Digital forensics - Search Warrants and Subpoenas
Teddyks
Chapter031.pptx
Chapter 3
Search Warrants and Subpoenas
1
Why a Warrant?
Founding fathers wanted to avoid the general warrant
A warrant forces law enforcement to define what they are looking for and where they will look
Usually must be executed during normal business hours
Warrant or Subpoena
A warrant authorizes law enforcement to perform a search and seize evidence
A subpoena orders an individual to appear in a certain place at a particular time with a collection of defined articles of evidence
Requirements for a Warrant
Probable cause established by an affidavit from the requesting official
Must fulfill “particularity requirements”
What is being sought
Where it is expected to be found
Who is the target of the search
No-Knock Warrants
Default warrant is “knock and announce”
Must knock and announce intention to search
Must allow residents time to respond
Some cases may require “no knock” warrant
May break down the door and enter unannounced
Can only be issued when it is likely the suspect will flee or destroy evidence
After Hours Warrants
Default warrant must be executed during “normal business hours”
Same conditions for issuing a no knock warrant apply to after hours warrants
Sneak and Peek Warrants
Default warrant requires that subjects of a search must be notified
Sneak and peek warrants allow the executor to perform the search
Subject must be notified within 90 days
Reasons for a Sneak and Peek
Endangering the life or physical safety of an individual
Flight from prosecution
Destruction of or tampering with evidence
Intimidation of potential witnesses
Otherwise seriously jeopardizing an investigation or unduly delaying a trial
Plain View Doctrine
An officer executing a legally issued arrest or search warrant may seize unrelated evidence if found in plain sight
A computer example is a sample of child pornography found while searching a computer for a drug bust
When searching a computer use a defined search protocol
The Warrantless Search
A search with permission of the subject
Probable cause
A search incident to arrest
Special needs search
Searching with Permission
Person has “actual authority” to give permission
Owner or renter of a property
Person has “apparent authority” to give permission
Person has the genuine appearance of authority
Search with Probable Cause
A law enforcement officer's personal observations
Reliable hearsay
Behavior fitting a criminal profile
Unprovoked flight
Search Incident to Arrest
Allows for the search of the suspect for:
Weapons
Incriminating evidence
Allows a search of:
Vehicle
Person
Immediate area accessible to arrestee
Special Needs Search
Applicable to employees in the public sector
Allows the search of the employee’s computer at any time
Search must be work-related and not for the purpose of collecting criminal evidence
Details of a Subpoena
Orders a person to appear bearing documents (or other evidence)
States time and place to appear
Defines what objects to bring
A subpoena may be quashed if:
Insufficient time to respond, or not relevant
Requires disclosure of privileged information
Places an undue burden on recipient
Information is available from other sources
