WPCŢ Bl -mUه>E2 Ȥc5KoهSI0>kL~,Zף͐# 0ٌgeфT)/_`٨a!3o?# 2oQ )8Hdy"T{Iv| BCccSzVIm˔A,K[ J 3hN[hyc4i%ؔBHnT :#NQ;(T&9;cCinTlXmıG =x!iv|H,;L饤0^0s=>o[ jGi[z=Ztv2Tj D+uŦ2ltozL)E%Vcpr]馉m6Gv-]\BϋYI#Mm Yʱ\{ K>:c#jUN+ %y 0xU>@U @7U.NwU<U<.UN/ 0} 0D9U >}U <U>5C 1u@! 72!1! 0w&^ &w&4&&) & *12 2^+25f<9 1<99aA 0[cAf'Ba'B m;B 1RBfBaBBWH M M: NCO BQ 1RR 1US*SX@XN.X0X 72[ 0`\ 0T`\ 1\^;]] 0] 0A^ 0^ 0_ 0\` 07a 0 D&bBjc 1c 13d 72d 1dse Aeg 0g 72h 1h 0KEii 72n 72n 1n xo 72rrr 0rs 0s 0t 0u 0xv 0Zw 09x 0y 0y 0z 0{ 0y| 0O} 0"~ 0~ 0 0 0P 0 0 0ǃ 0 0n 0= 0 0҇ 0 1[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ 1iii/Ȏ,,,,,, 0e 1 1 1333333333 0A 0bT 0hO 0e| 133333333 1 1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA 1țțțț *WW 1 1 D+ҝ 1 0yyyyy 0 T2?CCS250,,,,,,0(9 Z6Times New Roman RegularX(P $X>XXXX>XXX>USUS.,(hH  Z(Times New Roman (@ Z(Times New Roman x9 Z6Times New Roman RegularH $AZ$Tahoma Regular-l hAZTahoma (9 Z 6Times New Roman Regular(l(3h$  !XXXXXXXXUSUS.,      0  (#$  0  \  `&Times New Roman\  `$Times NewRoman\  `&Times New Roman   h$XXXXXXXXUSUS.,    2    _Afterviewingevidenceofacrimestoredonacomputer,agentsmayneedtoseizethe  computertemporarilytoensuretheintegrityandavailabilityoftheevidencebeforetheycan  obtainawarranttosearchthecontentsofthecomputer.See,e.g.,Hall,142F.3dat99495;  UnitedStatesv.Grosenheider,200F.3d321,330n.10(5thCir.2000).TheFourthAmendment   permitsagentstoseizeacomputertemporarilysolongastheyhaveprobablecausetobelieve _ thatitcontainsevidenceofacrime,theagentsseekawarrantexpeditiously,andthedurationof O thewarrantlessseizureisnot unreasonablegiventhetotalityofthecircumstances.SeeUnited ? Statesv.Place,462U.S.696,700(1983);UnitedStatesv.Martin,157F.3d46,54(2dCir. / 1998);UnitedStatesv.Licata,761F.2d537,54042(9thCir.1985). 9  h$XXXXXXXXUSUS.,    3    _Consentbyemployersandcoemployeesisdiscussedseparatelyintheworkplacesearch  sectionofthischapter.SeePartD.3#37=CIQYag1.a.i.(1)(a)(i)1)a)i) '  h$XXXXXXXXUSUS.,    10    _Anunusualnumberofcomputersearchandseizuredecisionsinvolvechild  pornography.Thisistruefortworeasons.First,computernetworksprovideaneasymeansof  possessingandtransmittingcontrabandimagesofchildpornography.Second,thefactthat  possessionofchildpornographytransmittedoverstatelinesisafelonyoftenleavesdefendants  withlittlerecoursebuttochallengetheprocedurebywhichlawenforcementobtainedthe  contrabandimages.InvestigatorsandprosecutorsshouldcontacttheChildExploitationand  ObscenitySectionat(202)5145780oranAssistantU.S.AttorneydesignatedasaChild o  ExploitationandObscenityCoordinatorforfurtherassistancewithchildexploitation _  investigationsandcases.(O;$0  2#  a  .3  0` (#(#&)*L R)=S'3|x   h$XXXXXXXXUSUS.,    12    _ԀThisistruefortworeasons.First,accountholdersmaynotretaina reasonable  expectationofprivacyininformationsenttonetworkprovidersbecausesendingtheinformation  totheprovidersmayconstituteadisclosureundertheprinciplesofUnitedStatesv.Miller,425  U.S.435(1976),andSmithv.Maryland,442U.S.735(1979).SeeChapter1,PartB,Section3  ( ReasonableExpectationofPrivacyandThirdPartyPossession).Second,theFourth  Amendmentgenerallypermitsthegovernmenttoissueasubpoenacompellingthedisclosureof  informationandpropertyevenifitisprotectedbyaFourthAmendment reasonableexpectation o  ofprivacy.Whenthegovernmentdoesnotactuallyconductthesearchforevidence,butinstead _  merelyobtainsacourtorderthatrequirestherecipientoftheordertoturnoverevidencetothe O   governmentwithinaspecifiedperiodoftime,theordercomplieswiththeFourthAmendmentso _ longasitisnotoverbroad,seeksrelevantinformation,andisservedinalegalmanner.See O UnitedStatesv.Dionisio,410U.S.1,712(1973);InreHorowitz,482F.2d72,7580(2dCir. ? 1973)(Friendly,J.).Thisanalysisalsoapplieswhenasuspecthasstoredmaterialsremotelywith / athirdparty,andthegovernmentservesthethirdpartywiththesubpoena.Thecasesindicate   thatsolongasthethirdpartyisinpossessionofthetargetsmaterials,thegovernmentmay   subpoenathematerialsfromthethirdpartywithoutfirstobtainingawarrantbasedonprobable   cause,evenifitwouldneedawarranttoexecuteasearchdirectly.SeeUnitedStatesv.Barr,   605F.Supp.114,119(S.D.N.Y.1985)(subpoenaservedonprivatethirdpartymailservicefor   thedefendantsundeliveredmailinthethirdpartyspossession);UnitedStatesv.Schwimmer,  p  232F.2d855,861(8thCir.1956)(subpoenaservedonthirdpartystoragefacilityforthe `  defendantsprivatepapersinthethirdpartyspossession);Newfieldv.Ryan,91F.2d700,702 P  05(5thCir.1937)(subpoenaservedontelegraphcompanyforcopiesofdefendantstelegramsin @  thetelegraphcompanyspossession).28 C.F.R.  59.1-.6 T  h$XXXXXXXXUSUS.,    7    _TheSteveJacksonGameslitigationraisedmanyimportantissuesinvolvingthePPAand  ECPAbeforethedistrictcourt.Onappeal,however,theonlyissueraisedwas averynarrow  one:whethertheseizureofacomputeronwhichisstoredprivateEmailthathasbeensenttoan  electronicbulletinboard,butnotyetread(retrieved)bytherecipients,constitutesanintercept  proscribedby18U.S.C.2511(1)(a).SteveJacksonGames,36F.3dat460.Thisissueis  discussedintheelectronicsurveillancechapter.SeeChapter4,infra.   h$XXXXXXXXUSUS.,    11    _Ofcourse,therealitythatagentslegallymayretainhardwareforanextendedperiodof  timedoesnotprecludeagentsfromagreeingtorequestsfromdefensecounselforreturnofseized  hardwareandfiles.Inseveralcases,agentshaveofferedsuspectselectroniccopiesofinnocent  fileswithfinancialorpersonalvaluethatwerestoredonseizedcomputers.Ifsuspectscanshow  alegitimateneedforaccesstoseizedfilesorhardwareandtheagentscancomplywithsuspects'  requestswithouteitherjeopardizingtheinvestigationorimposingprohibitivecostsonthe  government,agentsshouldnothesitatetooffertheirassistanceasacourtesy.(5hCEKQW]cioAutoList1a.a.a.a.a.a.a.a.   h$XXXXXXXXUSUS.,    8    _ԀThisraisesafundamentaldistinctionoverlookedinSteveJacksonGames:thedifference  betweenaRule41searchwarrantthatauthorizeslawenforcementtoexecuteasearch,andan  ECPAsearchwarrantthatcompelsaproviderofelectroniccommunicationserviceorremote  computingservicetodisclosethecontentsofasubscribersnetworkaccounttolawenforcement.  Althoughbotharecalled searchwarrants,theyareverydifferentinpractice.ECPAsearch  warrantsrequiredby18U.S.C.2703(a)arecourtordersthatareservedmuchlikesubpoenas:  ordinarily,theinvestigatorsbringthewarranttotheprovider,andtheproviderthendivulgesthe o  informationdescribedinthewarranttotheinvestigatorswithinacertainperiodoftime.In _  contrast,Rule41searchwarrantstypicallyauthorizeagentstoenterontoprivateproperty,search O  forandthenseizetheevidencedescribedinthewarrant.CompareChapter2(discussingsearch ? p  andseizurewithaRule41warrant)withChapter3(discussingelectronicevidencethatcanbe / `  obtainedunderECPA).XXXXԀ#XXXX#Thisdistinctionisespeciallyimportantwhenacourtconcludesthat P  ECPAwasviolatedandthenmustdeterminetheremedy.Becausethewarrantrequirementof18 P  U.S.C.2703(a)isonlyastatutorystandard,anonconstitutionalviolationof2703(a)should @  notresultinsuppressionoftheevidenceobtained.SeeChapter3,PartH(discussingremedies 0  forviolationsofECPA).TABLE C(;3$2#  0  .3  0  TABLE DU0BuCEKOU[agmAutoList3a.+a.a.a.a.a.a.TABLE B   h$XXXXXXXXUSUS.,    13    _Inthisregard,asinseveralothers,ECPAmirrorstheRighttoFinancialPrivacyAct,12  U.S.C.3401etseq.( RFPA).Seegenerally XXXXOrganizacionJDLtda.v.UnitedStates  DepartmentofJustice,124F.3d354,360(2dCir.1997)(notingthat Congressmodeled...  ECPAaftertheRFPA,andlookingtotheRFPAforguidanceonhowtointerpret customerand  subscriberasusedinECPA);Tuckerv.Waddell,83F.3d688,692(4thCir.1996)(examining  theRFPAinordertoconstrueECPA).Thecourtshaveuniformlyrefusedtoreadastatutory  suppressionremedyintotheanalogousprovisionoftheRFPA.SeeUnitedStatesv.Kington, o  801F.2d733,737(5thCir.1986);#XXX Xb# XXXXUnitedStatesv.Frazin,780F.2d1461,1466(9thCir.1986) [  ( HadCongressintendedtoauthorizeasuppressionremedy[forviolationsoftheRFPA],it G x  surelywouldhaveincludeditamongtheremediesitexpresslyauthorized.).#XXX X^# M  h$XXXXXXXXUSUS.,    14    _Forexample,theopinioncontainsseveralstatementsaboutECPAsrequirementsthat  areinconsistentwitheachotherandindividuallyincorrect.Atonepoint,theopinionstatesthat  ECPArequiredtheNavyeithertoobtainasearchwarrantorderingAOLtodiscloseMcVeighs  identity,orelsegivepriornoticetoMcVeighandthenuseasubpoenaora2703(d)courtorder.  See983F.Supp.at219.Onthenextpage,theopinionstatesthattheNavyneededtoobtaina  searchwarranttoobtainMcVeighsnamefromAOL.Seeid.at220.Bothstatementsare  incorrect.Pursuantto18U.S.C.2703(c)(1)(C),theNavycouldhaveobtainedMcVeighs o  nameproperlywithasubpoena,anddidnotneedtogivenoticeofthesubpoenatoMcVeigh. _    h$XXXXXXXXUSUS.,    15    _Prohibited useand disclosurearebeyondthescopeofthismanual. 0  h$XXXXXXXXUSUS.,    16    _Statesurveillancelawsmaydiffer.Somestatesforbidtheinterceptionof  communicationsunlessallpartiesconsent.   h$XXXXXXXXUSUS.,    18    _ XXXXUnlikeotherTitleIIIexceptions#XXX XФ# XXXX,theextensiontelephoneexceptionistechnicallyalimit  onthestatutorydefinitionof intercept.See18U.S.C.2510(4)(5).However,theprovision  actsjustlikeotherexceptionstoTitleIIImonitoringthatauthorizeinterceptionincertain  circumstances.#XXX X# d(CEKQW]cioAutoList2A.A.A.A.A.A.A.A.Level 1Level 2Level 3Level 4Level 5(CEKQW]cioAutoList4A.A.A.A.A.A.A.A.   h$XXXXXXXXUSUS.,    17    _ XXXXThefinalclauseof#XXX XФ# XXXX2511(2)(a)(i)#XXX X# XXXX,whichprohibitspublictelephonecompanies#XXX XN# XXXXԀfrom  conducting serviceobservingorrandommonitoringunrelatedtoqualitycontrol,limitsrandom  monitoring#XXX Xм# XXXXԀbyphonecompaniestointerceptiondesignedtoensurethatthecompanysequipment  isingoodworkingorder.See1JamesG.Carr,TheLawofElectronicSurveillance,3.3(f),at  375.Thisclausehasnoapplicationtononvoicecomputernetworktransmissions.#XXX XМ#IndexDojSeal.wpg   h$XXXXXXXXUSUS.,    1    _Technically,theElectronicCommunicationsPrivacyActof1986amendedChapter119  ofTitle18oftheU.S.Code,codifiedat18U.S.C.251022,andcreatedChapter121ofTitle  18,codifiedat18U.S.C.270111.Asaresult,somecourtsandcommentatorsusetheterm   ECPAtorefercollectivelytoboth251022and270111.Thismanualadoptsasimpler  conventionforthesakeofclarity:251022willbereferredtobyitsoriginalname, TitleIII,  (asTitleIIIoftheOmnibusCrimeControlandSafeStreetsAct,passedin1968),and270111  as ECPA.zF(8 c$0  0` (#(#   (,!$0  0` (#(#  $@ABCDEh.kCEIMQUY]aAutoList6++++++++i)1)a) T  #7Xd#    IndexBanners(b$0  0` (#(#2#   .3  0 ` (#` (#(xir$0  0` (#(#0 ` (#` (#2#(  0  )3  0 (# (#($0  0` (#(#0 ` (#` (#0 (# (#2#(  a  )3  0h(#(#(F$0  0` (#(#0 ` (#` (#0 (# (#0h(#(#2#(   )3  0h(#h(#($0  0` (#(#0 ` (#` (#0 (# (#0h(#(#0h(#h(#2#  0  )3  0(#(#({$0  0` (#(#0 ` (#` (#0 (# (#0h(#(#0h(#h(#0(#(#2#  a  )3  0p(#(#(F$0  0` (#(#0 ` (#` (#0 (# (#0h(#(#0h(#h(#0(#(#0p(#(#2#     )3  0p(#p(# IndexConsent, Fourth Amendment$@ABCDEhEGKOSW[_cAutoList87++++++++)1)a)$@ABCDEh^kCEIMQUY]aAutoList9++++++++i)1)a)HF+$@ABCDEh~EGKOSW[_cAutoList10++++++++)1)a)   h$XXXXXXXXUSUS.,    4    _Ofcourse,agentsexecutingasearchpursuanttoavalidwarrantneednotrelyonthe  plainviewdoctrinetojustifythesearch.Thewarrantitselfjustifiesthesearch.Seegenerally  Chapter2,PartD, SearchingComputersAlreadyinLawEnforcementCustody.3NQ I&mage <=8C(l3{$  !XXXXXXXXUSUS.,  $@ABCDEhΨEGKOSW[_cAutoList89++++++++)1)a)( $ Figure  1     h$XXXXXXXXUSUS.,    5    _Creatingamirrorimagecopyofanentiredrive(oftenknownsimplyas imaging)is  differentfrommakinganelectroniccopyofindividualfiles.Whenacomputerfileissavedtoa  storagedisk,itissavedinrandomlyscatteredsectorsonthediskratherthanincontiguous,  consolidatedblocks;whenthefileisretrieved,thescatteredpiecesarereassembledfromthedisk  inthecomputersmemoryandpresentedasasinglefile.Imagingthediskcopiestheentiredisk   exactlyasitis,includingallthescatteredpiecesofvariousfiles.Theimageallowsacomputer _ techniciantorecreate(or mount)theentirestoragediskandhaveanexactcopyjustlikethe O original.Incontrast,anelectroniccopy(alsoknownasa logicalfilecopy)merelycreatesa ? copyofanindividualfilebyreassemblingandthencopyingthescatteredsectorsofdata / associatedwiththeparticularfile.PF+((jEGMSY_ekqAutoList88A.A.A.A.A.A.A.A.   h$XXXXXXXXUSUS.,    6    _Suchdistinctionsmayalsobeimportantfromtheperspectiveofassetforfeiture.  Propertyusedtocommitorpromoteanoffenseinvolvingobscenematerialmaybeforfeited  criminallypursuantto18U.S.C.1467.Propertyusedtocommitorpromoteanoffense  involvingchildpornographymaybeforfeitedcriminallypursuantto18U.S.C.2253and  civillypursuantto18U.S.C.2254.AgentsandprosecutorscancontacttheAssetForfeiture  andMoneyLaunderingSectionat(202)5141263foradditionalassistance.UA.2G+J 0_level1  X /%4 4 <DL/23  ..  2( 4 <DL2   2D+J 0_level2   ," <DL,23  ..  2( 4 <DL2  2A+J 0_level3   ) <DL)23  ..  2( 4 <DL2  2>+J 0_level4  ` &<<DL&23  ..  2( 4 <DL2  2;+J 0_level5   #DL#23  ..  2( 4 <DL2  28+J 0_level6    DL 23  ..  2( 4 <DL2  25+J 0_level7  h DDL23  ..  2( 4 <DL2  22+J 0_level8   L23  ..  2( 4 <DL2  2/+J 0_level9    L23  ..  2( 4 <DL2  2GJ 0_levsl1  X /%4 4 <DL/23  Ԁ  2( 4 <DL2  2DJ 0_levsl2   ," <DL,23  Ԁ  2( 4 <DL2  2AJ 0_levsl3   ) <DL)23  Ԁ  2( 4 <DL2  2>J 0_levsl4  ` &<<DL&23  Ԁ  2( 4 <DL2  2;J 0_levsl5   #DL#23  Ԁ  2( 4 <DL2  28J 0_levsl6    DL 23  Ԁ  2( 4 <DL2  25J 0_levsl7  h DDL23  Ԁ  2( 4 <DL2  22J 0_levsl8   L23  Ԁ  2( 4 <DL2  2/J 0_levsl9    L23  Ԁ  2( 4 <DL2  2GJ 0_levnl1  X /%4 4 <DL/23   2( 4 <DL2  2DJ 0_levnl2   ," <DL,23   2( 4 <DL2  2AJ 0_levnl3   ) <DL)23   2( 4 <DL2  2>J 0_levnl4  ` &<<DL&23   2( 4 <DL2  2;J 0_levnl5   #DL#23   2( 4 <DL2  28J 0_levnl6    DL 23   2( 4 <DL2  25J 0_levnl7  h DDL23   2( 4 <DL2  22J 0_levnl8   L23   2( 4 <DL2  2/J 0_levnl9    L23   2( 4 <DL2  $@ABCDEpNkCEIMQUY]aAutoList8++++++++i)1)a)(EGMSY_ekqAutoList591)1)1)1)1)1)1)1)1, 2, 3,Level 1Level 2Level 3Level 4Level 5   h$XXXXXXXXUSUS.,    1    _ ElectronicStorageisatermofart,specificallydefinedin18U.S.C.2510(17)as   (A)anytemporary,intermediatestorageofawireorelectroniccommunicationincidentaltothe  electronictransmissionthereof;andanystorageofsuchcommunicationbyanelectronic  communicationserviceforpurposesofbackupprotectionofsuchcommunication.The  governmentdoesnotseekaccesstoanysuchmaterials.Communicationsnotin electronic  storageincludeanyemailcommunicationsreceivedbythespecifiedaccountsthattheowneror  useroftheaccounthasalreadyaccessed,viewed,ordownloaded.   h$XXXXXXXXUSUS.,    2    _Ԁ18U.S.C.3127(2)(A)definestheterm courtofcompetentjurisdictionasincluding   adistrictcourtoftheUnitedStates(includingamagistrateofsuchacourt)oraUnitedStates  CourtofAppeals.Because18U.S.C.2703(d)expresslypermits anysuchcourttoissuean  order,thisCourtmayenteranorderdirectingthedisclosureofsuchinformationevenifthe  informationisstoredoutsideofthisjudicialDistrict.   h$XXXXXXXXUSUS.,    1    _Ԁ ElectronicStorageisatermofart,specificallydefinedin18U.S.C.2510(17)as   (A)anytemporary,intermediatestorageofawireorelectroniccommunicationincidentaltothe  electronictransmissionthereof;andanystorageofsuchcommunicationbyanelectronic  communicationserviceforpurposesofbackupprotectionofsuchcommunication.The  governmentdoesnotseekaccesstoanysuchmaterials.Communicationsnotin electronic   storageincludeanyemailcommunicationsreceivedbythespecifiedaccountsthattheowneror _ useroftheaccounthasalreadyaccessed,viewed,ordownloaded.A, B,Level 1Level 2Level 3Level 4Level 5I., II.,Level 1Level 2Level 3Level 4Level 54#0V2Quick I.  .0 (G'EGOW_gowAutoList83(A)(A)(A)(A)(A)(A)(A)(A)( EGMSY_ekqAutoList82A.A.A.A.A.A.A.A.(5EGMSY_ekqAutoList621.1.1.1.1.1.1.1.(Vm$0   (,!$0  0` (#(#  (@$0  0` (#(#0 ` (#` (# ` (T$0  0` (#(#0 ` (#` (#0 (# (# $@ABCDEh.EGKOSW[_cAutoList73++++++++)1)a)(*EGMSY_ekqAutoList84A.A.A.A.A.A.A.A.(EGMSY_ekqAutoList861.1.1.1.1.1.1.1.(EGOW_gowAutoList75(1)(1)(1)(1)(1)(1)(1)(1)28 C.F.R.  59.1-.60եEGMSY_ekqAutoList781.1.1.1.1.1.1.1.0EGMSY_ekqAutoList801.1.1.1.1.1.1.1. 'dxd (''EGOW_gowAutoList81(A)(A)(A)(A)(A)(A)(A)(A)(x3$  !XXXXXXXXUSUS.,   d    h$XXXXXXXXUSUS.,    9    _Focusingonthecomputersratherthantheinformationmayalsoleadtoawarrantthatis  toonarrow.Ifrelevantinformationisinpaperorphotographicform,agentsmaymissit  altogether. 8{'XXXXXXXXUSUS.,  _   XXSearchandSeizureManual#XX ܇#(l3{$  !XXXXXXXXUSUS.,  bS. Rep. No. 874, 96th Cong., 2d Sess.5 5_S.Rep.No.874,96thCong.,2dSess.  !XXXXXXXXUSUS.,  _%cXX  >!#XX%c{#%cXXSearchingandSeizingComputers p andObtainingElectronicEvidence P  inCriminal#XX%c#%cXXԀInvestigations#XX%c#x vXX  0  #XXvx #QXXsM7?/+b|1 K `@EV+ V+ s VV(#(# (#(#VV#XXQP#GXX  ________________ !  ComputerCrimeandIntellectualPropertySection #, CriminalDivision %X  UnitedStatesDepartmentofJustice  4&! ________________#XXGH#QXX! ,XXX! `'" h  #XXQw#   @  GXX0 @ January2001#XXGz#T XX0@(#(##XX T#  L,' >! >  8XXdXXd8 >  _7PREFACE /   ` ThispublicationsupersedesFederalGuidelinesforSearchingandSeizing   Computers(1994),aswellastheGuidelines1997and1999Supplements.   AlthoughtheinteragencygroupthatproducedtheGuidelinesachieveditsgoalof   offering systematicguidancetoallfederalagentsandattorneysinthelawof   computersearchandseizure,interveningchangesinlawandthedramatic  p  expansionoftheInternetsince1994havefosteredtheneedforfreshguidance. `  ThismanualisdesignedtocombineanupdatedversionoftheGuidelinesadvice P  onsearchingandseizingcomputerswithguidanceonthestatutesthatgovern @  obtainingelectronicevidenceincasesinvolvingcomputernetworksandthe 0  Internet.Ofcourse,thismanualisintendedtoofferassistance,notauthority.Its   analysisandconclusionsreflectcurrentthinkingondifficultareasoflaw,anddo o notrepresenttheofficialpositionoftheDepartmentofJusticeoranyother _ agency.Ithasnoregulatoryeffect,andconfersnorightsorremedies. O  `   ` ThispublicationwaswrittenbyOrinS.KerroftheComputerCrimeand / IntellectualPropertySectionoftheU.S.DepartmentofJustice,underthe  supervisionofMarthaStansellGamm,ChiefoftheComputerCrimeand  IntellectualPropertySection.Theauthorgratefullyacknowledgestheassistance  ofMarkEckenwiler,ScottCharney,DavidGreen,JenniferMartin,ChrisPainter,  themembersofthe1999CTCWorkingGroup(especiallyStephenHeymann),  JeffSingdahlsen,MarkPollitt,Thos.GregoryMotta,JoannePasquerelli,and p summerinternsDanJacksonandAviIonescu.Electroniccopiesofthisdocument ` areavailablefromtheComputerCrimeandIntellectualPropertySectionsweb P site,www.cybercrime.gov.Inquiries,comments,andcorrectionsshouldbe @ directedtoOrinS.Kerrat(202)5141026.Requestsforpapercopiesorwritten  0 correspondenceshouldbesenttothefollowingaddress: !  #Attn:SearchandSeizureManual _#  ComputerCrimeand O$! IntellectualPropertySection ?%" UnitedStatesDepartmentofJustice /& # P.O.Box887 '!$ BenFranklinStation ("% Washington,DC20044-0887 (#& 1]  *%(    TABLEOFCONTENTS  O    Vm  VmY0     INTRODUCTION#T"T"H(#. (#(##viiVmYu݌ / Ќ  Vm  Vm0     I.SEARCHINGANDSEIZINGCOMPUTERSWITHOUTAWARRANT#""J(#.?(#(##1Vm3݌   Ќ  !  !0  0` (#(#    A.Introduction#""J(#. ` (#` (##1!݌   Ќ  !  !0  0` (#(#    B.TheFourthAmendments ReasonableExpectationofPrivacy!݌ ` (#` (# Ќ  !  !0  0` (#(#     ` inCasesInvolvingComputers#""J(#.0` (#` (##1!݌   Ќ    0  0` (#(#0 ` (#` (# `   1.GeneralPrinciples#""J(#.) (# (##1݌  p  Ќ    0  0` (#(#0 ` (#` (# `   2.ReasonableExpectationofPrivacyinComputersasStorageDevices#""J(#.X (# (##2݌ `  Ќ    0  0` (#(#0 ` (#` (# `   3.ReasonableExpectationofPrivacyandThirdPartyPossession#""J(#.S (# (##3݌ P  Ќ    0  0` (#(#0 ` (#` (# `   4.PrivateSearches#""J(#.TT' (# (##6݌ @  Ќ  !  !0  0` (#(#    C.ExceptionstotheWarrantRequirementinCasesInvolvingComputers#""J(#.66U` (#` (##9!݌ 0  Ќ    0  0` (#(#0 ` (#` (# `   1.Consent#""J(#.  (# (##9݌   Ќ    0  0` (#(#0 ` (#` (#0 (# (#   a)ScopeofConsent#""J(#.88-(#(##9݌ o Ќ    0  0` (#(#0 ` (#` (#0 (# (#   b)ThirdPartyConsent#`"`"I(#.((0(#(##11݌ _ Ќ    0  0` (#(#0 ` (#` (#0 (# (#   c)ImpliedConsent#`"`"I(#.+(#(##16݌ O Ќ     0  0` (#(#0 ` (#` (# `   2.ExigentCircumstances#`"`"I(#.``, (# (##17 ݌ ? Ќ    !0  0` (#(#0 ` (#` (# `   3.PlainView#`"`"I(#. ! (# (##18!!݌ / Ќ    p"0  0` (#(#0 ` (#` (# `   4.SearchIncidenttoaLawfulArrest#`"`"I(#.9 (# (##19p""݌  Ќ    m#0  0` (#(#0 ` (#` (# `   5.InventorySearches#`"`"I(#.&&) (# (##20m##݌  Ќ    Z$0  0` (#(#0 ` (#` (# `   6.BorderSearches#`"`"I(#.HH& (# (##21Z$u$݌  Ќ    D%0  0` (#(#0 ` (#` (# `   7.InternationalIssues#`"`"I(#.>>+ (# (##22D%_%݌  Ќ  !  !3&0  0` (#(#    D.SpecialCase:WorkplaceSearches#`"`"I(#.2` (#` (##23!3&N&݌  Ќ    '0  0` (#(#0 ` (#` (# `   1.PrivateSectorWorkplaceSearches#`"`"I(#.  8 (# (##24'5'݌ p Ќ    (0  0` (#(#0 ` (#` (#0 (# (#   a)ReasonableExpectationofPrivacyinPrivateSectorWorkplaces#`"`"I(#. Z(#(##24(1(݌ ` Ќ    C)0  0` (#(#0 ` (#` (#0 (# (#   b)ConsentinPrivateSectorWorkplaces#`"`"I(#.@(#(##25C)^)݌ P Ќ    V*0  0` (#(#0 ` (#` (#0 (# (#   c)EmployerSearchesinPrivateSectorWorkplaces#`"`"I(#.J(#(##26V*q*݌ @ Ќ    s+0  0` (#(#0 ` (#` (# `   2.PublicSectorWorkplaceSearches#`"`"I(#.7 (# (##26s++݌  0 Ќ    n,0  0` (#(#0 ` (#` (#0 (# (#   a)ReasonableExpectationofPrivacyinPublicWorkplaces#`"`"I(#.^^R(#(##26n,,݌ !  Ќ    -0  0` (#(#0 ` (#` (#0 (# (#   b) ReasonableWorkplaceSearchesUnderOConnorv.Ortega#`"`"I(#.  T(#(##29--݌ o" Ќ    .0  0` (#(#0 ` (#` (#0 (# (#   c)ConsentinPublicSectorWorkplaces#`"`"I(#.>>?(#(##33..݌ _#  Ќ  Vm  Vm/0     II.SEARCHINGANDSEIZINGCOMPUTERSWITHAWARRANT#`"`"I(#.bb=(#(##34Vm//݌ ?%" Ќ  !  !00  0` (#(#    A.Introduction#`"`"I(#. ` (#` (##34!00݌ /& # Ќ  !  !10  0` (#(#    B.PlanningtheSearch#`"`"I(#.00%` (#` (##37!11݌ '!$ Ќ    l20  0` (#(#0 ` (#` (# `   1.BasicStrategiesforExecutingComputerSearches#`"`"I(#.G (# (##37l22݌ ("% Ќ    w30  0` (#(#0 ` (#` (#0 (# (#   a)WhenHardwareIsItselfContraband,Evidence,w33݌(#&(#(# Ќ    x40  0` (#(#0 ` (#` (#0 (# (#     oranInstrumentalityorFruitofCrime#`"`"I(#.**E(#(##39x44݌ )$' Ќ    50  0` (#(#0 ` (#` (#0 (# (#   b)WhenHardwareisMerelyaStorageDeviceforEvidenceofCrime *%( #`"`"I(#.(#(##3955݌ +p&) Ќ    60  0` (#(#0 ` (#` (# `   2.ThePrivacyProtectionAct#`"`"I(#.1 (# (##4166݌ _ Ќ    70  0` (#(#0 ` (#` (#0 (# (#   a)ABriefHistoryofthePrivacyProtectionAct#`"`"I(#.I(#(##4277݌ O Ќ    80  0` (#(#0 ` (#` (#0 (# (#   b)TheTermsofthePrivacyProtectionAct#`"`"I(#.BBC(#(##4389݌ ? Ќ    :0  0` (#(#0 ` (#` (#0 (# (#   c)ApplicationofthePPAtoComputerSearchesandSeizures#`"`"I(#.T(#(##44::݌ / Ќ    (;0  0` (#(#0 ` (#` (# `   3.CivilLiabilityUndertheElectronicCommunicationsPrivacyAct#`"`"I(#.V (# (##47(;C;݌   Ќ    B<0  0` (#(#0 ` (#` (# `   4.ConsideringtheNeedforMultipleWarrantsinNetworkSearches#`"`"I(#.U (# (##49B<]<݌   Ќ    [=0  0` (#(#0 ` (#` (# `   5.NoKnockWarrants#`"`"I(#.~~( (# (##51[=v=݌   Ќ    G>0  0` (#(#0 ` (#` (# `   6.SneakandPeekWarrants#`"`"I(#.DD. (# (##52G>b>݌   Ќ    9?0  0` (#(#0 ` (#` (# `   7.PrivilegedDocuments#`"`"I(#.+ (# (##539?T?݌   Ќ    (@0  0` (#(#0 ` (#` (#0 (# (#   a)TheAttorneyGeneral'sRegulationsRelatingtoSearchesof  p  DisinterestedLawyers,Physicians,andClergymen#`"`"I(#.N(#(##53(@C@݌ `  Ќ    A0  0` (#(#0 ` (#` (#0 (# (#   b)StrategiesforReviewingPrivilegedComputerFiles#`"`"I(#.N(#(##54AA݌ P  Ќ  !  !B0  0` (#(#    C.DraftingtheWarrantandAffidavit#`"`"I(#.4` (#` (##55!BB݌ @  Ќ    C0  0` (#(#0 ` (#` (# `   Step1:AccuratelyandParticularlyDescribethePropertytobeSeizedinthe 0  Warrantand/orAttachmentstotheWarrant#`"`"I(#.JJB (# (##55CC݌   Ќ    E0  0` (#(#0 ` (#` (# `   Step2:EstablishProbableCauseintheAffidavit#`"`"I(#.E (# (##61EE݌ o Ќ     F0  0` (#(#0 ` (#` (# `   Step3:IntheAffidavitSupportingtheWarrant,IncludeanExplanationofthe _ SearchStrategy(SuchastheNeedtoConductanOffsiteSearch)asWell O asthePracticalandLegalConsiderationsThatWillGoverntheExecution ? oftheSearch#`"`"I(#.& (# (##63 F'F݌ / Ќ  !  !H0  0` (#(#    D.PostSeizureIssues#`"`"I(#.%` (#` (##68!H)H݌  Ќ    H0  0` (#(#0 ` (#` (# `   1.SearchingComputersAlreadyinLawEnforcementCustody#`"`"I(#.M (# (##68HI݌  Ќ    I0  0` (#(#0 ` (#` (# `   2.ThePermissibleTimePeriodForExaminingSeizedComputers#`"`"I(#.Q (# (##70IJ݌  Ќ    K0  0` (#(#0 ` (#` (# `   3.Rule41(e)MotionsforReturnofProperty#`"`"I(#.ll@ (# (##72K)K݌  Ќ  Vm  VmL0     III.THEELECTRONICCOMMUNICATIONSPRIVACYACT#`"`"I(#.pp9(#(##75VmL.L݌ p Ќ  !  !L0  0` (#(#    A.Introduction#`"`"I(#. ` (#` (##75!L M݌ ` Ќ  !  !M0  0` (#(#    B.ProvidersofElectronicCommunicationServicevs.RemoteComputingService#`"`"I(#. \` (#` (##77!MM݌ P Ќ    N0  0` (#(#0 ` (#` (# `    Electroniccommunicationservice#`"`"I(#.; (# (##78NN݌ @ Ќ    O0  0` (#(#0 ` (#` (# `    Electronicstorage#`"`"I(#.- (# (##79OO݌  0 Ќ    P0  0` (#(#0 ` (#` (# `     Remotecomputingservice#`"`"I(#.3 (# (##79PP݌ !  Ќ  !  !Q0  0` (#(#    C.ClassifyingTypesofInformationHeldbyServiceProviders#`"`"I(#.L` (#` (##82!QR݌ o" Ќ    R0  0` (#(#0 ` (#` (# `   1.BasicSubscriberInformationListedin18U.S.C.2703(c)(1)(C)#`"`"I(#.W (# (##82RS݌ _#  Ќ     T0  0` (#(#0 ` (#` (# `   2.RecordsorOtherInformationPertainingtoaCustomerorSubscriber#`"`"I(#.Z (# (##83 T$T݌ O$! Ќ    'U0  0` (#(#0 ` (#` (# `   3.Contents#`"`"I(#.  (# (##83'UBU݌ ?%" Ќ  !  ! V0  0` (#(#    D.CompelledDisclosureUnderECPA#`"`"I(#.HH1` (#` (##84! V%V݌ /& # Ќ    V0  0` (#(#0 ` (#` (# `   1.Subpoena#`"`"I(#.< <  (# (##85V W݌ '!$ Ќ    W0  0` (#(#0 ` (#` (# `   2.SubpoenawithPriorNoticetotheSubscriberorCustomer#`"`"I(#.jjO (# (##86WW݌ ("% Ќ    X0  0` (#(#0 ` (#` (# `   3.Section2703(d)Order#`"`"I(#.,,, (# (##87XY݌ (#& Ќ    Y0  0` (#(#0 ` (#` (# `   4.2703(d)OrderwithPriorNoticetotheSubscriberorCustomer#`"`"I(#.ffV (# (##88YY݌ )$' Ќ    Z0  0` (#(#0 ` (#` (# `   5.SearchWarrant#`"`"I(#.% (# (##89Z[݌ *%( Ќ  !  ![0  0` (#(#    E.VoluntaryDisclosure#`"`"I(#.&` (#` (##90![[݌ +p&) Ќ    \0  0` (#(#0 ` (#` (# `   1.Contents#`"`"I(#.  (# (##90\\݌ _ Ќ    ]0  0` (#(#0 ` (#` (# `   2.RecordsOtherthanContents#`"`"I(#.222 (# (##91]]݌ O Ќ  !  !^0  0` (#(#    F.QuickReferenceGuide#`"`"I(#.66'` (#` (##94!^^݌ ? Ќ  !  !l_0  0` (#(#    G.WorkingwithNetworkProviders:PreservationofEvidence,PreventingDisclosureto / Subjects,andCableActIssues#`"`"I(#.2` (#` (##95!l__݌   Ќ    `0  0` (#(#0 ` (#` (# `   1.PreservationofEvidenceunder18U.S.C.2703(f)#`"`"I(#.\\I (# (##95``݌   Ќ    a0  0` (#(#0 ` (#` (# `   2.OrdersNottoDisclosetheExistenceofaWarrant,Subpoena,orCourtOrder   #`"`"I(#.  (# (##96aa݌   Ќ    c0  0` (#(#0 ` (#` (# `   3.PossibleConflictswiththeCableAct,47U.S.C.551#`"`"I(#.TTM (# (##97cc݌   Ќ  !  !d0  0` (#(#    H.Remedies#`"`"I(#.  ` (#` (##98!d3d݌  p  Ќ    d0  0` (#(#0 ` (#` (# `   1.Suppression#`"`"I(#. " (# (##98de݌ `  Ќ    e0  0` (#(#0 ` (#` (# `   2.CivilActions#!!H(#.ZZ$ (# (##100ee݌ P  Ќ  Vm  Vmf0     IV.ELECTRONICSURVEILLANCEINCOMMUNICATIONSNETWORKS#!!H(#.::B(#(##101Vmff݌ 0  Ќ  !  !g0  0` (#(#    A.Introduction#!!H(#. ` (#` (##101!gg݌   Ќ  !  !th0  0` (#(#    B.ThePen/TrapStatute,18U.S.C.312127#!!H(#.<` (#` (##102!thh݌ o Ќ  !  !li0  0` (#(#    C.TheWiretapStatute,TitleIII,18U.S.C.251022#!!H(#.PPF` (#` (##104!lii݌ _ Ќ    nj0  0` (#(#0 ` (#` (# `   1.Introduction:TheGeneralProhibition#!!H(#.< (# (##104njj݌ O Ќ    ok0  0` (#(#0 ` (#` (# `   2.KeyPhrases#!!H(#." (# (##105okk݌ ? Ќ    Vl0  0` (#(#0 ` (#` (#0 (# (#   Wirecommunication#!!H(#.-(#(##105Vlql݌ / Ќ    ]m0  0` (#(#0 ` (#` (#0 (# (#   Electroniccommunication#!!H(#.3(#(##106]mxm݌  Ќ    jn0  0` (#(#0 ` (#` (#0 (# (#   Intercept#!!H(#.,,$(#(##107jnn݌  Ќ    ho0  0` (#(#0 ` (#` (# `   3.ExceptionstoTitleIII#!!H(#.. (# (##108hoo݌  Ќ    [p0  0` (#(#0 ` (#` (#0 (# (#   a)InterceptionAuthorizedbyaTitleIIIOrder,18U.S.C.2518.#!!H(#.* * [(#(##109[pvp݌  Ќ    q0  0` (#(#0 ` (#` (#0 (# (#   b)ConsentofaPartytotheCommunication,qq݌(#(# Ќ    r0  0` (#(#0 ` (#` (#0 (# (#     18U.S.C.2511(2)(c)(d)#!!H(#.:(#(##110rr݌ p Ќ    s0  0` (#(#0 ` (#` (#0 (# (#   c)TheProviderException,18U.S.C.2511(2)(a)(i)#!!H(#.JJM(#(##113ss݌ ` Ќ    t0  0` (#(#0 ` (#` (#0 (# (#   d)TheExtensionTelephoneException,18U.S.C.2510(5)(a)#!!H(#.U(#(##117tt݌ P Ќ    u0  0` (#(#0 ` (#` (#0 (# (#   e)TheInadvertentlyObtainedCriminalEvidenceException,u v݌@(#(# Ќ    w0  0` (#(#0 ` (#` (#0 (# (#     18U.S.C.2511(3)(b)(iv)#!!H(#.nn8(#(##119ww݌  0 Ќ    x0  0` (#(#0 ` (#` (#0 (# (#   f)TheAccessibletothePublicException,x5x݌! (#(# Ќ    y0  0` (#(#0 ` (#` (#0 (# (#     18U.S.C.2511(2)(g)(i)#!!H(#.  7(#(##119y8y݌ o" Ќ  !  !2z0  0` (#(#    D.RemediesForViolationsofTitleIIIandthePen/TrapStatute#!!H(#.,,O` (#` (##119!2zMz݌ _#  Ќ    7{0  0` (#(#0 ` (#` (# `   1.SuppressionRemedies#!!H(#.@@+ (# (##1207{R{݌ O$! Ќ    '|0  0` (#(#0 ` (#` (#0 (# (#   a)StatutorySuppressionRemedies#!!H(#.:(#(##120'|B|݌ ?%" Ќ    5}0  0` (#(#0 ` (#` (#0 (# (#   b)ConstitutionalSuppressionRemedies#!!H(#.JJ?(#(##1235}P}݌ /& # Ќ    H~0  0` (#(#0 ` (#` (# `   2.DefensestoCivilandCriminalActions#!!H(#.= (# (##124H~c~݌ '!$ Ќ    J0  0` (#(#0 ` (#` (#0 (# (#   a)GoodFaithDefense#!!H(#..(#(##125Je݌ ("% Ќ    L0  0` (#(#0 ` (#` (#0 (# (#   b)QualifiedImmunity#!!H(#..(#(##126Lg݌ (#& Ќ  Vm  VmN0     V.EVIDENCE#!!H(#. (#(##127VmNj݌ *%( Ќ  !  ! 0  0` (#(#    A.Introduction#!!H(#. ` (#` (##127! '݌ +p&) Ќ  !  !0  0` (#(#    B.Authentication#!!H(#. ` (#` (##129!݌ _ Ќ    0  0` (#(#0 ` (#` (# `   1.AuthenticityandtheAlterationofComputerRecords#!!H(#.J (# (##130у݌ O Ќ    ń0  0` (#(#0 ` (#` (# `   2.EstablishingtheReliabilityofComputerPrograms#!!H(#.H (# (##130ń݌ ? Ќ    ҅0  0` (#(#0 ` (#` (# `   3.IdentifyingtheAuthorofComputerStoredRecords#!!H(#.ddH (# (##132҅݌ / Ќ  !  !߆0  0` (#(#    C.Hearsay#!!H(#.~ ~ ` (#` (##133!߆݌   Ќ    0  0` (#(#0 ` (#` (# `   1.InapplicabilityoftheHearsayRulestoComputerGeneratedRecords#!!H(#.Y (# (##133ɇ݌   Ќ    ̈0  0` (#(#0 ` (#` (# `   2.ApplicabilityoftheHearsayRulestoComputerStoredRecords#!!H(#.**T (# (##135̈݌   Ќ  !  !0  0` (#(#    D.OtherIssues#!!H(#. ` (#` (##136!݌   Ќ    0  0` (#(#0 ` (#` (# `   1.TheBestEvidenceRule#!!H(#.- (# (##136Ԋ݌   Ќ    0  0` (#(#0 ` (#` (# `   2.ComputerPrintoutsas Summaries#!!H(#.8 (# (##137Ƌ݌  p  Ќ  Vm  Vm0     VI.APPENDICES#!!H(#. (#(##138Vmʌ݌ P  Ќ  !  !n0  0` (#(#    AppendixA:SampleNetworkBannerLanguage#!!H(#.BB9` (#` (##138!n݌ @  Ќ  !  !]0  0` (#(#    AppendixB:Sample18U.S.C.2703(d)ApplicationandOrder#!!H(#.TTK` (#` (##141!]x݌ 0  Ќ  !  !a0  0` (#(#    AppendixC:SampleLanguageforPreservation   RequestLettersunder18U.S.C.2703(f)#!!H(#.>` (#` (##152!a|݌ o Ќ  !  !0  0` (#(#    AppendixD:SamplePenRegister/Trap _ andTraceApplicationandOrder#!!H(#.3` (#` (##155!݌ O Ќ  !  !0  0` (#(#    AppendixE:SampleSubpoenaLanguage#!!H(#.3` (#` (##145!ё݌ ? Ќ  !  !0  0` (#(#    AppendixF:SampleLanguageforSearchWarrants / andAccompanyingAffidavitstoSearchandSeizeComputers#!!H(#.M` (#` (##147!݌  Ќ  !  !0  0` (#(#    AppendixG:SampleLetterforProviderMonitoring#!!H(#.ll@` (#` (##160!݌  Ќ  Vm  Vmٔ0     INDEX#!!H(#.(#(##161Vmٔ݌  Ќ  M      INTRODUCTION ĕ  _   Inthelastdecade,computersandtheInternethaveenteredthemainstreamofAmerican ? life.MillionsofAmericansspendseveralhourseverydayinfrontofcomputers,wherethey / sendandreceiveemail,surftheWeb,maintaindatabases,andparticipateincountlessother   activities.       Unfortunately,thosewhocommitcrimehavenotmissedthecomputerrevolution.An   increasingnumberofcriminalsusepagers,cellularphones,laptopcomputersandnetwork   serversinthecourseofcommittingtheircrimes.Insomecases,computersprovidethemeansof  p  committingcrime.Forexample,theInternetcanbeusedtodeliveradeaththreatviaemail;to `  launchhackerattacksagainstavulnerablecomputernetwork;todisseminatecomputerviruses; P  ortotransmitimagesofchildpornography.Inothercases,computersmerelyserveas @  convenientstoragedevicesforevidenceofcrime.Forexample,adrugkingpinmightkeepalist 0  ofwhooweshimmoneyinafilestoredinhisdesktopcomputerathome,oramoneylaundering   operationmightretainfalsefinancialrecordsinafileonanetworkserver. o   Thedramaticincreaseincomputerrelatedcrimerequiresprosecutorsandlaw O enforcementagentstounderstandhowtoobtainelectronicevidencestoredincomputers. ? Electronicrecordssuchascomputernetworklogs,emails,wordprocessingfiles,and .jpg / picturefilesincreasinglyprovidethegovernmentwithimportant(andsometimesessential)  evidenceincriminalcases.ThepurposeofthispublicationistoprovideFederallaw  enforcementagentsandprosecutorswithsystematicguidancethatcanhelpthemunderstandthe  legalissuesthatarisewhentheyseekelectronicevidenceincriminalinvestigations.    Thelawgoverningelectronicevidenceincriminalinvestigationshastwoprimary p sources:theFourthAmendmenttotheU.S.Constitution,andthestatutoryprivacylawscodified ` at18U.S.C.251022,18U.S.C.270111,and18U.S.C.312127.Although P constitutionalandstatutoryissuesoverlapinsomecases,mostsituationspresenteithera @ constitutionalissueundertheFourthAmendmentorastatutoryissueunderthesethreestatutes.  0 Thismanualreflectsthatdivision:Chapters1and2addresstheFourthAmendmentlawof !  searchandseizure,andChapters3and4focusonthestatutoryissues,whicharisemostlyin o" casesinvolvingcomputernetworksandtheInternet. _#    Chapter1explainstherestrictionsthattheFourthAmendmentplacesonthewarrantless ?%" searchandseizureofcomputersandcomputerdata.Thechapterbeginsbyexplaininghowthe /& # courtsapplythe reasonableexpectationofprivacytesttocomputers;turnsnexttohowthe '!$ exceptionstothewarrantrequirementapplyincasesinvolvingcomputers;andconcludeswitha ("% comprehensivediscussionofthedifficultFourthAmendmentissuesraisedbywarrantless (#& workplacesearchesofcomputers.Questionsaddressedinthischapterinclude:Whendoesthe )$' governmentneedasearchwarranttosearchandseizeasuspect'scomputer?Cananinvestigator *%( searchwithoutawarrantthroughasuspect'spagerfoundincidenttoarrest?Doesthe +p&) governmentneedawarranttosearchagovernmentemployee'sdesktopcomputerlocatedinthe _ employeesoffice? O   Chapter2discussesthelawthatgovernsthesearchandseizureofcomputerspursuantto / searchwarrants.Thechapterbeginsbyreviewingthestepsthatinvestigatorsshouldfollow   whenplanningandexecutingsearchestoseizecomputerhardwareandcomputerdatawitha   warrant.Inparticular,thechapterfocusesontwoissues:first,howinvestigatorsshouldplanto   executecomputersearches,andsecond,howtheyshoulddrafttheproposedsearchwarrantsand   theiraccompanyingaffidavits.Finally,thechapterendswithadiscussionofpostsearchissues.   Questionsaddressedinthechapterinclude:Whenshouldinvestigatorsplantosearchcomputers  p  onthepremises,andwhenshouldtheyremovethecomputerhardwareandsearchitlateroff `  site?HowshouldinvestigatorsplantheirsearchestoavoidcivilliabilityunderthePrivacy P  ProtectionAct,42U.S.C.2000aa?Howshouldprosecutorsdraftsearchwarrantlanguageso @  thatitcomplieswiththeparticularityrequirementoftheFourthAmendmentandRule41ofthe 0  FederalRulesofCriminalProcedure?Whatisthelawgoverningwhenthegovernmentmust   searchandreturnseizedcomputers? o   ThefocusofChapter3isthestoredcommunicationsportionoftheElectronic O CommunicationsPrivacyAct,18U.S.C.270111( ECPA).ECPAgovernshow ? investigatorscanobtainstoredaccountrecordsandcontentsfromnetworkserviceproviders, / includingInternetserviceproviders(ISPs),telephonecompanies,cellphoneserviceproviders,  andsatelliteservices.ECPAissuesariseoftenincasesinvolvingtheInternet:anytime  investigatorsseekstoredinformationconcerningInternetaccountsfromprovidersofInternet  service,theymustcomplywiththestatute.Topicscoveredinthissectioninclude:Howcanthe  governmentobtainemailsandnetworkaccountlogsfromISPs?Whendoesthegovernment  needtoobtainasearchwarrant,asopposedto18U.S.C.2703(d)orderorasubpoena?When p canprovidersdiscloseemailsandrecordstothegovernmentvoluntarily?Whatremedieswill ` courtsimposewhenECPAhasbeenviolated? P     Chapter4reviewsthelegalframeworkthatgovernselectronicsurveillance,with  0 particularemphasisonhowthestatutesapplytosurveillanceonthecommunicationsnetworks. !  Inparticular,thechapterdiscussesTitleIIIasmodifiedbytheElectronicCommunications o" PrivacyAct,18U.S.C.251022(referredtohereas TitleIII),9  #  1      ׀aswellasthePenRegister _#  andTrapandTraceDevicesstatute,18U.S.C.312127.Thesestatutesgovernwhenand _ howthegovernmentcanconductrealtimesurveillance,suchasmonitoringacomputerhacker's O activityashebreaksintoagovernmentcomputernetwork.Topicsaddressedinthischapter ? include:Whencanvictimsofcomputercrimemonitorunauthorizedintrusionsintotheir / networksanddisclosethatinformationtolawenforcement?Cannetwork bannersgenerate   impliedconsenttomonitoring?Howcanthegovernmentobtainapenregister/trapandtrace   orderthatpermitsthegovernmenttocollectpacketheaderinformationfromInternet   communications?XXXXԀWhatremedieswillcourtsimposewhentheelectronicsurveillancestatutes   havebeenviolated?   #XXXXе#  Ofcourse,theissuesdiscussedinChapters1through4canoverlapinactualcases.An l  investigationintocomputerhackingmaybeginwithobtainingstoredrecordsfromanISP \  accordingtoChapter3,movenexttoanelectronicsurveillancephaseimplicatingChapter4,and L  thenconcludewithasearchofthesuspect'sresidenceandaseizureofhiscomputersaccordingto <  Chapters1and2.Inothercases,agentsandprosecutorsmustunderstandissuesraisedin ,  multiplechaptersnotjustinthesamecase,butatthesametime.Forexample,aninvestigation { intoworkplacemisconductbyagovernmentemployeemayimplicateallofChapters1through k  4.Investigatorsmaywanttoobtaintheemployee'semailsfromthegovernmentnetworkserver [ (implicatingECPA,discussedinChapter3);maywishtomonitortheemployee'suseofthe K telephoneorInternetinrealtime(raisingsurveillanceissuesfromChapter4);andatthesame ; time,mayneedtosearchtheemployee'sdesktopcomputerinhisofficeforcluesofthe + misconduct(raisingsearchandseizureissuesfromChapters1and2).Becausethe  constitutionalandstatutoryregimescanoverlapincertaincases,agentsandprosecutorswill   needtounderstandnotonlyallofthelegalissuescoveredinChapters1through4,butwillalso  needtounderstandtheprecisenatureoftheinformationtobegatheredintheirparticularcases.    Chapters1through4arefollowedbyashortChapter5,whichdiscussesevidentiary l issuesthatarisefrequentlyincomputerrelatedcases.Thepublicationconcludeswith \ appendicesthatoffersampleforms,language,andorders. L Ѐ  Computercrimeinvestigationsraisemanynovelissues,andthecourtshaveonlybegun !, tointerprethowtheFourthAmendmentandfederalstatutorylawsapplytocomputerrelated {" cases.Agentsandprosecutorswhoneedmoredetailedadvicecanrelyonseveralresourcesfor k#   furtherassistance.Atthefederaldistrictlevel,everyU.S.AttorneysOfficehasatleastone [$! AssistantU.S.AttorneywhohasbeendesignatedasaComputerandTelecommunications K%" Coordinator( CTC).EveryCTCreceivesextensivetrainingincomputerrelatedcrime,andis ;& # primarilyresponsibleforprovidingexpertiserelatingtothetopicscoveredinthismanualwithin +'!$ hisorherdistrict.CTCsmaybereachedintheirdistrictoffices.Further,severalsectionswithin ("% theCriminalDivisionoftheU.S.DepartmentofJusticeinWashington,D.C.,haveexpertisein  )#& computerrelatedfields.TheOfficeofInternationalAffairs((202)5140000)providesexpertise )$' inthemanycomputercrimeinvestigationsthatraiseinternationalissues.TheOfficeof *%( EnforcementOperations((202)5146809)providesexpertiseinthewiretappinglawsandother +|&) privacystatutesdiscussedinChapters3and4.Also,theChildExploitationandObscenity _ Section((202)5145780)providesexpertiseincomputerrelatedcasesinvolvingchild O pornographyandchildexploitation. ?   Finally,agentsandprosecutorsarealwayswelcometocontacttheComputerCrimeand   IntellectualPropertySection( CCIPS)directlybothforgeneraladviceandspecificcaserelated   assistance.Duringregularbusinesshours,atleasttwoCCIPSattorneysareondutytoanswer   questionsandprovideassistancetoagentsandprosecutorsonthetopicscoveredinthis   document,aswellasothermattersthatariseincomputercrimecases.Themainnumberfor   CCIPSis(202)5141026.  p    `      I.SEARCHINGANDSEIZINGCOMPUTERSWITHOUTAWARRANT   O   A.Introduction 8      TheFourthAmendmentlimitstheabilityofgovernmentagentstosearchforevidence   withoutawarrant.Thischapterexplainstheconstitutionallimitsofwarrantlesssearchesincases   involvingcomputers.     TheFourthAmendmentstates:     p      x  `  Therightofthepeopletobesecureintheirpersons,houses,papers,andeffects, @  againstunreasonablesearchesandseizures,shallnotbeviolated,andnoWarrants 0  shallissue,butuponprobablecause,supportedbyOathoraffirmation,and   particularlydescribingtheplacetobesearched,andthepersonsorthingstobe o seized. _ -  AccordingtotheSupremeCourt,awarrantlesssearchdoesnotviolatetheFourth ? Amendmentifoneoftwoconditionsissatisfied.First,ifthegovernmentsconductdoesnot / violateapersons reasonableexpectationofprivacy,thenformallyitdoesnotconstitutea  FourthAmendment searchandnowarrantisrequired.SeeIllinoisv.Andreas,463U.S.765,  771(1983).Second,awarrantlesssearchthatviolatesapersonsreasonableexpectationof  privacywillnonethelessbe reasonable(andthereforeconstitutional)ifitfallswithinan  establishedexceptiontothewarrantrequirement.SeeIllinoisv.Rodriguez,497U.S.177,183  (1990).Accordingly,investigatorsmustconsidertwoissueswhenaskingwhetheragovernment p searchofacomputerrequiresawarrant.First,doesthesearchviolateareasonableexpectation ` ofprivacy?Andifso,isthesearchnonethelessreasonablebecauseitfallswithinanexceptionto P thewarrantrequirement? @ 0    B.TheFourthAmendments ReasonableExpectationofPrivacyinCasesInvolving o" Computers nd _# (#(#     1.GeneralPrinciples nd /& #     Asearchisconstitutionalifitdoesnotviolateapersons reasonableor legitimate ("% expectationofprivacy.Katzv.UnitedStates,389U.S.347,362(1967)(Harlan,J.,concurring). (#& Thisinquiryembracestwodiscretequestions:first,whethertheindividualsconductreflects an )$' actual(subjective)expectationofprivacy,andsecond,whethertheindividualssubjective *%( expectationofprivacyis onethatsocietyispreparedtorecognizeasreasonable.Id.at361. +p&) Inmostcases,thedifficultyofcontestingadefendantssubjectiveexpectationofprivacyfocuses _ theanalysisontheobjectiveaspectoftheKatztest,i.e.,whethertheindividualsexpectationof O privacywasreasonable. ?   Nobrightlineruleindicateswhetheranexpectationofprivacyisconstitutionally   reasonable.SeeOConnorv.Ortega,480U.S.709,715(1987).Forexample,theSupremeCourt   hasheldthatapersonhasareasonableexpectationofprivacyinpropertylocatedinsidea   personshome,seePaytonv.NewYork,445U.S.573,58990(1980);inconversationstaking   placeinanenclosedphonebooth,seeKatz,389U.S.at358;andinthecontentsofopaque   containers,seeUnitedStatesv.Ross,456U.S.798,82223(1982).Incontrast,apersondoes  p  nothaveareasonableexpectationofprivacyinactivitiesconductedinopenfields,seeOliverv. `  UnitedStates,466U.S.170,177(1984);ingarbagedepositedattheoutskirtsofrealproperty, P  seeCaliforniav.Greenwood,486U.S.35,4041(1988);orinastrangershousethattheperson @  hasenteredwithouttheownersconsentinordertocommitatheft,seeRakasv.Illinois,439 0  U.S.128,143n.12(1978).     2.ReasonableExpectationofPrivacyinComputersasStorageDevices nd O XXXX  x vXX+#XXvx # XX#  y#s 0 ` Todeterminewhetheranindividualhasareasonableexpectationofprivacyfin / informationstoredinacomputer,ithelpstotreatthecomputerlikef3aclosed  containersuchasabriefcaseorfilecabinet.TheFourthAmendment3Ӏgenerally  prohibitslawenforcementfromaccessingandviewinginformationstoredina z computerwithoutawarrantifitwouldbeprohibitedfromopeningaclosed j containerandexaminingitscontentsinthesamesituation.# sq#  #XX /#Z` `  #XXXXH#  ThemostbasicFourthAmendmentquestionincomputercasesaskswhetheran : individualenjoysareasonableexpectationofprivacyinelectronicinformationstoredwithin * computers(orotherelectronicstoragedevices)undertheindividualscontrol.Forexample,do y individualshaveareasonableexpectationofprivacyinthecontentsoftheirlaptopcomputers, i  floppydisksorpagers?Iftheanswerisyes,thenthegovernmentordinarilymustobtaina Y! warrantbeforeitaccessestheinformationstoredinside. I"   Whenconfrontedwiththisissue,courtshaveanalogizedelectronicstoragedevicesto )$! closedcontainers,andhavereasonedthataccessingtheinformationstoredwithinanelectronic %" storagedeviceisakintoopeningaclosedcontainer.Becauseindividualsgenerallyretaina  & # reasonableexpectationofprivacyinthecontentsofclosedcontainers,seeUnitedStatesv.Ross, &!$ 456U.S.798,82223(1982),theyalsogenerallyretainareasonableexpectationofprivacyin '"% dataheldwithinelectronicstoragedevices.Accordingly,accessinginformationstoredina (z#& computerordinarilywillimplicatetheownersreasonableexpectationofprivacyinthe )j$' information.SeeUnitedStatesv.Barth,26F.Supp.2d929,93637(W.D.Tex.1998)(finding *Z%( reasonableexpectationofprivacyinfilesstoredonharddriveofpersonalcomputer);United +J&) Statesv.Reyes,922F.Supp.818,83233(S.D.N.Y.1996)(findingreasonableexpectationof _ privacyindatastoredinapager);UnitedStatesv.Lynch,908F.Supp.284,287(D.V.I.1995) O (same);UnitedStatesv.Chan,830F.Supp.531,535(N.D.Cal.1993)(same);UnitedStatesv. ? Blas,1990WL265179,at*21(E.D.Wis.1990)( [A]nindividualhasthesameexpectationof / privacyinapager,computer,orotherelectronicdatastorageandretrievaldeviceasinaclosed   container.).ButseeUnitedStatesv.Carey,172F.3d1268,1275(10thCir.1999)(dicta)   (analogizingacomputerharddrivetoafilecabinetinthecontextofasearchpursuanttoa   warrant,butthenstatingwithoutexplanationthat thefilecabinetanalogymaybeinadequate).     Althoughindividualsgenerallyretainareasonableexpectationofprivacyincomputers  p  undertheircontrol,specialcircumstancesmayeliminatethatexpectation.Forexample,an `  individualwillnotretainareasonableexpectationofprivacyininformationfromacomputerthat P  thepersonhasmadeopenlyavailable.InUnitedStatesv.David,756F.Supp.1385(D.Nev. @  1991),agentslookingoverthedefendantsshoulderreadthedefendantspasswordfromthe 0  screenasthedefendanttypedhispasswordintoahandheldcomputer.ThecourtfoundnoFourth   Amendmentviolationinobtainingthepassword,becausethedefendantdidnotenjoya o reasonableexpectationofprivacy inthedisplaythatappearedonthescreen.Id.at1389.See _ alsoKatzv.UnitedStates,389U.S.347,351(1967)( Whatapersonknowinglyexposestothe O public,eveninhisownhomeoroffice,isnotasubjectofFourthAmendmentprotection.).Nor ? willindividualsgenerallyenjoyareasonableexpectationofprivacyinthecontentsofcomputers / theyhavestolen.SeeUnitedStatesv.Lyons,992F.2d1029,103132(10thCir.1993).    3.ReasonableExpectationofPrivacyandThirdPartyPossession re0    Individualswhoretainareasonableexpectationofprivacyinstoredelectronic p informationundertheircontrolmayloseFourthAmendmentprotectionswhentheyrelinquish ` thatcontroltothirdparties.Forexample,anindividualmayofferacontainerofelectronic P informationtoathirdpartybybringingamalfunctioningcomputertoarepairshop,orby @ shippingafloppydisketteinthemailtoafriend.Alternatively,ausermaytransmitinformation  0 tothirdpartieselectronically,suchasbysendingdataacrosstheInternet.Whenlaw !  enforcementagentslearnofinformationpossessedbythirdpartiesthatmayprovideevidenceof o" acrime,theymaywishtoinspectit.WhethertheFourthAmendmentrequiresthemtoobtaina _#  warrantbeforeexaminingtheinformationdependsfirstuponwhetherthethirdpartypossession O$! haseliminatedtheindividualsreasonableexpectationofprivacy. ?%"   Toanalyzethirdpartypossessionissues,ithelpsfirsttodistinguishbetweenpossession '!$ byacarrierinthecourseoftransmissiontoanintendedrecipient,andsubsequentpossessionby ("% theintendedrecipient.Forexample,ifAhiresBtocarryapackagetoC,Asreasonable (#& expectationofprivacyinthecontentsofthepackageduringthetimethatBcarriesthepackage )$' onitswaytoCmaybedifferentthanAsreasonableexpectationofprivacyafterChasreceived *%( thepackage.Duringtransmission,contentsgenerallyretainFourthAmendmentprotection.The +p&) governmentordinarilymaynotexaminethecontentsofapackageinthecourseoftransmission _ withoutawarrant.Governmentintrusionandexaminationofthecontentsordinarilyviolatesthe O reasonableexpectationofprivacyofboththesenderandreceiver.SeeUnitedStatesv. ? Villarreal,963F.2d770,774(5thCir.1992);butseeUnitedStatesv.Walker,20F.Supp.2d971, / 97374(S.D.W.Va.1998)(concludingthatpackagessenttoanaliasinfurtheranceofacriminal   schemedonotsupportareasonableexpectationofprivacy).Thisruleappliesregardlessof   whetherthecarrierisownedbythegovernmentoraprivatecompany.CompareExParte   Jackson,96U.S.(6Otto)727,733(1877)(publiccarrier)withWalterv.UnitedStates,447U.S.   649,651(1980)(privatecarrier).       Agovernment searchofanintangibleelectronicsignalinthecourseoftransmission `  mayalsoimplicatetheFourthAmendment.SeeBergerv.NewYork,388U.S.41,5860(1967) P  (applyingtheFourthAmendmenttoawirecommunicationinthecontextofawiretap).The @  boundariesoftheFourthAmendmentinsuchcasesremainhazy,however,becauseCongress 0  addressedtheFourthAmendmentconcernsidentifiedinBergerbypassingTitleIIIofthe   OmnibusCrimeControlandSafeStreetsActof1968( TitleIII),18U.S.C.251022.Title o III,whichisdiscussedfullyinChapter4,providesacomprehensivestatutoryframeworkthat _ regulatesrealtimemonitoringofwireandelectroniccommunications.Itsscopeencompasses, O andinmanysignificantwaysexceeds,theprotectionofferedbytheFourthAmendment.See ? UnitedStatesv.Torres,751F.2d875,884(7thCir.1985).Asapracticalmatter,then,the / monitoringofwireandelectroniccommunicationsinthecourseoftransmissiongenerallyraises  manystatutoryquestions,butfewconstitutionalones.SeegenerallyChapter4.  x vXXx vvx +#XXvx {# XX#  ܬ#s Ԁ0 ` #XXs##XXXX7#XXXXsXXIndividualsmayloseFourthAmendmentprotectionintheircomputerfilesifthey  losecontrolofthefiles.#XXs##XXXXʩ#\` `  l^  Onceanitemhasbeenreceivedbytheintendedrecipient,thesendersreasonable < expectationofprivacygenerallydependsuponwhetherthesendercanreasonablyexpectto , retaincontrolovertheitemanditscontents.Whenapersonleavesapackagewithathirdparty { fortemporarysafekeeping,forexample,heusuallyretainscontrolofthepackage,andthus k  retainsareasonableexpectationofprivacyinitscontents.See,e.g.,UnitedStatesv.Most,876 [! F.2d191,19798(D.C.Cir.1989)(findingreasonableexpectationofprivacyincontentsof K" plasticbagleftwithgrocerystoreclerk);UnitedStatesv.Barry,853F.2d1479,148183(8thCir. ;#  1988)(findingreasonableexpectationofprivacyinlockedsuitcasestoredatairportbaggage +$! counter);UnitedStatesv.Presler,610F.2d1206,121314(4thCir.1979)(findingreasonable %" expectationofprivacyinlockedbriefcasesstoredwithdefendantsfriendforsafekeeping).See  & # alsoUnitedStatesv.Barth,26F.Supp.2d929,93637(W.D.Tex.1998)(holdingthatdefendant &!$ retainsareasonableexpectationofprivacyincomputerfilescontainedinharddriveleftwith '"% computertechnicianforlimitedpurposeofrepairingcomputer). (|#&   Ifthesendercannotreasonablyexpecttoretaincontrolovertheiteminthethirdpartys *\%( possession,however,thesendernolongerretainsareasonableexpectationofprivacyinits +L&) contents.Forexample,inUnitedStatesv.Horowitz,806F.2d1222(4thCir.1986),the _ defendantemailedconfidentialpricinginformationrelatingtohisemployertohisemployers O competitor.AftertheFBIsearchedthecompetitorscomputersandfoundthepricing ? information,thedefendantclaimedthatthesearchviolatedhisFourthAmendmentrights.The / FourthCircuitdisagreed,holdingthatthedefendantrelinquishedhisinterestinandcontrolover   theinformationbysendingittothecompetitorforthecompetitorsfutureuse.Seeid.at1225   26.SeealsoUnitedStatesv.Charbonneau,979F.Supp.1177,1184(S.D.Ohio1997)(holding   thatdefendantdoesnotretainreasonableexpectationofprivacyincontentsofemailmessage   senttoAmericaOnlinechatroomafterthemessagehasbeenreceivedbychatroomparticipants)   (citingHoffav.UnitedStates,385U.S.293,302(1966)).Insomecases,thesendermay  p  initiallyretainarighttocontrolthethirdpartyspossession,butmaylosethatrightovertime. `  ThegeneralruleisthatthesendersFourthAmendmentrightsdissipatealongwiththesenders P  righttocontrolthethirdpartyspossession.Forexample,inUnitedStatesv.Poulsen,41F.3d @  1330(9thCir.1994),computerhackerKevinPoulsenleftcomputertapesinalockerata 0  commercialstoragefacilitybutneglectedtopayrentforthelocker.Followingawarrantless   searchofthefacility,thegovernmentsoughttousethetapesagainstPoulsen.TheNinthCircuit o heldthatthesearchdidnotviolatePoulsensreasonableexpectationofprivacybecauseunder _ statelawPoulsensfailuretopayrentextinguishedhisrighttoaccessthetapes.Seeid.at1337. O   AnimportantlineofSupremeCourtcasesstatesthatindividualsgenerallycannot / reasonablyexpecttoretaincontrolovermereinformationrevealedtothirdparties,evenifthe  sendershaveasubjectiveexpectationthatthethirdpartieswillkeeptheinformationconfidential.  Forexample,inUnitedStatesv.Miller,425U.S.435,443(1976),theCourtheldthattheFourth  Amendmentdoesnotprotectbankaccountinformationthataccountholdersdivulgetotheir  banks.Byplacinginformationunderthecontrolofathirdparty,theCourtstated,anaccount  holderassumestheriskthattheinformationwillbeconveyedtothegovernment.Id.According p totheCourt, theFourthAmendmentdoesnotprohibittheobtainingofinformationrevealedtoa ` thirdpartyandconveyedbyhimtoGovernmentauthorities,eveniftheinformationisrevealed P ontheassumptionthatitwillbeusedonlyforalimitedpurposeandtheconfidenceplacedinthe @ thirdpartywillnotbebetrayed.Id.(citingHoffav.UnitedStates,385U.S.293,302(1966)).  0 SeealsoSmithv.Maryland,442U.S.735,74344(1979)(findingnoreasonableexpectationof !  privacyinphonenumbersdialedbyownerofatelephonebecauseactofdialingthenumber o" effectivelytellsthenumbertothephonecompany);Couchv.UnitedStates,409U.S.322,335 _#  (1973)(holdingthatgovernmentmaysubpoenaaccountantforclientinformationgivento O$! accountantbyclient,becauseclientretainsnoreasonableexpectationofprivacyininformation ?%" giventoaccountant). /& #   Becausecomputerdatais information,thislineofcasessuggeststhatindividualswho ("% senddataovercommunicationsnetworksmayloseFourthAmendmentprotectioninthedata (#& onceitreachestheintendedrecipient.SeeUnitedStatesv.Meriwether,917F.2d955,959(6th )$' Cir.1990)(suggestingthatanelectronicmessagesentviaapageris informationunderthe *%( Smith/Millerlineofcases);Charbonneau,979F.Supp.at1184( [A]ne-mailmessage... +p&) cannotbeaffordedareasonableexpectationofprivacyoncethatmessageisreceived.).Butsee _ C.RyanReetz,Note,WarrantRequirementforSearchesofComputerizedInformation,67B.U. O L.Rev.179,20006(1987)(arguingthatcertainkindsofremotelystoredcomputerfilesshould ? retainFourthAmendmentprotection,andattemptingtodistinguishUnitedStatesv.Millerand / Smithv.Maryland).Ofcourse,theabsenceofconstitutionalprotectionsdoesnotnecessarily   meanthatthegovernmentcanaccessthedatawithoutawarrantorcourtorder.Statutory   protectionsexistthatgenerallyprotecttheprivacyofelectroniccommunicationsstoredremotely   withserviceproviders,andcanprotecttheprivacyofInternetuserswhentheFourthAmendment   maynot.See18U.S.C.270111(discussedinChapter3,infra).         DefendantswilloccasionallyraiseaFourthAmendmentchallengetotheacquisitionof `  accountrecordsandsubscriberinformationheldbyInternetserviceprovidersusinglessprocess P  thanafullsearchwarrant.Asdiscussedinalaterchapter,theElectronicCommunications @  PrivacyActpermitsthegovernmenttoobtaintransactionalrecordswithan articulablefacts 0  courtorder,andbasicsubscriberinformationwithasubpoena.See18U.S.C.270111   (discussedinChapter3,infra).ThesestatutoryprocedurescomplywiththeFourthAmendment o becausecustomersofInternetserviceprovidersdonothaveareasonableexpectationofprivacy _ incustomeraccountrecordsmaintainedbyandfortheprovidersbusiness.SeeUnitedStatesv. O Hambrick,55F.Supp.2d504,508(W.D.Va.1999),affd,XXXX225F.3d656,#XXXX%#XXXXԀ2000WL1062039#XXXX&#Ԁ(4th ? Cir.2000)(unpublishedopinion)(findingnoFourthAmendmentprotectionfornetworkaccount / holdersbasicsubscriberinformationobtainedfromInternetserviceprovider);UnitedStatesv.  Kennedy,81F.Supp.2d1103,1110)(D.Kan.2000)(same).Thisruleaccordswithpriorcases  consideringthescopeofFourthAmendmentprotectionincustomeraccountrecords.See,e.g.,  UnitedStatesv.Fregoso,60F.3d1314,1321(8thCir.1995)(holdingthatatelephonecompany  customerhasnoreasonableexpectationofprivacyinaccountinformationdisclosedtothe  telephonecompany);InreGrandJuryProceedings,827F.2d301,30203(8thCir.1987) p (holdingthatcustomeraccountrecordsmaintainedandheldbyWesternUnionarenotentitledto ` FourthAmendmentprotection). P Ѐ  4.PrivateSearches vi* o" XXXXx vXX+#XXvx +# XX#  *#s Ԁ ` TheFourthAmendmentdoesnotapplytosearchesconductedbyprivateparties O$! *+ ` whoarenotactingasagentsofthegovernment.# s+##XX f+# %" **  TheFourthAmendment iswhollyinapplicabletoasearchorseizure,evenan &!$ unreasonableone,effectedbyaprivateindividualnotactingasanagentoftheGovernmentor '"% withtheparticipationorknowledgeofanygovernmentalofficial.UnitedStatesv.Jacobsen, (|#& 466U.S.109,113(1984).Asaresult,noviolationoftheFourthAmendmentoccurswhena )l$' privateindividualactingonhisownaccordconductsasearchandmakestheresultsavailableto *\%( lawenforcement.Seeid.Forexample,inUnitedStatesv.Hall,142F.3d988(7thCir.1998), +L&) thedefendanttookhiscomputertoaprivatecomputerspecialistforrepairs.Inthecourseof _ evaluatingthedefendantscomputer,therepairmanobservedthatmanyfilesstoredonthe O computerhadfilenamescharacteristicofchildpornography.Therepairmanaccessedthefiles, ? sawthattheydidinfactcontainchildpornography,andthencontactedthestatepolice.Thetip / ledtoawarrant,thedefendantsarrest,andhisconvictionforchildpornographyoffenses.On   appeal,theSeventhCircuitrejectedthedefendantsclaimthattherepairmanswarrantlesssearch   throughthecomputerviolatedtheFourthAmendment.Becausetherepairmanssearchwas   conductedonhisown,thecourtheld,theFourthAmendmentdidnotapplytothesearchorhis   laterdescriptionoftheevidencetothestatepolice.Seeid.at993.SeealsoUnitedStatesv.   Kennedy,81F.Supp.2d1103,1112(D.Kan.2000)(concludingthatsearchesofdefendants  p  computerovertheInternetbyananonymouscallerandemployeesofaprivateISPdidnot `  violateFourthAmendmentbecausetherewasnoevidencethatthegovernmentwasinvolvedin P  thesearch). @    InUnitedStatesv.Jacobsen,466U.S.109(1984),theSupremeCourtpresentedthe   frameworkthatshouldguideagentsseekingtouncoverevidenceasaresultofaprivatesearch. o AccordingtoJacobsen,agentswholearnofevidenceviaaprivatesearchcanreenacttheoriginal _ privatesearchwithoutviolatinganyreasonableexpectationofprivacy.Whattheagentscannot O dowithoutawarrantis exceed[]thescopeoftheprivatesearch.Id.at115.SeealsoUnited ? Statesv.Miller,152F.3d813,81516(8thCir.1998);UnitedStatesv.Donnes,947F.2d1430, / 1434(10thCir.1991).ButseeUnitedStatesv.Allen,106F.3d695,699(6thCir.1999)(dicta)  (statingthatJacobsendoesnotpermitlawenforcementtoreenactaprivatesearchofaprivate  homeorresidence).Thisstandardrequiresagentstolimittheirinvestigationtotheprecisescope  oftheprivatesearchwhensearchingwithoutawarrantafteraprivatesearchhasoccurred.So  longastheagentslimitthemselvestothescopeoftheprivatesearch,theagentssearchwillnot  violatetheFourthAmendment.However,assoonasagentsexceedthescopeoftheprivate p warrantlesssearch,anyevidenceuncoveredmaybesuppressed.SeeUnitedStatesv.Barth,26 ` F.Supp.2d929,937(W.D.Tex.1998)(suppressingevidenceofchildpornographyfoundon P computerharddriveafteragentsviewedmorefilesthanprivatetechnicianhadinitiallyviewed @ duringrepairofdefendantscomputer).Incomputercases,thisaspectofJacobsenmeansthat  0 privatesearcheswilloftenbeusefulpartlyasopportunitiestoprovidetheprobablecauseneeded !  toobtainawarrantforafurthersearch.Thefactthataprivatepersonhasuncoveredevidenceof o" acrimeonanotherpersonscomputerdoesnotpermitagentstosearchtheentirecomputer. _#  Instead,theprivatesearchpermitstheagentstoviewtheevidencethattheprivatesearch O$! revealed,and,ifnecessary,tousethatevidenceasabasisforprocuringawarranttosearchthe ?%" restofthecomputer.  #  2      ׀ /& # Ї  Althoughmostprivatesearchissuesarisewhenprivatethirdpartiesintentionallyexamine _ propertyandofferevidenceofacrimetolawenforcement,thesameframeworkapplieswhen O thirdpartiesinadvertentlyexposeevidenceofacrimetoplainview.Forexample,inUnited ? Statesv.Procopio,88F.3d21(1stCir.1996),adefendantstoredincriminatingfilesinhis / brotherssafe.Later,thievesstolethesafe,openedit,andabandoneditinapublicpark.Police   investigatingthetheftofthesafefoundthefilesscatteredonthegroundnearby,gatheredthem,   andthenusedthemagainstthedefendantinanunrelatedcase.TheFirstCircuitheldthattheuse   ofthefilesdidnotviolatetheFourthAmendment,becausethefilesweremadeopenlyavailable   bythethievesprivatesearch.Seeid.at2627(citingJacobsen,466U.S.at113).     Importantly,thefactthatthepersonconductingasearchisnotagovernmentemployee `  doesnotnecessarilymeanthatthesearchis privateforFourthAmendmentpurposes.Asearch P  byaprivatepartywillbeconsideredaFourthAmendmentgovernmentsearch iftheprivate @  partyact[s]asaninstrumentoragentoftheGovernment.Skinnerv.RailwayLaborExecutives 0  Assn,489U.S.602,614(1989).TheSupremeCourthasofferedlittleguidanceonwhenprivate   conductcanbeattributedtothegovernment;theCourthasmerelystatedthatthisquestion o  necessarilyturnsonthedegreeoftheGovernmentsparticipationintheprivatepartys _ activities,...aquestionthatcanonlyberesolvedinlightofallthecircumstances.Id.at614 O 15(quotingCoolidgev.NewHampshire,403U.S.443,487(1971)).Intheabsenceofamore ? definitivestandard,thevariousfederalCourtsofAppealshaveadoptedarangeofapproachesfor / distinguishingbetweenprivateandgovernmentsearches.Abouthalfofthecircuitsapplya  totalityofthecircumstancesapproachthatexaminesthreefactors:whetherthegovernment  knowsoforacquiescesintheintrusiveconduct;whetherthepartyperformingthesearchintends  toassistlawenforcementeffortsatthetimeofthesearch;andwhetherthegovernment  affirmativelyencourages,initiatesorinstigatestheprivateaction.See,e.g.,UnitedStatesv.  Pervaz,118F.3d1,6(1stCir.1997);UnitedStatesv.Smythe,84F.3d1240,124243(10thCir. p 1996);UnitedStatesv.McAllister,18F.3d1412,141718(7thCir.1994);UnitedStatesv. ` Malbrough,922F.2d458,462(8thCir.1990).Othercircuitshaveadoptedmorerulelike P formulationsthatfocusononlytwoofthesefactors.See,e.g.,UnitedStatesv.Miller,688F.2d @ 652,657(9thCir.1982)(holdingthatprivateactioncountsasgovernmentconductif,atthetime  0 ofthesearch,thegovernmentknewoforacquiescedintheintrusiveconduct,andtheparty !  performingthesearchintendedtoassistlawenforcementefforts);UnitedStatesv.Paige,136 o" F.3d1012,1017(5thCir.1998)(same);UnitedStatesv.Lambert,771F.2d83,89(6thCir.1985) _#  (holdingthataprivateindividualisastateactorforFourthAmendmentpurposesifthepolice O$! instigated,encouragedorparticipatedinthesearch,andtheindividualengagedinthesearchwith ?%" theintentofassistingthepoliceintheirinvestigativeefforts). _   C.ExceptionstotheWarrantRequirementinCasesInvolvingComputers ojP  /   Warrantlesssearchesthatviolateareasonableexpectationofprivacywillcomplywith   theFourthAmendmentiftheyfallwithinanestablishedexceptiontothewarrantrequirement.   Casesinvolvingcomputersoftenraisequestionsrelatingtohowthese establishedexceptions   applytonewtechnologies.     1.Consent oR P    Agentsmaysearchaplaceorobjectwithoutawarrantorevenprobablecauseifaperson 0  withauthorityhasvoluntarilyconsentedtothesearch.SeeSchnecklothv.Bustamonte,412U.S.   218,219(1973).Thisconsentmaybeexplicitorimplicit.SeeUnitedStatesv.Milian o Rodriguez,759F.2d1558,156364(11thCir.1985).Whetherconsentwasvoluntarilygivenis _ aquestionoffactthatthecourtmustdecidebyconsideringthetotalityofthecircumstances. O Whilenosingleaspectcontrolstheresult,theSupremeCourthasidentifiedthefollowing ? importantfactors:theage,education,intelligence,physicalandmentalconditionoftheperson / givingconsent;whetherthepersonwasunderarrest;andwhetherthepersonhadbeenadvisedof  hisrighttorefuseconsent.SeeSchneckloth,412U.S.at226.Thegovernmentcarriesthe  burdenofprovingthatconsentwasvoluntary.SeeUnitedStatesv.Price,599F.2d494,503(2d  Cir.1979).    Incomputercrimecases,twoconsentissuesariseparticularlyoften.First,whendoesa p searchexceedthescopeofconsent?Forexample,whenatargetconsentstothesearchofa ` machine,towhatextentdoestheconsentauthorizetheretrievalofinformationstoredinthe P machine?Second,whoistheproperpartytoconsenttoasearch?Doroommates,friends,and @ parentshavetheauthoritytoconsenttoasearchofanotherpersonscomputerfiles?  #  3        0 Ѐ   !      a)ScopeofConsent WZ _#    Thescopeofaconsenttosearchisgenerallydefinedbyitsexpressedobject,andis ?%" limitedbythebreadthoftheconsentgiven.UnitedStatesv.Pena,143F.3d1363,1368(10th /& # Cir.1998).ThestandardformeasuringthescopeofconsentundertheFourthAmendmentis '!$ objectivereasonableness: Whatwouldthet