What Extractly Am I Consenting To? the Effects of Data Extraction on Consent
| Jurisdiction | United States,Federal |
| Author | By Jessica Bove |
| Publication year | 2021 |
| Citation | Vol. 21 No. 1 |
By Jessica Bove*
With the monumental decision in Riley v. California1, courts and legal scholars have questioned the implications of Riley on cell phone searches, particularly because cell phones house large amounts of data. Since Riley, Fourth Amendment law has evolved to recognize a distinction between searches of physical property and searches of data. However, courts still rely on outdated consent laws when determining whether a suspect's consent to search their cell phone was lawfully given. These laws have only become more outdated with the use of data extraction devices to retrieve cell phone data stored on the cloud. In a case of first impression, the United States District Court for the Southern District of Texas questioned if the scope of consent includes data stored on the cloud and not physically on a suspect's cell phone.2 This paper argues that the Court should update consent law to match the evolution of Fourth Amendment searches. Currently, the standard is that a suspect's consent must be "knowing and voluntary," but the Court should apply a heightened standard for consent to search cell phones.3 Instead the "knowing and intelligent" standard, used for waiver of Miranda rights, should be applied.4
Much of the scholarship in this area ignore consent and focus on other areas of warrantless searches. In A Right To Go Dark (?), David Gray explores whether companies or individuals have the right to go dark, meaning do they have the right to use encryption methods that make data inaccessible to the government.5 Currently, private information can still be accessed by law enforcement through lawful means like search warrants.6 Allowing citizens to "go dark" would allow them to prevent searches that were otherwise reasonable.7 The only way this information could be accessed is through the suspect's consent.8 Gray found that the Fourth Amendment did not provide citizens the right to go dark because the Fourth Amendment only protects against unreasonable searches and seizures, not lawful searches and seizures.9
David Harris responded to Riley10 by advocating for courts to abandon the third-party search doctrine. Harris argues that in the digital era, all aspects of communication require conveying data to a third party.11 Cloud based data "by its very nature" is conveyed to third parties.12 Harris notes, "the data does not reside on the phone itself, but on another larger computer somewhere else that the user does not own."13 This effectively makes almost all data subject to the third-party search doctrine.14
Harris notes that the third-party doctrine seems to be in contention with Riley.15 In Riley, the court said that cell phones' ability to use cloud-based data created a heightened privacy interest.16 However, the third-party search doctrine cuts back on this privacy interest by allowing for expansive searches that have a "far reaching consequences on digital privacy."17 Harris believes that getting rid of the third-party search doctrine would open Congress to conversations about privacy and potentially develop legislation to protect our digital rights.18
Orin Kerr has written extensively in the area of data privacy. In a 2005 article, Kerr argued that government made copies19 of a suspect's device should have the same search and seizure standards as the original device.20 In an excerpt from a forthcoming book, Kerr argues that computers and the Internet should trigger new Fourth Amendment rules for the digital age.21 The digital and physical worlds are inherently different, so the Fourth Amendment should provide different applications in both scenarios.22 Kerr notes that the Supreme Court has already begun creating a "digital Fourth Amendment" in Carpenter and Riley.23 In a co-authored book, Kerr and Bruce Schneier24 wrote that the use of data encryption has triggered a new step in the criminal process-the encryption workaround.25
The scholarship already written on Fourth Amendment law and how it intersects with cell phone searches does not touch on consent. Scholars address the rights individuals have in their digital privacy,26 how the emerging digital world changes existing doctrine,27 and generally what constitutes a search and limits on digital searches. Generally, scholars seem to be concerned with the effects of the digital world on existing doctrine and the rights people have against involuntary searches of their cellular data. Almost all of the articles operate in a space where individuals are not willing to voluntarily hand over their phones to law enforcement. This article addresses what the changing digital world means for consent law. This paper will be confined to situations where a suspect consents to their phone being searched and attempts to bridge the gap between consent law and Fourth Amendment cell phone searches.
This article will begin by defining data that is physically located on a phone for purposes of determining the scope of consent. It will then give a historical overview of the influential cases in digital searches and seizures and consent law. Then it will offer the solution that the Supreme Court should update consent law's "knowing and voluntary" standard to the "knowing and intelligent" standard utilized for Miranda waivers.
[Page 2]
Before this article begins its analysis, it is important to define data that is physically located on a phone. This is important because the crux of this article relies on distinguishing between data that is physically stored on a cell phone and data that would require the use of an extraction device to access.
There is a difference between "technical" definitions and "legal" definitions established by prior court precedent. Except for the section explaining Cellebrite technology, this article will mostly rely on the "legal" definitions of technology established by Supreme Court precedent.
The Riley Court provided multiple definitions for types of technology and insight into how the Court was thinking about technology's advancement. The Court defined a smart phone as "a cell phone with a broad range of other functions based on advanced computing capability, large storage capacity, and internet connectivity."28 Cloud computed was defined as "the ability of internet connected devices to display data stored on remote servers as opposed to the physical phone itself."29
The Riley Court noted that without the user knowing it, smartphones use "data located elsewhere."30 Cell phone users—and officers searching the user's phone—may not know whether the information was stored on the device or on the cloud.31 The cloud refers to software the runs on the Internet, as opposed to locally on the device.32 Cloud services can be accessed through web browsers like Internet Explorer, and some can be accessed through apps like Google Drive and Netflix.33
What does this mean for consent if a suspect doesn't know whether information is stored locally on their device or in the cloud? And what about apps like WhatsApp where data is stored on the cloud but can easily be accessed on a cell phone? This article is not arguing that cloud data is beyond the scope of consent. Rather the distinction should be made between data that can be accessed by physically flipping through a phone and data that could only be discovered by hooking the phone up to an extraction device. When this article refers to information that is "physically" stored on a phone, it is not referring to only locally stored data but rather data that can be accessed by an officer physically flipping through a suspect's cell phone.
For example, WhatsApp data can be backed up on the cloud,34 but WhatsApp conversations can also be viewed by opening the mobile app on a cell phone. Conversations that can be seen by opening the mobile app and flipping through its contents are inside the scope of consent. However, deleted conversations that aren't physically on the phone and can only be accessed through data extraction are not.
A. CELLEBRITE TECHNOLOGYThe Riley Court defined data and smart phones35, but an evolving area that the Court has yet to define is data extraction. Data extraction devices can "dump the entirety of [a] phone . . . all of [a device's] text messages, emails, videos, and photos-even the ones [that were] deleted . . . [a] phone's entire file system."36 The largest manufacturer of data extraction devices is Cellebrite and their devices are used by various levels of law enforcement.37 Cellebrite's website advertises that it can "extract and decode every ounce of data within digital devices."38
Cellebrite physically extracts the data through its Universal Forensic Extraction Device ("UFED").39 The data is collected by connecting the UFED device to a cell phone via a USB cable. The device allows law enforcement to "extract, preserve, and analyze public- and private- domain, social-media data, instant messaging, file storage, web pages and other cloud-based content.40 Once extracted, law enforcement can easily search and sort the data to identify wanted information, like a suspect's location.41
The Fourth Amendment provides:
The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.42
Consent law and search and seizure law have developed into two separate doctrinal lines. This article will examine both areas independently before discussing how they interact-or more accurately, fail to interact.
B. CELL PHONE SEARCHESThe first major case dealing with phone searches was Katz v. United States in 1967. Katz was convicted of transmitting wagering information by telephone.43 Law...
To continue reading
Request your trial