Obscured by clouds: the Fourth Amendment and searching cloud storage accounts through locally installed software.

• Author: Gold, Aaron J.

TABLE OF CONTENTS INTRODUCTION I. BACKGROUND A. A Reasonable Expectation of Privacy B. General Fourth Amendment Challenges with Computers II. CLOUD STORAGE AND A REASONABLE EXPECTATION OF PRIVACY A. Is There a Reasonable Expectation to Begin With? 1. Positive Model of Privacy and the Electronic Communications Privacy Act a. Electronic Communication Services b. Remote Computing Services 2. The Current Law's Future and Policy Judgments B. The Third-Party Doctrine and Cloud Storage III. CLOUD STORAGE AND LOCAL SOFTWARE A. Plain View B. Exigent Circumstances IV. A POSSIBLE SOLUTION CONCLUSION INTRODUCTION

Suppose the police suspect Winston of possessing child pornography on his computer. Acting on that suspicion, authorities secure a warrant to seize and search Winston's computer and all other digital storage mediums at his residence. However, when combing through the files stored on Winston's devices, the police find no trace of the illicit images.

To ensure that the search is thorough, law enforcement officers begin to open separate programs installed on the machine, searching for documents hidden within the applications. One program they open is Microsoft's OneDrive, (1) which provides a list of files that are stored in Winston's cloud storage account. The files, however, are not actually present on his computer's hard drive, or on any other storage medium he possesses. The police do this despite the fact that their warrant specifies only their right to search the contents of Winston's physical drive. Regardless, they can see the files available for download and they seize them anyway. Later, when checking the downloaded data, the police do not find any evidence of child pornography, but they do find documents incriminating Winston of another crime. As it turns out, Winston does not traffic child porn, but he was in fact committing bank fraud.

This seemingly small exploration might appear innocuous on its face, but it carries broad implications for search and seizure law in a digital environment. The warrant gave the police license to search files on Winston's computer and the storage media he owned, but in this instance they did not find incriminating data there. Instead, the police discovered evidence on a remote platform that Winston's computer could access, but the evidence was not stored on his actual computer.

The Fourth Amendment to the Constitution protects citizens against warrantless searches and seizures of their "homes, papers, and effects." (2) Nevertheless, this guarantee is not unconditional; the Supreme Court has recognized several exceptions. (3) Courts face the challenge of applying these standards as society and technology evolve beyond the immediate foresight of the Fourth Amendment's drafters. Winston's predicament highlights not only the general Fourth Amendment difficulties intrinsic to searching computers, but also the added complications of privacy and the Internet.

The aforementioned hypothetical dealt specifically with issues surrounding cloud computing. Cloud computing is a colloquial term for computer services provided remotely over the Internet, rather than by direct local access. (4) Cloud computing has both a private and a public form. A private cloud hosts services to a limited number of people, (5) whereas a public cloud is one offered through a third-party service to general consumers. (6) In particular, cloud storage is a term for storing data and files on remote drives. (7) A user essentially sends their files to another location where the files are redundantly preserved. (8)

Companies providing public cloud storage maintain user data on clusters of networked servers at off-site locations. (9) Users can upload data to cloud servers in various ways, including placing files in a folder that synchronizes with the storage service, (10) accessing the account directly from an Internet browser, or doing so through cloud-linked software installed on a computer. (11) Generally, cloud accounts permit users to access their data from any Internet-capable device that has a web browser or cloud-linked software. (12) Winston's computer hosted cloud-linked software. The files the police collected via that program were not on his hard drive, and the warrant only specified files that were actually on his machine. The question becomes whether the existence of software on the hard drive with direct access to outside files permits the police to broaden their search.

The backbone of Fourth Amendment jurisprudence developed prior to the advent of personal computers, and its modern application can be fraught with difficulty. Even applying these principles to storage mediums that police have actually seized proves troublesome, (13) particularly in the context of the plain view exception to the warrant requirement. (14) Those uncertainties only get murkier when physical computers and the Internet collide. Recently, courts have begun to address these issues in a modern digital context, (15) but scholarship on the subject is limited. (16)

The number of people storing data though cloud services is increasing. (17) Soon, if not already, Winston's plight will cease being hypothetical. There must be clarity as to whether law enforcement can use locally installed software to access data stored on cloud servers--but not on the local machine--because they can see and access the files when searching a suspect's computer. Winston could argue that he had a separate expectation of privacy, and that the police had no right to comb through his cloud storage. The police could then counter that such an expectation is not reasonable, and that the Fourth Amendment does not protect information stored on the Internet. Alternatively, authorities may argue that even if such a protection exists, they were justified in bypassing the warrant requirement because the files were in plain view of their lawful search, or because of the risk that Winston could destroy the data via remote access.

Others have discussed expectations of privacy in cloud storage in different contexts, and some have grappled with issues similar to those discussed in this Note. (18) This Note, however, will focus on the relationship between cloud storage and locally installed software on a home computer. It will argue that a proper reading of the Fourth Amendment and the surrounding circumstances vindicates Winston and constrains the police. Under the Fourth Amendment, the police do not have an automatic right to rifle through cloud storage via software installed on computers they search. Part I of this Note will discuss the general Fourth Amendment problems associated with searching physical hard drives that the police have under their control. Part II will argue that consumers have a reasonable expectation of privacy in data they keep in cloud storage. Part III will demonstrate why cloud data that is accessible through local software does not come under the umbrella of the plain view doctrine or the exigency exception to the warrant requirement. Finally, Part IV will offer a solution that courts may employ to properly preserve Fourth Amendment protections, as well as to enable the police to carry out their mission to enforce the law.

1. BACKGROUND

   The Fourth Amendment preserves the right of people to "be secure in their persons, houses, papers, and effects[] against unreasonable searches and seizures;" and warrants, supported by probable cause, must "particularly describ[e] the place to be searched, and the persons or things to be seized." (19) The Amendment's central concern is protecting individual liberty and providing security from government intrusion. (20)

   1. A Reasonable Expectation of Privacy

      The Fourth Amendment is not absolute. Its protections shield individuals only in a realm in which they can maintain a reasonable expectation of privacy. (21) With the 1967 watershed opinion Katz v. United States, the Court recognized for the first time that a reasonable expectation of privacy is critical to Fourth Amendment search and seizure analysis. (22) In that case, the police eavesdropped on Katz without a warrant as he made a phone call from a telephone booth. (23) The Court struck down his conviction, ruling that such action constituted a search under the Fourth Amendment, and therefore required judicial approval. (24)

      Rejecting a prior approach, which indicated that there needed to be some physical trespass to offend the Fourth Amendment, (25) the Court concluded that Katz justifiably relied on an expectation of privacy, and that warrantlessly violating that expectation breached his rights. (26) This is because the Fourth Amendment, as the Court decreed, protects people, and is not limited to particular places. (27)

      For an expectation of privacy to be reasonable, not only must the individual have a subjective expectation of privacy, but also society as a whole must objectively believe that such an expectation is sensible. (28) Moreover, to be reasonable, that objective expectation must be justifiable given the facts of the surrounding circumstances. (29)

      Part of the Court's implicit reasoning in Katz was that the "vital role that the public telephone has come to play in private communication" established the reasonable expectation of privacy in Katz's telephone conversation. (30) This indicates that what makes privacy expectations reasonable is far from a static determination. Rather, expectations shift as technology advances. (31) The Court has already addressed related matters, including issues involving aerial surveillance (32) and infrared scanning of homes. (33) Most recently, the Court recognized the role that cell phones have come to play in modern society and the associated privacy interests that citizens have in these devices. (34)

   2. General Fourth Amendment Challenges with Computers

      Courts now consistently recognize that people possess a reasonable expectation of privacy in their computers. (35) Thus, searching one without...