Police blotter: Can someone else let cops search your PC?

A man whose father gave Homeland Security agents permission to search his computer says they should have used a warrant.

Police Blotter is a weekly CNET News.com report on the intersection of technology and the law.

What: Homeland Security agents obtained permission from elderly father, who lived in the same house, to search his son's computer for contraband.

When: 10th U.S. Circuit Court of Appeals ruled on April 25.

Outcome: By a 2-1 majority, the appeals court ruled the search was permissible because the father had the authority to consent to the search of the computer in his son's bedroom.

What happened, according to court documents:
During an investigation of Regpay, a payment-processing company that has been accused of having ties to child pornography, federal agents with the Department of Homeland Security became interested in a specific subscriber.

The name they obtained from Regpay's records was "Ray Andrus," with a street address in Leawood, Kan. They believed the account was used to access a now-defunct pornographic Web site called SunshineBoys.com. The e-mail address linked to the account was bandrus@kc.rr.com, however, which was associated with the name "Bailey Andrus."

But even after investigating for eight months, agents of Homeland Security's Immigration and Customs Enforcement section still didn't have enough hard evidence to make an arrest or get a search warrant from the judge. So they stopped by the house in Leawood for what's known as a "knock and talk," hoping to get permission for a voluntary search.

Customs agent Cheatham and Leawood police detective Woollen (no last names are given) arrived at the Andrus house at approximately 8:45 a.m. on August 27, 2004. Bailey Andrus, a 91-year old physician, answered the door in his pajamas and explained that his son Ray Andrus lived in the house to care for his aging parents.

Ray Andrus had a separate bedroom with the door ajar, and he was not at home. The father gave permission for the police to search his son's bedroom and any computers in it. Cheatham and Woollen called in a computer forensics expert, who had been waiting outside. He immediately unplugged the computer's hard drive and began browsing the contents using the EnCase forensic software (but did not check in advance to see if the contents were password-protected). Eventually the computer was seized by police.

The technician reported finding indications of child pornography after a few minutes of searching for JPEG files. At some point after this discovery, he halted and Ray Andrus was called at work. He agreed to come home. He was indicted on one count of knowingly and intentionally possessing sexually explicit images of minors in violation of federal law.

Andrus' defense counsel raised a number of objections to the search, centering on the argument that the elder Andrus did not have the legal authority to consent to a police search of his son's room and computer. (The computer was password-protected, but unless the contents are encrypted, such protection can typically be bypassed by plugging the hard drive into a second computer.)

That point is crucial. Normally a search warrant is required for a police search. But the U.S. Supreme Court has said that a third party can give consent--this often arises in husband-wife and roommate cases--for police to conduct a search if that person has joint access to that property, or control for most purposes.

Co-habitation is legally trickier, in other words, than a straightforward case of a bachelor living alone in a leased apartment. In a previous installment of Police Blotter, an appeals court ruled that police could not seize a computer without a warrant when the husband declined but the wife consented.

In the case of U.S. v. Andrus, the district court agreed that questions about the father's ability to consent made it a "close call"--but eventually ruled the results of the search could be used as evidence. Ray Andrus pleaded guilty and was sentenced to 70 months in prison. He did, however, reserve his right to raise the question of his father's consent during the appeal.

By a 2-1 majority, the 10th Circuit agreed with the district court and upheld his prison sentence.

Excerpts from the appeals court's majority opinion:
The inquiry into whether the owner of a highly personal object has indicated a subjective expectation of privacy traditionally focuses on whether the subject suitcase, footlocker or other container is physically locked. Determining whether a computer is "locked," or whether a reasonable officer should know a computer may be locked, presents a challenge distinct from that associated with other types of closed containers.

Courts addressing the issue of third-party consent in the context of computers, therefore, have examined officers' knowledge about password protection as an indication of whether a computer is "locked" in the way a footlocker would be. For example, in Trulock, the 4th Circuit held a live-in girlfriend lacked actual authority to consent to a search of her boyfriend's computer files where the girlfriend told police she and her boyfriend shared the household computer but had separate password-protected files that were inaccessible to the other. The court in that case explained, "Although Conrad had authority to consent to a general search of the computer, her authority did not extend to Trulock's password-protected files.

Andrus' case presents facts that differ somewhat from those in other cases. Andrus' computer was located in a bedroom occupied by the homeowner's 51-year-old son rather than in a true common area. Dr. Andrus, however, had unlimited access to the room. Law enforcement officers did not ask specific questions about Dr. Andrus' use of the computer, but Dr. Andrus said nothing indicating the need for such questions.

The critical issue in our analysis is whether, under the totality of the circumstances known to Cheatham, Woollen and Kanatzar, these officers could reasonably have believed Dr. Andrus had authority to consent to a search of the computer.

Andrus argues his computer's password protection indicated his computer was "locked" to third parties, a fact the officers would have known had they asked questions of Dr. Andrus prior to searching the computer. Under our case law, however, officers are not obligated to ask questions unless the circumstances are ambiguous. In essence, by suggesting the onus was on the officers to ask about password protection prior to searching the computer, despite the absence of any indication that Dr. Andrus' access to the computer was limited by a password, Andrus necessarily submits there is inherent ambiguity whenever police want to search a household computer and a third party has not affirmatively provided information about his own use of the computer or about password protection. Andrus' argument presupposes, however, that password protection of home computers is so common that a reasonable officer ought to know password protection is likely. Andrus has neither made this argument directly nor proffered any evidence to demonstrate a high incidence of password protection among home computer users.

For the foregoing reasons, this court concludes Dr. Andrus had apparent authority to consent to a search of the computer in Ray Andrus' bedroom. We accordingly affirm the district court's denial of Andrus' motion to suppress.

Excerpts from the dissent by Judge Monroe McKay:
I take issue with the majority's implicit holding that law enforcement may use software deliberately designed to automatically bypass computer password protection based on third-party consent without the need to make a reasonable inquiry regarding the presence of password protection and the third party's access to that password.

The presence of security on Defendant's computer is undisputed. Yet, the majority curiously argues that Defendant's use of password protection is inconsequential because Defendant failed to argue that computer password protection is "commonplace." Of course, the decision provides no guidance on what would constitute sufficient proof of the prevalence of password protection, nor does it explain why the court could not take judicial notice that password protection is a standard feature of operating systems. Despite recognizing the "pervasiveness of computers in American homes," and the fact that the "personal computer is often a repository for private information the computer's owner does not intend to share with others," the majority requires the invocation of magical language in order to give effect to Defendant's subjective intent to exclude others from accessing the computer.

The burden on law enforcement to identify ownership of the computer was minimal. A simple question or two would have sufficed. Prior to the computer search, the agents questioned Dr. Andrus about Ray Andrus' status as a renter and Dr. Andrus' ability to enter his 51-year-old son's bedroom in order to determine Dr. Andrus' ability to consent to a search of the room, but the agents did not inquire whether Dr. Andrus used the computer, and if so, whether he had access to his son's password. At the suppression hearing, the agents testified that they were not immediately aware that Defendant's computer was the only one in the house, and they began to doubt Dr. Andrus' authority to consent when they learned this fact.

Accordingly, in my view, given the case law indicating the importance of computer password protection, the common knowledge about the prevalence of password usage, and the design of EnCase or similar password bypass mechanisms, the Fourth Amendment and the reasonable inquiry rule, mandate that in consent-based, warrantless computer searches, law enforcement personnel inquire or otherwise check for the presence of password protection and, if a password is present, inquire about the consenter's knowledge of that password and joint access to the computer.

Close
Drag
Autoplay: ON Autoplay: OFF