A new and important decision by the Vermont Supreme Court could go a long way to safeguard privacy by ensuring police computer searches remain narrow.  EFF together with the ACLU and ACLU of Vermont filed an amicus brief in the case, which empowered courts that issue warrants to include specific instructions on how the police can conduct a search so they remain narrow and "particular."

This case started as part of an identity theft investigation, where police in Burlington, Vermont applied for a search warrant to seize and search a number of computers, cell phones, and other electronic devices in a house. Noting the ease with which electronic data can travel between electronic devices -- as well as the fact that evidence could be stored anywhere on the computer -- investigators submitted an extraordinarily overbroad search warrant application, including requests to search other electronic devices found in the house even if its owners wasn't suspected of committing a crime.  They also asked for the ability to search the entire contents of all the computers and devices they seized.

But the Fourth Amendment requires searches to be "reasonable." That obviously means the police need a search warrant to search a place. It also means that their search must be limited or "particular" so that the search only intrudes into a private space where the thing the police want is most likely to be found. But how does that work in the digital age, where computers and other electronic devices store vasts amount of our private and sensitive information in any number of places?

The judge, grappling with the Fourth Amendment implications, issued the search warrant but imposed limits on how the government could execute the search. The court relied heavily on the Ninth Circuit Court of Appeals 2010 decision in United States v. Comprehensive Drug Testing, Inc. (PDF), which provided law enforcement with suggested guidelines designed to protect privacy during computer searches. Unhappy with these limitations, the government filed a petition for extraordinary relief in the Vermont Supreme Court, asking that the original, broad warrant officers requested be granted.

In last Friday's decision, the Vermont Supreme Court understood the privacy implications at issue, and ruled that the Fourth Amendment allows a judge to include instructions in a search warrant to ensure an electronic search remains narrow and particular. The importance of this decision should not be underestimated. While other forms of electronic evidence have been subject to particularity requirements by statute -- like the Wiretap Act's requirement that law enforcement minimize the interception of irrelevant conversations -- there has been little judicial discussion of ensuring computer searches are "particular." Even the guidelines in Comprehensive Drug Testing were only suggestions, and not binding. And while the Vermont Supreme Court's decision does not require judges to impose restrictions, the fact it even authorizes judges to do so is important in and of itself.

The court approved of three different limitations judges can place on the government as part of a computer search that have important ramifications for other forms of electronic seizures:

• Searches can be performed by 3rd parties or police personnel segregated from the main investigators who segregate irrelevant information prior to disclosure
• Judges can order investigators use focused search techniques while precluding use of specialized search tools without prior judicial authorization
• Investigators are limited in the data they can copy; non-responsive data should be destroyed and devices returned

These specific restrictions are worth exploring in more detail.

Building a Wall: Privacy Survives Even In Someone Else's Hands

The court noted that the warrant prosecutors sought couldn't have been broader; they wanted "to search all files in all ways on all computers in the house.” The government claimed it needed this sweeping authority because computer files could be hidden anywhere on the computer, in any file format. Sensitive to the legitimate needs of law enforcement to find relevant evidence, the court agreed with the judge's compromise that allowed investigators do their job without eviscerating privacy: allow third parties to review the evidence on the computer first, segregating relevant data that would be turned over to investigators from irrelevant data, which would not. 

Even more importantly, the court rejected the government's argument that this segregation would eliminate privacy rights anyway because the information was turned over to someone else. Recognizing “that exposure to one person may harm one's privacy interests more than exposure to another person is a familiar feature of human experience,” the court noted that privacy is "deeply sensitive to the identification of the recipient of the information." And revealing information to the government -- the only entity with the power to prosecute and punish -- is the most harmful of all revelations. 

In essence, the court resisted the urge to treat privacy as an all or nothing commodity. This is important because the government has repeatedly pushed for the expansion of the "third party doctrine," or the idea established by the U.S. Supreme Court long ago that people lose their expectation of privacy when they turn information over to third parties. The government has used this doctrine to justify warrantless acquisition of cell site tracking records, Twitter account information, and email, arguing these records belong to the companies, so a user can't complain when the data is turned over to the government.

While the Vermont Supreme Court didn't address this doctrine directly, its recognition that “all exposures are not created equally” echoes the words of Justice Sotomayor's concurring opinion in United States v. Jones, where she wrote it was time to stop treating "secrecy as a prerequisite for privacy," and stop assuming "that all information voluntarily disclosed to some member of the public for a limited purpose is, for that reason alone, disentitled to Fourth Amendment protection."

In a world where more data is being stored on the cloud and social media companies know our every thought and association, greater judicial recognition of this idea will result in greater privacy protection.

Search Techniques: Don't Look For Shotguns in an Envelope

In the phyiscal world, court have long restricted how and where the government can search, giving the police only a portion of what they want to ensure a search doesn't become a "general warrant": boundless and limitless and ultimately unreasonable under the Fourth Amendment. If police ask for a search warrant to search a house for a shotgun used to commit a crime, a court absolutely has the ability to prohibit the officers from searching envelopes on a desk, or any other place or item where the thing they're looking for -- the shotgun -- will certainly not be found. 

When it comes to electronic evidence, however, particularity is more difficult. As the Vermont court explained, "in the digital universe, particular information is not accessed through corridors and drawers, but through commands and queries. As a result, in many cases, the only feasible way to specify a particular 'region' of the computer will be by specifying how to search." Restricting the way the government can search a computer is simply the digital analog to its search limitations in the physical world. And it makes sure that every electronic search doesn't turn into a general search just because data is highly mobile.

Copy Some, Delete All

As demonstrated by the government's broad seizure of data in the Megaupload case, prosecutors love seizing a wide ranging amount of electronic data, and then take their sweet time to sort out the relevant from the irrelevant. The rationale, again, is that the relevant evidence they're looking for can be anywhere, and so they need to search everywhere. While courts have authorized these broad seizures at least initially, a number of courts have been increasingly unhappy with the government's delay in sorting this information out and returning (and deleting) what it doesn't need.

The Vermont Supreme Court authorized judges to put safeguards in place before the search, ensuring that seizures aren't so broad, and that delays won't occur in the first place. 

Judges Control Searches, Not the Government

The court noted that warrant applications aren't submitted to judges on a "take it or leave it basis." But oftentimes it seems this is precisely what the government wants: wide ranging authorization into electronic evidence, with minimal oversight and little particularity. And when prosecutors don't get their way, their default is to argue that judges are little more than rubber stamps, permitted to do nothing more than approve or deny a government request. Thankfully the Vermont Supreme Court stood up to the government and told them they couldn't have whatever they wanted. Other courts are starting to be more vocal too about the government's efforts to intrude into the private lives of Americans.

We need more courts to think about the implications of their decisions and craft limits on electronic surveillance so they can fullfill their traditional role as a check against government overreach.