The Supreme Court June 25 unanimously held in Riley v. California that police must generally obtain a warrant to search a cell phone seized from an arrestee, rejecting the argument that such searches fall within the search-incident-to-arrest exception to the warrant requirement. (1) More importantly, the Court’s opinion indicates a willingness to treat searches of digital devices differently from physical searches because of their potentially greater impact on privacy. Lower courts may extend the rationale of Riley to require a warrant in other circumstances where one has previously not been considered necessary. They may also rely on Riley as support for narrowing the scope of searches that are conducted pursuant to a warrant. The decision could thus have a significant effect on matters that are much more important to companies than searches incident to arrests. Companies that may be particularly affected are electronic communications providers (such as cell phone and e-mail service providers, search engines, and social media), banks, credit card companies, data mining companies, and other businesses and organizations that maintain files with a large variety of information about their customers or members. More broadly, the decision could affect any company or individual whose computers or electronic data are searched by law enforcement.
The Court’s decision involved two cases in which police seized and searched cell phones found on the person of an arrestee, without first obtaining a warrant. In both cases, the government sought to use evidence derived from the searches in criminal prosecutions, and the defendants moved to suppress.
The Supreme Court, in an opinion by Chief Justice John G. Roberts Jr., held that the evidence in both cases should have been suppressed because the warrantless searches violated the Fourth Amendment. The search incident-to-arrest doctrine is based on the need to allow police to search an arrestee for a weapon that he might use to resist arrest or escape and for evidence that he might conceal or destroy. It is also founded on the proposition that an arrestee has a diminished expectation of privacy once he is in police custody. Police are therefore generally permitted to search, without a warrant, an arrestee’s person and the area within his immediate control, including some physical containers. But these rationales, the Court in Riley found, do not apply to cell phones.
First, the data stored on a phone cannot be used as a weapon. While the data could indirectly protect officers by, for example, alerting them to confederates coming to the scene of the arrest, the government had not offered evidence showing that warrantless searches are really needed to address such potential threats by third parties. And if such threats do occur, the Court reasoned, they can be addressed through other case specific exceptions to the warrant requirement, such as the one for exigent circumstances.
Second, a warrantless search of a phone is not generally necessary to prevent the destruction of evidence. The government had conceded that, once police seize a phone, the arrestee cannot delete data from it. But the government had argued that the data might be vulnerable to being remotely wiped or encrypted, and thus effectively lost to law enforcement. Here, too, the Court found that there was ‘‘little reason to believe either problem is prevalent.’’ Moreover, it said, law enforcement can address the wiping threat by turning the phone off or removing its battery. And it can avoid someone’s encrypting the data by placing the phone in a ‘‘Faraday bag’’—a bag made of aluminum foil that can isolate the phone from radio waves.
Third, in the most important part of the decision, the Court determined that even if an arrestee has diminished privacy interests, ‘‘[m]odern cell phones, as a category, implicate privacy concerns far beyond those implicated by the search’’ of physical containers. As Roberts put it, the government’s contention that the search of cell phones is indistinguishable from searches of a physical container ‘‘is like saying a ride on horseback is materially indistinguishable from a flight to the moon. Both are ways of getting from point A to point B, but little else justifies lumping them together.’’ The Court noted that cell phones are not just telephones, but are in fact ‘‘minicomputers’’ that can be used as ‘‘cameras, video players, rolodexes, calendars, tape recorders, libraries, diaries, albums, televisions, maps, or newspapers.’’ Moreover, phones have ‘‘immense storage capacity,’’ meaning that the scope of a cell phone search can far exceed the scope of any search of a physical container on a person’s body or in his or her immediate vicinity. And even just one category of information stored on a phone can reveal a great deal of private information about a person’s life over a long period of time, whether the category comprises photographs, records of previous calls, Web-browsing history, or historic location data. In addition, a search of a cell phone might allow the police to search data not stored on the device itself, but somewhere in ‘‘the cloud.’’
The Court also emphasized the ‘‘pervasiveness’’ of cell phone use, noting that 90 percent of American adults own a cell phone, and many of them: ‘‘keep on their person a digital record of nearly every aspect of their lives—from the mundane to the intimate . . . . Allowing the police to scrutinize such records on a routine basis is quite different from allowing them to search a personal item or two in the occasional case.’’
Finally, the Court found that some of the data found on cell phones is ‘‘qualitatively different’’ from physical records. Such data include ‘‘Internet search and browsing history,’’ which can ‘‘reveal an individual’s private interests or concerns’’; ‘‘[h]istoric location information,’’ which can reconstruct someone’s specific movements down to the minute’’; and applications that might reveal a person’s particular interests, affiliations, medical issues, and other sensitive data.
The Court’s extended discussion of the special privacy interests implicated by searches of digital data, and its recognition that existing Fourth Amendment doctrines do not neatly apply to such searches, could have important consequences in other areas that are much more important to companies than searches incident to arrests. For instance, the Department of Justice has long argued that it is permitted, under the Electronic Communications Privacy Act, (2)to obtain the content of e-mails that have been opened or have been stored for more than 180 days using only a subpoena or a so-called ‘‘2703(d)’’ order (named after the relevant section of ECPA), which requires less than probable cause. (3) But in the last few years, courts have begun to reject this position, holding that the Fourth Amendment requires the government to obtain a warrant to get this sort of information.(4) After Riley, more courts may reach this same conclusion and require the government to obtain a warrant.
Courts have similarly divided over whether police need a warrant to obtain customer location data from a cell phone service provider. (5) This issue has grown in importance since the Supreme Court’s decision in United States v. Jones , which held that law enforcement needs a warrant to place a GPS tracking device on a suspect’s car.(6) That decision increased the incentive for law enforcement to track suspects using an alternative method—obtaining location data from a suspect’s cell phone provider. In some courts’ view, the government does not need a warrant to obtain such data because the data have been voluntarily disclosed by the customer to a third party—the cell service provider. Here, too, courts may now be more willing to hold that the government needs a warrant to obtain such data, at least in some circumstances. Relying on Riley, they might note that such location data allows the police to track a person’s movements over an extended period of time, including into private spaces, and thereby reveal a great deal of information about the person’s activities, interests, and associations. The same reasoning could extend to other areas, such as government demands for records of a person’s Internet search history, Web browsing, or financial transactions.
Courts have also reached widely differing conclusions about how law enforcement may go about its searches of digital data stored on computers and other digital devices, or of communications stored by e-mail or social media providers, even when they have a warrant. Some courts have allowed police to seize and search all the files on a hard drive, or all the communications in an e-mail or social media account, in order to look for evidence of the crime under investigation. (7) Other courts have insisted that the government establish protocols to limit the scope of its search and the length of its retention of unrelated data. (8) Limits might include having the data searched by a neutral third party or a ‘‘clean team’’ of agents other than those responsible for the investigation, with only relevant data passed on to investigators; forswearing reliance on the ‘‘plain view’’ doctrine to justify searching and seizing evidence of a crime other than the one under investigation; and destroying or returning to the suspect any unrelated data.(9) Again, the Supreme Court’s strong defense of digital privacy in Riley may make some lower courts more willing to impose limits on how the government goes about obtaining digital evidence. This could greatly affect how the government conducts its searches of companies’ networks and individuals’ Internet communications and hard drives from now on.
The Supreme Court’s decision in Riley does not by any means resolve these other issues. It is, of course, limited to the narrow issue of a search incident to an arrest. But a significant part of the Court’s rationale strongly suggests that the Court may be more receptive to privacy arguments when it comes to investigations involving digital evidence. The decision also sends a message to lower courts: Searches of computers and digital data are both quantitatively and qualitatively different from other types of searches, and the same rules don’t necessarily apply. Lower courts may therefore be more willing than ever to place restrictions on government demands to search and seize customer information or corporate computers data.