A monthly newsletter focused on real-world issues and practical strategies for the professional involved in investigations, computer forensics, and incident readiness and response.

In This Issue:

	From the Investigator's Notebook: Recent Case Law's Potential Impact on Fourth Amendment Searches & Seizures of ESI
	News & Events

From the Investigator's Notebook: Recent Case Law's Potential Impact on Fourth Amendment Searches & Seizures of ESI

In August 2009, the United States Court of Appeals for the Ninth Circuit issued an opinion, United States v. Comprehensive Drug Testing, Inc.¹, that may greatly impact the protocols law enforcement agencies follow when searching and seizing electronically stored information (ESI). This case provides insight into the relatively young and amorphous field of the proper handling, collection and analysis of ESI, and it highlights the growing trend of investigations that are largely focused on digital evidence.

Case Background
In 2002, the Major League Baseball Players Association and Major League Baseball entered into an agreement for suspicion-less drug testing of every baseball player. In other words, players agreed to submit to drug testing regardless of whether probable cause existed to believe that illicit drugs were being used. That same year, the federal government launched an investigation into the Bay Area Lab Co-Operative (BALCO) regarding its alleged supply of steroids to professional baseball players. An independent business, Comprehensive Drug Testing, Inc. (CDT), oversaw the program and collected the players' samples. Quest Diagnostics, Inc. performed the testing and kept the specimens, while CDT maintained the list of players and results.

After discovering 10 players who tested positive, federal authorities made several legal moves. These included acquiring a grand jury subpoena from the Northern District of California for all "drug testing records and specimens," a search warrant in the Central District of California to search CDT's Long Beach facilities, and an additional warrant from the District of Nevada for the urine samples kept at Quest's Las Vegas facilities. Subsequently, the government served new subpoenas in the Northern District of California seeking production of the records it had already seized under the search warrants.

CDT and the players filed several motions in response to the government's actions, seeking return of the property the government seized pursuant to the warrants it received from the Central District of California and the District of Nevada. In the Northern District of California, the players and CDT moved to quash the round of subpoenas the government served for production of the records.

All three courts reprimanded the government's actions, stating the government was manipulative and made misrepresentations. The courts also determined that the government "demonstrated a callous disregard" for the players' rights and failed to comply with the procedure set forth in the warrant.

Ninth Circuit's Opinion
The government argued that it complied with the procedures outlined in the precedent cited by the court, United States v. Tamura, and that it was allowed to seize any data under the "plain view" exception of the Fourth Amendment. Labeling these arguments as "too clever by half," the Ninth Circuit determined that upholding this argument "would make a mockery of Tamura" because Tamura was designed to protect privacy of intertwined materials when segregating data that is subject to a warrant. The Ninth Circuit also believed that supporting those arguments would incentivize the government to seize more broadly rather than make efforts to narrow the amount of seized materials.

After considering the government's arguments, the Ninth Circuit held that the government should "forswear reliance on the plain view doctrine or any similar doctrine" regarding seizure of data requiring segregation. This waiver of reliance had to be consented to by the government, or the magistrate judge should either order an independent third party to conduct the segregation under the court's supervision or deny the warrant.

The Ninth Circuit also found the government's argument that the warrant failed to specify that only computer personnel could view the data as "an obvious case of deliberate overreaching...in an effort by the government to seize data without probable cause." The Ninth Circuit held that any future warrant applications must include a protocol that prevents agents from examining or retaining data other than what was specified in the warrant. To comply with this requirement, segregation needed to be conducted by specially trained computer personnel independent of those involved in the investigations.

Accepting the reality of over seizure when working with electronic data, the Ninth Circuit concluded its analysis by issuing five guidelines for magistrate judges to follow when considering warrants regarding examination of electronic data and media.

Best Practices
This ruling may have a significant impact on the way law enforcement agencies perform computer forensic collections and investigations. Some agencies may no longer allow investigating officers to "preview" search results as they did in the past, but instead provide investigators with data that is specific to the items named in the search warrant. The full impact will depend on the adoption in other federal circuits and courts—in addition to state courts—around the country.

Civil Impact
On the civil side, litigants have been encountering similar issues with increasing frequency, and rules and protections have been put in place to address these concerns. Perhaps the most similar analogy is a discovery request for data from a former employee's home computer. While this former employee will more likely be a party to the suit, rather than a third party such as CDT and Quest were in the previous case, privacy concerns of the individual with respect to personal financial files, family pictures, correspondence and other issues are the same.

Expert Engagement
By this decision, it appears the Ninth Circuit is attempting to enhance individual privacy protection in criminal cases by imposing some of the protections it already sees in civil cases and "walling off" information for those who are not supposed to see or possess it. However, smaller law enforcement agencies may be prejudiced by this decision because they may not be able to afford multiple people – those who act as "segregator" of the data and those who conduct the analysis.

To help alleviate these concerns, law enforcement agencies (in addition to other organizations in need of expert assistance) should look to a third-party expert who can perform these functions cost-effectively. Experts can assist with assessing computer systems, negotiating technical aspects of discovery, demonstrating burden and expense, recovering deleted information where required and developing collection, filtering and searching protocols. Experts can perform the task similar to that of the special master, segregating specific data listed as "named items" in a search warrant and preventing the involved investigator from previewing such items.

Conclusion
The government is considering its options for appeal. The long-term impact of this rule on the Fourth Amendment and the plain view exception is uncertain for the time being. Subsequent case law will certainly provide more texture and color to this opinion and the guidelines provided.

One thing is clear: law enforcement agencies need to arrive at a decision regarding whether they will handle cases internally or engage an outside expert to segregate the data. This decision should consider how well personnel can be "walled off" within the agency. Larger agencies with a dedicated computer forensic staff may not experience a problem in this area. Smaller agencies can form some type of mutual aid or other outside assistance to sister agencies to wall off the involved investigators. If an agency cannot "wall off" personnel, it is important to use tight organizational resources in the most cost-efficient manner by engaging an expert who has a solid reputation both in the industry and the courtroom. Such an approach will increase defensibility and help persuade the court that the protocol was followed appropriately should an issue arise.

Special thanks to Terry Willis, Consultant with Kroll Ontrack's Computer Forensics and ESI Consulting services group, for his contribution in writing this article. Prior to working for Kroll Ontrack, Mr. Willis was the Officer-in-Charge of LAPD's Computer Crimes Unit and has a proven track record of technical investigations and consultative expertise. He can be reached for questions or comments at twillis@krollontrack.com.

¹2009 WL 2605378 (C.A.9 (Cal.) Aug. 26, 2009).

Back To Top

News & Events

Lawyer 2 Lawyer Podcast, "The Fourth Amendment and E-Mail"
The Fourth Amendment of the Constitution gives us protection against unreasonable searches and seizures. But what about a search of your e-mail – is it afforded the same protection? Co-hosts and attorneys J. Craig Williams and Bob Ambrogi welcome Orin S. Kerr, Professor of Law at the George Washington University Law School, and Jason Paroff Esq., Director of Computer Forensics Operations with the ESI Consulting practice at Kroll Ontrack, to look at the recent opinion handed down by U.S. District Judge Mosman with respect to the Fourth Amendment and e-mail, along with an expert look at what can be retrieved and used in court when it comes to e-mail. To listen to this podcast, visit www.krollontrack.com/redir/11094thAmendPodcast-II.asp

Enhanced E-Discovery Certification Course Propels Litigation Teams to New Heights
Given the current economic conditions, corporate clients are being forced to cut back legal and IT budgets, while the threat of sanctions due to improper ESI handling continues to rise. Become an e-discovery expert to prevent your firm or corporation from becoming the next headline. Kroll Ontrack's 2009 E-Discovery Certification Course is ideal for legal and technical professionals of all levels, especially in-house counsel, law firm attorneys, litigation support professionals, paralegals, IT staff, and members of the judiciary. Upon completion of this program, you will be able to make informed decisions regarding ESI, be prepared to negotiate at the meet and confer and understand the most current e-discovery law. For more information and to register for the December 3-4 course, visit www.krollontrack.com/certification-courses/.

Download Kroll Ontrack's Recent Podcast, "Electronic Search and Seizure, Fourth Amendment & Inadvertent Production"
In this edition of the ESI Report, host Gina Jytyla, Managing Staff Attorney in the Legal Technologies division at Kroll Ontrack, welcomes Joe DeMarco, Partner with DeVore & DeMarco LLP, and Jason Paroff, Senior Director of Computer Forensics Operations at Kroll Ontrack, to discuss a recent case from the Ninth Circuit Court of Appeals, United States v. Comprehensive Drug Testing, Inc. Mr. DeMarco and Mr. Paroff will take an in-depth look into the court's analysis, including the potential impact on law enforcement agencies that conduct investigations in which digital evidence is at issue. In the Bits & Bytes Legal Analysis segment, Kroll Ontrack Legal Correspondent Kelly Kubacki will look at the discovery order issued in United States v. Sensient Colors, Inc. To listen to the podcast, visit www.krollontrack.com/redir/1009ESISearchPodcast-II.asp.

Keep Up to Date with Kroll Ontrack Social Media
Become a fan of the Kroll Ontrack Facebook page: www.krollontrack.com/redir/FBpromo-II.asp.
Follow Kroll Ontrack on Twitter: www.krollontrack.com/redir/TWpromo-II.asp.
Visit Kroll Ontrack on LinkedIn: www.krollontrack.com/redir/LIpromo-II.asp.

Meet our representatives at the following events:

Visit www.krollontrack.com/upcoming-events/ for more information on these events and others.

Back To Top

We Request Your Input

This newsletter was written by Kelly Kubacki, Kroll Ontrack Law Clerk, with assistance from Regina Jytyla, Kroll Ontrack Managing Staff Attorney. Ms. Kubacki can be contacted by writing to kkubacki@krollontrack.com.

For more information about e-discovery and computer forensics services, contact Kroll Ontrack at 800 347 6105 or www.krollontrack.com.