Withdrawal of Consent to Search Computers Also Blocks Searches of Digital Copies, Court Holds

An important decision from the Maryland Supreme Court.

In Fourth Amendment law, the authority to grant consent to search allows you withdraw that consent, too, at least before the search occurs.  But consider this wrinkle.  When the government searches a computer, the forensic process  has two distinct steps.  First, the government makes a perfect copy of the data (known as an "image") and saves in on a government storage device.  Second, the government searches the image rather than the original.

So how does withdrawal of consent work now? There are two key questions.

First, if a computer owner grants consent to search, an image is made, and then consent is withdrawn, does the withdrawal of consent extend to the image?  That is, does the owner's control include control of the copy on the government's machine?  Or does the government necessarily control the image?

Second, if an owner retains rights in the image, is there a different result if the owner signed a consent form stating that, once the government made the copy, the owner relinquished rights in the copy?  That is, can rights retained in the image that might generally exist with a general consent be relinquished if there is specific and explicit disavowal of rights as to the image?

There have been a few district court rulings that touched very briefly on the first of these questions. Long-time readers may remember I blogged about two of those cases; you can read my 2009 post from our volokh.com days here and my 2015 post from the Washington Post era here.

All of this is a wind-up to say that, last week, the Maryland Supreme Court ruled on both questions in considerable detail in an important new case, State v. McDonnell.  McDonnell is the first case to address both of the issues, and it did so in detail.  Given the detail of McDonnell's reasoning, and how sparse the caselaw has been,  I think McDonnell is worth a close look.

The basic facts are simple. McDonnell signed and initialed a consent form that said the following:

I have been informed of my right to refuse to consent to such a search. I hereby authorize the undersigned Special Agent, another Special Agent or other person designated by USACIDC, to conduct at any time a complete search of: . . . all digital media including cell[ ]phones, thum[b ]drive[s], hard disk drives, laptops & any other media relevant to this investigation.

I understand that any contraband or evidence found on these devices may be used against me in a court of law.

I relinquish any constitutional right to privacy in these electronic devices and any information stored on them. I authorize USACIDC to make and keep a copy of any information stored on these devices.

I understand that any copy made by USACIDC will become the property of USACIDC and that I will have no privacy or possessory interest in the copy.

I give this written permission voluntarily. I have not been threatened, placed under duress, or promised anything in exchange for my consent. I have read this form or it has been read to me and I understand it. . . .

I understand that I may withdraw my consent at any time.

Based on McDonnell's consent, investigators seized McDonnell's devices and imaged his computer a few days later.   And a few days after that, McDonnell's lawyers sent a message to the government withdrawing consent.  Relying on the language in the consent form, agents then searched the image anyway.  McDonnell later moved to suppress the evidence found on the image, arguing that it was the fruit of an unlawful search and seizure because he had previously withdrawn his consent.

In the new case, the Maryland Supreme Court unanimously agreed with McDonnell.  First, McDonnell's withdrawal of consent blocked the government's ability to rely on consent to search the image as well as the original.  And second, the potentially contrary language in the consent form did not alter that holding.

Here's the court's reasoning as to the first holding, that a person generally retains rights to withdraw consent as to images, at least until the images are searched:

After careful examination of relevant authority, we hold that Mr. McDonnell had a reasonable expectation of privacy in the digital data stored on his laptop, and, as such, in the data stored on USACIDC's copy of his laptop's hard drive. Mr. McDonnell's reasonable expectation of privacy was not eliminated by the making of a copy of his hard drive because the data was not searched or exposed prior to his revocation of consent. Central to this holding is our conclusion that Mr. McDonnell's privacy interest is in the data on his hard drive, not just the particular computer or apparatus on which the data is stored (his original or USACIDC's copy). To accept the State's stance—i.e., that Mr. McDonnell irrevocably lost all privacy interest in the data on his hard drive when he allowed USACIDC to copy it—would be to permit a limitless search through vast quantities and a varied array of personal data that the Supreme Court of the United States has characterized as consisting of more information than would be found in an exhaustive search of a person's home. See Riley, 573 U.S. at 396, 134 S.Ct. 2473. Absent a warrant supported by probable cause or an exception to the warrant requirement, the Fourth Amendment does not permit such an unfettered governmental intrusion of a person's "private sphere[.]" Carpenter, 138 S. Ct. at 2213, 2221 (citation omitted).

Like the Supreme Court of Illinois, we focus on the data as the significant factor here, not the fact that USACIDC lawfully made a replica of Mr. McDonnell's hard drive. See McCavitt, 185 N.E.3d at 1206. We agree that Mr. McDonnell has a privacy interest in the data itself. "The evidentiary value of data resides in the data itself, not in the medium on which it is stored." Id. This conclusion flows logically from our explanation in Richardson that the defendant's abandonment of his cell phone made its seizure lawful, but did not permit the government, without a particularized warrant, to search the data stored on it. See Richardson, 481 Md. at 435-36, 282 A.3d at 105. So, too, here: Mr. McDonnell's consent made the creation and retention of the copy of his hard drive lawful, but after withdrawal of his consent, USACIDC needed additional authority to search the data on the copy. For the duration of Mr. McDonnell's consent, USACIDC had the authority to examine the data; once the consent was withdrawn, the authority to examine went with it. Likewise, Riley, 573 U.S. at 386, 134 S.Ct. 2473, dictates that law enforcement's justification for a search of the data stored on an electronic device must be assessed independently from the justification for seizure of the device. Therefore, copying the same data to a different device that law enforcement officers have legal authority to possess makes no difference in the Fourth Amendment analysis.FN12

[FN12: The logistics of digital storage also support this conclusion because data saved on a computer is automatically copied multiple times in the course of using a computer. See Kerr, Searches and Seizures, supra, 119 Harv. L. Rev. at 562. In addition, digital information is often deliberately or automatically copied to remote servers to be stored "in the cloud." Riley, 573 U.S. at 397 ("Cell phone users often may not know whether particular information is stored on the device or in the cloud, and it generally makes little difference." (Citation omitted)). Yet, the owners of such data, regardless of where it is copied and stored, have a reasonable expectation of privacy in the information.]

Because making a copy of a hard drive is usually the first step in performing a forensic analysis, if making a copy itself divested a person of a reasonable expectation of privacy in the data, people would lose all expectation of privacy in the entirety of the data on any device the moment the government made a copy of the device's hard drive. That would permit precisely the kind of unlimited rummaging through a person's private domain that the Fourth Amendment was designed to prohibit. See Riley, 573 U.S. at 386, 134 S.Ct. 2473. The legitimate subjective and objective reasonable expectation of privacy that people have in their electronically stored data should not be so easily defeated. Focusing on the data in question rather than on the possession of an apparatus containing a copy of the data "recognizes that the key to fourth-amendment reasonableness is the access to data, regardless of whether the data is copied, transferred, or otherwise manipulated." McCavitt, 185 N.E.3d at 1206 (citing Kerr, Searches and Seizures, supra, 119 Harv. L. Rev. at 564).

Obviously, in this case, if any data had been revealed prior to the revocation of Mr. McDonnell's consent, that data would have lost any reasonable expectation of privacy that was previously attached to it. That is because, as to that data, Mr. McDonnell's privacy interest would have been eliminated. And lawfully so, because USACIDC had the authority, while Mr. McDonnell's consent was in effect, to search and examine his data. In such a scenario, the cat could not be put back into the bag.

As to data that was not exposed before the withdrawal of consent, however, Mr. McDonnell retained an expectation of privacy. By way of analogy, if Mr. McDonnell had stood on a street corner and offered passersby the opportunity to read his diary, but no one took him up on it, his reasonable expectation of privacy would not be lost. The threat of an invasion of privacy is not an invasion at all. See Karo, 468 U.S. at 712, 104 S.Ct. 3296. In this way, the creation of the copy was akin to the placement of the tracking device in Karo, id., because with the making of the copy, USACIDC created only the "potential for an invasion of privacy" rather than an actual invasion of the subjective and objective expectation of privacy in Mr. McDonnell's data. It would be objectively reasonable to believe that data could be exposed to law enforcement through an owner's consent to copy a laptop's hard drive and could lose its private nature if examined—but, absent an enforceable waiver to the contrary, if law enforcement had not already become privy to the data, upon withdrawal of consent to access the data, the data remains private, i.e., the owner retains a reasonable expectation of privacy in the data by withdrawal of consent.

I agree with all of this (as I blogged back in 2015), and I greatly appreciate the Court's reliance on my work.  So far, so good, at least from my perspective.

But that brings us to what I think is the harder issue: What about the language in the consent form?  The government has every incentive to include in consent forms that they have exclusive control over copies they make. It's easy for government lawyers to draft that language, and it's unlikely to discourage a computer owner from consenting.  So does that language control?  Or are there general principles of consent law that direct the answer, about which a consent form cannot alter the general principle?

The Maryland Supreme Court concluded that this particular consent form was not clear enough on the issue to direct a different result.  And in a footnote,  Footnote 14, it left open whether clearer and more obvious language could resolve  differently or whether the language was irrelevant.  From the opinion:

The terms of the consent form guide our assessment of the reasonableness of the search. Per the terms of the consent form, Mr. McDonnell authorized a Special Agent or other person designated by USACIDC to conduct a complete search of all "digital media including cell[ ]phones, thum[b ]drive[s], hard disk drives, laptops & any other media relevant to this investigation." (Capitalization omitted). According to the language of the form, among other things, Mr. McDonnell relinquished his constitutional right to privacy in his electronic devices and all of the information stored on them, and "authorize[d] USACIDC to make and keep a copy of any information stored on [his] devices." The form stated that Mr. McDonnell understood that any copy made by USACIDC would be the property of USACIDC and that he would have no privacy or possessory interest in the copy. Critically, a sentence at the bottom of the form stated without qualification: "I understand that I may withdraw my consent at any time."

Using the reasonableness approach discussed by the Supreme Court of the United States in Riley and Carpenter, and used by this Court in Varriale for that matter, we conclude that it was not reasonable for USACIDC to examine the data on the copy of Mr. McDonnell's hard drive after he withdrew his consent and that the examination was a search. It would have been objectively reasonable for Mr. McDonnell, or anyone else, to believe that the final sentence of the form advising of the ability to withdraw consent at any time applied to all of the language in the form, i.e., that the withdrawal of consent applied to all of the matters agreed or consented to earlier in the form. See Riley, 573 U.S. at 386, 134 S.Ct. 2473 (determining that it would be unreasonable to apply the search incident to arrest exception to permit a warrantless search of a cell phone because the rationale for the exception's application to physical objects did not extend to the digital contents of a cell phone); Carpenter, 138 S. Ct. at 2217-20 (determining that it would be unreasonable to apply the third-party doctrine to permit a warrantless search of 127 days' worth of cell site location records because society does not expect law enforcement to secretly track an individual's every movement without a warrant); Varriale, 444 Md. at 418-19, 119 A.3d at 835 (determining that it was reasonable for the State to retain and compare a defendant's DNA sample to samples from cold cases under the totality of the circumstances of the consent to the taking of the sample). In this case, it would not be reasonable, under the totality of the circumstances, to interpret the consent form to mean that the withdrawal of consent applied only to certain language on the form and not to the entire document.

The State focuses on language on the form stating "I understand that any copy made by USACIDC will become the property of USACIDC and that I will have no privacy or possessory interest in the copy." The State refers to this language as a disclaimer and argues that the language could not be rendered ineffective by Mr. McDonnell's withdrawal of consent. We disagree. No language in the form states or even suggests that the acknowledgement of having no privacy or possessory interest in any copy made by USACIDC is irrevocable and not subject to withdrawal of consent at any time as provided by the language at the bottom of the consent form. The language setting forth the alleged disclaimer is contained in the fifth paragraph of the seven-paragraph form and is in no way distinguished from the other language of the form. It is included in the same paragraph in which Mr. McDonnell relinquished his right to privacy in his laptop itself, and, as the State agrees, the withdrawal of consent precluded further examination of the laptop. The paragraph is stylistically identical to every other paragraph in the document. In no way does the purported disclaimer stand out. Neither its express terms nor its appearance would suggest to a reasonable person that the last sentence of the fifth paragraph of a seven-paragraph document should be treated differently than the other language of the form with respect to the withdrawal of consent, as the State contends.

The language in the consent form did not convey that Mr. McDonnell relinquished for all time a privacy and possessory interest in the data on his laptop. Instead, the language sought to establish that Mr. McDonnell had no privacy or possessory interest in the copy of his data made by USACIDC based on the copy being property of USACIDC. But that cannot be. The copying of the data, without the data being examined, did not vitiate Mr. McDonnell's privacy interest in the data itself. As explained, a person has an independent privacy interest in the data on a laptop or hard drive, no matter where the data may be stored. See McCavitt, 185 N.E.3d at 1206. Due to the personal content and far-reaching consequences of allowing access to such data, the data on a laptop, like the digital information on a cell phone, warrants its own discrete privacy interest. See Riley, 573 U.S. at 386, 134 S.Ct. 2473; Richardson, 481 Md. at 434, 452, 282 A.3d at 104, 115. Under the terms of the consent form, Mr. McDonnell never agreed to permanently relinquish a privacy interest in his data, and, as discussed above, the consent form, on its face, provided an unqualified right to withdraw consent at any time. This necessarily included the right to withdraw consent to a search of the data.FN14

[FN14: On brief and at oral argument, counsel for Mr. McDonnell asserted that even if the disclaimer had been written to accomplish what the State claimed it did, Mr. McDonnell retained a constitutional right to withdraw consent. This contention has significant rational force, as a person has a constitutional right to not consent in the first instance, and, as Mr. McDonnell points out, at least one court in another jurisdiction has so held. See United States v. McWeeney, 454 F.3d 1030, 1035 (9th Cir. 2006) (concluding defendants "had a constitutional right to modify or withdraw their general consent at any[ ]time"). Nothing in this opinion should be construed to mean that clauses in consent forms purporting to irrevocably waive the right to consent are enforceable. However, because the language in the consent form did not purport to irrevocably waive Mr. McDonnell's privacy or possessory interest in his data, we need not address the issue to resolve this case. See Robinson v. State, 404 Md. 208, 217, 946 A.2d 456, 461 (2008) ("[I]t is this Court's established policy to decide a constitutional issue only when necessary." (Citations omitted)).]

The State argues that Mr. "McDonnell's reading would treat the disclaimer as meaningless[,]" but the State's treatment of the consent form's language regarding the copy would render a different portion of the document meaningless: Mr. McDonnell's right to withdraw consent "at any time." Mr. McDonnell's agreement that USACIDC could search his hard drive at any time was limited by his right to withdraw consent at any time. Based on the language of the consent form, it would not be reasonable to believe that, by consenting to the government's searching the laptop and making of a copy of its hard drive, a person could not withdraw consent before the search occurred and prevent the government from examining anything that had not yet been searched.

When Mr. McDonnell revoked his consent to the search of the laptop, he retained a reasonable expectation of privacy in any data that had not been exposed. Because USACIDC did not search or examine any of his data prior to the withdrawal of consent, Mr. McDonnell continued to retain a privacy interest in the entirety of his data on his laptop's hard drive and the copy thereof. Lacking Mr. McDonnell's consent, USACIDC needed another justification for the examination of the data on the copy of the hard drive, such as a warrant. But because USACIDC did not obtain a warrant or have any other justification for the search, the search of the data on the copy of the hard drive was unlawful and the evidence obtained as a result of the search should have been suppressed.

Government action in consent searches is restrained in two ways: by limits placed on the scope of consent, see Varriale, 444 Md. at 412, 119 A.3d at 831, and withdrawal of the consent, see Williams, 898 F.3d at 330. Here, Mr. McDonnell provided his consent for USACIDC to seize, search, and copy his hard drive, limited by the scope of the investigation. Anything uncovered in the course of that consent would have been lawfully in USACIDC's possession. But once he withdrew his consent, a right he always had and which the consent form that he signed confirmed, USACIDC's authority to search ended. USACIDC could keep the copy, as Mr. McDonnell had consented to its creation; he could not un-ring that bell.

However, because USACIDC had not examined the data on the copy of the hard drive in any way while Mr. McDonnell's consent was in effect, it could not claim the right to search his data under the authority of his consent after his consent was withdrawn. This case involves the undifferentiated copying of the entirety of a hard drive before the examination of any data on it, which distinguishes it from those in which recipients consensually share with government actors emails or text messages, or law enforcement gains access through other means to items with readily visible content. See United States v. Barber, 184 F. Supp. 3d 1013, 1016 (D. Kan. 2016); State v. Carle, 266 Or.App. 102, 337 P.3d 904, 910 (2014).  [FN16: For similar reasons, the State's argument that different iterations of data can have different reasonable expectations of privacy does not hold up when no data was examined or revealed before or during the copying of the laptop's hard drive, unlike the viewing of a physical copy of a digital photo. Because different facts could support the loss of a reasonable expectation of privacy in data on a hard drive, there may, of course, be other circumstances under which a forensic copy of a hard drive may not maintain the same Fourth Amendment protections as an original.] In this case, the copying process exposed none of the data on the laptop's hard drive and the process did not differentiate between data that might have implicated child pornography and data that did not. Prior to his withdrawal of consent, USACIDC had not yet intruded upon Mr. McDonnell's privacy interest in the data on the copy of the hard drive; that bell was never rung, and upon the withdrawal of his consent, Mr. McDonnell retained a reasonable expectation of privacy in the data.

McDonnell concludes by explaining that, even if this meant that there was one rule for paper copies and another rule for digital copies, that was okay under Riley and Carpenter:

[E]ven if, for argument's sake, we were to apply the reasoning of cases like Ponder and its progeny, and the information in a thousand-page paper document was not entirely examined by the government prior to or in the course of photocopying the pages, such a copy would not begin to approximate a copy of a hard drive, which allows "[t]he sum of an individual's private life [to] be reconstructed[.]" Riley, 573 U.S. at 394, 134 S.Ct. 2473. A copy of a paper document does not give access to the "many distinct types of information" found in a copy of a hard drive, which can reveal much more than any isolated record. Id.

A copy of a hard drive, the search of which "would typically expose to the government far more than the most exhaustive search of a house[,]" has as much in common with a photocopy of paper documents as "a flight to the moon" has in common with "a ride on horseback[.]" Riley, 573 U.S. at 393, 396, 134 S.Ct. 2473 (emphasis in original). [FN19: FN19: As such, we decline to adopt the reasoning of courts in other jurisdictions that a forensic copy of a hard drive is akin to a photocopy of a paper document that, if made while consent was effective, can still be examined after consent is withdrawn. See, e.g., Lutcza, 76 M.J. at 702; Campbell, 76 M.J. at 658; Megahed, 2009 WL 722481, at *3; Thomas, 2014 U.S. Dist. LEXIS 33443, at *20.]

With respect to digital information or data on a hard drive, and perhaps even photocopies for that matter, withdrawal of consent after copying but before analysis is like interruption of a consented-to search of a home by withdrawal of consent—police would have to promptly leave the home and seek a warrant, or other authorization, in order to further search.  The copying of Mr. McDonnell's hard drive was a precursor to a search, or perhaps a step in preparation, but it was not the search. An inexact comparison could be made to police securing a house, with the owner's consent, as precursor to a consent search. If the person were to withdraw consent after the securing but before the search, the search of the house would not occur and the owner would have lost a reasonable expectation of privacy only to the extent of what the officers may have observed before the consent was withdrawn. The advancement of technology that allows the digital equivalent of making a copy of a person's home and all its contents, see Riley, 573 U.S. at 396, 134 S.Ct. 2473, should not permit invasion of a privacy interest that otherwise would be prohibited, see Kyllo, 533 U.S. at 34, 121 S.Ct. 2038.

Fascinating!  Let me reprint Footnote 14, which leaves open whether clear language could dictate a different result:

On brief and at oral argument, counsel for Mr. McDonnell asserted that even if the disclaimer had been written to accomplish what the State claimed it did, Mr. McDonnell retained a constitutional right to withdraw consent. This contention has significant rational force, as a person has a constitutional right to not consent in the first instance, and, as Mr. McDonnell points out, at least one court in another jurisdiction has so held. See United States v. McWeeney, 454 F.3d 1030, 1035 (9th Cir. 2006) (concluding defendants "had a constitutional right to modify or withdraw their general consent at any[ ]time"). Nothing in this opinion should be construed to mean that clauses in consent forms purporting to irrevocably waive the right to consent are enforceable. However, because the language in the consent form did not purport to irrevocably waive Mr. McDonnell's privacy or possessory interest in his data, we need not address the issue to resolve this case. See Robinson v. State, 404 Md. 208, 217, 946 A.2d 456, 461 (2008) ("[I]t is this Court's established policy to decide a constitutional issue only when necessary." (Citations omitted)).

That will have to be litigated another day, but it nicely sets up the next case for when the government uses super-clear language as to rights on the image.  As always, stay tuned.