Computer searches and the problem of withdrawn consent

Last week, a district court in Atlanta handed down a fascinating decision on whether agents can search a copy of a seized computer after consent to search the computer was withdrawn. The opinion, United States v. Sharp, 2015 WL 4641537, (N.D.Ga. August 5, 2015) (Batten, D.J.), rules for the government that agents have that power. My tentative view is that the decision is probably wrong, and I thought I would explain the case and why I'm not persuaded by the court's decision.

First, some background. Computer searches usually happen in two stages. Agents take the computer, make a mirror image copy of its hard drive on a government storage device, and then search the image. Officers do this to ensure the integrity of the original data. Searching can alter the contents on the computer, so working from a copy preserves the original.

This two-step procedure raises an interesting puzzle for consent doctrine. What happens if a target consents to a computer search, the agents quickly make a copy, and then the target revokes consent before the image is searched? Everyone agrees that the officer can't search the target's own computer after consent was withdrawn. But can the officer search the copy? Is the copy now the government's to search regardless of the suspect's revocation, or should the revocation of consent cover both the original and the copy?

Despite the importance of the question, no case has directly answered it. There is one decision that addresses revoked consent, United States v. Megahed, 2009 WL 722481 (M.D.Fla. 2009), which I blogged about when it was handed down. But the officers in Megahed had already begun to search the image when consent was withdrawn, and the court's quite conclusory holding that the search was permitted may have rested on that. No court has addressed the more basic fact pattern in which the suspect withdraws consent before the image is searched.

Until this past week, at least. In the new case, United States v. Sharp, agents were investigating Sharp's involvement in an Android App piracy ring. On August 21st, the FBI visited Sharp and Sharp signed two different consent forms. One form allowed agents to search Sharp's Gmail, Facebook, and Dropbox accounts, and the other allowed agents to take away and search his laptop and two disks. Sharp later had second thoughts, and he withdrew his consent—first to the online accounts, and later to the laptop and disks.

The district court concluded that Sharp did not withdraw his consent until after agents had made copies of his data. For example, the agents had imaged Sharp's hard drive starting on the afternoon of September 10th, and the image was complete by the morning of September 11th. Sharp's lawyer called to withdraw Sharp's consent to search the computer just a few hours later.

Was it too late? Yes, Judge Batten concludes:

Both parties agree that Sharp revoked his consent to search his laptop and email accounts after it was given, but Sharp objects to the [Magistrate Judge's] conclusion that a search of the imaged copy of his laptop can be made after he revoked his consent. However, Sharp cites no authority suggesting that a later revocation prohibits the continued review of an item of evidence that was obtained pursuant to a valid consent. Rather, it is well established in the Eleventh Circuit that a "valid consent to a search … carries with it the ri[g]ht to examine and [ ]copy." United States v. Ponder, 444 F.2d 816, 818 (5th Cir.1971)8; see also United States v. Ward, 576 F.2d 243, 244-45 (9th Cir.1978) ("Because the records were given to the IRS on March 26, 1975, and the demand for return was not made until March 31, 1975, we agree with the district court that any evidence gathered or copies made from the records during the intervening five days should not be suppressed.").

The Court takes notice that this case involves an image of a computer hard drive rather than copies of paper documents. Though there is little authority available on this issue, United States v.. Megahed, No. 8:07-CV-342-T23MAP, 2009 WL 722481 (M.D.Fla. March 18, 2009), provides some insight. There, agents captured a mirror image of the defendant's desktop computer with the defendant's consent, and searched the imaged copy after the defendant revoked his consent. The court found that the defendant did not "retain[ ] a reasonable expectation of privacy of the mirror image copy that the FBI had already obtained" and that the defendant's revocation would not operate retroactively to invalidate the agents' right to copy the hard drive. Id. The court in Megahed found no difference between a copy of a paper document and an imaged copy of a computer hard drive.

Sharp contends that Megahed "got it wrong" because evidence obtained from computers requires analysis, and is therefore somewhat "unknowable." [74], p. 9. Thus, Sharp insists that the Government is not entitled to search an imaged copy of his computer after revocation of consent because they have no idea what is on the computer without additional analysis. Though the Court recognizes that the prior knowledge of the contents of a paper document versus an imaged hard drive may vary, Sharp cites no authority that suggests that the copies of each should be viewed differently for purposes of a later search. Therefore, the Court agrees with the magistrate judge that the reasoning in Megahed should control.

My views on this are tentative, but I'm inclined to disagree. As I see it, the Fourth Amendment implications of making a paper copy and making a computer image are very different. When the government makes a paper copy of a document, a government agent handles the document. The document is exposed to human observation. The traditional Fourth Amendment analysis would be that the original document was therefore searched. Having been searched, the Fourth Amendment privacy rights in the paper document have been eliminated. See, e.g., Illinois v. Andreas, 463 U.S. 765 (1983). The government is therefore free to examine the paper copy it has made.

The Fourth Amendment treatment of computer images should be different, I think. When agents make an image, they don't see the data on the original device. For the most part, they just enter commands that move a body of unseen data from one physical box to another. As I argued in this article and this article, imaging the computer should be understood as a seizure of the contents of the original computer but is not yet a search of those contents. The image retains all the Fourth Amendment protection as the original. As a result, the same Fourth Amendment rules should apply to searching the image that applied to searching the original.

If I'm right about these differences, then I'm not sure how making the image can change anything. The files are still there unsearched. The image is just an extra copy of the unsearched files that was created to help prove chain of custody. Why should the imaging, sans searching, make the consent to search irrevocable? And if I'm right that creating the image was a seizure, and that holding on to the image is a continuing seizure, by what authority can agents continue to seize the suspect's files—needed to then search them—after consent was withdrawn?

It's a tricky issue, I think. But at least when no search of the image was begun until after consent was revoked, my tentative sense is that the withdrawal of consent should revoke the right to search both the original and the copy.