The Fourth Amendment’s warrant requirement is a key protection against invasive government searches, but getting a warrant doesn’t solve every problem that can arise, particularly with searches for digital data. When the government has a warrant to search for specific files on a computer, courts may permit it to copy more than just those files in order to conduct a thorough search. Even so, the Fourth Amendment does not allow the government to hold on to this extra data for several years, which is exactly what it did in United States v. Ganias, a case decided by the Second Circuit Court of Appeals last week.
In an analog world of paper-filled filing cabinets, this would be clearly unconstitutional. Unfortunately, despite issuing a lengthy opinion, the appeals court failed to set out a rule that retaining irrelevant data when it is stored on a hard drive is also unconstitutional. And that’s a real problem: in the infamous words of the NSA, the government routinely “collects it all,” so the Ganias decision could set a de facto norm that allows overcollection and retention of data.
Ganias began with an investigation by the Army into suspicious billing practices by one of its contractors. In 2003, the Army’s Criminal Investigation Division (CID) got a search warrant seeking digital records from the contractor’s outside accountant, Stavros Ganias. Rather than searching for the records on-site, the warrant gave CID permission to mirror three of Ganias’ computers, copying everything on the hard drives in order to later search for information relevant to the investigation. However, the mirrored drives also contained records outside the scope of the warrant and investigation into Ganias’ clients, including his personal financial records.
In 2006, IRS investigators who had been working with CID began to separately suspect Ganias himself of tax evasion, so they obtained a second search warrant allowing them to review the files seized three years earlier—even though Ganias wasn't under suspicion in 2003. Ganias was convicted on the basis of evidence turned up pursuant to this second warrant, but he argued that this evidence should have been excluded. On appeal, a three-judge panel of the Second Circuit overturned the conviction, holding that when the government retained evidence outside of the scope of the first warrant, it violated Ganias’ Fourth Amendment rights. But the appeals court agreed to reconsider the case en banc, in front of all thirteen active judges.
EFF filed an amicus brief along with a number of other civil liberties organizations arguing that the government’s lengthy retention of data non-responsive to the 2003 warrant violated Ganias’ Fourth Amendment rights. But in its ruling last week, the Second Circuit failed to address the Fourth Amendment issue head on. Instead, the court ruled in favor of the government, stating that the IRS investigators relied in good faith on the magistrate judge’s issuance of the 2006 warrant.
The Second Circuit’s opinion flies in the face of the purpose behind the Fourth Amendment: to protect citizens against “general warrants.” In the colonial era, general warrants gave British soldiers the right to search any house they chose, and the drafters of the Bill of Rights specifically intended to make such searches unconstitutional. As a result, the Fourth Amendment requires that valid warrants specify particular persons and places to be searched and seized. Here, the 2003 warrant gave investigators permission to search for specific types of files on Ganias’ computers. But in order to be able to conduct an in-depth forensic analysis and minimize the disruption to Ganias, the government “overseized” by mirroring entire drives. While that might have been convenient as a technical matter to isolate data covered by the initial warrant, our brief argued that the government shouldn’t “profit” by retaining the extra data indefinitely. But the government held on to the mirrors for several years, even though the 2003 warrant didn’t give them permission to do so. That meant that when suspicion fell on Ganias, the government already had an exact copy of his data from 2003, instead of having to go back to Ganias to search the computers as they existed in 2006.
Had Ganias' files been stored on paper, this would have been a simple case. As the Ninth Circuit explained in United States v. Tamura, police may do a cursory examination of files in a filing cabinet to determine which are included in a warrant, but they can only seize items outside that warrant for off-site review in very limited circumstances. And even then, non-responsive items must be promptly returned.
In considering these issues in Ganias, however, the Second Circuit’s new decision misses the forest for the trees. The opinion contains the promising recognition that
The seizure of a computer hard drive, and its subsequent retention by the government, can give the government possession of a vast trove of personal information about the person to whom the drive belongs, much of which may be entirely irrelevant to the criminal investigation that led to the seizure.
But instead of reaching a conclusion about what the Fourth Amendment requires with regard to deleting overseized data, the court determined that these issues were too difficult and that it need not decide them. That’s because under existing precedent, evidence is not excluded from a case when the government acts in “good faith” reliance on a warrant. According to the Second Circuit, the IRS acted in good faith when it obtained the second warrant in 2006, so any constitutional problem with the multi-year retention of Ganias’ data was swept under the rug.
This is an especially frustrating outcome because it provides no guidance for how these sort of computer searches and seizures should be conducted in the future. The court’s discussion of Ganias’ failure to seek the return of his data before 2006 could set a dangerous norm of allowing broad searches, putting the burden on users to sue the government if they object. As we’ve seen in a number of contexts, the government engages in a “collect it all” approach to digital data, copying large swaths of innocent users’ communications, cell phone location information and more, all in an attempt to sniff out actual targets. By failing to require the deletion of overcollected data, the Ganias court may provide a perverse incentive to retain when the government has no good reason to do so.
