db cybercrime week3

ismails95

pdf2.pdf

Home >Law homework help >Criminal homework help >db cybercrime week3

THE COMMONWEALTH OF MASSACHUSETTS

OFFICE OF THE ATTORNEY GENERAL ONE ASHBURTON PLACE

BOSTON, MASSACHUSETTS 02108 (617)�727-2200

(617)�727-4765 TTY� www.mass.gov/ago

MASSACHUSETTS DIGITAL EVIDENCE

GUIDE

________________________

Office of the Attorney General, Maura Healey

Cyber Crime Division - Thomas Ralph, Division Chief ________________________

June 9, 2015

________________________

This Digital Evidence guide is meant only to be a guide and does not suggest modifying or replacing any

existing agency procedure. As a precaution, please consult appropriate State and local authorities before

implementing any information contained herein. Additionally, call our office to discuss any concerns.

http://www.mass.gov/ago

Massachusetts Digital Evidence Guide: Contents, The Search and Seizure of Digital Evidence

Massachusetts Digital Evidence Guide

Office of the Attorney General, Maura Healey

Cyber Crime Division - Thomas Ralph, Division Chief

Contents

Contents ........................................................................................................................................... 2

I. Investigation .............................................................................................................................. 6

A. The Search and Seizure of Digital Evidence ..................................................................... 6

1. Was there a search or seizure? .......................................................................................... 6

a) Searches and the Reasonable Expectation of Privacy ................................................... 7

(1) The Third-Party Doctrine ........................................................................................ 8

b) Seizures and Interference with Possessory Interest .................................................... 10

c) Private Party Searches ................................................................................................ 11

(1) Initial Search Made by Private Party ..................................................................... 11

(2) Warrantless Search: Private Citizen or State Actor ............................................... 11

(3) An ISP’s Reporting Obligation Does Not Make it a State Agent ......................... 12

2. Was a search or seizure reasonable? ............................................................................... 12

a) Warrants ...................................................................................................................... 12

(1) Probable Cause / Affidavit .................................................................................... 13

(2) Particularity / Scope .............................................................................................. 15

(3) Staleness of Information Supporting Probable Cause ........................................... 16

(4) Timely Execution of the Warrant .......................................................................... 17

(5) Manner of Executing the Warrant ......................................................................... 18

b) Exceptions to the Warrant Requirement ..................................................................... 19

Massachusetts Digital Evidence Guide: Contents, The Search and Seizure of Digital Evidence

(1) Search Incident to Arrest ....................................................................................... 19

(2) The Plain View Doctrine ....................................................................................... 20

(3) Exigent Circumstances .......................................................................................... 21

3. The Exclusionary Rule .................................................................................................... 22

a) Good Faith / Substantial and Prejudicial .................................................................... 22

b) Inevitable Discovery ................................................................................................... 22

B. Cases Relating to Specific Digital Devices ..................................................................... 23

1. Cell Phone Searches ........................................................................................................ 23

2. Cell Site Location Information ....................................................................................... 23

3. Search of Computer Files ................................................................................................ 24

4. Email ............................................................................................................................... 25

C. Search of Electronic Service Providers ........................................................................... 26

1. General Overview of Stored Communications Act......................................................... 26

2. Search warrants served on out-of-state Internet service providers ................................. 26

D. Encryption and Self Incrimination .................................................................................. 26

1. The Fifth Amendment and the Foregone Conclusion Doctrine ...................................... 26

2. Massachusetts Declaration of Rights Article Twelve ..................................................... 27

3. Encryption ....................................................................................................................... 27

4. Model Decryption Protocol ............................................................................................. 28

E. Searches Implicating Attorney-Client Privilege ............................................................. 29

1. Post-Indictment Email and File Searches ....................................................................... 30

2. Taint Teams .................................................................................................................... 30

3. Third Parties and Attorney-Client Privilege (e.g., CC’d emails) .................................... 31

II. Evidentiary Matters ............................................................................................................. 32

A. Judicial Discretion........................................................................................................... 32

1. Trial Judge’s Discretion .................................................................................................. 32

2. Demonstrative Photographs ............................................................................................ 32

B. Discovery ........................................................................................................................ 32

1. Pornographic Images in Child Pornography Cases ......................................................... 32

Massachusetts Digital Evidence Guide: Contents, The Search and Seizure of Digital Evidence

C. Authentication ................................................................................................................. 32

1. Generally ......................................................................................................................... 32

2. Photographs and Digital Images, Videos, and CDs ........................................................ 33

3. Digitally Enhanced Images and Video ............................................................................ 33

4. Transcripts of Recordings ............................................................................................... 33

5. Email ............................................................................................................................... 34

6. Chatrooms ....................................................................................................................... 35

7. Information Available on Websites and Social Networks .............................................. 35

8. Software Programs Used in Investigation ....................................................................... 36

9. GPS and Probation .......................................................................................................... 36

D. Best Evidence Rule ......................................................................................................... 36

1. Best Evidence Rule - Generally ...................................................................................... 36

2. Digital Images ................................................................................................................. 37

3. Admission of Duplicate Evidence ................................................................................... 37

4. Videos ............................................................................................................................. 37

5. Email ............................................................................................................................... 38

6. Summaries ....................................................................................................................... 38

E. Hearsay ........................................................................................................................... 38

1. Software Programs .......................................................................................................... 38

2. Social Networking Sites .................................................................................................. 38

F. Business Records Exception ........................................................................................... 39

1. Email ............................................................................................................................... 39

2. Computer Records........................................................................................................... 39

G. Confrontation Clause ...................................................................................................... 39

1. Secondary Examiners ...................................................................................................... 39

H. Encryption ....................................................................................................................... 40

III. Crimes ................................................................................................................................. 41

A. Possession of Child Pornography ................................................................................... 41

1. Multiple Convictions Require Multiple “Caches” .......................................................... 41

2. Brief Possession is Sufficient .......................................................................................... 41

3. Receipt by Cell Phone is Sufficient ................................................................................ 41

Massachusetts Digital Evidence Guide: Contents, The Search and Seizure of Digital Evidence

4. Malware and Computer Viruses Defense ....................................................................... 41

B. Statutory Terms of M.G.L. c. 272 (Knowing Purchase, Possession, or Dissemination) 42

1. “Dissemination” .............................................................................................................. 42

2. Computer “Depictions” ................................................................................................... 42

3. Child Enticement............................................................................................................. 42

4. “Visual Material” ............................................................................................................ 42

5. “Nudity” under M.G.L. c. 272 §31 ................................................................................. 43

6. “Performance” under M.G.L. c. 272 § 29A .................................................................... 43

7. “Knowingly Permit” under M.G.L. c. 272 § 29A ........................................................... 43

8. Lewdness ......................................................................................................................... 44

IV. Expert Testimony about Technology .................................................................................. 45

Massachusetts Digital Evidence Guide: Investigation, The Search and Seizure of Digital Evidence

I. Investigation

A. The Search and Seizure of Digital Evidence

As with physical evidence, searches and seizures of digital evidence must be reasonable to be

valid. This section provides a summary of Fourth Amendment law as it relates to the search and seizure of

digital evidence. It also references Article Fourteen of the Massachusetts Declaration of Rights, which

parallels the Fourth Amendment, but is sometimes more expansive.

The Fourth Amendment states:

The right of the people to be secure in their persons, houses, papers, and effects, against

unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon

probable cause, supported by Oath or affirmation, and particularly describing the place to be

searched, and the persons or things to be seized.

U.S. Const. amend. IV.

Article Fourteen (art. 14) of the Massachusetts Declaration of Rights is similar to the Fourth Amendment,

but since 1985, the Supreme Judicial Court has interpreted it as providing broader protections than its

federal counterpart. See Commonwealth v. Upton, 394 Mass. 363 (1985) (“We conclude that art. 14

provides more substantive protection to criminal defendants than does the Fourth Amendment in the

determination of probable cause.”). This guide will generally reference the Fourth Amendment. Where

applicable, however, it will note Article Fourteen’s higher standards.

To determine whether law enforcement action constitutes an unreasonable search or seizure, courts ask

two questions: First, was the action a search or seizure within the meaning of the Fourth Amendment?

See, e.g., Commonwealth v. Magri, 462 Mass. 360, 366 (2012) (“In deciding whether police conduct

violates the Fourth Amendment or art. 14 of the Massachusetts Declaration of Rights, we first determine

whether a search, in the constitutional sense, has taken place.”). Second, was that search or seizure

reasonable? See, e.g., Riley v. California, 134 S. Ct. 2473, 2482 (2014) (“[T]he ultimate touchstone of the

Fourth Amendment is reasonableness.” (internal quotation marks omitted)).

1. Was there a search or seizure?

“A search implicating the Fourth Amendment occurs ‘when an expectation of privacy that society is

prepared to consider reasonable is infringed’ and a seizure of property for purposes of the Fourth

Amendment occurs when ‘there is some meaningful interference with an individual’s possessory interests

in that property.’” Commonwealth v. Connolly, 454 Mass. 808, 819 (2009) (quoting United States v.

Karo, 468 U.S. 705, 712 (1984)) (finding installation of a GPS tracking device on a car to be a seizure

under Massachusetts art. 14 because it required entering and using the electricity of the defendant’s car).

Massachusetts Digital Evidence Guide: Investigation, The Search and Seizure of Digital Evidence

a) Searches and the Reasonable Expectation of Privacy

For a search to implicate the Fourth Amendment, the defendant must have a “reasonable

expectation of privacy” in the place to be searched. Katz v. United States, 389 U.S. 347, 360 (1967)

(Harlan, J., concurring); see also United States v. Heckencamp, 482 F.3d 1142, 1146 (9th Cir. 2007)

(finding a college student had a reasonable expectation of privacy in the contents of his personal computer

because it was located in his dorm room, was protected by a password, and was not subject to regular

university monitoring). A person’s expectation of privacy is reasonable “if he can demonstrate a

subjective expectation that his activities would be private, and he can show that his expectation was one

that society is prepared to recognize as reasonable.” Heckencamp, 482 F.3d at 1146 (citations omitted).

Individuals generally have a reasonable expectation of privacy in their personal computers and

files. See id. (listing cases to that effect). “The salient question is whether the defendant's objectively

reasonable expectation of privacy in his computer was eliminated” by some other circumstance. Id. The

cases below explore some of these circumstances. There is also a separate section for searches falling

under the third-party doctrine.

 Commonwealth v. Kaupp, 453 Mass. 102 (2009). Police observed pirated movies in the publicly

shared folder of defendant’s computers. Id. at 107. The publicly shared folder of a different

computer nearby contained both pirated movies and child pornography. Id. at 103–05. Police

seized the defendant’s computer and then received a search warrant for it based on an affidavit

alleging: 1) both shared folders had a copy of the same pirated movie, 2) the second computer’s

shared folder had child pornography, and 3) the defendant stated he could not guarantee there was

no child pornography on his computer. Id. at 105, 107–09. Defendant did not dispute that he had

no reasonable expectation of privacy in files shared with the network. Id. at 107. Instead,

defendant argued that he did have a reasonable expectation of privacy in his private files and that

there was not probable cause to search the private files for child pornography. Id. The Court held

that the affidavit in support of the search warrant did not establish probable cause to believe that

child pornography was located in the private files on defendant’s computer. The facts, even

considered together, did not provide a substantial basis to conclude that child pornography would

be found on the computer. Id. at 111.

 United States v. Borowy, 595 F.3d 1045 (9th Cir. 2010). Defendant shared child pornography

over a peer-to-peer file sharing network that was being monitored by police using special forensic

software. Id. at 1046–47. The Ninth Circuit held the defendant had no reasonable expectation of

privacy in files that anyone who had access to the network could download. See id. at 1048. The

court ruled this way notwithstanding the defendant’s attempts to keep the files private because

even though his subjective intent demonstrated a desire for privacy, it would be objectively

unreasonable to uphold an expectation of privacy “in the face of such widespread public access.”

Id. The court also rejected defendant’s argument that the special forensic software used by

investigators constituted a search. They cited several other cases supporting the proposition that

special tools could be used to access already-public information like the files in this case because

public information enjoys no Fourth Amendment protections. See id. at 1048.

Massachusetts Digital Evidence Guide: Investigation, The Search and Seizure of Digital Evidence

 United States v. King, 509 F.3d 1338 (11th Cir. 2007). Defendant had child pornography on a

hard drive shared across a military network. See id. at 1342. He took several steps—ultimately

unsuccessful—that he believed shielded this hard drive from access by others. See id. at 1341.

Even though the defendant manifested a subjective expectation of privacy by attempting to secure

the files, id., the court found that his failure to actually secure the files rendered that expectation

objectively unreasonable, id. at 1342. In reaching this conclusion, the court analogized to a prior

case holding that a defendant had no objectively reasonable expectation of privacy in the

unsecured common area of a multi-unit apartment building. Id. In both cases, the fact of public

access rendered any subjective expectation of privacy objectively unreasonable. Id.

 United States v. Ladeau, No. 09–40021–FDS, 2010 WL 1427523 (D. Mass. April 7, 2010).

Defendant shared child pornography over a secured peer-to-peer network that allowed him to

select who could download his files. See id. at *1. He allowed downloads by a private user who

then turned his account over to the Royal Canadian Mounted Police. See id. at *1. The court held

that even though he manifested a subjective expectation of privacy through his actions, this

expectation was not objectively reasonable because “a person has no legitimate expectation of

privacy in information he voluntarily turns over to third parties.” Id. at *4. “No matter how

strictly Ladeau controlled who accessed his computer files, he had no control over what those

people did with information about the files once he granted them access.” Id. So, “[o]nce Ladeau

turned over the information about how to access the network to a third party, his expectation of

privacy in the network became objectively unreasonable.” Id. at *5.

 United States v. Thomas, Nos. 5:12–cr–37, 5:12–cr–44, 5:12–cr–97, 2013 WL 6000484 (D. Vt.

Nov. 8, 2013). Defendants in this case shared child pornography over peer-to-peer networks. Id.

at *17. Police found defendants by using automated scanning tools designed to detect child

pornography shared on peer-to-peer networks. Id. After lengthy explanations of what these tools

do, see id. at *2–*6, the court held that the defendants had no reasonable expectation of privacy in

files they shared publicly on a peer-to-peer network, id. at *19–*20. In making this ruling, the

Court relied on Borowy, see discussion supra, along with other circuit cases to that effect, see

Thomas, 2013 WL 6000404, at *19. Defendants argued against the inclusion of partially-

downloaded files in the evidence used against them, saying they would not have shared those files

once the download was complete, but the court rejected this argument because those files were

nonetheless being shared when the police searched and were therefore publicly accessible. Id. at

*18. [Note: This case contains clear and thorough explanations of peer-to-peer networks, hash

values, and TLO’s CPS suite of tools.]

(1) The Third-Party Doctrine

In United States v. Miller, 425 U.S. 435 (1976), and Smith v. Maryland, 442 U.S. 735 (1979), the

Supreme Court articulated what has become known as the “third-party doctrine.” Under this doctrine, “the

Fourth Amendment does not prohibit the obtaining of information revealed [by a suspect] to a third party

and conveyed by him to Government authorities,” regardless of the suspect’s expectation of how the

information might be used. Miller, 425 U.S. at 443. Massachusetts has traditionally followed the Supreme

Massachusetts Digital Evidence Guide: Investigation, The Search and Seizure of Digital Evidence

Court’s guidance on the third-party-doctrine. See, e.g., Commonwealth v. Cote, 407 Mass. 827, 833–36

(1990) (holding that a defendant had no reasonable expectation of privacy in telephone message records

held by a third-party answering service for the reasons cited in Miller).

The third-party doctrine is increasingly controversial, however, as highlighted by Justice

Sotomayor’s concurrence in United States v. Jones, 132 S. Ct. 945, 954–55 (2012) (Sotomayor, J.,

concurring) (“[I]t may be necessary to reconsider the premise that an individual has no reasonable

expectation of privacy in information voluntarily disclosed to third parties . . . . This approach is ill suited

to the digital age . . . .” (citations omitted)). More importantly, the Supreme Judicial Court recently ruled

that—regardless of Fourth Amendment jurisprudence—art. 14 of the Massachusetts Declaration of Rights

protects some information held by third parties. See Commonwealth v. Augustine, 467 Mass. 230, 244–

55 (2014) (examined below). Though the third-party doctrine still applies to most information held by

third parties, the cases below highlight the growing list of exceptions.

 Commonwealth v. Augustine, 467 Mass. 230 (2014). Police investigating a murder obtained the

defendant’s Cellular Site Location Information (CSLI) from his service provider pursuant to a

§ 2703(d) order. Id. at 233. These orders are not warrants, so they cannot be used to effectuate a

search for information protected by the Fourth Amendment or art. 14. The CSLI obtained helped

police determine the defendant’s location over the period they were investigating. See Augustine,

467 Mass. at 233–34. The Court considered but ultimately rejected the Commonwealth’s

argument that the third-party doctrine negated any reasonable expectation of privacy the

defendant had in his CSLI. Id. at 241–56. It reasoned that art. 14 does not protect information

voluntarily and intentionally transmitted to third parties (like the number dialed to initiate a call)

but that the provision does protect information incidentally transmitted (like the location

information the cell phone provider acquires as a result of cell phone technology). Id. at 249–52.

The Court found that the defendant therefore had a reasonable expectation of privacy in his CSLI,

which, under art. 14, requires a warrant to overcome. Id. at 252–55.

 United States v. Warshak, 631 F.3d 266 (6th Cir. 2010). Law enforcement obtained thousands of

emails related to fraudulent marketing claims from the defendant’s Internet Service Provider

(ISP). The defendant challenged such access to his email on Fourth Amendment grounds. The

Sixth Circuit agreed and held that “a subscriber enjoys a reasonable expectation of privacy in the

contents of emails ‘that are stored with, or sent or received through, a commercial ISP.’” Id. at

288 (quoting Warshak v. United States, 490 F.3d 455, 473 (6th Cir. 2007)). In finding this

reasonable expectation of privacy, the Sixth Circuit analogized the contents of telephone

conversations and closed letters, each of which received Fourth Amendment protection. See id. at

286–87. Rebutting the third-party doctrine argument, the Sixth Circuit—similar to the SJC in

Augustine above—noted that the ISP in this case was an intermediary rather than the intended

target of a conversation. Id. at 288. Thus, “[t]he government may not compel a commercial ISP to

turn over the contents of a subscriber's emails without first obtaining a warrant based on probable

cause.” Id. Though binding only in the Sixth Circuit, this case has been cited by some of the

largest email providers in requiring warrants to obtain the contents of email. See Brendan Sasso,

Facebook, email providers say they require warrants for private data seizures, The Hill, Jan. 25,

2013, http://thehill.com/policy/technology/279441-facebook-email-providers-require-warrant-for-

Massachusetts Digital Evidence Guide: Investigation, The Search and Seizure of Digital Evidence

private-data. The Department of Justice also requires its prosecutors nationwide to follow this

holding.

b) Seizures and Interference with Possessory Interest

Police actions reaching an individual’s property constitute a seizure when “there is some

meaningful interference with an individual’s possessory interests in that property.” Commonwealth v.

Connolly, 454 Mass. 808, 819 (2009) (internal quotation marks omitted). As Justice Stevens noted, “a

seizure is usually preceded by a search, but when a container is involved the converse is often true . . . for

example, the seizure of a locked suitcase does not necessarily compromise the secrecy of its contents

. . . .” Texas v. Brown, 460 U.S. 730, 747–48 (1983) (Stevens, J., concurring). Relying on ample

precedent from other courts, the Supreme Judicial Court has found the entire computer analogous to such

closed containers for seizure purposes. See Commonwealth v. McDermott, 448 Mass. 750, 766 (2007)

(agreeing with lower-court “judge’s analogy to closed containers with respect to the seizure of the

computers and disks”). Whether a seizure has occurred is usually obvious and rarely contested. The

following cases concern less-common circumstances.

 Commonwealth v. Connolly, 454 Mass. 808 (2009). Investigating a suspected drug dealer, police

installed a GPS tracking device in his car. See id. at 809–10. To install the device, police opened

the car’s engine compartment, placed the tracking device inside, and attached it to the car’s

battery. See id. at 812. Police obtained a warrant for the tracker, though there was some question

as to whether the warrant had expired. The Supreme Judicial Court took the opportunity to hold

that installing the GPS device was a seizure within the context of art. 14 of the Massachusetts

Declaration of Rights. Id. at 822. First, the installation and presence of the tracker constituted a

physical intrusion on the defendant’s property. See id. Second, the government’s use of the

vehicle to obtain information was itself an interference with the defendant’s interest in it. See id.

at 823 (“It is a seizure not by virtue of the technology employed, but because the police use

private property (the vehicle) to obtain information for their own purposes.”).

 Berger v. State of New York, 388 U.S. 41 (1967). The Court held that wiretaps “seize”

conversations in violation of the Fourth Amendment. See Berger, 388 U.S. at 59. The Court did

not expand further on how it came to this conclusion, but this case is often cited for the

proposition that intangibles (e.g., data) can be seized in the constitutional sense. See, e.g.,

LeClair v. Hart, 800 F.2d 692, 695 (7th Cir. 1986) (“Following Berger, it has been clear that the

Fourth Amendment embraces more than just the forced physical removal of tangible objects . . . .

Berger stands for the proposition that the government may seize intangible items . . . .”).

 United States v. Hicks, 438 F. App’x 216 (4th Cir. 2011). Defendant destroyed his hard drive

after he found out he was under investigation for possession of child pornography. See id. at

217–18. After he was convicted of destroying records in a federal investigation, the defendant

attacked his conviction on constitutional grounds. See id. at 218. One of these challenges was

that by criminalizing his destruction of his hard drive, the government had interfered with his

possessory interest in that hard drive, effectively seizing it in violation of the Fourth

Amendment. See id. at 219. The Fourth Circuit found that there was no meaningful interference

Massachusetts Digital Evidence Guide: Investigation, The Search and Seizure of Digital Evidence

with the defendant’s possessory interest because he did not have a property right in images of

child pornography, which are contraband. Id.

c) Private Party Searches

(1) Initial Search Made by Private Party

“[W]hen the state conducts a search in response to information that a private party obtained and

communicated to the government, ‘the legality of the governmental search must be tested by the scope of

the antecedent private search.’” Commonwealth v. Cormier, 28 Mass. L. Rptr. 489, at *4 (Mass. Super.

Ct. 2011) (quoting United States v. Jacobsen, 466 U.S. 109, 116 (1984)). Where the government searches

something in which a private party has already eroded a suspect’s expectation of privacy, the Fourth

Amendment is not implicated. Id. (citing Jacobsen, 466 U.S. at 116). Crucially, police examination of

materials “initially discovered and viewed by a private party” can be more thorough than that private

party’s examination and still fall within the scope of the private party search. Id. at *5 (citing

Commonwealth v. Raboin, 24 Mass. L. Rptr. 278, 282–83 (Mass. Super. Ct. 2008)). The case below

demonstrates how this analysis works in a digital evidence case.

 Commonwealth v. Cormier, 28 Mass. L. Rptr. 489 (Mass. Super. Ct. 2011). The defendant in this

case brought a computer hard drive to a data recovery shop. Id. at *1. An employee at the shop

copied the files from the damaged hard drive and viewed several of them at random to determine

if they had been transferred successfully. Id. Some of the files he viewed contained child

pornography. Id. Police then inspected several files from the hard drive to confirm the presence of

child pornography before obtaining a search warrant for the drive and the defendant’s house. Id.

After finding more child pornography at the house, defendant was arrested and charged. Id. The

trial judge denied defendant’s motion to suppress because the warrantless search conducted by

police was within the scope of the preceding private party search. Id. at *4–*6. Because the

computer technician had previously viewed files from the hard drive, the court found that the

defendant’s expectation of privacy “had already been eroded,” so the subsequent police search

did not implicate the Fourth Amendment. Id. at *5.

(2) Warrantless Search: Private Citizen or State Actor

If the intent of a private party conducting a search is not independent of the government’s intent,

however, the private party becomes an agent of the government, implicating the Fourth Amendment and

art. 14. See Commonwealth v. Leone, 386 Mass. 329, 333 (1982). A party becomes a state actor if the

police do anything to “solicit, provoke, or tempt” that party into obtaining evidence for them.

Commonwealth v. Brandwein, 435 Mass. 623, 631 (2002). The cases below examine the state actor issue

in the digital evidence context.

 Commonwealth v. Cormier, 28 Mass. L. Rptr. 489 (Mass. Super. Ct. 2011). The defendant

brought a computer hard drive to a data recovery shop. Id. at *1. An employee at the shop copied

the files from the damaged hard drive and viewed several of them at random to determine if they

had been transferred successfully. Id. Some of the files he viewed contained child pornography.

Id. Police then inspected several files from the hard drive to confirm the presence of child

Massachusetts Digital Evidence Guide: Investigation, The Search and Seizure of Digital Evidence

pornography before obtaining a search warrant for the drive and the defendant’s house. Id. The

court found that the data recovery shop employee was not acting as a state agent because he was a

private party not acting under the authority of the state. Id. at *4 (citing Commonwealth v. Leone,

386 Mass. 329, 333 (1982) for the proposition that “[e]vidence discovered and seized by private

parties is admissible without regard to the methods used, unless State officials have instigated or

participated in the search”). The court noted that the employee “made the decision to open the

suspicious files . . . as a private citizen, while trying to repair the hard drive at [defendant’s]

request.” Id. The court also found that authorities “did not know that [the defendant] asked [the

employee] to repair his hard drive and did not instruct [the employee] to inspect the files.” Id.

They did nothing “to ‘solicit, provoke, or tempt’ [the employee] into viewing the files,” so he was

not a state actor. Id. (quoting Brandwein, 435 Mass. at 631).

 United States v. Lichtenberger, 19 F. Supp. 3d 753 (N.D. Ohio April 30, 2014). A private party

called police after discovering child pornography on a computer, and the responding officer

instructed that individual to boot up the laptop, enter the password, show the images, and gather

other devices belonging to the defendant for him before seeking a warrant. Id. at 754–55. The

court found these actions violated the Fourth Amendment because by giving instructions and

directing the private party’s actions, the police officer made that private party into a government

agent. Id. at 758–59. The court therefore suppressed the evidence as having been collected in

violation of the Fourth Amendment. Id. at 760.

(3) An ISP’s Reporting Obligation Does Not Make it a State

Agent

The reporting requirement of 18 U.S.C. §§ 2258A(a) and 2258B(a)—requiring an Internet service

provider (ISP) to report any child pornography that it discovers—does not transform an ISP into a

government agent when it chooses, voluntarily, to scan files sent on its network for child pornography.

United States v. Stevenson, 727 F.3d 826, 829–30 (8th Cir. 2013).

2. Was a search or seizure reasonable?

“The ordinary rule is that to be reasonable under the [Fourth] Amendment a search [or seizure]

must be authorized by warrant issued by a magistrate upon a showing of probable cause.” Almeida-

Sanchez v. United States, 413 U.S. 266, 287 (1973). This section will lay out the requirements of a valid

warrant in the cybercrime context and then highlight some applicable exceptions to the warrant

requirement.

a) Warrants

“The Fourth Amendment to the United States Constitution and art. 14 of the Massachusetts

Declaration of Rights require that a warrant be issued only on probable cause, supported by oath or

affirmation.” Commonwealth v. Nelson, 460 Mass. 564, 568 (2011). Massachusetts law specifically

“require[s] an affidavit and an oath.” Id. (citing Mass. Gen. Laws ch. 276, §§ 1and 2B). A neutral

magistrate must issue the warrant, see Coolidge v. New Hampshire, 403 U.S. 443, 453 (1971), and it must

be particular as to the items to be seized and places to be searched, see Commonwealth v. Valerio, 449

Massachusetts Digital Evidence Guide: Investigation, The Search and Seizure of Digital Evidence

Mass. 562, 566 (2007). Warrants must contain fresh information, see United States v. Morales-

Aldahondo, 524 F.3d 115, 119 (1st Cir. 2008), and officers must execute them in a timely fashion, see

Commonwealth v. Ericson, 85 Mass. App. Ct. 326, 329–30 (2014). Warrants must be executed in a

reasonable manner. Preventive Medicine Associates, Inc. v. Commonwealth, 465 Mass. 810, 821 (2013).

Finally, executing officers must have the signed warrant with them when commencing the search. The

sections below focus on probable cause, particularity, staleness, timely execution, and the manner of

executing warrants in the digital evidence context.

(1) Probable Cause / Affidavit

“Under the Fourth Amendment and art. 14, probable cause requires a substantial basis for

concluding that the items sought are related to the criminal activity under investigation, and that they

reasonably may be expected to be located in the place to be searched at the time the search warrant

issues.” Commonwealth v. Kaupp, 453 Mass. 102 (2009) (citations omitted) (detailed below). Further:

The affidavit need not convince the magistrate beyond a reasonable doubt, but must provide a

substantial basis for concluding that evidence connected to the crime will be found on the

specified premises. Moreover, affidavits for search warrants should be interpreted in a

commonsense and realistic fashion and read as a whole, not parsed, severed, and subjected to

hypercritical analysis. All reasonable inferences which may be drawn from the information in the

affidavit may also be considered as to whether probable cause has been established.

Commonwealth v. Donahue, 430 Mass. 710, 712 (2000) (citations omitted).

Probable cause is typically established by law enforcement submitting an affidavit to a

magistrate. That magistrate’s probable cause determination is confined to the “four corners” of the

affidavit. Commonwealth v. Anthony, 451 Mass. 59, 68 (2008) (detailed below). Probable cause by

definition deals with probabilities, which “are the factual and practical considerations of everyday life on

which reasonable and prudent men, not legal technicians, act.” Id. The following cases address probable

cause and affidavits in the digital evidence context.

 Commonwealth v. Kaupp, 453 Mass. 102 (2009). Police observed pirated movies in the publicly

shared folder of one of defendant’s computers. Id. at 107. The publicly shared folder of a

different computer nearby contained both pirated movies and child pornography. Id. at 103–05.

Police seized the first computer and then received a search warrant for it based on an affidavit

alleging: 1) both shared folders had a copy of the same pirated movie, 2) the second computer’s

shared folder had child pornography, and 3) the defendant stated he could not guarantee there was

no child pornography on his computer. Id. at 105, 107–09. The court invalidated the search

warrant because it found police did not provide a “substantial basis” to believe there would be

child pornography on the computer. Id. at 111. The court found it unreasonable to infer that

somebody interested in sharing a commercial movie would also be interested in sharing child

pornography. Id. at 112. That the defendant had access to child pornography did not help the

Commonwealth’s case. Id. Nor was a suspicious statement, standing alone, enough to provide the

substantial basis necessary for probable cause. Id. at 113.

Massachusetts Digital Evidence Guide: Investigation, The Search and Seizure of Digital Evidence

 Commonwealth v. Anthony, 451 Mass. 59 (2008). Police received a tip about a person soliciting

child pornography online. Id. at 60–62. They traced these solicitations to a library and arrested a

homeless suspect there. Id. at 63. Shortly after the arrest, the suspect took a receipt out of his

pocket and tore it up. Id. This receipt was from a repair shop for the repair of two laptops. Id.

Police also determined he rented a storage locker. Id. at 64. Police sought and received a search

warrant for the locker, the laptops, and a hard drive from the library. Id. at 65–66. A superior

court judge granted the defendant’s motion to suppress for lack of probable cause, however, and

the Commonwealth pursued an interlocutory appeal. Id. at 67–68. The SJC reversed the motion

judge’s suppression of the warrant, finding the affidavit established probable cause. Id. at 73.

Specifically, the Court found information about the suspect’s prior conviction for child

pornography, the outside tip, and the suspect’s admission to viewing child pornography in

violation of his probation established probable cause for the crime. Id. at 70–71. From there, it

found the fact that a homeless individual rented a storage locker using a false address—along

with the detective’s experience that viewers of child pornography tend to collect it—supported

the idea that the suspect might hide child pornography at his storage locker, the only space under

his control. Id. at 71–72. The Court found the suspect tearing up the receipt supported the

inference that he was trying to hide child pornography. Id. at 71. It emphasized that the affidavit

did not rely solely on the opinions of the affiant with respect to general characteristics of

collectors of child pornography. Id. at 72. Rather, the affidavit contained enough fact and

inference to support a nexus between the alleged crime and the locations to be searched. Id. 72–

73.

 Commonwealth v. Finglas, 81 Mass. App. Ct. 1102 (2011) (unpublished). Police were sent

information about the defendant, whose email address had received five images depicting child

pornography. Id. at *1. On interlocutory appeal, the Appeals Court granted the defendant’s

motion to suppress evidence obtained as a result of a search of his residence. Id. at *3. It did so

because that affidavit was “inadequate to establish a timely nexus between the defendant and the

location to be searched and to permit the determination that the particular items of criminal

activity sought reasonably could be expected to be found there.” Id. The appeals court held that

the affidavit did not provide any evidence that a computer at the residence had been used to

search for or download any child pornography or that the emailed images had actually been

accessed. Id. at *2. Further, a police officer’s opinion about the common practices of child

pornography collectors was not enough, without further facts, to support finding that the

defendant’s computer likely contained child pornography. Id.

 Mem. of Decision and Order on Def.’s Mot. for Franks Hr’g and Mots. to Suppress Evidence and

Statements at 12, Commonwealth v. Hall, No. MICR-2012-771 (Mass. Super. Ct. July 26, 2013).

When a computer connects to the internet through a residential IP address, there is a reasonable

probability that the computer or device in question will be located in that residence. The court

found the defendant’s argument about the possibility of wireless piracy meritless, stating that it

was still reasonable to infer that evidence of the transmission of child pornography would be

recovered from inside the defendant’s home. Id.

Massachusetts Digital Evidence Guide: Investigation, The Search and Seizure of Digital Evidence

(2) Particularity / Scope

The Fourth Amendment, art. 14, and G.L. c. 276, § 2 all require that search warrant applications

particularly describe the places to be searched and the items to be seized. See Commonwealth v. Valerio,

449 Mass. 562, 566 (2007). Massachusetts courts treat these provisions as coextensive. Id. The dual

purpose of these requirements is (1) to protect people from general searches and (2) to provide the

Commonwealth the opportunity to demonstrate to a court that officers’ search authorization was properly

limited. Id. Additionally, the requirement provides essential information to a person whose property is

being searched. Id. (citing Katz v. United States, 389 U.S. 347, 356 (1967)). The cases below explore the

tension between the particularity requirement and the amorphous nature of data in the digital era.

 Commonwealth v. McDermott, 448 Mass. 750 (2007). After a deadly mass shooting, police

officers searched the defendant’s apartment pursuant to a warrant for evidence linking him to the

shooting. Id. at 764–65. They seized five computers and disks. Id. The defendant asserted that this

was unlawful because the warrant did not specifically authorize the seizure of these items. The

warrant did authorize, however, seizure of several types of documents. Id. The Court held that the

seizure of the computers was reasonable because they functioned as “closed containers” storing

documents. Id. at 766. [Note: In Preventative Medicine Assocs. v. Commonwealth, 465 Mass.

810 (2013), the SJC clarified that in McDermott, the fact that the warrant was issued before an

indictment as part of an investigation and the Commonwealth’s use of preset search terms during

the preliminary review of the defendant’s files were important to its holding. Id. at 830–32. The

Court stated that it took “seriously the concern that a cursory review of every e-mail undermines

the particularity requirement of the Fourth Amendment and art. 14, particularly where—as the

Commonwealth appears to argue would be permissible and appropriate in this case—the cursory

review is joined with the plain view doctrine to enable the Commonwealth to use against the

defendants inculpatory evidence with respect to the pending indictments that it finds in the

emails, even though such evidence may not actually fit within the scope of the search warrants

obtained.” Id. at 831–32. The SJC did not rule on these issues in Preventative Medicine, however,

because a search had not yet been conducted in that case. Id. at 832.]

 Commonwealth v. Gousie, 13 Mass. L. Rptr. 585 (Mass. Super. Ct. 2001). Police received

information that defendant was distributing child pornography over the Internet. Id. at *1. They

received a warrant allowing them to seize the defendant’s computers and associated storage

devices, to bring those items to a search location, and to search them for “visual images depicting

children in a state of nudity or sexual conduct.” Id. at *8. Defendant challenged the warrant as not

particular enough because it allowed for seizure and search of all files on the computer, many of

which were not related to child pornography. Id. The court denied defendant’s motion, noting that

“where the commingling of legitimate and illegitimate items makes an on-site examination

impracticable, a temporary seizure of the whole is permitted.” Id. (citing various federal cases to

that effect). It noted that “[t]he investigators could not have known in what form—whether on the

computer hard drive or other various storage devices—the defendant was storing the target

images,” so protecting “such images from search and seizure merely because other, non-

incriminating items may have sheltered the images would pervert the accepted purpose of the

constitutional bar against general searches.” Id. at *9.

Massachusetts Digital Evidence Guide: Investigation, The Search and Seizure of Digital Evidence

 United States v. Schesso, 730 F.3d 1040 (9th Cir. 2013). Police received a tip that a Washington

resident was sharing child pornography over a peer-to-peer networking site. Id. at 1043. They

prepared a search warrant affidavit setting forth the information they had received about the

suspect’s IP address, the pornography he shared, general peer-to-peer network operations, data

storage, and known characteristics of child pornography offenders. See id. The magistrate granted

the warrant, which authorized seizure of all defendant’s computers and data storage devices, and

police discovered large quantities of child pornography. Id. at 1043–44. The trial judge

suppressed the evidence reasoning that the warrant was facially overbroad. Id. at 1045. The Ninth

Circuit reversed this decision. Id. at 1046. It based this ruling on the “practical, common-sense

decision” judges make in issuing warrants. Id. at 1046. Specifically, the court found that “[t]he

government was faced with the challenge of searching for digital data that was not limited to a

specific, known file or set of files” and reasoned that “[t]he government had no way of knowing

which or how many illicit files there might be or where they might be stored, or of describing the

items to be seized in a more precise manner.” Id. Given this reasoning and supportive precedent,

the court found the warrant permissible.

 In re a Warrant for All Content & Other Info. Associated with Email Account

[email protected] Maintained at Premises Controlled by Google, Inc., 33 F. Supp. 3d 386

(S.D.N.Y. 2014). Federal agents investigating illegal money remitting applied for a search

warrant to access a suspect’s entire email account in search of specified emails. Id. at 388. The

Magistrate considered and rejected the reasoning—employed in a recent D.C. District Court case

(since overruled)—that such a search was akin to a general warrant and therefore failed the

Fourth Amendment’s particularity requirement. Id. at 390–91. First, the judge noted that

extensive authority supported the proposition that investigators could briefly examine a wide

variety of documents during a search in order to determine relevance. Id. at 391–92. Though that

examination is essentially a seizure, it is also a practical necessity to determine which documents

can be more permanently seized. Id. at 392. Next, he noted that courts have been more flexible

with searches and seizures of electronic evidence because the large mass of undifferentiated

information makes an on-site search impossible. See id. Courts have recognized the practical

necessity of copying hard drives for later examination, so the government has been allowed to

access electronic information outside the scope of its search in order to effectuate that search. Id.

at 393. Finally, the judge found that email provider employees would not be capable of

performing the search themselves because they would not know enough about the investigation in

order to properly recognize relevant emails. Id. at 395.

(3) Staleness of Information Supporting Probable Cause

In order to provide probable cause sufficient for a search warrant, the information contained in an

affidavit supporting such a warrant must be sufficiently fresh. See United States v. Morales-Aldahondo,

524 F.3d 115, 119 (1st Cir. 2008) (detailed below). The reasoning behind this requirement is that the

passage of time “reduc[es] the likelihood that the ‘evidence of the offense will be found at the place to be

searched.’” Id. (quoting United States v. Woodbury, 511 F.3d 93, 97 (1st Cir. 2007)). In assessing

staleness, courts “do not measure the timeliness of information simply by counting the number of days

Massachusetts Digital Evidence Guide: Investigation, The Search and Seizure of Digital Evidence

that have elapsed” but rather “assess the nature of the information, the nature and characteristics of the

suspected criminal activity, and the likely endurance of the information.” Id. (citing United States v.

Pierre, 484 F.3d 75, 83 (1st Cir. 2007)). This requirement should not be confused with the separate

Massachusetts statutory requirement (examined next) that warrants be timely executed after they have

been issued. The following cases address staleness in the digital evidence context.

 United States v. Morales-Aldahondo, 524 F.3d 115 (1st Cir. 2008). The defendant was convicted

of possessing child pornography as a result of an investigation targeting a child pornography

website and its subscribers. Id. at 117. The download information obtained from the website was

over three years old by the time the search warrant in this case was issued. Id. at 119. On appeal,

the court upheld the trial judge’s denial of defendant’s motion to suppress for staleness. Id.

Focusing on the characteristics of child pornography collection, the court found that the warrant

application (along with testimony by the same officer during a subsequent Franks hearing)

“provided considerable support for the government’s position that customers of child

pornography sites do not quickly dispose of” their collection. Id. The court also cited other cases

in which child pornography had been kept for years. Id. (citing United States v. Irving, 452 F.3d

110 (2d Cir. 2006) (two years); United States v. Riccardi, 405 F.3d 852 (10th Cir. 2005) (five

years)). Given this support, the court found that three years was not so long a period that the

information had become stale. Id.

 Commonwealth v. Gousie, 13 Mass. L. Rptr. 585 (Mass. Super. Ct. Sept. 26, 2001)

(unpublished). In this case, the Attorney General’s Office investigated the defendant based on a

tip they had received from a New Hampshire police officer. Id. at *1. Using information from

online exchanges the defendant had with the officer four months prior, the AG’s Office obtained

a search warrant for the defendant’s premises where they located the evidence at issue in this

case. Id. The defendant alleged that the warrant was defective because, among other reasons,

“there was no temporal proximity between the events constituting probable cause and the

issuance of the warrant.” Id. at *5. The court rejected this argument for two reasons. First, it

found that the affidavit demonstrated continuous contact between the defendant and the

undercover officer for several months. Id. at *6. Even though that information was itself four

months old, the court found that it gave rise to an inference that the contact had continued. Id.

Second, the court focused on the special circumstance of transmitting child pornography via

computer. Id. at *7. Specifically, the affidavit described how computers retain data and how

collectors of child pornography tended to retain those collections for long periods. Id. The court

found that these descriptions “provided the magistrate with reason to conclude that the passage of

time did not constitute a disabling tardiness.” Id.

(4) Timely Execution of the Warrant

General Laws c. 276, § 3A, provides that “[e]very officer to whom a warrant to search is issued

shall return the same to the court by which it was issued as soon as it has been served and in any event not

later than seven days from the date of issuance thereof . . . .” Id.; see also Fed. R. Crim. P. 41(e)(2)(A)

(requiring return of a warrant within fourteen days in federal courts). Given the complexities inherent in

searching digital devices, the requirement that warrants be executed within seven days of issue could

Massachusetts Digital Evidence Guide: Investigation, The Search and Seizure of Digital Evidence

prove burdensome when investigating computer crimes. Fortunately, Massachusetts courts have

interpreted the provision liberally with regard to digital evidence, as the cases below demonstrate.

 Commonwealth v. Ericson, 85 Mass. App. Ct. 326 (2014). The defendant in this case texted with

a young girl—and subsequently with the police officers to whom she gave her phone—asking for

nude photos. Id. at 327–28. As part of this exchange, the defendant sent a photo of himself in a

tank top from the waist up. Id. at 328. Upon obtaining the phone, police received a warrant to

search for, among other things, the tank top image. Id. at 329. While examining the phone, they

discovered three images of the defendant’s penis, which served as the basis of his conviction for

possession of matter harmful to minors with intent to disseminate. Id. at 329, 333. Relying on the

reasoning in Commonwealth v. Kaupp, the court concluded that “if police have obtained a

warrant to search and seize evidence from a cell phone in their custody, they must attempt but

need not complete a forensic examination of the device within seven days of the warrant's

issuance.” Id. at 330 (emphasis added) (citing Commonwealth v. Kaupp, 453 Mass. 102, 115

(2009) (explained below)). The court provided no guidance about what exactly constituted an

“attempt” to conduct a forensic examination.

 Commonwealth v. Kaupp, 453 Mass. 102 (2009). Police observed pirated movies in the publicly

shared folder of one of defendant’s computers. Id. at 107. The publicly shared folder of a

different computer nearby contained both pirated movies and child pornography. Id. at 103–05.

Police seized the first computer and then received a search warrant for it. Id. at 105. Though

invalidating the warrant on probable cause grounds, the Supreme Judicial Court noted that had

the warrant been valid, the fact that it took more than seven days to fully search the computer

would not have required suppression. Id. at 115. The Court cited other jurisdictions in support of

the proposition “that the police do not need to complete forensic analysis of a seized computer

and other electronic data storage devices within the prescribed period for executing a search

warrant.” Id. The Court found a written return listing the devices to be examined that was filed

within seven days after the search warrant issued satisfied G.L. c. 276, § 3A. Id.

(5) Manner of Executing the Warrant

“Under both the Fourth Amendment to the United States Constitution and art. 14 of the

Massachusetts Declaration of Rights, the manner in which a search is conducted must be reasonable.”

Preventive Medicine Associates, Inc. v. Commonwealth, 465 Mass. 810, 821 (2013). The cases below

deal with this requirement in the digital evidence context.

 Commonwealth v. McDermott, 448 Mass. 750 (2007). After a deadly mass shooting, police

officers searched the defendant’s apartment pursuant to a warrant for evidence linking him to the

shooting. Id. at 764–65. As part of that search, they seized computers and disks. Id. The Court

upheld this seizure as reasonable because it recognized the impracticality of searching computers

on-site. Id. at 776. It also analogized this seizure to that of a firearm, stating that it “must be listed

in the inventory taken from the premises in the timely return of the warrant . . . but it may be

submitted for specialized examination at an off-site forensic setting for the further extraction of

evidence . . . .” Id. The Court stressed the need for conducting reasonable digital searches with

Massachusetts Digital Evidence Guide: Investigation, The Search and Seizure of Digital Evidence

minimal intrusion. Id. at 777. In this case, police met that burden through the procedure they

employed: “A forensic duplicate was made of the . . . hard drives and storage media to preserve

all original data,” and investigators used a keyword search that “resulted in a cursory inspection

of only approximately 750 files . . . which amounted to less than one per cent of the defendant's

files.” Id. This case also contains liberal language suggesting that “[i]n conducting the actual

search . . . considerable discretion must be afforded to the executing officers regarding how best

to proceed” and that “[a]dvance approval for the particular methods to be used in the forensic

examination of the computers and disks is not necessary.” Id. at 776.

 Preventive Medicine Associates, Inc. v. Commonwealth, 465 Mass. 810 (2013). This case dealt

with the search of a defendant’s email account after indictment, raising the distinct possibility of

intercepting privileged communications. Id. at 822–23. The Court held that “[w]hen an indicted

defendant's e-mails are the object to be searched by the Commonwealth, because there is a risk

that they contain privileged communications . . . a search, to be reasonable, must include

reasonable steps designed to prevent a breach of the attorney-client privilege.” Id. More broadly,

the SJC clarified that in McDermott, the fact that the warrant was issued before an indictment as

part of an investigation and the Commonwealth’s use of preset search terms during the

preliminary review of the defendant’s files were important to its holding. Id. at 830–32. The

Court stated that it took “seriously the concern that a cursory review of every e-mail undermines

the particularity requirement of the Fourth Amendment and art. 14, particularly where—as the

Commonwealth appears to argue would be permissible and appropriate in this case—the cursory

review is joined with the plain view doctrine to enable the Commonwealth to use against the

defendants inculpatory evidence with respect to the pending indictments that it finds in the

emails, even though such evidence may not actually fit within the scope of the search warrants

obtained.” Id. at 831–32. The SJC did not rule on these issues in Preventative Medicine, however,

because a search had not yet been conducted in that case. Id. at 832.

b) Exceptions to the Warrant Requirement

“Warrantless searches are per se unreasonable unless they fall within one of the few narrowly-

drawn exceptions to the warrant requirement.” Commonwealth v. Durham, No. 9610398, 1998 WL

34064623, at *2 (Mass. Super. Ct. Oct. 13, 1998) (citing Commonwealth v. Forde, 367 Mass. 798, 800

(1975)). “When a warrantless search is conducted, the Commonwealth has the burden of showing that the

search, and any resulting seizure, falls within this narrow class of permissive exceptions. Id. (citing

Commonwealth v. Phillips, 413 Mass 50, 55 (1992)). The sections below examine searches incident to

arrest, the plain view doctrine, and exigent circumstances in the digital evidence context.

(1) Search Incident to Arrest

One of the recognized exceptions to the warrant requirement is for searches made incident to a

suspect’s arrest. In Massachusetts, such searches are governed not only by the Fourth Amendment and art.

14 but also by G.L. c. 276, § 1, which is generally seen as more restrictive than these constitutional

provisions. See Commonwealth v. Blevines, 438 Mass. 604, 607 (2003). This statute permits searches

incident to arrest “only (1) for the purpose of seizing evidence of the crime for which the arrest has been

Massachusetts Digital Evidence Guide: Investigation, The Search and Seizure of Digital Evidence

made in order to prevent its destruction or concealment or (2) for the purpose of removing any weapon

the person arrested might use to resist arrest or to escape.” Id. (quoting Commonwealth v. Wilson, 389

Mass. 115, 118 (1983)) (internal quotation marks omitted).

Whether the search is permissible is based on an objective standard, so an officer’s subjective

intent as to the search is irrelevant as long as the search could reasonably have been expected to uncover

weapons or evidence facing destruction. Id. at 608 (permitting removal of defendant’s car keys from his

pocket during search because an officer “discovering a hard object in [a] defendant's rear pocket, [is]

justified in retrieving that object as a potential weapon”). Further, having removed an item, “police need

not ignore obvious aspects of or markings on” it, id. at 609 (citing Commonwealth v. Sullo, 26 Mass.

App. Ct. 766, 770 (1989)), but “detailed scrutiny” (such as examining papers) is disallowed, id. (citing

Commonwealth v. Vuthy Seng, 436 Mass. 537, 551–552 (2002)). The case below involves digital

evidence in the context of a search incident to arrest.

 Riley v. California, 134 S. Ct. 2473 (2014). In two consolidated cases, law enforcement officials

inspected the contents of an arrestee’s cellphone—citing the search incident to arrest (SITA)

exception—and used information therefrom in aid of further investigation. Id. at 2480–82. The

Supreme Court held that these searches did not fall within SITA exception because the

justifications undergirding the exception did not apply to cell phones. Id. at 2484–85. First, digital

contents of a cell phone cannot pose an immediate risk of physical injury to an officer. Id. at

2485–86. Second, once the phone has been seized by law enforcement (which the Court did

allow), the arrestee cannot hide or destroy any evidence thereon (at least according to the Court).

Id. at 2486–88. Confronting the issues of automatic locking, encryption, and remote wiping, the

Court expressed doubt that these issues were particularly common, drew a distinction between

such actions and the arrestee-initiated destruction of evidence in a typical SITA exception case,

and allowed police to employ other means of preventing such actions. Id. (noting that police may

power off the phone or block its network connection and hypothesizing that the police may be

allowed to alter a phone’s settings to prevent it from locking). Finally, the Court noted that in

exceptional cases—such as an imminent threat that the phone will be remotely wiped—the

exigent circumstances exception may apply on a case-by-case basis. Id. at 2487.

(2) The Plain View Doctrine

Under the plain view doctrine, law enforcement may make a warrantless seizure of evidence

when four conditions are met. See Commonwealth v. Ericson, 85 Mass. App. Ct. 326, 333 (2014) (laying

out the requirements for plain view) (explained below). First, the officers must lawfully be in a position to

view the evidence. Id. Second, they must have a lawful right of access to the object. Id. Third, they must

have a reason for seizing it. Id. In cases concerning (a) items possessed illegally, the incriminating

character of the object should be immediately apparent. Id. (citing Horton v. California, 496 U.S. 128,

136 (1990) (explained below)). In cases concerning (b) other types of evidence, the particular evidence

must plausibly be related to criminal activity of which the police are already aware. Id. (citing

Commonwealth v. Sliech-Brodeur, 457 Mass. 300 at 306–307 (2010)). Fourth, art. 14 requires that police

come across the object inadvertently. Id. (citing Sliech-Brodeur, 457 Mass. at 307). The following cases

address the plain view doctrine in the digital evidence context.

Massachusetts Digital Evidence Guide: Investigation, The Search and Seizure of Digital Evidence

 Commonwealth v. Ericson, 85 Mass. App. Ct. 326 (2014). The defendant in this case texted with

a young girl—and subsequently with the police officers to whom she gave her phone—asking for

nude photos. Id. at 327–28. As part of this exchange, the defendant sent a photo of himself in a

tank top from the waist up. Id. at 328. Upon obtaining the phone, police received a warrant to

search for, among other things, the tank top image. Id. at 329. While examining the phone, they

discovered three images of the defendant’s penis, which served as the basis of his conviction for

possession of matter harmful to minors with intent to disseminate. Id. at 329, 333. On appeal, the

court upheld this seizure under the plain view doctrine. Id. at 333. Fulfilling the first and second

plain view requirements, the warrant authorizing seizure of the tank top image means “they were

lawfully situated to view and to secure the [penis] images” because police are authorized to

conduct cursory inspection of computer files to determine whether they match items listed in the

warrant. Id. (citing Commonwealth v. McDermott, 448 Mass. 750, 776–77 (2007)). Third, the

images of the defendant’s penis were plausibly related to criminal activity of which the police

were aware. Id. at 334. His statements of intent to exchange pictures of his nude body with the

purported child gave police reasonable ground to believe the pictures were evidence of enticing

the child to pose in a state of nudity. Id. The same statements made it plausible that the pictures

were evidence of possession of matter harmful to minors with intent to disseminate. Id. Fourth,

police discovered the images inadvertently because they “lacked probable cause to believe, prior

to the search, that specific items would be discovered during the search.” Id. (quoting

Commonwealth v. Balicki, 436 Mass. 1, 9–10 (2002)).

 United States v. Burdulis, No. 10–40003–FDS, 2011 WL 1898941 (D. Mass. May 19, 2011). The

defendant in this case emailed a police officer impersonating a young boy an explicit image. Id. at

*1. Police obtained a warrant to search the defendant’s computer for that image as well as proof

that he had sent the emails. Id. at *2. During their search of all image files on the computer,

police uncovered child pornography. Id. After finding the seizure of those images authorized by

the initial warrant, the court held in the alternative that the plain view doctrine also authorized the

use of those images in evidence. Id. at *11–12. First, the officer searching the computer was

lawfully in a position to view the evidence because he was conducting a search pursuant to a

warrant. Id. at *11. As he was looking for image files, he was authorized to briefly examine all

images to determine if they were a match. Id. Second, by this same logic, the officer had a lawful

right of access to the files. Id. at *12. Third, the prohibited nature of child pornography images

would have been immediately apparent. Id. [The court did not examine the fourth requirement—

inadvertence—because it exists only under Massachusetts law. See above for more detail on

inadvertence.]

(3) Exigent Circumstances

“One well-recognized exception [to the warrant requirement] applies when ‘the exigencies of the

situation make the needs of law enforcement so compelling that [a] warrantless search is objectively

reasonable under the Fourth Amendment.’” Kentucky v. King, 131 S. Ct. 1849, 1856 (2011) (quoting

Mincey v. Arizona, 437 U.S. 385, 394 (1978)). Among the exigencies that the Court has identified in the

context of searching a home are “emergency aid” (entering a home to render assistance to an injured

Massachusetts Digital Evidence Guide: Investigation, The Search and Seizure of Digital Evidence

occupant), “hot pursuit” (chasing after a fleeing suspect), and the need to prevent the “imminent

destruction of evidence.” Id.

 Commonwealth v. Kaupp, 453 Mass. 102 (2009). Police observed pirated movies in the publicly

shared folder of one of defendant’s (a teacher) computers in a school classroom. Id. at 107. The

publicly shared folder of a different computer nearby contained both pirated movies and child

pornography. Id. at 103–05. Police seized both computers and subsequently obtained a search

warrant. Id. at 105. The Court upheld the seizure of defendant’s computer as appropriate because

of exigent circumstances. Id. at 105–06. Specifically, the Court noted that “impoundment of an

object pending the issuance of a search warrant violates the Fourth Amendment . . . only if it is

unreasonable,” which “turns on the facts of each case, requiring courts to ‘balanc[e] the need to

search or seize against the invasion that the search or seizure entails.’” Id. at 106 (quoting

Commonwealth v. Catanzaro, 441 Mass. 46, 56 (2004)). The court held that “[g]iven the ease

with which computer files may be accessed and deleted, and the disruption that would have been

created by posting an officer in the defendant's office and preventing students from entering [their

classroom] pending the issuance of a search warrant . . . the seizure was reasonable.” Id. In a

footnote, the court noted that while exigent circumstances justified the seizure, they would not

have justified the subsequent search had it been warrantless because “[t]he exigency necessitating

[the computer’s] seizure dissipated once the computer had been secured.” Id. n.7.

3. The Exclusionary Rule

Generally, the exclusionary rule prohibits the introduction of evidence obtained as a result of a

violation of a defendant’s Fourth Amendment or art. 14 rights. See Commonwealth v. Brown, 456 Mass.

708, 715 (2010).

a) Good Faith / Substantial and Prejudicial

The Supreme Court has limited the application of this judicially crafted remedy in federal cases

where officers acted in good faith, but Massachusetts does not recognize the good faith exception for art.

14. See Commonwealth v. Porter P., 456 Mass. 254, 273 (2010). Instead, it looks to “the foundational

purpose of the rule—to deter unlawful police conduct . . . as a guiding principle” to determine whether

evidence should be excluded. Commonwealth v. Maingrette, 20 Mass. App. Ct. 691, 697 (2014) (citing

Commonwealth v. Wilkerson, 436 Mass. 137, 142 (2002)). Where there has been a constitutional

violation, “the burden is on the government to show . . . that the [government’s] mistake was reasonable

in the circumstances, and that the violation was minor or insubstantial and nonprejudicial and that

exclusion of the evidence would not be likely to deter future police misconduct.” Id. (citations omitted).

b) Inevitable Discovery

“Under the inevitable discovery doctrine, if the Commonwealth can demonstrate by a

preponderance standard that discovery of the evidence by lawful means was certain as a practical matter,

the evidence may be admissible as long as the officers did not act in bad faith to accelerate the discovery

of evidence, and the particular constitutional violation is not so severe as to require suppression.”

Commonwealth v. Fontaine, 84 Mass. App. Ct. 699, 709–710 (2014) (citations omitted). Though there are

Massachusetts Digital Evidence Guide: Investigation, Cases Relating to Specific Digital Devices

no Massachusetts cases applying this doctrine to a computer search, the First Circuit case below applying

a slightly different federal test is instructive:

 United States v. Crespo-Rios, 645 F.3d 37 (1st Cir. 2011). In this case, the FBI searched the

defendant’s computer and external hard drive for evidence of chats between both him and an

undercover agent and him and minors. Id. at 40–41. The search for these chats was conducted

pursuant to a warrant that also listed, among other things, child pornography as something being

sought. Id. During this search, agents found child pornography, and the defendant moved to

suppress the evidence at trial, arguing that there was insufficient probable cause to support the

overly-broad search warrant. Id. at 41. The First Circuit overturned the lower court by applying

the inevitable discovery doctrine. Id. at 43. In searching the computer and hard drive for the chat

evidence—for which there was undoubtedly probable cause—the court found that government

agents would inevitably have discovered the child pornography because searching for computer

files allows brief scanning of all possibly relevant files on the computer. Id. [This analysis is quite

similar to that of the plain view doctrine. See supra Part 2.b)(2), p. 20.]

B. Cases Relating to Specific Digital Devices

1. Cell Phone Searches

 Riley v. California, 134 S. Ct. 2473 (2014). In two consolidated cases, law enforcement officials

inspected the contents of an arrestee’s cellphone—citing the search incident to arrest (SITA)

exception—and used information therefrom in aid of further investigation. Id. at 2480–82. The

Supreme Court held that these searches did not fall within SITA because the justifications

undergirding the exception do not apply to cell phones. Id. at 2484–85. First, the digital contents

of a cell phone cannot pose an immediate risk of physical injury to an officer. Id. at 2485–86. The

Court does allow for physical inspection of the cell phone to mitigate the risk of a hidden weapon.

Id. at 2485. Second, once the phone has been seized by law enforcement (which the Court does

allow), the arrestee cannot hide or destroy any evidence thereon. Id. at 2486–88. Confronting the

issues of encryption and remote wiping, the Court expressed doubt that those issues are

particularly common, drew a distinction between such actions and the arrestee-initiated

destruction of evidence in a typical SITA exception case, and noted that police could employ

other means of preventing such actions. Id. (noting that police may power off the phone or block

its network connection and hypothesizing that the police may be allowed to alter a phone’s

settings to prevent it from locking). Finally, the Court noted that in exceptional cases—such as an

imminent threat that the phone will be remotely wiped—the exigent circumstances exception may

apply on a case-by-case basis. Id. at 2487.

2. Cell Site Location Information

 Commonwealth v. Augustine, 467 Mass. 230 (2014). Police investigating a murder obtained the

defendant’s Cellular Site Location Information (CSLI) from his service provider pursuant to a

§ 2703(d) order. Id. at 233. The CSLI obtained helped police determine the defendant’s location

over the period they were investigating. See id. at 233–34. The Court considered but ultimately

Massachusetts Digital Evidence Guide: Investigation, Cases Relating to Specific Digital Devices

rejected the Commonwealth’s argument that the third-party doctrine negated any reasonable

expectation of privacy the defendant had in his CSLI. Id. at 241–56. It reasoned that art. 14 does

not protect information voluntarily and intentionally transmitted to third parties (like the number

dialed to initiate a call) but that it does protect information incidentally transmitted (like the

location information the cell phone provider acquires as a result of cell phone technology). Id. at

249–52. The Court found that the defendant therefore had a reasonable expectation of privacy in

his CSLI, which, under art. 14, requires a warrant to overcome. Id. at 252–55. Then-Justice

Gants, writing in dissent, was careful to distinguish between the call CSLI sought in this case

(which is only recorded when a telephone call is placed) and registration CSLI (which records the

phone’s location every few seconds it is powered on). See id. at 258–59 (Gants, J., dissenting).

He argued that such call CSLI, which is essential to completing a call, should be covered by the

third-party doctrine while registration CSLI should not. Id. at 872–73.

3. Search of Computer Files

 Commonwealth v. McDermott, 448 Mass. 750 (2007). After a deadly mass shooting, police

officers searched the defendant’s apartment for evidence linking him to the shooting pursuant to a

warrant. Id. at 764–65. As part of that search, they seized five computers and disks. Id. The

defendant asserted that this was unlawful because the warrant did not specifically authorize the

seizure of these items. The warrant did authorize, however, seizure of several types of documents.

Id. The Court held that the seizure of the computers was reasonable because they functioned as

“closed containers” storing documents. Id. at 766.

 Commonwealth v. Kaupp, 453 Mass. 102 (2009). Police observed pirated movies in the publicly

shared folder of one of defendant’s (a teacher) computers in a school classroom. Id. at 107. The

publicly shared folder of a different computer nearby contained both pirated movies and child

pornography. Id. at 103–05. Police seized both computers and subsequently obtained a search

warrant. Id. at 105. The court upheld the seizure of defendant’s computer as appropriate because

of exigent circumstances. Id. at 105–06. Specifically, the court noted that “impoundment of an

object pending the issuance of a search warrant violates the Fourth Amendment . . . only if it is

unreasonable,” which “turns on the facts of each case, requiring courts to ‘balanc[e] the need to

search or seize against the invasion that the search or seizure entails.’” Id. at 106 (quoting

Commonwealth v. Catanzaro, 441 Mass. 46, 56 (2004)). In this case, the court found that “[g]iven

the ease with which computer files may be accessed and deleted, and the disruption that would

have been created by posting an officer in the defendant's office and preventing students from

entering [their classroom] pending the issuance of a search warrant . . . the seizure was

reasonable.” Id. In a footnote, the court noted that while exigent circumstances justified the

seizure, they would not have justified the subsequent search had it been warrantless because

“[t]he exigency necessitating [the computer’s] seizure dissipated once the computer had been

secured.” Id. n.7.