Houle, 603 F.2d 1297 (8th Cir. 1979) 11 p p q United States v. Johns, 948 F.2d 599, 50 CrL 1224 (9th Cir. 1991), cert. r denied, 112 S. Ct. 3046 (1992) 35 s t United States v. Judd, 687 F. Supp. 1052 (N.D. Miss. 1988), aff'd 889 u F.2d 1410 (5th Cir. 1989), cert. denied, 494 U.S. 1036 (1989) 93 v w United States v. Korman, 614 F.2d 541 (6th Cir.), cert denied, 446 U.S. x 952 (1980) 39 y z United States v. Lefkowitz, 285 U.S. 452 (1932) 37 F{ p ( 0 H Fܿ | @ United States v. Leon, 468 U.S. 897 (1984) 9 } P ~ ` United States v. Lindenfield, 142 F.2d 829 (2d Cir.), cert. denied, 323 p U.S. 761 (1944) 38 United States v. Long, 524 F.2d 660 (9th Cir. 1975) 15 United States v. Lucas, 932 F.2d 1210, 49 CrL 1138 (8th Cir.), cert. denied, 112 S. Ct. 399 (1991) 53 United States v. Markis, 352 F.2d 860 (2d Cir. 1965), vacated without opinion, 387 U.S. 425 (1967) 28 United States v. Matlock, 415 U.S. 164 (1974) 14, 16, 17 0 United States v. Mendenhall, 446 U.S. 544 (1980) 13 @ P United States v. MilanRodriguez, 759 F.2d 1558 (11th Cir.), cert. ` denied, 474 U.S. 845 (1985), and cert. denied, 486 U.S. 1054 (1988) 12 p United States v. Murrie, 534 F.2d 695 (6th Cir. 1976) 100 United States v. Musson, 650 F. Supp. 525 (D. Colo. 1986) 53 United States v. Patino, 830 F.2d 1413 (7th Cir. 1987), cert. denied, 490 U.S. 1069 (1989) 11 United States v. Price, 599 F.2d 494 (2nd Cir. 1979) 13 United States v. Prout, 526 F.2d 380 (5th Cir.), cert. denied, 429 U.S. 840 (1976) 94 0 @ United States v. Ramsey, 431 U.S. 606 (1977), cert. denied, 434 U.S. 1062 P (1978) 12 p United States v. Reed, 935 F.2d 641 (4th Cir.), cert. denied, 112 S. Ct. 423 (1991) 10 F p ( H FUnited States v. Remigio, 767 F.2d 730 (1Oth Cir.), cert. denied, 474 U.S. 1009 (1985) 100 United States v. Reyes, 798 F.2d 380 (1Oth Cir. 1986) 53 United States v. Robinson, 287 F. Supp. 245 (N.D. Ind. 1968) 29 0 United States v. Rodriguez, 968 F.2d 130, 51 CrL 1097 (2d Cir.), cert. @ denied, 113 S. Ct. 140 (1992) 94 P ` United States v. Ruminer, 786 F.2d 381 (10th Cir. 1986) 101 p United States v. Santarelli, 778 F.2d 609 (11th Cir. 1985) 60 United States v. Santarsiero, 566 F. Supp. 536 (S.D.N.Y. 1983) 27, 39 United States v. Sawyer, 799 F.2d 1494 (11th Cir. 1986), cert. denied sub nom. Leavitt v. United States, 479 U.S. 1069 (1987) 56 United States v. Scheer, 600 F.2d 5 (3d Cir. 1979) 12 United States v. Scott, 578 F.2d 1186 (6th Cir.), cert. denied, 439 U.S. 0 870 (1978) 13 @ P United States v. Sealey, 830 F.2d 1028 (9th Cir. 1987) 16 ` p United States v. Sinclair, 742 F. Supp. 688 (D.D.C. 1990) 101 United States v. Sklaroff, 323 F. Supp. 296 (S.D. Fla. 1971) 96 United States v. Snow, 919 F.2d 1458 (1Oth Cir. 1990) 57 United States v. Stern, 225 F. Supp. 187 (S.D.N.Y. 1964) 28, 29, 38 United States v. Stewart, 867 F.2d 581 (1Oth Cir. 1989) 102 United States v. Taft, 769 F. Supp. 1295 (D. Vt. 1991) 108 0 United States v. Talkington, 875 F.2d 591 (7th Cir. 1989) 9 F @ @ p ( P H Fܿ ` United States v. Tamura, 694 F.2d 591 (9th Cir. 1982) 58, 60, 100 p United States v. Tropp, 725 F. Supp. 482 (D. Wyo. 1989) 84 United States v. Truitt, 521 F.2d 1174 (6th Cir. 1975) 27, 30 United States v. Turk, 526 F.2d 654 (5th Cir.), cert. denied, 429 U.S. 823 (1976) 11 United States v. Valenzuela, 596 F.2d 824 (9th Cir.), cert. denied, 441 U.S. 965 (1979) 100 United States v. Viera, 569 F. Supp. 1419 (S.D.N.Y. 1983) 28 0 @ United States v. Villegas, 899 F.2d 1324, 47 CrL 1041 (2d Cir.), cert. P denied, 498 U.S. 991 (1990) 35, 36 ` p United States v. Whitten, 706 F.2d 1000 (9th Cir. 1983), cert. denied, 465 U.S. 1100 (1984) 39 United States v. Wuagneux, 683 F.2d 1343 (11th Cir. 1982), cert. denied, 464 U.S. 814 (1983) 58 United States v. Wysong, 528 F.2d 345 (9th Cir. 1976) 102 Vaughn v. Baldwin, 950 F.2d 331 (6th Cir. 1991) 13 Voss v. Bergsgaard, 774 F.2d 402 (1Oth Cir. 1985) 53 0 @ Warden v. Hayden, 387 U.S. 294 (1967) 26, 28, 29, 37 P ` Yancey v. Jenkins, 638 F. Supp. 340 (N.D. Ill. 1986) 27 p Zurcher v. Stanford Daily, 436 U.S. 547 (1978) 72, 76 Statutes F p ( H F18 U.S.C. 1029 36, 77 18 U.S.C. 1030 36, 77 18 U.S.C. 2510 86, 131 0 @ 18 U.S.C. 2701, et seq. 56, 71 P ` 18 U.S.C. 2702 23, 50, 85 ! p " 18 U.S.C. 2703 8588, 131 # $ 18 U.S.C. 2711 85 % & 18 U.S.C. 3109 100 ' ( 26 U.S.C. 6103 66 ) * 42 U.S.C. 2000aa 41, 42, 56, 7275, 7780, 8284 + , - 0 Federal Rules . @ / P 124 F.R.D. 428 107 0 ` 1 p Fed. R. Crim. P. 41 1, 2628, 30, 3537, 8689, 9296, 105110, 125, 126 2 3 Fed. R. Evid. 16 69 4 5 Fed. R. Evid. 501 41 6 7 Fed. R. Evid. 803(6) 113, 122, 123 8 9 Fed. R. Evid. 803(10) 121 : ; Fed. R. Evid. 901 115, 116, 119 < = 0 Fed. R. Evid. 1001 108, 114, 115, 120 > @ ? P Fed. R. Evid. 1002 114 F @ ` ` p ( @ p H Fܿ A Fed. R. Evid . 1003 115 B C Fed. R. Evid. 1006 122 D E Federal Regulations F G 28 C.F.R. 50.10 73 H ! I 28 C.F.R. 59.1.6 30, 41 " J # K $ L 0 Legislative History % M @ & N P H.R. Rep. No. 647, 99th Cong., 2d Sess. 87 ' O ` ( P p H.R. Rep. No. 1064, 96th Cong., 2d Sess. 76, 79 ) Q * R S. Rep. No. 874, 96th Cong., 2d Sess. 73, 75, 76, 78 + S , T Testimony of Richard J. Williams, Vice President, National District - U Attorney's Association, in Hearing before the Committee on the Judiciary, . W United States Senate, 96th Cong., 2d Sess. on S. 115, S. 1790, and S. / X 1816 (Mar. 28, 1980) Serial No. 9659, at 1523 76 0 Y 1 Z 2 [ Reference Materials 3 \ 0 4 ] @ Rose, Steve Jackson Games Decision Stops the Insanity, Boardwatch, May 5 _ P 1993 83 6 ` p 7 a The American Heritage Dictionary, (2d ed. 1983) 92 8 b 9 c W. LaFave, Search and Seizure: A Treatise on the Fourth Amendment (2d ed. : e 1987) 15, 17 ; f < g Webster's Dictionary of Computer Terms (3d ed. 1988) 2, 139 F= h p ( h H Fܿ > i Wright & Miller, Federal Practice and Procedure: Criminal 2d (1982) 29 ? j . @ k 0