Search of Electronic Devices Flashcards
searches of computers are governed by ________.
- 4th amendment
private searches of computers:
- does not trigger 4th (allowed)
- ex: computer repairman finds evidence on a computer and gives to an LEO
no REP
- if target has no REP, 4th not triggered
when a computer has no REP:
A) exposure to public
B) stolen computers
C) 3rd party possession
consent to search computers must be:
1) voluntary
2) actual or apparent authority
co-users can give consent to search computer but if one party objects…
- there is NO CONSENT
can consent be withdrawn or limited?
YES
if computer has a network banner….
- consent is not necessary.
can network administrators give consent?
YES
3rd party consent:
husband > wife
parents > minor child
parents > adult child
roommate > roommate
- husband > wife
- parents > minor child
- parents > adult child
- roommate > roommate
warrantless searches during exigent circumstances:
depends on:
- is there enough time to get a warrant?
- destruction of evidence?
what can you do during an exigent circumstance?
- seize the computer, but must get a warrant after computer is seized.
requirements for a plain view seizure (warrantless seizure):
1) lawfully present
2) incriminating evidence immediately apparent
when you find evidence during plain view, you can not abandon your original search and begin….
- searching for evidence of another crime!
search incident to arrest requirements:
1) lawful arrest
2) contemporaneous search
what is the scope of an SIA (warrantless search):
- head to toe
- areas of immediate control
what do you need to search a mobile phone?
- A SEARCH WARRANT
purpose of inventory (warrantless search):
- to inventory items NOT to search for evidence of a crime.
what are the requirements for an inventory:
1) lawful impoundment
2) standardized policy
**DO NOT INVENTORY DATA
problems with searching a computer for data:
- mislabeled info.
- encrypted info.
- data can be instantly erased or destroyed
- data can be easily hidden
issues when preparing a search warrant for a computer:
- pre search info (types of computers, software)
- meeting the particularity requirement
- justifying an off site search
- what jurisdiction do you get the warrant for?
pre search info needed:
- types of computer
- types of software
- network connections
meeting the particularity requirement:
1) independent component doctrine
2) identifying the objects of the search
independent component doctrine:
- you must establish PC to search each component of the computer
a warrant authorizing the search of a computer does not allow…..
- a search of detached devices
- ex: thumb drives, dvd’s, separate hard drive
**KEYBOARD, SCANNER, MANUALS SHOULD EACH BE SEPARATELY JUSTIFIED.
requesting to search for records:
1) all records: you can not request to seize all business records unless you have PC to believe that the target’s criminal history pervades the entire business (too broad)
2) records in any form: includes paper and electronic records.
you must establish PC for data (true or false)
TRUE
hardware
- the computer itself not the data
off site searches:
- you must justify in the warrant why you need to remove the computer to do an off site search.
reasons to do an off site search:
- data hidden or encrypted
- time or tools not available
- number and size of computer
- condition of scene safe or unclean
jurisdictional requirements for data/stored emails:
- data: if data is stored in more than one district, you must obtain a warrant in EACH DISTRICT where the data is located
- stored emails: the judge who has jurisdiction of the offense may issue the warrant and its good in all jurisdictions
things to consider before executing a search warrant:
- technical assistance
- knock and announce rule
- no knock warrant needed?
technical assistance
- non LEO personnel can assist
- forensic experts should be with you
authentication of data/files:
- government must “LAY THE FOUNDATION” for all physical evidence
- government must establish CHAIN OF CUSTODY
2 parts of authentication of evidence/files:
1) ensure the files are not altered after seizure
2) prove the authorship of the files
defending claims of alteration:
- use forensic experts to help you collect files or data without altering
who is the author of those files?
- you have to prove authorship by circumstantial evidence
- you must determine:
- who had access
- any passwords
- any trace evidence
- can you match email attachments
