Two cases whose names may well be connected to one of the most important rulings the Supreme Court will make in our lifetime are United States v. Wurie and Riley v. California. On the surface, the issue is whether the police have the authority to conduct a nonconsensual, non-exigent, warrantless search of a cell phone upon arrest.
While the issue could be disposed of easily with a basic search incident to arrest analysis, where a cell phone (read smart phone, for those who want to think a step ahead) was deemed just another container that happened to hold digital stuff rather than physical stuff, the ramifications are devastating.
The real issue of these two cases is set forth in Jeff Fisher’s merits brief in Riley (courtesy of Orin Kerr at WaPo Conspiracy), where he hammers home the scope and depth of what such a search reveals about the defendant, not to mention everyone the defendant knows. It draws the analogy (because law in the digital age is all about who has the best analogy) to “papers and effects,” the secret thoughts of a human being that are least subject to search by the government.
The scope and depth of what our computers reveal about us. After all, what’s a cellphone, but a little computer. And a smartphone is a little more of a computer. And the next gen will certainly be even more of a computer, capable of accessing our entire world, whether saved, visited or online.
In Wurie, Solicitor General Donald Verrilli tries to old school it, running down the laundry list of arguments based on the authority police have already obtained to search the physical world. The cellphone is just another object, though there might be a difference between removing its back to see if there’s some heroin in there as opposed to turning it on and accessing a Facebook page.
The scope and depth of our lives are going to be decided. The Wurie argument is that it’s just another search incident, no more or less than a search incident that the law already permits. The Riley argument is that the cellphone is the digital gateway to everything in a person’s life, and the search of a cellphone, down the line, is unlike any search incident that ever existed in the physical world. Once a cellphone is secure, there is no reason in the world why police cannot obtain a warrant, assuming probable cause exists, before being allowed to give a defendant and everyone he’s ever known a digital colonoscopy.
At the top level, the two sides take categorical approaches to what they ask the Supreme Court to hold. One might suspect that the Court will split the difference, rejecting the government’s search ’em all position, but crafting some sort of exception. There will no doubt be a great deal of discussion about this going forward.
For now, read the briefs so that we have a firm grasp of what’s really at stake here. If, as the government wants, an arrest alone gives the police carte blanche access to our deepest, most private thoughts via our digital lives, the damage could be irreparable. But for the Supremes to rule otherwise, it would require them to have a far firmer grasp of the role computers, technology and our digital existence play in our lives today, and going forward.
The rule decided here may well haunt us, and technology, for a very long time. The scope and depth of our lives as revealed by our engagement with technology is at stake. Think about that.
SHG,
Take off your defense attorney hat. Put on a SCOTUS robe. What rule would you craft to decide this issue? The categorical warrant rule requested by Riley? The categorical carte blanche rule requested by the SG? The alternative “reason to believe” rule requested by the SG? My proposed Felony Arrest + Probable Cause + Particularity + Custodial Detention rule, set forth as a comment to Professor Kerr’s WaPoConspiracy blog post?
Many academics and highly-skilled attorneys such as yourself have stated just how important the Court’s rulings in these cases will be regarding the 4A and technology. But the vast majority have not stated how they believe the Court should resolve the issue. Your objective opinion on the issue would be appreciated and enlightening.
Thanks.
pvine
You start off by asking me to not be what I am. Unfair. But I’ll try. I struggle with the contention that the 4th Amendment “reasonableness” can be severed from the warrant clause. If there is an opportunity to obtain a warrant, then I think the 4th Amendment requires a cop to do so. Yes, it’s a pain in the ass. Tough nuggies. That’s the price of living in a constitutional democracy.
The problem with any post-hoc assessment of a reasonableness determination of probable cause by a cop is that it invariably comes after something bad is found. We know this because if nothing is found, nobody is fighting it. Once something bad is found, the pressure to find PC (usually a subjective determination) is hard to resist. So things that work well in theory play out poorly in the courtroom.
Plus, tech is different. Jeff Fishers’ scope and depth argument is correct, and no matter what there may be on a cellphone for which PC might exist, they get everything, a million times what they should. I would require a warrant.
Is there a presumption in US 4th Amendment jurisprudence that a warrantless search is prima facie unreasonable? Up here in the Great White North, we have such a presumption, obviously a rebuttable one, in respect of s.8 of our Charter of Rights and Freedoms (the Canuck analogue to the US Bill of Rights), which is explicitly endorsed in Supreme Court of Canada jurisprudence.
Yes, there is. A warrantless search is presumed unconstitutional. Of course, it’s a rule swallowed by exceptions.
In light of recent Supreme Court decisions (see Fernandez for a very recent example), I don’t believe that the majority of the Court still adheres to the Warrant Preference Rule. As has been stated time and time again (especially in the last decade), the ultimate requirement of the 4A is reasonableness. The break hasn’t been definitively made between the Warrant Clause & the Reasonableness Clause, but I believe the Court is really close to severing those ties.
I agree with you that the trend is toward an independent reasonableness standard. My problem is I disagree with it, and think it’s dangerous. If there is a separate reasonableness clause, then the warrant clause is superfluous.
As long as the exclusionary rule is around (which may not be too much longer) the good faith exception provides a strong incentive for cops to get a warrant. If there are no exigent circumstances, and consent can’t be obtained, warrants will still play a huge role in 4A litigation, even if the clauses are decoupled.
Not so sure that the exclusionary rule won’t be around much longer. After all, it’s barely used and almost brand new. No reason to get rid of it until it wears out.
Not sure what you mean, however, about the good faith exception providing an incentive to get a warrant.
Fair enough. Our Supremes, while less overtly obsessed with theories of Constitutional interpretation, are also frequently willing to stretch exceptions beyond their rational limits when it suits their particular sensibilities (if Dudley Do-Right might not get his man, say).
Does Canada have an exclusionary rule?
Well I guess worst case I’ll have to override the US Supreme Court with hard crypto from hell. I already use whole disk encryption under Linux on my laptop with a ridiculous password…
Can you name the top ten reasons why encryption won’t help?
It won’t help with anything cloud-stored, for now. That could change and some decent geeks are working on it.
It won’t help with cellphone tracking using either a carrier or a Stinger for assistance.
But, it is still possible for small groups of people to do encrypted email, so long as they exchange a key in person… that works even with non-geeky players. Pass encrypted zip files around. And rock-solid control of local storage is very possible if you use good open-source tools. SO FAR at least the courts are upholding a 5th amendment right to hold passwords in your head, barring very unusual circumstances that somebody aware can avoid.
I wonder how well they’ll remember the key after a couple of years in jail for contempt for refusing to disclose or unencrypt. One of the massive failings of people who think technology can beat the system is that they fail to understand how a big stick works.
The government doesn’t have to figure out how to beat encryption. It just needs to beat the encrypter.
But most people won’t do it anyway. It’s just not how people behave.
Hey! That’s what she said (“can you name the top ten reasons encryption won’t work”) when I suggested the withdrawal method.
To which I replied, “No worries, what’s the worst that can happen?”
“Well….” she started to say. I just interrupted her and said, “Don’t -worry-about-it Honey, the prison population is declining right now there will be plenty of room.”
So, are you suggesting if the Supreme Sperms can’t find it in themselves to hold cell phone “contents” as holly as the egg or the master bedrooms bottom dresser drawer that the crypto key on my wife’s cell phone will be equivalent to the side zipper on her new pocketless red calf skin leather jump suit, that she likes to wear to the grocery store for the weekend shopping, and after she gets arrested for doing thirty over on the way back home to bake chocolate chip cookies and muffins for movie night the cops will not only be examining the blade length of the knife she hides in her cleavage but the contents of her cell phone, which she keeps stashed up the sleeve, if these rulings don’t go the right way?
Them sneaky bastards! What next? Hum, hey, I know. They should start indexing and holding onto a copy of all that potential evidence. After all it’s a known fact that them criminals like to socialize with criminals right?
And if that storage and indexing starts happening we will at long last be able to rid of all the world of drunk people urinating in public right?
Could these briefs but mere child’s play? Are you suggesting the big dog shit fix is in?
Tick tock & all aboard…where did I leave my passport?
Will we be reading Jack’s “the dog shit fix is in” brief in a few years?
Next summer it seems (it is a near certainty) that a mom is going to get ticketed in the park for not picking up her dogs shit which leads to her being arrested for disorderly conduct and resisting arrest, which leads to her cellphone search where clever Detective Fran finds all her cloud based apps wherein Fran looks in on the woman’s live home security cameras to see her husband fucking Jane, the coed from down the street, on the kitchen table who just happens to have a felonious check forging warrant and when the cops show up and bust the door down and haul her off they take a look at her phone which has a text message from her TA wanting to know if she still wants the 50 ecstasy pills.
After ecstasy dealing TA is arrested his cell phone browser cache turns up a dark web site address run by his wife dedicated to helping illegal immigrants stay one step ahead of deportation which of of course leads to the basement of Jack where the server hosting that web site is located and as it turns out, Jack is a wanted man for pissing off the balcony at a party which was known and indexed a month prior back at police headquarters because Jill who was arrested for failure to appear on reckless driving charge and happened to have a photo of Jack pissing off the balcony at the party on her cell phone (which she didn’t find offensive but hilarious because he fell off the balcony). But when the cops showed up with a warrant to seize the server from Jack the cops lapel cameras facial recognition software identified Jack as the miscreant public urinator that he is and locked him up.
Damn, I might have to seriously consider adding an Oldsmobile and a mother with baby stroller to my action figure CDL line to memorialize the forthcoming rulings.
Thanks for the reading material this morning and as usual, I learned something new.
It looks like I am seriously going to have to stop carrying around my work and personal cell phones in public. Who knows what could happen if I had both those phones on me and I had a successful day at the track and get busted for jaywalking.
Now, now children. Don’t even think about it. I just filed my copyright for the worlds first enclosed cell phone & dog shit carrying case. I just double dog dare them cops to get around my low tech encryption dog shit cell phone carrying case to get to my SIM card and end up arresting my local taverns daytime bartender’s daughter for sending out texts trying to sell the puppies her golden retriever just had without a breeders permit.
Everything else you wrote made completely perfect sense, but I think you meant patent, not copyright, for your nifty new invention.
In the cryptography trade, that’s known as rubber hose cryptanalysis.
I like it. It’s kinda steampunk.
Semi-violation of link policy due to relevance: xkcd.com/538/
Oh yeah. First thing that came to mind.
It never ceases to amaze me that no matter where I go, xkcd has already been there.
But anyone with even a basic knowledge of encryption knows how much a pain in the ass rubber-hose encryption really is in practice to implement and hidden volumes-within-a-volume are a lot of work to setup and maintain. Also, they are very prone to corruption and they aren’t usable for day to day things – only good for hiding rarely accessed and edited files.
Sure your drug sale ledger sheet might be a good candidate for hidden volume encryption, but what would you do about your contact list, cell phone calls, text messages, and the other things you do on a daily basis that will betray you? It is nice in theory, but in practice it just isn’t feasible for anyone who isn’t a spy.
How many people have you heard of that could resist the big stick? Do you really think you could be productive while maintaining a hidden volume within an encrypted volume or a system with plausible deniability? Plus – having truecrypt on your machine or a stegfs filesystem just makes you look like a target and evne if you truly have nothing, may end up in a cell because it looks like you do.
The rubber hose is a decryption tool, not an encryption tool.
“Rubber Hose” is just another name for plausible deniability – it isn’t a specific tool. There are many ways to implement it. If you do it with a hidden volume within a volume – your plausible deniability comes through encryption. If you do it with stegfs, then it is through decryption.
These deep discussions of technological prowess are so fascinating, and yet, not here. Do I need to add “no stegfs” to the rules? Do I?
Sorry – I misunderstood what Maupin was saying. He was literally saying “It is a tool to beat the shit out of you” and I was thinking of it in the sense that all the tools enabling plausible deniability are also called “rubber hose” tools. Semantics are important and I had a momentary lapse.
You guys can be really hard on a funny line sometimes.
Surely your day job has taught you that if you haven’t designed the rules such that every post violates at least two of them, you’re doing it wrong.
I’m trying for three, but creating really good quality rule violations isn’t nearly as easy as it looks.
I sort of understand why Lava Levinson could be compelled to turn over the keys under evidentiary laws. They were looking for evidence on cases that didn’t involve him directly.
However, in the case of an individual, could one plead the fifth when asked to turn over the keys to the lock on their personal, digital property?
That’s a more complicated question than you may realize. The 5th Amendment prohibits compelled testimony against oneself. It doesn’t not give a defendant the right to conceal evidence of guilt. But, yes, unencrypting can be a testimonial act, and compelling unencryption would violate the act of production privilege. The solution, which has been used regularly, is to grant use immunity so that the fact the person knows the code and can unencrypt can not be used against him to prove access and knowledge, but he still has to unencrypt. In other words, a court can compel a defendant to unencrypt provided the act of doing so isn’t used against him, though the contents can be.
There’s an interesting wikipedia page on this — “key disclosure law”. Of course, the fact that laws in some jurisdiction mandate decryption would never be used to put away an innocent defendant, so none of us have anything to worry about.
Just be prepared to prove that you don’t have the key.
I can hardly believe this is a serious debate. What part of “papers and effects” is unclear to the courts? They can search my phone for heroin, I don’t care. But leave the FILES alone. If you want to know what’s in that cabinet, get a warrant.
Debates don’t get any more serious than this.
So what are the consequences for someone who claims, “I don’t know the password. I’d have to guess,” then provides enough wrong passwords to trigger the phone’s auto-wipe function?
See xkcd 538.
Holy crap. This is big stuff for the Supremes and I will be following it closely.
In my first two years practicing criminal defense in a small town, I got disgusted with the way cops treated cell phones. They’d not only seize the phones of alleged dealers, they’d go through said dealer’s address book and start arranging controlled buys for everyone in the address book–sending texts like “2 hydros $30 meet @ sonic.” Those clueless enough to show up would get arrested, have their phones seized, and the crazy cycle repeated. This is still a common tactic of the local Drug Task Force, and continues to be silently approved by judges as a means of enforcing strict drug policies.
Thanks for bringing this to my attention, Scott.
While I’m glad this is helpful, I really didn’t bring it to “your” attention, and you might want to consider staying reasonably abreast of stuff like Supreme Court cases on your own because, well, they matter.
Ouch. Guess I kind of deserved that. I do try to stay ahead of developments in the law, and the Supremes activity included, but it gets really hard to read everything and still get work done. I get a kick out of what you do here, Scott, and love Simple Justice–it’s one of the places I check almost daily because you write with passion and provide information people need.
Just my way of saying “thanks,” I guess. If I offended, it was not intended.
Not offended at all, and appreciate the thanks. I have this unfortunate tendency to seize the opportunity to make a point, and it sometimes comes at the expense of sentimentality. So no need to thank me, just tip the waitress.
Over at Jonathan Turley’s blawg weekend contributor
Darren Smith is thinking perhaps a password will do even if the SCOTUS goes off the rails with smart phone data protection in the comment section of his post:
>Washington Supreme Court Rules Citizens Have Right To Privacy In Text Messaging<
I took a swing but perhaps some of you underpaid CDLs who have more expertise than I can summons, might be interested in informing his readers of the finer nuisances and stakes via forthcoming smart phone rulings and precedent by the Supremes.
Anyway, not much of a cross poster but I think this whole smart phone deal is worth as much attention and chatter as possible even if that will potential hurt sales of my dog feces cell phone SIM card protecting low tech carrying case.
His post about the Washington State decisions isn’t particularly relevant to the issues in Wurie and Riley. State’s are allowed to be more protective of constitutional rights than the feds, based upon their own Constitution. However, his assertion that police cannot open a sealed container without a warrant is mistaken. The Supreme held in Belton, way back in 1981, that police can break into locked containers for a search incident to arrest. The question now is whether the digital contents of a cellphone are the same as the physical contents of a locked container.
As for whether the 5th Amendment prevents the police from obtaining a password, or decrypting content, that’s a much more sophisticated question that hasn’t been completely decided, but the upshot (short version) is they can with some caveats, that they can’t use the “act of production” privilege against the defendant unless he’s already given it away under the foregone conclusion doctrine.
But the reality is the nobody uses a serious password on their cellphone or they would never be able to take a call, as they would have to input it every time they wanted to use their phone. People are too lazy and it’s too much of a burden. Thus, it’s a red herring argument.
Pingback: What? Me Wurie? | Simple Justice