No In The SUPREME COURT OF THE UNITED STATES ALBERTA CAPINE, Petitioner, UNITED STATES OF AMERICA, Respondent.

Transcription

1 No In The SUPREME COURT OF THE UNITED STATES ALBERTA CAPINE, Petitioner, v. UNITED STATES OF AMERICA, Respondent. On Writ of Certiorari To The United States Court of Appeals For The Twelfth Circuit BRIEF OF PETITIONER Team 2 Counsel for Petitioner

2 TABLE OF CONTENTS TABLE OF AUTHORTIES... ii QUESTIONS PRESENTED... 1 OPINIONS BELOW... 1 CONSTITUTIONAL PROVISIONS AND RULES... 1 INTRODUCTION... 1 STATEMENT OF THE CASE... 4 ARGUMENT... 5 I. THE COMPUTER FILES THAT WERE NOT PART OF SUNDON S PRIVATE SEARCH SHOULD NOT BE ADMITTED UNDER THE PRIVATE SEARCH EXCEPTION A. Computer files are subject to immense privacy concerns that make them akin to private homes, two which the private search exception does not apply B. Even if a container framework is applied, the computer files should be considered containers, and are not reached by the private search exception As containers, the files that were not opened during the private search maintained their reasonable expectations of privacy The decision of United States v. Runyan is incorrect and should not be applied. Even if it were applied, Officer Miller did not have the substantial certainty that Runyan requires C. Even if the computer folders were considered containers, the private search exception does not apply The contents of the transaction history folder maintained a reasonable expectation of privacy following the private search The opening of one file within a folder does not necessitate that all files within that folder lose their expectation of privacy i

3 II. THE CFAA SHOULD BE INTERPRETED NARROWLY, IMMUNIZING CAPINE FROM LIABILITY A. Two interpretations of authorization within the CFAA have developed B. The plain language of the CFAA favors a narrow interpretation of authorization C. The rule of lenity dictates that the narrow interpretation should be adopted D. A broad interpretation of the CFAA would render it void for vagueness E. The narrow interpretation of authorization should be adopted to avoid setting a precedent in favor of overly expansive computer laws F. Applying the narrow interpretation of the CFAA leads to the conclusion that Capine did not violate the CFAA CONCLUSION TABLE OF AUTHORTIES Cases Abramski v. United States, 134 S. Ct (2014) Coates v. City of Cincinnati, 402 U.S. 611 (1971)... 26, 27 Connally v. Gen. Const. Co., 269 U.S. 385 (1926) Consumer Prod. Safety Comm'n v. GTE Sylvania, Inc., 447 U.S. 102 (1980) EF Cultural Travel BV v. Explorica, Inc., 274 F.3d 577 (1st Cir. 2001)... 20, 27 Ex parte Jackson, 96 U.S. 727 (1877) Illinois v. Andreas, 463 U.S. 765 (1983) Int'l Airport Centers, L.L.C. v. Citrin, 440 F.3d 418 (7th Cir. 2006) LVRC Holdings LLC v. Brekka, 581 F.3d 1127, (9th Cir. 2009) Muscarello v. United States, 524 U.S. 125, 138 (1998) New York v. Belton, 453 U.S. 454 (1981)... 6, 8 Perrin v. United States, 444 U.S. 37 (1979) Riley v. California, 134 S. Ct (2014)... 6, 7, 8, 9, 11 Smith v. Goguen, 415 U.S. 566 (1974) ii

4 Smith v. Ohio, 494 U.S. 541 (1990) United States v. Allen, 106 F.3d 695, (6th Cir. 1997)... 9 United States v. Bass, 404 U.S. 336 (1971) United States v. Carey, 172 F.3d 1268 (10th Cir. 1999)... 8, 11, 18 United States v. Chesney, 86 F.3d 564 (6th Cir. 1996) United States v. Jacobsen, 466 U.S. 109 (1984)... 6, 7, 14, 15 United States v. John, 597 F.3d 263 (5th Cir. 2010) United States v. Knoll, 16 F.3d 1313 (2d Cir. 1994) United States v. Lichtenberger, 786 F.3d 478 (6th Cir. 2015)... 8, 11, 13, 15, 16, 18 United States v. Mitchell, 565 F.3d 1347 (11th Cir. 2009)... 9, 11 United States v. Mitra, 405 F.3d 492 (7th Cir. 2005)... 19, 24 United States v. Nosal, 676 F.3d 854 (9th Cir. 2012)... 19, 20, 28 United States v. Oliver, 630 F.3d 397 (5th Cir 2011) United States v. Place, 462 U.S. 696 (1983) United States v. Rodriguez, 628 F.3d 1258 (11th Cir. 2010) United States v. Ross, 456 U.S. 798 (1982) United States v. Rouse, 148 F.3d 1040 (8th Cir. 1998) United States v. Runyan, 275 F.3d 449 (5th Cir. 2001)... 12, 13, 17 Statutes 18 U.S.C (2008)... 19, 21, 22, 24 Other Authorities H.R. REP. NO (1984)... 22, 25 Orin S. Kerr, Vagueness Challenges to the Computer Fraud and Abuse Act, 94 MINN. L. REV.1561 (2010) Oxford Dictionaries (Feb. 7, 2016), 21, 23 S. REP. NO (1996) S. REP. NO (1986) U.S. CONST. amend. IV... 6 iii

5 QUESTIONS PRESENTED 1. Whether the private search exception to the Fourth Amendment applies to evidence obtained in a government search of computer files not already searched by a private party. 2. Whether the nature of the use of computer data should affect the authorization status of an individual who is otherwise authorized to access the computer as it pertains to section 1030(a)(2)(C) of the Computer Fraud and Abuse Act. OPINIONS BELOW The opinion for the United States Court of Appeals for the Twelfth Circuit is reported in Capine v. United States, 913 F.3d 1131 (12th Cir. 2015). CONSTITUTIONAL PROVISIONS AND RULES The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized. U.S. CONST. amend. IV. INTRODUCTION This appeal is the product of Petitioner Alberta Capine s conviction of drug trafficking, attempted identity theft, and violation of the Computer Fraud and Abuse Act. Local law enforcement obtained evidence against Capine through a warrantless search of her home computer, following a private search by Capine s roommate. The government argued that the private search exception, which allows warrantless government searches of material following a private search, legitimized the search. The district court denied 1

6 Capine s motion to suppress any electronic evidence gathered by law enforcement that was not part of the private search. The Court of Appeals also rejected Capine s argument that the private search exception does not apply to the electronic evidence gathered by law enforcement that was not viewed in the private search. Capine appeals on the same grounds. The appellate court decision with respect to the private search exception should be reversed for three reasons. First, the private search exception should not be applied to searches of electronic storage devices because of the massive privacy concerns associated with electronic storage devices, which are similar to privacy concerns associated with homes. Second, even if a container framework is applied to computers, the individual computer files would be considered containers. Those containers that were not opened during the private search would thus retain their reasonable expectations of privacy. Because the private search exception only allows the government to search those items that have lost their expectation of privacy, the private search exception would not apply to the computer files. Additionally, the containers not opened in the private search may not be searched by the government just because they are near a container that was privately searched and revealed evidence of a crime, and are suspected to contain evidence of that same crime; and even if they could be searched in this manner, a police officer could not be certain that they contained evidence of that crime. Finally, even if computer folders, and not individual files, were considered containers, the files not viewed in the private search of petitioner s folder maintained a reasonable expectation of privacy following the private search, because unsearched items within a container maintain an expectation of privacy even after another inside the folder is searched. 2

7 Because computer files can contain such massive amounts of private information, the opening of one file within a folder does not necessitate that all files within that folder lose their expectation of privacy. Section 1030(a)(2)(C) of the Computer Fraud and Abuse Act ( CFAA ) prohibits accessing a protected computer without authorization or in excess of authorization and thereby taking information stored on that computer. In the case at bar, Capine was discovered to have various PDF files containing the personal information of numerous individuals on her personal laptop. It was determined that Capine had gathered this information using her authorized access to Sureinf.com, a database used by her employer, Find Funds, Inc. Petitioner asserts that since she had been given authorization to access the database as a condition of her employment, her intended use of that data did not alter her authorization status as it pertains to section 1030(a)(2)(C). The appellate court determined that Capine had violated the statute, however, because any access of data by an employee for non-business reasons, is an access of data without proper authorization. The appellate court erred in its broad interpretation of section 1030(a)(2)(C) for four reasons. First, the plain language of section 1030(a)(2)(C) favors a narrow interpretation of authorization as it is used in within the statute. Such a narrow interpretation would, in turn, inoculate Capine from any violation of section 1030(a)(2)(C). Second, the narrow interpretation of authorization is the proper interpretation according to the rule of lenity, which calls for criminal statutes to be interpreted in the least harsh way possible. Third, a broad interpretation of authorization would render section 1030(a)(2)(C) void-for-vagueness because it would fail to give proper guidelines to citizens and authorities concerning what conduct is 3

8 criminalized by the statute. Fourth, adopting a narrow interpretation sets an important precedent that computer related laws should be limited to their exact purpose and language. For these reasons, Petitioner impels the court to reverse the appellate court s ruling with regard to section 1030(a)(2)(C). STATEMENT OF THE CASE Petitioner Alberta Capine was a small claims supervisor for Find Funds, Inc. (R. at 2). As part of her employment, Capine held significant responsibilities over Find Funds computers and employees access to databases. (R at 2). Sureinf.com was one of the financial databases used by Find Funds. (R at 3). Find Funds gave Capine a username and password to access Sureinf.com. (R at 3). Find Funds had an internal policy prohibiting the use of company computer resources for personal purposes. (R at 2). On September 23 rd, Capine s roommate, Ester Sundon, asked Capine if she could use Capine s personal laptop; Capine refused. (R at 2). After this refusal, Sundon gained access to Capine s laptop without Capine s permission, and opened a folder labeled transaction history. (R at 2). Sundon opened this folder, which contained a list of 16.pdf documents and 16 Microsoft Excel spreadsheets. (R. at 2). Each.pdf file shared a common name with one other.xlsx file in the folder. (R. at 2). Each document was roughly the same size as the others in the folder; the.pdf files ranged from 10 to 17 kilobytes in size, while the.xlsx files ranged from 15 to 20 kilobytes. (R. at 3). Sundon clicked the first.xlsx file on the list, which opened a spreadsheet that appeared to identify a series of controlled substance sales. (R. at 3). Sundon opened two more spreadsheets at random and found similar charts that appeared to detail past sales. (R. at 3). Without viewing the other files, Sundon called the police. (R. at 3). 4

9 Officer Miller was dispatched to answer the call. (R. at 3). Miller asked Sundon to show him the three.xlsx files she had already opened; she did. (R. at 3). Miller, under the belief that the spreadsheets detailed narcotics sales, asked Sundon for permission to use the laptop. (R. at 3). She complied. (R. at 3). Miller then made copies of all 16.pdf files and all 16.xlsx files onto a flash drive. (R. at 3). He then opened and viewed the contents of each file. (R. at 3). The.pdf files indicated that they had been saved from the Sureinf.com database. (R at 3). After viewing all of the.pdf and.xlsx files, Officer Miller confiscated the laptop and obtained a warrant before searching the remainder of the computer. (R. at 3). The resulting investigation showed that the.pdf files had been accessed using Capine s employee username and password. (R. at 3). Capine was indicted for multiple counts of drug trafficking, attempted identity theft, and violation of the Computer Fraud and Abuse Act. (R at. 3). Prior to trial, Capine moved to exclude the files that Sundon had not viewed based on the Fourth Amendment s prohibition against unreasonable search and seizure. (R. at 3). The trial court denied Capine s motion based on the private search exception, and allowed the.pdf and.xlsx files to be admitted to evidence. (R. at 3). Capine was eventually convicted on all counts, and thereafter appealed her convictions arguing that she obtained the personal information as an authorized user of her company s computer system and reasserting her claim that Officer Miller s search of files not viewed by Sundon violated the Fourth Amendment. (R. at 3). The appellate court upheld the convictions. (R. at 3). ARGUMENT 5

10 I. THE COMPUTER FILES THAT WERE NOT PART OF SUNDON S PRIVATE SEARCH SHOULD NOT BE ADMITTED UNDER THE PRIVATE SEARCH EXCEPTION. A. Computer files are subject to immense privacy concerns that make them akin to private homes, two which the private search exception does not apply. The Fourth Amendment to the United States Constitution guarantees the people the right to be free of unreasonable searches and seizures of their persons, houses, papers, and effects. U.S. CONST. amend. IV. A search occurs when an expectation of privacy that society is prepared to consider reasonable is infringed by the government. United States v. Jacobsen, 466 U.S. 109, 113 (1984). In addition to individual objects, the courts have recognized an expectation of privacy within a person s containers, which are defined as any object capable of holding another object. New York v. Belton, 453 U.S. 454, 460 (1981). Government searches of both individual objects and containers are considered reasonable only if the government first secures a warrant or demonstrates that a specific exception to the warrant requirement applies. Riley v. California, 134 S. Ct. 2473, 2482 (2014). One such exception is the private search exception. The private search exception dictates that protections granted by the Fourth Amendment do not extend to searches made by private parties who are not acting on behalf of the government, no matter how unreasonable their searches might be. Jacobsen, 466 U.S. 109 at 113. Police are allowed to subsequently inspect materials that were already privately searched without a warrant. Id. But when law enforcement subsequently reviews this privately searched material without a warrant, the legality of the government s searches must be tested by the degree to which they exceed the scope of the private search. Id. At

11 The Supreme Court illustrated the applicability of the private search exception to containers with their holding in Jacobsen. There, employees of a private freight carrier were inspecting a damaged package when they observed a white, powdery substance; further searching of the package revealed several bags of the substance within a tube inside. Id. at 111. The employees called the Drug Enforcement Administration, who reopened the package, tested the powder, and confirmed it was cocaine. Id. at The Court ruled this search of the previously opened container was constitutional, because it revealed no more information than what the private search already had. Id. at 120. The container and its contents, which had been made aware to the officers by the private searchers, had no legitimate expectation of privacy left to be infringed, and thus there was no illegal search within the meaning of the Fourth Amendment. Id. at 120. Though a tube containing cocaine lends itself well to this kind of container analysis, the privacy issues implicated by the search of electronic storage devices transcend that of normal containers. While the search of the tube in Jacobsen was held constitutional because police learned nothing new, any search of an electronic storage device creates too high a chance that unexpected, private information will be discovered. As the Supreme Court has noted, electronic storage devices such as cell phones described by the Court as microcomputers hold virtually unlimited quantities of personal, private information within them, such as photographs, videos, contact lists, communications, medical records, and political affiliations. Riley v. California, 134 S. Ct. 2473, (2014). As such, allowing unrestrained searches of cell phones would thus give police officers unbridled discretion to rummage at will among a person s private effects. Id. 7

12 Computer hard drives, folders, and files, which host at least the same quality of sensitive information that microcomputer cell phones do, should be accorded the same privacy concerns that cell phones enjoy. In fact, the Sixth Circuit has held that, due to the extent of information that can be stored on a computer, it is incredibly difficult for police to conduct a search of a computer and be certain that they will find no private information while doing so. See United States v. Lichtenberger, 786 F.3d 478, 488 (6th Cir. 2015). Thus, because electronic storage devices hold such broader amounts of protected, private information than any physical storage method, relying on analogies between computers and closed containers ignores the realities of modern electronic storage, and, as a consequence, may cause courts to oversimplify a complex area of Fourth Amendment doctrines. United States v. Carey, 172 F.3d 1268, 1275 (10th Cir. 1999) (citations omitted). An additional problem to the comparison between an electronic storage device and a closed container is created by modern cloud computing. Cloud computing is the capacity of Internet-connected devices to display data stored on remote servers rather than on the device itself. Riley v. California, 134 S. Ct. at As discussed above, a container is defined as any object capable of holding another object. Belton, 453 U.S. at 460 (1981). Even if electronic information could properly be described as an object per this definition, cloud computing creates a risk that this information is not even held in the container being searched. The Supreme Court has held that the search of information that is not physically present on an electronic device being searched, but is instead located remotely, is impermissible under the Fourth Amendment. Riley, 134 S. Ct. at This problem is especially relevant to computers because law enforcement may not 8

13 be able to differentiate between information stored on a hard drive and information stored remotely. See Id. As such, some electronic information may not be stored in the container being searched at all. Accordingly, because of the immense privacy interests inherent in electronic storage devices, and because of the remote nature of cloud computing, basic container analysis should not be applied to computers. A more appropriate comparison for electronic storage devices, with their huge quantities of personal information, would be to private homes. Indeed, the Supreme Court has remarked that a search of even a cell phone would reveal more information than the most exhaustive search of a house. Id. Similarly, the Eleventh Circuit has described computers as the digital equivalent of its owner s home, capable of holding a universe of private information. United States v. Mitchell, 565 F.3d 1347, 1352 (11th Cir. 2009). Because of the immense privacy interests at stake within a home, some courts have refused to extend the private search exception to private residences. See United States v. Allen, 106 F.3d 695, (6th Cir. 1997). Though homes are a uniquely protected space under the Fourth Amendment, the privacy concerns present within a home and within a computer are incredibly similar; as discussed above, the Supreme Court has expressed concern that electronic storage devices may indeed hold even more private information than a home. Riley, 134 S. Ct. at An unbridled search of either would inevitably lead to the discovery of massive amounts of private, personal information. Therefore, because the private search exception does not apply to homes due to high privacy interests, and because electronic storage devices have equally grave privacy interests, the private search exception should not apply to electronic storage devices. 9

14 Because the contents of Capine s computer have such a significant privacy interest at least as similar to that of a private home the private search exception should not apply to Officer Miller s search. Because there was no warrant to search the computer, and because no other exceptions to the Fourth Amendment apply, Officer Miller s search violated the Fourth Amendment, and the evidence illegally obtained through it should be suppressed. B. Even if a container framework is applied, the computer files should be considered containers, and are not reached by the private search exception. 1. As containers, the files that were not opened during the private search maintained their reasonable expectations of privacy. The Supreme Court has long recognized that containers are subject to protection from warrantless government searches under the Fourth Amendment. See, e.g., Smith v. Ohio, 494 U.S. 541, 543 (1990) (per curiam) (brown paper grocery bag); United States v. Place, 462 U.S. 696, (1983) (luggage); Ex parte Jackson, 96 U.S. 727, 733 (1877) (letters and packages). Indeed, the Supreme Court has noted that the Fourth Amendment is invoked when a defendant has a reasonable expectation of privacy in the contents of a container, and provides protection to the owner of every container that conceals its contents from plain view. Illinois v. Andreas, 463 U.S. 765, 771 (1983); United States v. Ross, 456 U.S. 798, (1982). If basic container analysis was applied to electronic storage devices, each individual computer file, and not their resident folder or drive, must be viewed as a container. Individual files have massive privacy interests; a single one might contain photographs, videos, contact lists, diaries, or numerous other types of personal, protected information all of which enjoy a constitutionally protected reasonable expectation of 10

15 privacy. See Mitchell, 565 F.3d at As noted by the Supreme Court, electronic storage devices such as cell phones, with their tremendous capacities for personal data storage, hold for many Americans the privacies of life. Riley, 134 S. Ct. at Just as cell phones are afforded extensive Fourth Amendment protections, so too should individual computer files, which can, and often do, host these same kinds of significant information. This reasoning is reinforced by United States v. Knoll, in which the Second Circuit stated that computer files were containers that enjoyed a reasonable expectation of privacy. United States v. Knoll, 16 F.3d 1313, 1320 (2d Cir. 1994). Though the lower court here held that computer folders, and not individual computer files, should be considered containers, this argument is misplaced. As discussed above, the privacy concerns inherent in individual files suggests that it is these that should be considered containers. But beyond that, multiple federal circuits have suggested that computers and their folders are not containers under the Fourth Amendment. In United States v. Lichtenberger, the Sixth Circuit noted that laptop computers and physical containers were not alike because of the vast amount of diverse data a computer can hold. Lichtenberger, 786 F.3d at In United States v. Carey, the Tenth Circuit explained that analogizing computers to closed containers would oversimplify a complex area of Fourth Amendment doctrines and ignore the realities of massive modern data storage, because of the great quantity and variety of information that computers contain. Carey, 172 F.3d at Though neither case specifically mentions computer folders, folders potentially contain the same great quantity and variety of information that computers do. If a computer itself is analogized to a library, its folders are merely bookshelves; all significant information rests within the library s individual 11

16 books the computer files. To provide adequate constitutional protections, the container framework would thus have to be applied to the most basic piece of private information available; not the computer or the folder, but the individual file. Here, Capine s unsearched.pdf and.xlxs files were unconstitutionally searched by law enforcement in violation of the Fourth Amendment. The individual files are containers that were not viewed in Sundon s private search; thus, their reasonable expectations of privacy were never frustrated. As such, Officer Miller should have first obtained a search warrant before viewing Capine s private files. Therefore, because Capine s unsearched files were searched by Officer Miller without a warrant or exception to the warrant requirement, Capine s previously unopened files should be suppressed. 2. The decision of United States v. Runyan is incorrect and should not be applied. Even if it were applied, Officer Miller did not have the substantial certainty that Runyan requires. Though the Fifth Circuit held in United States v. Runyan that individual containers not searched by a private party may still be searched by police who are following up on a private search, this assertion is incorrect for numerous reasons. The rule introduced in Runyan is that police do not exceed the scope of a prior private search by opening a nearby, unsearched container if they are substantially certain that the container contains more evidence of the crime at hand. United States v. Runyan, 275 F.3d 449, 463 (5th Cir. 2001). This substantial certainty deprives the container of any reasonable expectation of privacy. Id. Thus, an argument may be made that Officer Miller was substantially certain of the contents of the files not searched by Sundon because she had found evidence of drug sales in the three.xlsx files she did search, because the files were in the same transaction history folder, and because the files were similar in size 12

17 and naming conventions. Because of this, one could contend that none of the files retained their reasonable expectation of privacy, and the government search of those files was legal. The Runyan holding, however, ignores both the decades of protection afforded to unopened containers by the courts, as well as the modern realities of electronic data storage. As discussed by the Sixth Circuit in United States v. Lichtenberger, the expansive nature of computer storage makes it nearly impossible for a police officer to believe with any certainty that evidence of a crime will be found within an unopened computer file; the odds are just as likely that there will be constitutionally protected, private information within that is unrelated to the crime at hand. Lichtenberger, 786 F.3d at Any searches of unopened electronic containers would thus put their owners at great risk of the government discovering this constitutionally protected information. Because of its subversion of traditional container protections, as well as its disregard for the privacy interests inherent within computer files, the Runyan holding should thus not be applied to the case at bar. Even if the Court were to apply Runyan in this regard, Officer Miller could not have had substantial certainty that evidence of the same crime could be found in Capine s unsearched files. From the outset, Sundon never searched the remaining 29 files, forcing Officer Miller to completely speculate about their contents. (R. at 3). The mere fact that the unsearched files were found in the same folder as the privately searched ones does not establish with substantial certainty that all the files in question contained evidence of illicit drug sales. See Runyan, 275 F.3d at 464. Indeed, half of the searched files contained no evidence of drug sales whatsoever. (R. at 3). Furthermore, the contents of 13

18 the files are not overtly obvious, even based on the context of the search. See United States v. Oliver, 630 F.3d 397, 408 (5th Cir 2011). The paired naming convention and similar sizes of the.xlsx and.pdf files does not establish with substantial certainty that the files contained evidence of illicit drug sales; their document names mention nothing of drugs or drug transactions, and indeed are apparently just named after people. (R. at 2). Finally, a hunch that files with similar names and sizes might contain evidence of drug sales is not enough to defeat the massive, constitutionally protected privacy interests that computer files have. It was just as likely that the files contained sensitive personal information, as they were to contain incriminating evidence. Officer Miller did not, and could not, have the substantial certainty required by Runyan that more evidence of illicit drug sales was contained in the computer files he searched without a warrant. Because there could be no substantial certainty that Capine s unopened files would contain evidence of drug transactions, those files retained their expectations of privacy under the rule of Runyan, and the private search exception does not apply. Consequently, because the government search was not supported by a warrant or a valid exception to the warrant requirement, the product of the illegal search must be suppressed. C. Even if the computer folders were considered containers, the private search exception does not apply. 1. The contents of the transaction history folder maintained a reasonable expectation of privacy following the private search. When a container is searched by a private party, any items within the container that are discovered by the searching party lose their expectation of privacy. Jacobsen, 466 U.S. 109 at As such, a government search of a container previously searched 14

19 by a private party is reasonable if it does not reveal anything that the private search has not discovered. Id. at Additionally, when law enforcement has virtual certainty that a container holds multiple units of one item, a search of that container is legal when all that is found inside is indeed that same item. See id. at 121. As discussed above, the Jacobsen Court thus determined that the multiple bags of cocaine within a privately searched package had already lost their expectation of privacy when the package was researched by law enforcement, who were virtually certain that the container held nothing but cocaine and revealed nothing that they were not already made aware of. Id. The Eighth Circuit has since applied the Jacobsen holding to the issue of undiscovered items within privately searched containers in United States v. Rouse. In Rouse, an airline employee privately searched a suspicious bag and found numerous identification cards and social security cards. United States v. Rouse, 148 F.3d 1040, 1041 (8th Cir. 1998). When law enforcement searched the bag later, they additionally found a laminating machine and material for laminating cards, which the airline employee had not discovered. Id. Utilizing the rule of Jacobsen in their discussion, the Eighth Circuit held that because the laminating machine and materials were undiscovered in the private search and unknown to the police, they retained their expectation of privacy. Id. As such, the suppression of the undiscovered materials within the previously searched container was ordered. Id. Similarly, the Sixth Circuit applied the Jacobsen holding specifically to laptop computers in United States v. Lichtenberger. There, a defendant s live-in girlfriend privately searched his laptop computer and discovered numerous illegal images of child pornography, but did not open all the files. Lichtenberger, 786 F.3d at 480. When the 15

20 laptop was later searched by police, they viewed a random assortment of all the pictures not necessarily just those the private searcher had viewed. Id. at The Sixth Circuit held that, in order for the officer s search to be constitutional, he needed virtual certainty that the inspection of the laptop and its contents would not tell him anything more than he had already been told by the private searcher. Id. at 488. But because the officer could not be virtually certain that his review was limited only to the photographs from the private party s earlier search, Jacobsen s virtual certainty requirement was not satisfied. Id. Additionally, the court held that, because of the expansive nature of modern data storage, the searching officer had no virtual certainty that the files would contain images of child pornography, and not constitutionally protected material. Id. at 489. The image files, labelled in a non-obvious numeric fashion, could have contained private personal photographs unrelated to the crime alleged, or even snippets of other personal documents. Id. Here, the contents of Capine s transaction history folder did not lose their reasonable expectation of privacy due to Sundon s private search. Unlike the tube of cocaine searched in Jacobsen, Capine s computer does not contain just one item; indeed, the transaction history folder contained 29 distinct, separate documents that Sundon had not searched. (R. at 3). Furthermore, like in Lichtenberger, Officer Miller could not be virtually certain that the unsearched files in Capine s transaction history folder contained evidence of drug sales. Just because the files were labelled with paired names and had similar sizes does provide virtual certainty that the files contained evidence of a crime, and did not contain highly sensitive personal information instead. Indeed, the.pdf documents none of which were searched in the private search did not even contain 16

21 evidence of the same type of crime. (R. at 3). As such, the files in the transaction history folder that were not subject to Sundon s private search should be treated like the laminating machine and materials in Rouse. Because they were passed over in the private search, the unsearched documents retained their reasonable expectation of privacy, and the private search exception does not apply. Because the unsearched contents of Capine s transaction history folder did not lose their reasonable expectation of privacy during the private search, and because Officer Miller did not have a warrant or valid exception to the warrant requirement, the files not already compromised during the private search should be suppressed. 2. The opening of one file within a folder does not necessitate that all files within that folder lose their expectation of privacy. Though the Fifth Circuit has held in United States v. Runyan that privately opened containers may be freely searched, this assertion is misplaced. There, the court held that, once a closed container is opened in a private search, it completely loses all reasonable expectation of privacy, and its entire contents even those items not discovered by the private party can be scoured by police with complete impunity. Runyan, 275 F.3d at Additionally, the court suggested that restricting police access to a privately searched container would over-deter police, who would not be able to adequately carry out searches, due to their fear that anything found might be suppressed. Id. at 465. Thus, it could be argued that because Capine s transaction history folder was accessed by a private party, Officer Miller had a complete right to search every file found inside. But this argument completely ignores the overwhelming privacy concerns that are at stake in this case. As discussed above, the modern reality of computer data storage is that personal information is stored all throughout a computer s hard drive and folders, 17

22 and is incredibly easy to find. Even illegal materials are often intermingled and hidden amongst legal, private material. See Carey, 172 F.3d at As such, a searching officer could rarely conclude with absolute certainty that a search of a computer will not contain some sort of protected, private information. Lichtenberger, 786 F.3d at With such serious, constitutionally protected privacy concerns at stake, it is unconscionable to think that even a brief search of a computer hard drive or folder would allow police unfettered access to the personal documents and data that are likely held within. Additionally, restricting government access to a briefly opened container would not over-deter police from adequately performing their duties. We must, as a society, be able to trust that police are capable of determining which materials they are allowed to search without a warrant. The exceptions to the warrant requirement are already limited in scope and applicability, meaning that police have to get a warrant to conduct a search more often than not. Maintaining the limited nature of this exception as it is applied to computer folders, therefore, will have little, if any, effect on the everyday investigatory practices of the police as a whole. Furthermore, with such serious Fourth Amendment concerns at stake, it is not unreasonable to expect police to simply get a warrant when they are unsure of whether they can search computer files without one, especially when there is no exigent circumstance that requires immediate action. Because Capine had a reasonable expectation of privacy within her computer files, and because it is not unreasonable to assume that Officer Miller simply could have secured a warrant to search those files not viewed by Sundon, Runyan s open container rule should not apply. The files not subject to the private search should thus be supressed. II. THE CFAA SHOULD BE INTERPRETED NARROWLY, IMMUNIZING CAPINE FROM LIABILITY. 18

23 A. Two interpretations of authorization within the CFAA have developed. 18 U.S.C. section 1030 (a)(2)(c), part of the Computer Fraud and Abuse Act ( CFAA ), imposes criminal liability on anyone who intentionally accesses a protected computer without authorization, or in excess of authorized access, and thereby obtains information from that computer. 18 U.S.C (2008). The CFAA defines the term protected computer as a computer which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States Id. 1030(e)(2). The CFAA defines exceeds authorized access as accessing a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter. Id. 1030(e)(6). Congress s use of the phrase affecting intestate or foreign commerce signals their intent that the CFAA should reach to the greatest length that the Commerce Clause will allow. United States v. Chesney, 86 F.3d 564, 571 (6th Cir. 1996). Given this, as well as the ubiquity of computers throughout modern commerce, the term protected computer, and consequently section 1030(a)(2)(C), covers nearly every computer in use throughout the United States. United States v. Mitra, 405 F.3d 492, 496 (7th Cir. 2005). Although the CFAA provides a definition for exceeds authorized access, it does not give a definition for the key term authorization. Since a conviction based on section 1030(a)(2)(C) requires proof that one has accessed a computer without authorization or in excess of authorization, the lack of a definition for authorization has led courts to draw different conclusions regarding the proper interpretation for the term. Circuit courts have developed two interpretations of the term authorization within the CFAA. United States v. Nosal, 676 F.3d 854, (9th Cir. 2012). The narrow interpretation of authorization limits the word to its plain meaning. LVRC 19

24 Holdings LLC v. Brekka, 581 F.3d 1127 (9th Cir. 2009). By its plain meaning, authorization refers to the existence of permission from an authority figure to do or access something. Id. Therefore, CFAA violations are based solely on whether one had permission to access information from a protected computer, not how one uses that information after they access it. Id. The broad interpretation of authorization, however, holds that the use or misuse of information obtained from a protected computer is directly connected to the authorization status of the individual who accessed the computer. Nosal, 676 F.3d at 857. Under this interpretation, an individual can be convicted of violating the CFAA if it is determined that their use of information obtained from a computer would not have been authorized by the owner of the computer. Id. This interpretation leads to the application of the CFAA in many different contexts. See United States v. John, 597 F.3d 263, 271 (5th Cir. 2010) (information accessed in perpetration of a crime); EF Cultural Travel BV v. Explorica, Inc., 274 F.3d 577, 581 (1st Cir. 2001) (information accessed in violation of an employment agreement); United States v. Rodriguez, 628 F.3d 1258, 1263 (11th Cir. 2010) (information accessed in violation of employer s internal policy); Int'l Airport Centers, L.L.C. v. Citrin, 440 F.3d 418, (7th Cir. 2006) (information accessed in violation of duty of loyalty to employer). B. The plain language of the CFAA favors a narrow interpretation of authorization. The starting point with any question of statutory interpretation is the statute s plain language. Consumer Prod. Safety Comm'n v. GTE Sylvania, Inc., 447 U.S. 102, 108 (1980). A fundamental rule of statutory construction is that unless a word is otherwise 20

25 defined within a statute, words will be understood as holding their common, contemporary meaning. Perrin v. United States, 444 U.S. 37, 42 (1979). The plain language of the CFAA holds that a violation of the statute occurs when one intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains information contained on a protected computer. 18 U.S.C. 1030(a)(2)(C) (2008). Therefore, a conviction based on section 1030(a)(2)(C) requires proof of three things: that an individual intentionally accessed a computer, that access was without authorization or in excess of authorization, and that information was taken in the course of that access. The CFAA does not give a specific definition of the words access or authorization, indicating that Congress intended for the words to carry their common meaning. Perrin, 444 U.S. at 42. Authorize means to, give official permission for or approval ; authorization is defined as, the action or fact of authorizing or being authorized. Oxford Dictionaries (Feb. 7, 2016), htttp:// definition/american_ english/authorize. Access, in the computer context, means to, obtain, examine, or retrieve. Oxford Dictionaries (Feb. 7, 2016), oxforddictionaries.com/us/definition/american_english/access. As these contemporary definitions show, to access something with authorization is to obtain or examine it with official permission. Therefore, the difference between accessing something with authorization and accessing something without authorization is whether one had been given permission to access it from an authority figure. How one uses information they have been given permission to access, therefore, is of no concern to one evaluating a potential section 1030(a)(2)(C) violation. 21

26 Additionally, there is no indication anywhere else within section 1030(a)(2)(C) that how one uses information after they obtain it has any bearing on a potential CFAA violation. Beyond intentionality and lack of authorization, a section 1030(a)(2)(C) conviction only requires that information from a computer be taken. 18 U.S.C. 1030(a)(2)(C) (2008). Section 1030(a)(2)(C) is not concerned with how information is used once it is taken because a violation of the Act is established once it is shown that information was in fact taken. Therefore, any use, no matter it pernicious nature, of information after it is taken is meaningless for section 1030(a)(2)(C). One may argue that when an authority figure explicitly limits the way one may use a computer they have been given authorization to access, any violation of those limitations would be considered accessing the computer in excess of authorization. As the CFAA s legislative history shows, however, this argument fails. Congressional committee reports concerning the CFAA indicate that its main purpose was to combat the actions of hackers, and not, for example, employees who violate internal company policies. H.R. REP. NO , at 21 (1984); S. REP. NO , at 7 (1986). Similarly, Congressional reports concerning the CFAA stated that they understood exceeding authorized access as a situation where someone who is authorized to use a limited number of computers within an organization accesses computers for which they were not given authorization. Id. at 8. These reports show that the CFAA is concerned with individuals, like hackers, who access computers without any authorization, not employees who use their authorized access in a way their employers prohibit. Moreover, as stated above, the CFAA s plain language shows that the statute is solely concerned with whether or not one had 22

27 authorization to access the computer in the first place, not how one uses that access. In this way, one can violate a company policy concerning use of a computer and still be innocent of any CFAA violation; they involve two completely separate inquiries. An argument that a computer accessed with the intention of perpetrating a crime would automatically be considered exceeding authorized access because one cannot be legally authorized to commit a crime would similarly fail. This is because, as stated above, a section 1030(a)(2)(C) violation consists of intentionally taking information from a computer you are not authorized to access, not using information in any unauthorized way. Therefore, the severity of the intentions involved with taking information from a protected computer makes no difference. In sum, the absence of a specific definition of authorization within the CFAA indicates that Congress intended for the word to carry its common, contemporary meaning. The common meaning of authorization is the existence of permission from an authority figure to do something. Oxford Dictionaries (Feb. 7, 2016), oxforddictionaries.com/us/definition/american_ english/authorization. Furthermore, the CFAA does not contain any language that would suggest that how one uses information has any bearing on an authorization issue. All that is needed to prove that one has violated section 1030(a)(2)(C) is a showing that someone intentionally accessed a computer and took information from it, any subsequent use of the information taken is meaningless. Therefore, the narrow interpretation of authorization that does not incorporate the idea of misuse within its definition is the proper interpretation according to the plain language of the statute. C. The rule of lenity dictates that the narrow interpretation should be adopted. 23

28 According to the rule of lenity, when an ambiguity exists between two alternative readings of what conduct Congress has made a crime, a court must choose the less harsh alternative and require Congress to adopt clear language before the harsher alternative is accepted. United States v. Bass, 404 U.S. 336, 347 (1971). An ambiguity within a statute exists where a court, after extinguishing all available aids of statutory construction, can do nothing more than guess at Congress s intended meaning. Muscarello v. United States, 524 U.S. 125, 138 (1998). Relevant to an inquiry of ambiguity are the purpose and history of the statute. Abramski v. United States, 134 S. Ct. 2259, 2267 (2014). Here, if it is determined that the plain language of section 1030(a)(2)(C) is not enough to adopt a narrow interpretation, an ambiguity may exist in regards to how authorization should be interpreted. But before determining whether an ambiguity exists, the statute s history and development should be examined. The CFAA, in its original form, only applied to situations involving governmentowned computers with three government interests in mind: national security, the protection of personal financial records, and the protection of government property. Orin S. Kerr, Vagueness Challenges to the Computer Fraud and Abuse Act, 94 MINN. L. REV.1561, 1564 (2010). Since then, the CFAA has been amended numerous times between 1986 and Among these amendments was the introduction and subsequent modification of the term protected computer. 18 U.S.C. 1030(e)(2) (2008). As stated above, the modern definition of protected computer enables the CFAA to be applicable to nearly every computer within the United States. Mitra, 405 F.3d at 496. Given the tremendous expansion of the CFAA from covering solely government computers to covering nearly every computer in the United States, it could be fair to think 24

29 that a similar expansion for authorization is appropriate. Numerous congressional committee reports, however, do not signal for such an expansion. For example, two reports concerning the CFAA from 1984 and 1996 state that the intent of the law is to proscribe the unauthorized use of a computer, not the unauthorized use of information gained from a computer. S. REP. NO at 6-7 (1996); H.R. REP. No at 20 (1984). The 1996 report goes on to analogize the prohibitions in the CFAA to theft in that laws covering theft are solely concerned with the act of taking something that you did not have permission to take, and how one uses an object after it is taken is of no consequence. S. REP. NO , at 7-8 (1996). These Congressional reports suggest that a narrow interpretation of authorization is proper. In addition, as explained above, the plain language of the statute suggests that the narrow interpretation of authorization is the proper one. The weight of the evidence, therefore, seems to favor a narrow interpretation. As explained above, the rule of lenity holds that when an ambiguity exists within a criminal statute regarding what behavior Congress has criminalized, courts must side with the less harsh interpretation. Here, the weight of the evidence suggests that a narrow interpretation of authorization is proper. But, even if one were to assume that this evidence is not enough, it cannot be said that there is enough evidence in favor of a broad interpretation to make it proper. Therefore, at best the evidence favors a narrow interpretation, and at worst an ambiguity still exists regarding the proper interpretation. Since the CFAA is a criminal statute, such an ambiguity would invoke the rule of lenity, which would lead to the adoption of the less harsh of the two alternatives. 25