Computer search and seizure issues in Internet crimes against children cases. By Susan S. Kreston Child sexual exploitation encompasses a broad spectrum of types of child abuse. For purposes of this article, the type of child sexual exploitation that will be primarily dealt with is computerfacilitated child pornography. However, other types of child sexual exploitation cases, such as prostituting children, on-line luring and abduction, and trafficking, will also certainly generate computer evidence. (1) Child pornography is the permanent recording of the sexual abuse and exploitation of a minor. The best approach to combating this crime is a multi-disciplinary one, in which the investigator, prosecutor, and all other allied criminal justice professionals involved work together to best ensure that sexually exploited children are assisted by the criminal justice system. Working together as a team also ensures the best chance for bringing to justice the perpetrators of this crime. One of the most important areas of multi-disciplinary collaboration is in the drafting and execution of search warrants. This article will initially focus on what components should be found in a search warrant, then address the exceptions to the search warrant requirement, specifically concentrating on the topics of plain view, consent, private searches, exigent circumstances and parole and probation considerations, and conclude with an overview of federal privacy statutes that may impact on search warrant issuance and execution. I. COMPUTER SEARCH AND SEIZURE ISSUES (2) With the advent of computer technology, the production and storage of child pornography has changed radically. In the past,

production and storage were expensive, technically difficult and often left a readily discernible trail for law enforcement to follow. With current computer technology, the creation of child pornography has been reduced to an easy-to-accomplish exercise, needing only common video cameras, video capture boards, digital cameras, or scanners and software tools to inexpensively and easily record and edit the product. The computer's capacity to store images in digital form makes it an ideal repository for child pornography. A single CD-R can store hundreds to thousands of images and thousands of pages of text. Hard drives can store hundreds of thousands of images at very high resolution. Thumb drives, Smart Cards, DVDs, CD-RWs, zip disks, and jazz disks, which can be easily hidden due to their small size and shipped anywhere in the world, can also store thousands of images. The communication between pedophiles engaging in the business of child pornography has also been revolutionized by the nearly universal access to computers now enjoyed in the United States. (3) This communication allows contact to be made around the world quickly, privately, and anonymously. These advantages to computer interaction are well known and serve as a foundation of trade among pedophiles. The ability to produce child pornography easily, reproduce it inexpensively, and market it anonymously (through electronic communications) has drastically changed the method of distribution. Child pornography can now be electronically mailed to anyone with access to a computer and a modem. With the proliferation of commercial services that provide electronic mail, anonymous re-mailing, chat rooms, and off-site storage facilities, computers have become a favored medium among child

pornographers. (4) In view of the advancing technological aspects available to those who traffic in child pornography, traditional tools used in criminal investigations, such as the search warrant, must be adapted to respond to the new and emerging facets of this crime and to the unique issues that arise within a child abuse/sexual exploitation case. II. SEARCH WARRANTS The Constitution requires law enforcement to establish "probable cause, supported by Oath or affirmation," and must "particularly describ[e] the place to be searched, and the persons or things to be seized." (5) The items to be seized must be defined with sufficient detail so as to limit the executing officer's discretion in deciding what will be seized. Components of a search warrant in cases of Internet crimes against children will now be detailed. A. Background Information A search warrant may begin with an introductory paragraph reciting the affiant's training and experience in the area of investigating child sexual exploitation. An affiant's expertise may be established by listing the following: (1) present rank and assignment, (2) area(s) of responsibility, (3) length of experience as a law enforcement officer, (4) training and work experience received in the area of child sexual exploitation, (5) training and work experience received in the area of computers, including conferring with other law enforcement officers trained in computer investigations, and (6) any other relevant information. The affiant may also rely upon the expertise of others.

Information explaining the Internet, the World Wide Web, chat rooms, electronic bulletin boards, Internet Service Providers ("ISPs"), free e-mail programs (e.g., Yahoo!), or other specialized online services relevant to the case should also be included in the search warrant application. The affiant should not assume the reader of the request for a search warrant has knowledge of the latest computer technologies or jargon. The terminology and descriptive explanations should be made as detailed as possible. B. Probable Cause Probable cause is established through an affidavit in support of the warrant, setting out the factual basis for the warrant application. In determining whether probable cause exists to issue a warrant, the issuing judge must decide whether, given the totality of the circumstances, there is a fair probability that contraband or evidence of a crime will be found in a particular place. (6) In determining if there is probable cause to seize and search a particular computer suspected of containing evidence of child sexual exploitation or having been used to facilitate the crime of child sexual exploitation, two facts must be established: first, that there is a computer physically located at a particular location and, second, that the computer contains evidence of, or was used to commit, the crime. If this two-prong test is not satisfied, the warrant will be invalidated. (7) C. Drafting the Warrant In many cases, undercover communications with the suspect via the Interact furnish probable cause to believe that the suspect's computer contains child pornography and other evidence of distribution and receipt. .In proactive cases, undercover

investigators, posing as minors, meet the suspect in predicatedchat rooms or an Internet Relay Chats ("IRC") (8) and receive child pornography image files from suspects who are also in the "room" or IRC. In reactive cases, actual minors and/or their parents, or other private citizens report receipt of child pornography image files to law enforcement agents, who then begin an investigation. Many affidavits in support of a search warrant list the titles of each image and describe their contents so that the reviewing magistrate can make a determination as to the illegality of the images. In United States v. Brunette, (9) the court held that where "neither the magistrate judge nor the district court judge independently viewed the images[,] ... and because the affidavit did not adequately describe them, we conclude that the warrant was not supported by probable cause." (10) The case was affirmed however, but only by applying a United States v. Leon (11) good faith analysis. (12) One way to avoid these questions is to print copies of the images, place them in sealed envelopes and make them available to the magistrate to review if desired. Accompanying e-mail messages, as well as the titles of the images, provide additional evidence as to the suspect's knowledge that the images feature children engaged in sexually explicit conduct or sexually explicit poses. In addition, IRCs and newsgroups are typically named to correspond to the user's interest, as in "preteensex." This evidence is particularly important if the affidavit includes an expert opinion section discussing the behavioral characteristics associated with a child pornography collector. The affidavit should recite case specific

evidence demonstrating that the suspect is a candidate who is likely to fit the behavioral characteristics identified. (13) Child pornography warrants typically authorize the seizure of all images of child pornography. The affidavit and attachments should specifically define the meaning of the term "child pornography." If the warrant authorizes seizure of child pornography as referred to in 18 U.S.C. [section] 2252A, there should be a reference to the definition found in [section] 2256(8). This is especially true in light of the Supreme Court's ruling in Ashcroft v. Free Speech Coalition, (14) which held unconstitutional the definitions contained in [subsection] 2256(8)(b) (15) and 2256(8)(d). (16) In situations in which a suspect is downloading child pornography files from, or uploading such files to, a newsgroup, the affidavit should include general Internet background, descriptions of terms used, and explanations of the investigative techniques for the reviewing magistrate, using accessible, non-technical, user-friendly language. D. Particularity Child pornography computer cases can present unique challenges when trying to describe the items to be seized with sufficient detail. Descriptive computer search language used in a search warrant affidavit might include the following: All electronic data processing and storage devices, computers and computer systems, such as central processing units, internal and peripheral storage devices such as fixed disks, internal and external hard drives, floppy disk drives and diskettes, tape drives and tapes, optical storage devices, dongles, encryption keys, personal data assistants (PDAs) or other memory storage devices, and any/all peripheral

input/output devices such as keyboards, printers, video display monitors, optical readers, and related communication devices such as modems, associated telephone sets, speed dialers, and/or other controlling devices, plotters, software to run programs, connecting cables and plugs, peripherals such as joysticks, mouses, or other input devices, scanners, writing pads, manuals, connecting switches, telephones and telephone cables, and interface devices; system documentation, operating logs and documentation, software and instructional manuals. Computing or data processing software, stored on any type of medium such as: hard disks, floppy disks, CD-R's, CD-RW's, DVD's, cassette tapes, or other permanent or transient storage medium. Any records, whether stored on paper, on magnetic media such as tape, cassette, disk, diskette or on memory storage devices such as optical disks, programmable instruments such as telephones, "electronic calendar\address books" calculators, or any other storage media, together with indicia of use, ownership, possession, or control of such records. Any written or computer communication in printed or stored medium such as e-mail and chat logs whether in active files, deleted files or unallocated space on the hard drive, floppy drive or any data storage media. Search of all of the above items is for files, data, images, software, operating systems, deleted files, altered files, system configurations drive and disk configurations, date and time, and unallocated and slack space, for evidence. (17)

However, this language must still be limited in scope to evidence of the crime alleged or criminal activity. In People v. Higgins, the warrant requested the seizure of "[a]ll computer equipment

capable of sending and receiving material via the Internet, or other forms of electronic communication designed to send or store an image[, and a]ll peripheral devices capable of processing a photographic or video image into electronic form for storage or transmittal including, but not limited to, scanners." (18) This language was found not to satisfy the particularity requirement of the Fourth Amendment. (19) However, by distinguishing this case from the facts of United States v. Hay, (20) this decision appears to state that had this generic language simply been qualified to include "[a]ll computer material ... that constitutes or contains evidence of the crime under investigation," then the warrant should survive particularity challenges. (21) In United States v. Upham, computer software and hardware, computer disks, and disk drives were ruled to be sufficiently specific. (22) Affidavits in support of the warrant should be attached or incorporated by reference to cure any alleged lack of particularity in the warrant itself. (23) Additionally, United States v. Simpson held that even where an affidavit was neither attached nor incorporated into the warrant, the good faith exception established in Leon might still allow for admissibility of the evidence. (24) An entire class of items may be seized if the warrant is sufficiently particular to establish probable cause to support the seizure of the entire class and a more precise description is not possible. (25) Where detailed particularity is impossible, generic language, if it particularizes the types of items to be seized, would be permissible. (26) Terminology used within the application should also be defined. These may be defined by reference to the applicable statute's definitions of these terms. (27) Words must be

defined with sufficient particularity to limit the executing officers' discretion in determining what to seize. (28) Under United States v. Koelling, (29) typographical statutory citation errors may be rendered harmless if the full content of the statute is put in the warrant. (30) Some courts have, however, held the warrant language to the higher "scrupulous exactitude" standard of particularity due to First Amendment and overbreadth concerns. (31) However, according to United States v. Rude, warrants must only be "reasonably specific, rather than elaborately detailed and the specificity required varies depending on the circumstances of the case and the type of items involved." (32) E. Overbreadth Overbreadth issues arise when the warrant is too broad in the sense that it includes items that should not be seized. In United States v. Loy, the court stated that "children under the age of 18 engaging in sexually explicit conduct" was not considered to be overly broad. Similarly, United States v. Koelling held that "[t]he fact that some adults look like minors and some minors look like adults does not mean [that] a warrant is overbroad. Most minors look like minors and most adults look like adults, and most of the time most law enforcement officers can tell the difference." (33) Likewise, in Upham, the court stated that "any and all visual depictions, in any format or media, of minors engaging in sexually explicit conduct [as defined by the statute] ..." was not unconstitutionally over broad. (34) Furthermore, United States v. Layne held that simply using the term "child pornography" was not overly broad. (35) Deleted data that is recovered has also been held to be within the scope of a warrant that authorized the search and seizure of "[a]ny

and all visual depictions, in any format or media...." (36) In United States v. Upham, the court specifically stated "their [deleted image] recovery, after attempted destruction, is no different than decoding a coded message lawfully seized or pasting together scraps of a torn-up ransom note." (37) In United States v. Tucker, (38) a case involving deleted images, the defendant argued that he did not possess the images as they were deleted. (39) There the court held that ability to destroy is definitive evidence of control and "[d]estruction of contraband does not logically lead to the conclusion that one never possessed it; indeed, it leads to the exact opposite." (40) F. Good Faith Even if the warrant is successfully attacked under either of the above noted areas, the good faith exception may allow for the admissibility of the seized item(s). (41) The good faith exception requires that the officer acted in reasonable reliance upon a warrant issued by a detached and neutral magistrate and the officer was unaware that the warrant was unsupported by probable cause, despite the magistrate's authorization. (42) In both Loy and United States v. Rowland, the courts held that where there was: (1) more than a "bare bones" affidavit; (2) a specific condition placed on the execution of the warrant and; (3) reasonable reliance on the magistrate's authorization, the good faith exception applied and the seized items (child pornography delivered to a post office box but seized at a residence) were admissible. (43) Similarly, in United States v. Jasorka, the court held that officers' reliance upon a search warrant issued on the basis of an affidavit that described a package of photographs was valid according to the Leon good faith exception to the

exclusionary rule. (44) Although the court did not decide whether the magistrate judge had a sufficient basis for issuing the warrant without personally viewing the photographs in order to determine whether they were "lascivious," the warrant was found not so facially defective as to bar a finding of reasonable reliance. (45) The 2002 Supreme Court case of Ashcroft v. Free Speech Coalition, striking down sections of 18 U.S.C. [section] 2256 as overbroad, brings forward the question of whether the warrants that were issued, using then-appropriate language, should all be invalidated. (46) Recently, this question was answered in United States v. Syphers, (47) where the court held the following: Syphers also notes that the Supreme Court has struck down as unconstitutionally overbroad that portion of 18 U.S.C. [sections] 2256 which criminalized depictions which "appear to be" of a minor engaging in sexually explicit conduct.... He therefore contends that [the affiant] Dougherty's affidavit, which provided only that the persons depicted in the materials allegedly seized from the apartment "appear to be" minors, did not show probable cause that the CPU contained images violating the enforceable part of the statute. Free Speech Coalition, however, was not decided until April 16, 2002, more than four months after Dougherty submitted his affidavit describing the materials on November 28, 2001. The government therefore argues that the evidence allegedly discovered on the CPU should not be suppressed because the police were acting in good faith in searching pursuant to a warrant which was consistent with the law existing at that time. Because the purpose of the exclusionary rule is to deter police officers from violating the Fourth Amendment, evidence should be suppressed only if it can be said that the law enforcement officer had knowledge, or may properly be charged

with knowledge, that the search was unconstitutional under the Fourth Amendment.... Assuming, without deciding, that an affiant's statement that an image "appears to" depict a minor engaged in sexual activity does not establish probable cause to search for child pornography in the wake of Free Speech Coalition, the court determines that the good faith exception precludes application of the exclusionary rule to the evidence allegedly recovered from the CPU. (48)

G. Expert Opinion Within the field of computer-facilitated child sexual exploitation, a unique element, known as the "expertise" component, may be included in a warrant application. (49) An expertise component would include a description of those individuals who are sexually interested in children, sometimes called preferential sex offenders ("PSO"), (50) including the typology, behaviors and strategies of a sexual offender. An example of "expertise" language might include the following: Based upon your affiant's training, experience and conversations that your Affiant had with other Law Enforcement Officers and/or reports that your Affiant has read, your Affiant is aware that the following characteristics are generally found in varying combinations in people who produce, trade, distribute or possess images / pictures of minors engaged in sexually explicit conduct: These people view children as sexual objects. They receive gratification from sexually explicit images / pictures of minors. They collect sexually explicit images / pictures of minors, which they use for their own sexual gratification and fantasy. They rarely, if ever, dispose of sexually

explicit images of minors because the images are treated as prized possessions. They store such images in many different formats including photographs, printouts, magazines, videotapes, and many other forms of digital media such as hard drives, diskettes, CD's and/or DVD's and other storing devices. They store the images in many different locations such as their home, their vehicle, their work areas and other areas under their control. They use sexually explicit images / pictures of minors as a means of reliving fantasies or actual sexual encounters. They use the images as keepsakes and as a means of gaining acceptance, status, trust and psychological support by exchanging, trading or selling the images / pictures to other people with similar interests. They may go to great lengths to conceal and protect from discovery their collection of sexually explicit images / pictures of minors. They may have passwords to access programs or control encryption written either in the vicinity of their computer, or on their person, for instance in their wallet or address book. They maintain images / pictures of minors with whom they have had sexual contact. If such a person takes a picture of a minor, depicting the minor in the nude, there is a high probability that the minor was used to produce sexually explicit images. (51)

The warrant application should include only those characteristics applicable to the suspect at hand, e.g. the presence of grooming evidence, the possession of pornography-either child or adult, and trophy/blackmail diaries to help the offender remember and relive the child's victimization. The key for investigators is to set forth in the affidavit not only the characteristics and mode of operation of PSOs, but also specific facts as to how the defendant has

demonstrated those characteristics and support for any conclusions that the suspect fits into that class of persons. When drafting an expertise component into a warrant, it should explain, in a case-specific manner, why or how the particular characteristics apply to the suspect. (52) This component should be used to supplement the probable cause developed elsewhere in the affidavit to expand the scope of the search to include evidence of grooming, or to address potential staleness issues. (53) United States v. Anderson (54) and United States v. Lamb (55) have held that a boilerplate expertise section, explaining general concepts of offender typology, is helpful and relevant when accompanied by case-specific information. (56) On a related issue, recent case law, including United States v. Long, (57) and United States v. Romero, (58) has allowed trial testimony by a properly qualified expert as to methods and techniques of preferential child molesters. In these cases, Special FBI agent Kenneth Lanning was qualified as an expert concerning sexual exploitation of children, including "'the typology, identification, characteristics, and strategies of sexual offenders, in particular preferential sex offenders,' as well as 'the characteristics and behavior of child victims of sexual abuse.'" (59) In Romero, Lanning was allowed to testify to the traits of offenders. (60) Lanning testified that grooming of the victim (61) by a preferential sex offender (PSO) is not a temporary, opportunistic event, but occurs over a long period of time with extreme persistence (in Romero the perpetrator engaged in nine months of Internet grooming and hundreds of miles of travel to effectuate his exploitation). (62) The specific, focused interests of the offender were also discussed. (63) Agent Lanning testified that the offender's interest in children may be age and gender

specific, or more pragmatic, such as simply searching for a vulnerable child. (64) The PSO identifies a need in the child and then fills that need. (65) It is here that the PSO gains the trust and confidence of the child. Finally, fantasy and need-driven behavior was discussed. (66) Specifically, the fact that perpetrators almost always collect child pornography and compulsively keep records and documentation of the abuse. (67) In Long, Agent Lanning's testimony was allowed in to rebut the defense of innocent intent and fabrication by the defendant, noting that the average layperson lacks knowledge regarding the manner in which preferential sex offenders operate. Long was a minister of the church and a substitute teacher, positions a juror would ordinarily view as held by law-abiding citizens of high moral character. (68) H. Staleness The age of the information supporting a warrant application is also a factor in determining probable cause. If the information is too old, it is stale, and probable cause may no longer exist. Age alone, however, does not determine staleness. The nature of the crime and the type of evidence must also be examined. The expert should also address whether the particular subject is likely to keep his contraband for long periods of time. (69) In United States v. Harvey, the Court of Appeals for the Third Circuit found a search warrant to be valid where delivery of pornographic materials to the suspect's residence occurred between two and fifteen months before the execution of the search warrant. (70) The court stated that age alone does not determine staleness, but that the nature of the crime and the kind of evidence are also factors to consider in determining the staleness of the affidavit in support of the search warrant. (71)

In United States v. Lacy, the court was "unwilling to assume that collectors of child pornography keep their materials indefinitely, but the nature of the crime, as set forth in this affidavit, provided 'good reason[]' to believe the computerized visual depictions downloaded by Lacy would be present in his apartment when the search was conducted ten months later." (72) Based on the facts of the case, Lacy held that 10-month-old information of receipt of child pornography was sufficient for probable cause. (73) As noted, those who deal in pornography treat these materials as valuable commodities, sometimes even regarding them as collections, and retain them in secure but available places for extended periods of time. (74) This is why an appropriate reference to expert opinion that child pornography collectors retain their collections for long periods of time can overcome staleness of the information. In United States v. Anderson, the Ninth Circuit relied on expert testimony to that effect and held that an 11-month lapse between obtaining information on child pornography and the search did not render the information stale. (75) The Eighth Circuit employed similar reasoning in United States v. Horn to allow for a three-month lapse, (76) and the Ninth Circuit followed its own precedent from Anderson in Hay (77) to allow a six-month lapse before the search was executed. I. Additional Considerations in Description of Items to Be Seized (78) While the focus of this article is child sexual exploitation, it must be stressed that these cases are a subset of all child abuse cases. As such, it is imperative that the "traditional" types of child molestation evidence not be forgotten when drafting a search warrant. If supported by the facts of the investigation, physical

evidence, such as sexual devices, lubricants, the child's clothing/underwear, bondage and discipline paraphernalia, adult pornography, and any other items used to sexually or physically abuse or exploit the child may be sought. (79) If appropriate, forensic evidence such as blood, blood spatter, semen, vaginal fluid, urine, hair, fiber evidence, and chemical evidence should be sought from the victim, suspect and crime scene. (80) It may be necessary to utilize special equipment, such as luminol lights, to properly and thoroughly search for some of these items. (81) When executing the warrant, agents should be sure to look for any evidence, however small, that corroborates the child's account of the abuse. In addition, other items may also be subject to seizure, depending upon the nature of the investigation. (82) For example, noncontraband evidence such as "child erotica," correspondence with other persons or groups interested in sexual behavior with children (e.g., North American Man/Boy Love Association ("NAMBLA")), diaries or other records of child sexual partners, phone or address books in which the suspect has recorded the name(s), address(es) and phone number(s) of child sexual victim(s), camera equipment with which the suspect has taken photos of a child or children engaged in sexually suggestive poses or sexual activity, information concerning any safe-deposit box or storage facilities used by the suspect to store records or personal belongings, and computer hardware and software used by the suspect to store the personal records and information of his relationships with child victims, should be considered so long as there is probable cause supporting the seizure. (83) If these types of items are seized but not named in the warrant, there is precedent for suppressing them. (84) Therefore, it is critical that

they be listed in the warrant to be given the best chance of being admissible later at trial. J. Federal Rule 41 and the Fourth Amendment Federal Rule of Criminal Procedure 41 states, in pertinent part, the following: (e) Issuing the Warrant. (2) Contents of the Warrant. The warrant must identify the person or property to be searched, identify any person or property to be seized, and designate the magistrate judge to whom it must be returned. The warrant must command the officer to: (A) execute the warrant within a specified time no longer than 10 days[.] (85)

A thorough forensic examination of a single, stand-alone computer, such as a laptop, takes approximately forty hours. (86) This time frame will obviously be expanded in situations where investigators have seized multiple computers, computers that are part of a network or, multiple types of digital evidence to be examined. Due to the high volume of information that may be contained within a computer, delays in the timely forensic analysis of computers are common. (87) The limited resources devoted to analysis of seized hardware by law enforcement agencies exacerbate this situation, resulting in a nationwide average delay of six months in forensic analysis. (88) Delays in forensic examination of seized computers have been unsuccessfully challenged on a number of occasions at motions to suppress hearings under the "10 day" rule provided by Federal Rule of Criminal Procedure 41. (89)

In United States v. Hernandez, a six-week delay occurred between the initial search of the hard drive and the subsequent search of floppy drives that had also been seized. (90) In denying Hernandez's motion to suppress, the court stated: Neither Fed. R. Crim. P. 41 nor the Fourth Amendment provides for a specific time limit in which a computer may undergo a government forensic examination after it has been seized pursuant to a search warrant. In most cases, the forensic examination of the computer will take place at a different location than that where the computer was seized. The same principle applies when a search warrant is performed for documents. The documents are seized within the time frame established in the warrant but examination of these documents may take a longer time, and extensions or additional warrants are not required. The examination of these items at a later date does not make the evidence suppressible. (91)

Other courts that have looked at this same issue have come to similar conclusions. In United States v. Habershaw, the court refused to suppress evidence that was discovered on the computer fourteen days after the warrant's execution. (92) The court held that "[f]urther forensic analysis of the seized hard drive image does not constitute a second execution of the warrant or a failure to 'depart the premises' as defendant claims, any more than would a review of a file cabinet's worth of seized documents." (93) Finally, a seven-month delay in the analysis of a seized computer was upheld in United States v. Syphers. (94) Here, the court discussed the constraints on the government's ability to delay examination of the evidence being only those of reasonableness

under the Fourth Amendment: Finally, Syphers asserts that the state acted unreasonably in detaining the CPU for seven months before completing the search. The government counters that the Fourth Amendment does not impose any limitation on the length of a forensic examination of a computer. "However, from the general prohibition against 'unreasonable searches and seizures' ... it may be contended that there are some constitutional limitations upon the time when a search warrant may be executed." .... The court concludes that the state did not overstep any constitutional boundaries in seizing the CPU for seven months under the circumstances presented. .... Syphers' motion is therefore denied to the extent it seeks suppression of evidence allegedly found on the CPU on the ground that the state took possession of the computer for an excessively long period. (95)

Ultimately, these cases will turn on a case-by-case basis of reasonableness of the delay, with the "10 day" rule taking a back seat to reasonableness of the government's conduct in the delay. K. Off-Site Searches The search warrant should address the situation where the volume of the items and information to be seized may require seizure of all computer items to be processed later in a laboratory or other controlled environment as sorting on-site extremely impractical as it may take weeks, or theoretically, months. If this is the case, the warrant application should note that a laboratory environment is needed to protect the integrity of the evidence, as well as

recover hidden, erased, compressed, password-protected or encrypted files. The high volume of the contents and intentional concealment of criminal activity mandates examination of all stored data to determine if it is covered by warrant. The off-site search has been addressed recently in United States v. Albert, where the district court held that the mechanics of searching a hard drive by viewing all of the information it contains cannot readily be accomplished on-site. (96) The off-site search was therefore appropriate and constitutional. (97) Albert noted and followed Upham, where "[t]he First Circuit upheld the off-site search of a computer, finding that it 'was about the narrowest definable search and seizure reasonably likely to obtain the images.'" (98) III. EXCEPTIONS TO THE WARRANT REQUIREMENT (99) A. Plain View The plain view exception applies to a seizure of electronic evidence if officers are in a lawful position to observe the evidence and its incriminating character is immediately apparent. (100) For example, if officers were lawfully present in a target's house and observed child pornography on the computer screen, the officers could seize the computer under the plain view exception. (101) The officers could not, however, search the computer based on their plain view seizure. The officers would be first required to obtain a warrant, based on probable cause, that the computer contained visual depictions of child pornography. (102) They would then be allowed to lawfully search the entire hard drive and any relevant and material parts, peripherals, manuals, or other items identified in the warrant. (103)

In United States v. Wong, the police executed a search with a warrant of the defendant's house looking for evidence that he had murdered his girlfriend. (104) During the search of his computer, the police found files containing child pornography. (105) The police then obtained a supplemental warrant and found more child pornography. (106) On appeal, the court held that the first image of child pornography was in plain view when the officer was legally searching for evidence in graphic files, and the supplemental warrant supported the introduction of all subsequent images found. (107) In United States v. Simmonds, a detective investigating a case involving a 14-year-old runaway, entered the defendant's motel room and "noticed a white piece of paper lying face-down on the edge of a nearby table." (108) The detective "could see through the sheet of paper an image of a child in a sexual pose. He turned over the paper and confirmed that it was indeed child pornography." (109) The defendant subsequently pled guilty to receiving and distributing child pornography. (110) In deciding the legality of the underlying search, the court held that: [a]lthough the paper was face-down against the table, Detective Washburn testified that he could see through the white sheet of paper an image of a child in a sexual position. In other words, the pornographic picture was in plain view, despite the paper being face-down. He thus had the requisite probable cause to turn over the sheet of paper and conduct a "search" of it. (111)

In United States v. Walser, police found a thumbnail (112) sketch of child pornography while conducting a warrant search of the defendant's computer for drug information. (113) The agent suspended the search and obtained a new warrant covering child pornography. (114) The court upheld the search, emphasizing the appropriate restraint shown by the agent in obtaining the supplemental warrant. (115) In United States v. Gray, federal agents seized Gray's computers to search for evidence of "unauthorized computer intrusions" at a library. (116) During their routine search, agents came across pornographic pictures of minors. (117) At that point, the agent ceased the search and "obtained a second [search] warrant authorizing a search of [the] files for child pornography." (118) The court ruled that the pornography was discovered under the plain view exception, reasoning that "[i]n searching for the items listed in the warrant, [the agent] was entitled to examine all of [the] defendant's files to [decide] whether they contained items that fell within the scope of the warrant." (119) In doing so, the agent "inadvertently discovered evidence of child pornography, which was clearly incriminating on its face." (120) In contrast, in United States v. Carey, a police officer accidentally discovered child pornography on the defendant's computer while conducting a search for evidence of drug transactions. (121) Without obtaining another warrant, he downloaded and viewed more than 200 similarly labeled files in a search for additional images of child pornography. (122) The court held that, while he discovered the first image of child pornography inadvertently, the officer exceeded the scope of the warrant because, after the accidental discovery of illegal pornography, "he expected to find child pornography and not material related to drugs." (123) As a

result, the panel concluded that the officer had temporarily "abandoned his search" for drug trafficking evidence and intentionally commenced a search for more child pornography, which the existing warrant did not authorize. (124) B. Consent Consent from the party whose computer is being searched may eradicate the need for a search warrant, provided the consent is voluntary, either impliedly or explicitly, and not coerced. In United States v. Salvo, the court held that voluntary consent was found when a suspect, after being told that he was not under arrest, signed a consent form, even when the agent stated a warrant would be obtained if consent were not given. (125) The search must also not exceed the scope of the consent given. In United States v. Turner, consent was granted to search for an intruder and evidence of an assault, but computer files were searched as well. (126) These files and their contents were later suppressed. (127) However, in United States v. Lemmons, it was held that an initial consensual search can be expanded based on the defendant's actions. (128) In Lemmons, the defendant signed a standard written consent to search form. (129) Thereafter, he and law enforcement jointly went through his belongings, including his computer, where they discovered child pornography. (130) While the Seventh Circuit held that a general written consent form did not authorize the search of the computers, the suspect's subsequent assistance in the search expanded the scope of the general consent to include the computers. (131) It must be remembered that consent may be withdrawn at any time prior to completion of the search, but any

evidence discovered prior to withdrawal may still be seized and searched. (132) A warrantless consent search must be executed with the permission of an authorized party. (133) If the party giving consent to the search is not the target of the investigation, that person must be reasonably believed by law enforcement to have lawful access and control over the item or premises. (134) Consent searches can raise multiple issues depending on the parties involved. When a third party (e.g., spouse, parent, employer, room/housemate, lessor) gives consent, the question becomes whether that party had common authority over the object of the search and, as a result, the authority to consent to the search. Generally, a spouse may consent to a search of the entire home. (135) However, with regard to computers, an exception to this rule exists when one spouse has excluded the other from using the computer or from entering certain files, either by the use of encryption or passwords known only to one spouse. A critical case on this issue is Trulock v. Freeh. (136) In Trulock, the plaintiff and his co-habitant, Linda Conrad, "both used a computer located in Conrad's bedroom and each had joint access to the hard drive. Conrad and Trulock, however, each protected their own personal files with passwords; Conrad did not have access to Trulock's passwords." (137) The court held that "[a]lthough Conrad had authority to consent to a general search of the computer, her authority did not extend to Trulock's password-protected files." (138) Another third-party consent situation characterized as bailorbailee was recently decided in United States v. James. (139) In that case, defendant James gave another inmate a letter for

mailing. (140) The inmate gave the letter to his attorney, who passed it on to law enforcement. (141) The contents of the letter asked the intended recipient, Michael Laschober ("Laschober"), to destroy all CDs James had left with him. (142) The detectives contacted Laschober, and he consented to the police taking the CDs, which were later found to contain child pornography. (143) In suppressing this evidence, the court held that James did not intend to give permission to Laschober, characterized as a bailor, to exercise control over the discs or to consent to the searching of the discs. (144) After dismissing the consent argument, the court also disposed of the government's "apparent authority" claim with the following: It cannot be reasonable to rely on a certain theory of apparent authority, when the police themselves know what the consenting party's actual authority is in this case, not to store the discs, but to destroy them. The standard of reasonableness is governed by what the law-enforcement officers know, not what the consenting party knows. Here the detectives knew too much about Mr. James's manifested desire to keep others, including Mr. Laschober, from seeing the contents of the disc to rely on Mr. Laschober's authority to consent. (145)

It must be noted, however, that there is an alternative line of bailor-bailee theory that takes a broader view of third-party consent. This theory ignores or minimizes the significance of ineffectual efforts to shield the third party from the information, as found in James, and places relatively greater weight on whether it was possible for the bailor to access the information. (146)

Parents of minor children generally have the authority to consent to a search by law enforcement of a computer used by the minor. (147) The exception to this rule would be if the minor maintained an expectation of privacy in the computer by virtue of being emancipated under state law for a particular purpose. (148) Parents of adult children who still live at home generally do not have the authority to consent to a search of the adult child's computer by law enforcement absent the parent being a co-user of the computer. (149) The court in United States v. Durham ruled that a mother lacked the authority to consent to a search of her adult son's bedroom where he paid rent and she did not have a key to his locked room. (150) Even if actual common authority does not exist, apparent authority of the consenting individual coupled with the police's reasonable belief in that apparent authority may suffice. (151) The court in United States v. Smith held that the girlfriend/housemate of the defendant had the authority to consent to a search of the computer in her home, where all members of the household used the computer. (152) Consent to search that is given after an illegal entry, however, is tainted and invalid under the Fourth Amendment. (153) Employees' expectation of privacy in their workplace computers depends on the notification given to employees by management. (154) If management has put all employees on notice that they have no reasonable expectation of privacy in their computer, through an employee handbook, a "splash" or banner page that specifically states the employee has no expectation of privacy, emails to the employees regarding the scope of their privacy rights, or other effective means of communication, then there should be no reasonable expectation of privacy in the workplace computer. (155) Accordingly, at any time, and for any reason, management

may enter an employee's computer, and allow law enforcement to search and seize evidence from any employee's computer without a search warrant. (156) Conversely, if management has failed to communicate what expectation of privacy their employees should have in workplace computers, employees may have a reasonable expectation of privacy, and a warrant may be required to search an employee's computer. (157) However, searches by government employers are governed by the Fourth Amendment. (158) C. Exigent Circumstances Exigent circumstances are another exception to the search warrant requirement. (159) Circumstances to consider in determining if this exception might apply include: urgency; amount of time needed to obtain a warrant under the particular facts of the investigation; likelihood that evidence will be destroyed, concealed, or altered; danger to officers or others; whether the target knows law enforcement is coming to the crime scene; the nature of the evidence and its susceptibility to destruction by remote "kill" switches or other means of destroying or concealing the evidence; or whether the target computer is a part of a network of computers that would facilitate the transfer of contraband to other computers outside the jurisdiction of the warrant. (160) This exception allows police fearing the destruction of evidence to enter the home of a suspect, but carries with it the following constraints: (1) requires "clear evidence of probable cause;" (2) is "available only for serious crimes and in circumstances in which the destruction of evidence is likely;" (3) is "limited in scope to the minimum intrusion necessary to prevent the destruction of evidence;" and (4) must be "supported by clearly defined

indications of an exigency that are not subject to police manipulation or abuse." (161) Even in exigent circumstances, while a warrantless seizure may be permitted, a subsequent warrant to search may still be necessary. (162) A no-knock warrant may also be sought if a factually particularized showing of imminent danger of destruction of the evidence can be made, such as the suspect being at the computer keyboard. (163) However, finding computer equipment itself (instrumentality evidence) does not necessarily run the same risk of imminent destruction as other (documentary) evidence. (164) D. Private Searches The Fourth Amendment proscribes only governmental action and is "wholly inapplicable 'to a search or seizure, even an unreasonable one, effected by a private individual not acting as an agent of the Government or with the participation or knowledge of any government official.'" (165) Private searches, most notably represented by the computer repair personnel cases, highlight the principle that the Fourth Amendment does not apply to nongovernmental actors, unless agency principles have attached. If agency is present, the Fourth Amendment and issues of reasonable expectation of privacy will also be present. (166) Law enforcement officials may obtain a warrant based on the private search, provided they do not expand the scope of the private search in the application for the warrant. (167) In United States v. Grimes, the defendant's wife dropped their computer off for repair. (168) Upon inspection, the repair personnel found JPGs while attempting to increase free space on

the hard drive. (169) Pursuant to standard practice, the repair technician looked at the image files ("JPGs") before deleting them. (170) Upon examination of the images, they were found to contain child pornography. (171) The repair technician called the local police, who in turn called the FBI, which reviewed the private search and obtained a search warrant based upon that review. (172) In response to the defendant's objection to introduction of the images at trial, the court held that the technician's search was a private search and that the defendant had no reasonable expectation of privacy after surrendering the computer for repair. (173) Similarly, in Rogers v. State, the court held that by asking a computer repair technician to back up his files, the defendant relinquished dominion and control over the computer such that he no longer had a legitimate expectation of privacy. (174) In People v. Emerson, the defendant hired a computer repair technician to fix his computer. (175) During the repair, the technician noticed a number of computer files labeled as child pornography. (176) The technician called the police after he verified that the images were child pornography. (177) The police obtained a warrant to search the files listed by the technician and also checked other files within the C and D drive similarly labeled and found more child pornography. (178) Here, the court held that as the illegal pictures had properly been found in files with a certain label, police were effectively looking at objects in plain view when they examined other similarly labeled files within the drives. (179) This was especially true in the context of child pornography, absolute contraband, where files were labeled as child pornography. (180)

Emerson relied in part on United States v. Runyan. (181) In Runyan, a number of private parties (including the former wife of Mr. Runyan) searched the defendant's home computer and disks, and found child pornography. (182) They then called the police, who examined the same disks, but may have viewed individual images on the disks not originally viewed by the private parties. (183) In deciding that these facts did not support the appellant's argument of the police exceeding the scope of the private search, the court stated: [T]he police do not exceed the scope of a prior private search when they examine the same materials that were examined by the private searchers, but they examine these materials more thoroughly than did the private parties. [citation omitted]. In the context of a closed container search, this means that the police do not exceed the private search when they examine more items within a closed container than did the private searchers. Though the Supreme Court has long recognized that individuals have an expectation of privacy in closed containers, [citations omitted], an individual's expectation of privacy in the contents of a container has already been compromised if that container was opened and examined by private searchers, [citation omitted]. Thus, the police do not engage in a new "search" for Fourth Amendment purposes each time they examine a particular item found within the container. (184)

While private searches are not within the reach of the Fourth Amendment, searches conducted at the behest or with the participation of the government are within the control of the Fourth Amendment, under the principle of agency. (185) When the private search is conducted by a criminal hacker, (186)

interesting issues arise. If agency is alleged, the defendant bears the burden of proving that such a relationship exists. (187) In United States v. Steiger, (188) and United States v. Jarrett, (189) the same hacker, who claimed to be from Istanbul, Turkey and was never identified further by law enforcement, gained entry first to Steiger's and then subsequently to Jarrett's computer through the use of a Trojan Horse program, that allowed him to search the defendants' computers undetected. (190) In Steiger, there was no indication that the government had any prior knowledge of the hacker's activities, thus defeating the claim of agency. (191) However, the government did occasionally continue to contact the anonymous informant to apprise him of the case's progress and to express their gratitude and openness to similar information in the future. (192) Seven months after the final contact, the hacker made unsolicited contact with law enforcement to inform them of another child pornographer, the soon-to-be defendant Jarrett. (193) Pursuant to the Jarrett investigation, an FBI agent began what "can only be characterized as the proverbial 'wink and a nod,'" (194) dealings with the informant, including two e-mails of what was described by the court as a "pen-pal type correspondence." (195) When attacked by the appellant as evidence of agency, the court stated that "Courts of Appeals have identified two primary factors that should be considered in determining whether a search conducted by a private person constitutes a Government search triggering Fourth Amendment protections." (196) These are: "(1) whether the Government knew of and acquiesced in the private search; and (2) whether the private individual intended to assist law enforcement or had some other independent motivation.'" (197) As only the second prong was at issue, the court held: Although

the Government operated close to the line in this case, it did not ... demonstrate the requisite level of knowledge and acquiescence sufficient to make Unknownuser [the hacker] a Government agent when he hacked into Jarrett's computer. When Unknownuser came forward with the Jarrett information, he had not been in contact with the Government for almost seven months, and nothing indicates that the Government had any intention of reestablishing contact with him. The only communications that could possibly be construed as signaling an agency relationship prior to the search of Jarrett's computer ... were simply too remote in time and too tenuous in substance to bring the Jarrett search within the scope of an agency relationship. That the Government did not actively discourage Unknownuser from engaging in illicit hacking does not transform Unknownuser into a Government agent. Although the Government's behavior in this case is discomforting, the Government was under no special obligation to affirmatively discourage Unknownuser from hacking. (198)

While this case exemplifies the general principles of agency consideration, it can nonetheless be argued that it also represents the outermost boundary of acceptable governmental behavior and should not be used as an example of how to conduct an investigation. Finally, in United States v. Peterson, (199) the court held that even where a state statute required computer technicians to report child pornography found in the course of doing business, there is no agency. (200) In this case a repair technician, Griffin, had finished his repair of the computer when he noticed links to what

appeared to him to be child pornography cites. (201) Based on his memory and understanding of the law in question, he "decided to investigate a little further," and opened files that turned out to be, in fact, child pornography, whereupon he contacted the police. (202) The court summed up the defendant's position as follows: Defendant's only argument that the government knew of or acquiesced in Griffin's search is a South Carolina statute that defendant alleges "may be seen as promoting such searches, and as such constitutes a blanket acknowledgment and endorsement of searches by computer technicians." The South Carolina statute in question states: ... [A]ny computer technician working with a computer who views an image of a child younger than eighteen years of age or appearing to be younger than eighteen years of age who is engaging in sexual conduct, sexual performance, or a sexually explicit posture must report the name and address of the individual requesting the development of the film, or of the owner or person in possession of the computer to law enforcement officials in the state and county or municipality from which the film was originally forwarded. Compliance with this section does not give rise to any civil liability on the part of anyone making the report. S.C. CODE ANN. [section] 16-3-850. This statute does not instruct computer technicians to search or investigate, but merely requires technicians to report the identity of the owner or possessor of the computer if they discover child pornography on the computer. Had Griffin never opened any of the files and never said anything to the police, he would not have been in violation of the statute. It cannot be said that the language of this statute shows that the government knew of and acquiesced in Griffin's search to the point of making Griffin an agent of the government. Indeed, there has been no suggestion that the government had any knowledge of this particular search prior to

Griffin's undertaking it. As the government neither knew of nor acquiesced in Griffin's search, Griffin was not acting as an agent for the government ... Because Griffin was not acting as an agent for the government, the search was private and did not violate the Fourth Amendment.... (203)

What is interesting about this case is that the technician had completed his repairs and only "investigated" the links due to his (mis)understanding of his duty under the law. However, as the government was not responsible for Griffin's error, it could not be charged with agency. E. Probation and Parole Searches Probationers enjoy only conditional liberty, so the government may closely supervise probationers and impinge on their privacy to a greater extent than is allowed for the general public to ensure that the probationer observes probation restrictions. (204) The search of a probationer's home without a warrant and with less than probable cause does not violate the Fourth Amendment if the search is conducted under state probation regulations that satisfy the Fourth Amendment's reasonableness standard. (205) "[A] probationer can be subject to a warrantless search under a statutory scheme or pursuant to the findings of a sentencing court." (206) In United States v. Knights, a warrantless search of a probationer's house, "supported by reasonable suspicion and authorized by a condition of his probation, was [found] reasonable within the meaning of the Fourth Amendment." (207) Nothing in the

defendant's conditions of probation limited searches to those with a probationary purpose. (208) However, although probationers have a reduced expectation of privacy in their person and residency, a warrantless search of a probationer's residence may be problematic if conducted by the probation officer at the request or direction of police. (209) Factors to consider in determining the primary purpose include whether it was the probation officer's idea to conduct the search, whether the search bears a direct relationship to the crime for which the defendant was convicted, and whether the search is authorized by probation conditions. (210) On the related topic of those conditions, the special issues and division of opinions regarding probation, parole and supervised release conditions of those convicted of child pornography were concisely summarized in United States v. Deaton, (211) where the district court stated the following: Courts have varied in their treatment of Internet access where a defendant is convicted of child pornography. The most recent pronouncement is United States v. Sofsky, where the defendant challenged the special condition that he "not access a computer, the Internet, or bulletin board systems at any time, unless approved by the probation officer." The court found that the condition "inflicts a greater deprivation of [the defendant's] liberty than is reasonably necessary." The court noted that less restrictive means are available to monitor the defendant to ensure he did not access pornography, such as unannounced inspections of the defendant's premises and examination of material stored on his hard drive or removable disks, or the setting up of a sting operation through the use of government placed Internet ads for pornography. Sofsky represents the far end of the spectrum of cases, that is, elimination

of the restriction. The Tenth Circuit takes a more moderate view of the restriction, [t]he court in United States v. Walser, approved a condition where the defendant had to obtain prior permission from the probation office before using the Internet. The court noted the condition, which did not completely ban the defendant from using the Internet, accomplished "the goal of restricting the use of the Internet" and "balanced "the protection of the public with the goals of the sentencing." Similarly, in United States v. Crandon, the court approved the restriction that "the defendant shall not possess, procure, purchase or otherwise obtain access to any form of computer network, bulletin board, Internet, or exchange format involving computers unless specifically approved by the [United States] Probation Office." The court found that condition was reasonably related to the goal of deterring defendant from engaging in further criminal conduct and in protecting the public, particularly in light of defendant's use of the Internet to develop an illegal sexual relationship with a young female over a period of months. At the other end of the spectrum is the absolute prohibition on access to computers and the Internet approved by the court in United States v. Paul. The court found that the condition was reasonably related to the defendant's offense and "the need to prevent recidivism and protect the public." In that case, the evidence revealed that the defendant had used the Internet extensively to engage in the trafficking of child pornography as well as to "encourage exploitation of children by seeking out fellow 'boy lovers' and providing them with advice on how to find and obtain access to 'young friends.'" An absolute prohibition on accessing the computers and the Internet was found to be reasonably necessary. (212)

Based on the language above, it is apparent that the viability of any warrantless search predicated on conditions or restrictions on Internet access by those convicted of crimes against children will depend on the narrow tailoring of the restricting language and the nexus between the crime and continued access to the Internet. Finally, an anonymous tip, suitably corroborated, may form the basis for a warrantless search of a parolee's residence by the parole officer. In United States v. Tucker, the search was held not to be invalid simply because the police were present, and the computer at the residence could be legally seized as evidence of a parole violation. (213) Parolees' rights under the Fourth Amendment are satisfied if the parole officer who is investigating a parole violation has reasonable grounds to believe that a parole violation has occurred. (214) Under these circumstances, the need for a search warrant is eliminated. (215) People v. Slusher held that where a convicted sex offender was on parole, corroborated allegations of sexual assault of a child and child sexual exploitation supported a warrantless search of the parolee's house. (216) Where the parolee consents to a search as a condition of parole, no warrant is required, so long as there is a reasonable suspicion, supported by specific and articulable facts, to believe that the parolee has committed a parole violation or crime. (217) IV. FEDERAL PRIVACY STATUTES AND COMPUTERRELATED EVIDENCE (218) The final consideration to be addressed is federal privacy statutes that may bear on whether, and how, to obtain a search warrant in

these cases. While there are a number of sources of privacy law, including the United States Constitution, state constitutions, the presence of privileged or confidential communications, and court decisions, this section will deal exclusively with statutory protections found at the federal level. (219) Title III of the Omnibus Crime Control and Safe Streets Act of 1968 ("Title III"), (220) the Pen Registers and Trap and Trace Device chapter of Title 18 ("Pen/Trap"), (221) the Electronic Communication Privacy Act (ECPA), (222) and the Privacy Protection Act (PPA) (223) are four such statutes, and a basic awareness of their principles and the rights they may afford to suspects and third parties is essential to avoiding unnecessary legal difficulties which might lead to financial liability. It also must be remembered that although the ECPA sets the minimum level of privacy protection, the state constitutions, statutes, and court decisions provide additional levels of privacy protection. A. Title III Title III protects electronic communication from interception during transmission (e.g., wiretap) by a third party who is not a participating member of the communication. (224) A human voice and most Internet communications, including email, are electronic communication. (225) Title III applies to all parties, private and law enforcement alike. A public or private party is generally prohibited from voluntarily disclosing the content of wire and electronic communication intercepted during transmission. (226) Exceptions to this rule include:

(1) a wire tap court order; (227) (2) where the addressee/sender consents to the interception; (228) (3) when the interception is necessary to protect the rights or property of the communication service provider; (229) (4) where the communication provider "inadvertently obtain[s] [information that] pertains to the commission of a crime"; (230) and (5) when the communication is made through a system that is configured so that the communication is readily accessible to the general public. (231) B. Pen Register/Trap and Trace The Pen/Trap statute regulates the collection of addressing information for wire and electronic communication. (232) The addressing information for a telephone call is either the outgoing call's telephone number or the incoming call's origination number ("caller ID"). (233) This also applies to Internet communication. (234) Every computer communication contains a "header," (235) which contains address information. An Electronic Communication Service ("ECS") provider (236) may use a pen/trap device without a court order where: (1) the user consents to the interception; (237) (2) when the interception is necessary to protect the rights or property of the communication service provider; (238)

(3) when the interception is necessary to protect the communication service provider or a user of that service (customer or other provider) from fraudulent, unlawful, or abuse of service; (239) and (4) when there is an emergency involving an immediate risk of death or serious physical injury to a person. (240) Law enforcement can obtain this address information via a pen register or trap and trace order. (241) This investigative tool is helpful in identifying the address of where the suspect is coming from when they access information in a Hotmail or Yahoo! account. The applicant is required to justify that the information likely to be obtained is relevant to an ongoing criminal investigation. (242) The order is only good for 60 days; however, extensions may be granted upon application. (243) The order shall be sealed until otherwise directed by the court and the ECS shall be directed not to release information relating to the pen/trap device until further ordered by the court. (244) Although federal law grants to state courts the authority to issue these orders, it is unclear whether a state court can issue such an order upon an out-of-state ECS. Use of a search warrant to authorize the use of a pen/trap device remedies this issue. C. The Electronic Communications Privacy Act ("ECPA") The ECPA protects communication based upon its form. It protects wire and electronic communication content in storage by the provider (e.g., email records held by an ISP). (245) The ECPA applies to all parties, private and law enforcement alike. However,

for law enforcement, there are mechanisms for requiring disclosure to the government by public ECS providers of information regarding an electronic communication. The most well-known example of an ECS would be an ISP, such as America Online, Hotmail, or Yahoo!. A public or private ECS is generally prohibited from voluntarily disclosing the content of wire and electronic communication intercepted during transmission. (246) The four exceptions to this rule are: (1) where the addressee/sender consents to the disclosure; (247) (2) where the communication provider is permitted to disclose customer communications in emergencies involving an immediate risk of death or serious physical injury to a person; (248) (3) when the disclosure is necessary to protect the rights or property of the communication service provider; (249) and (4) where the communication provider inadvertently obtains information that pertains to the commission of a crime. (250) Pursuant to the ECPA, a subpoena can be used to obtain basic subscriber information. (251) Basic subscriber information includes the customer's name, address, length of service, means and source of payment (including any credit card or bank account number), local and long-distance telephone toll billing records, and records of session times and durations, as well as any temporarily assigned network address. (252) A subpoena can also be used to obtain opened email from a provider if the "customer" or "subscriber" is given prior notice of the disclosure by the government. (253) This disclosure may be delayed for up to 90 days when notice would jeopardize a pending investigation or endanger the physical safety of a person. (254) An additional ninety-day extension may be considered by the

issuing court. (255) Following the delay notification period, the government must give notice. (256) Pursuant to the ECPA, a court order, sometimes referred to as an "articulable facts order" or "[section] 2703(d) court order," may be sought to obtain all other subscriber information except the content of an unopened email that has been stored for 180 days or less. (257) To obtain a "[section] 2703(d) court order," there must be specific and articulable facts demonstrating that reasonable grounds exist to believe that the "specified records are relevant and material to an ongoing criminal investigation." (258) These records would include complete audit trails/logs, web sites visited, identities of e-mail correspondents, cell site data from cellular/PCS carriers, and opened email. As a practical matter, a "[section] 2703(d) court order" can also be used to obtain basic subscriber information. (259) Notice to the subscriber is only required when opened e-mail is requested from the provider. A search warrant is necessary to obtain voice mail or unopened electronic communication in storage for less then 180 days. (260) As the investigation process escalates from subpoena to court order to search warrant, it must be remembered that the information available under the less exacting standard is included at the higher level (i.e., a search warrant will obtain basic subscriber information, transactional information, and content of the stored communication). The use of a search warrant removes the need for the government to comply with the notice requirements previously mentioned. (261) Additionally, law enforcement is allowed to request from the court an order commanding the communication provider not to disclose the existence of any issued court order, for such a period as the court

deems appropriate, where notification would lead to: "[1] endangering the physical safety of an individual; [2] flight from prosecution; [3] tampering with evidence; [4] intimidation of potential witnesses; or [5] otherwise seriously jeopardizing an investigation or unduly delaying a trial." (262) Law enforcement can and should talk to the ISP in advance about what types of information are sought and what the ISP may have. 18 U.S.C. [section] 2703(f) authorizes law enforcement to request that the provider take all steps necessary to preserve records and other information in its possession while law enforcement begins to obtain the necessary legal process to obtain the records. (263) This 2703(f) order, or preservation request, only applies to information in possession of the provider at the time the request is made. (264) There is no suppression remedy for a violation of the ECPA except in those cases where the defendant's constitutional rights have been violated. (265) Civil damages are the exclusive remedy for a violation of the ECPA. (266) These include a minimum damage amount of $1,000, plus costs, punitive damages, and attorney fees. (267) Negligent breaking or destroying of equipment is also actionable. (268) Additionally, loss of business opportunity may be actionable, particularly if brought by innocent third parties. (269) Employees of the United States may be subject to disciplinary action if the violation was willful or intentional. (270) The "good faith" defense is complete under the Act. (271) D. The Privacy Protection Act (PPA) The PPA (272) protects persons who may broadly, but reasonably, claim to be publishers. The PPA establishes

safeguards for these "publishers" from governmental search and seizure of the materials in their possession. (273) These materials may be either "work product" (materials created by the author/publisher) or "documentary materials" (any materials that document or support the work product). (274) Unlike the ECPA, the PPA applies only to law enforcement. If the material is covered by the PPA, law enforcement must serve the target with a subpoena, allowing the target to challenge the subpoena by a motion to quash before complying with it. (275) Exceptions to the PPA requirements of a subpoena generally include: (1) materials searched for or seized are contraband, instrumentalities, or fruits of the crime; (2) materials searched for are evidence of a crime; or (3) the seizure of materials is necessary to prevent death or serious bodily injury. (276) The PPA does not require investigators to give the publisher notice when doing so would reasonably result in the destruction, alteration, or concealment of the materials. (277) Exceptions to the PPA are particularly relevant within the scope of child sexual exploitation cases. Offenses that involve "the production, possession, receipt, mailing, sale, distribution, shipment, or transportation of child pornography, the sexual exploitation of children, or the sale or purchase of children under [[subsection]] 2251, 2251A, 2252, or 2252A of title 18" of the United States Code are specifically exempted from the protections afforded publishers/authors. (278) Child pornography is contraband and is not protected if it is a fruit or instrumentality of a crime. Finally, the PPA affords no protection to materials that may be evidence of a crime, such as images of child pornography, (279) nor does it require notice to publishers when doing so would

reasonably "result in the destruction, alteration or concealment of the materials." (280) Due to the above-mentioned facts, the importance of this act to child abuse prosecutors and investigators lies more in the area of commingled materials. Where there is evidence relating to the crime located on a computer which also contains protected material ("work product" or "documentary materials"), issues concerning proper scope and execution of a search warrant will arise. Adopting a protocol to address how to attempt to separate these types of material would be a good practice. (281) In Guest v. Leis, the Sixth Circuit held that "when protected materials are commingled on a criminal suspect's computer with criminal evidence that is unprotected by the act, we will not find liability under the PPA for seizure of the PPA-protected materials." (282) Recent court cases appear to indicate that the courts are limiting the scope of PPA protection to the press and certain other people not suspected of committing a crime (i.e., PPA does not apply to criminal suspects). (283) However, until this issue is more firmly settled, the best practice would be to minimize the taking of potentially protected materials and to return potentially protected materials that are taken as soon as possible. (284) There is no suppression remedy for a violation of the PPA. (285) Civil damages are the exclusive remedy for violation of the PPA. These include actions for damages, including attorney's fees and costs, with a statute of limitations of two years. (286) The "good faith" defense is available to law enforcement investigators under this statute. (287) The good faith defense does not extend to government entities, except in limited circumstances. (288) "[N]othing in the PPA prevents the government from seeking

forfeiture of computers or [related media] containing commingled materials." (289) V. CONCLUSION Computers and electronic communication are an intrinsic part of the new crime scene. Knowledge of the unique requirements and case law in the field of search and seizure attendant to computerfacilitated child sexual exploitation cases help ensure that "good" search warrants are drawn up and executed. Knowing the laws that protect the privacy of information must be a priority for the investigators and prosecutors who seek to utilize the best practices in search and seizure of computer evidence, and to minimize the potential personal and departmental liability of the parties involved. Both these elements assist in assuring that technical difficulties which might preclude either the introduction of evidence or have negative repercussions for the investigators are minimized or eliminated. Both these results will increase the likelihood of justice for children being brought closer to reality. (1.) The prostitution of children, for example, might yield the following types of electronic evidence: address book, biographies, calendar, customer database and/ or records, e-mail notes or letters, false identification documents and indicia of false identification use, financial/asset records, Internet activity logs, medical records, or World Wide Web page advertising. See generally Electronic Crime Scene Investigation: A Guide for First Responders, United States Department of Justice, Office of Justice Programs, National Institute of Justice (2001), available at http://www.ncjrs.org/pdffiles1/nij/187736.pdf (last visited Apr. 14, 2004) (on file with the Rutgers Computer and Technology Law Journal). (2.) Sections I and II are adapted from Susan Kreston, Search and Seizure in Cases of Computers and Child Pornography, APRI UPDATE, (Am. Prosecutors Res. Inst., Alexandria, Va.), vol. 12 no. 9, 1999, available at http://ndaaapri.org/publications/newsletters/ apri_update_vol_12_no_9_1999.html (last visited Feb. 9, 2004) (on file with the Rutgers Computer and Technology Law Journal). (3.) See generally KENNETH V. LANNING, CHILD MOLESTERS: A

BEHAVIORAL ANALYSIS FOR LAW ENFORCEMENT OFFICERS INVESTIGATING THE SEXUAL EXPLOITATION OF CHILDREN BY ACQUAINTANCE MOLESTERS (4th ed. 2001) available at http://ncmec.org/missingkids/servlet/ ResourceServlet?LanguageCountry=en_US& PageId=469 (last visited Mar. 8, 2004) (on file with the Rutgers Computer and Technology Law Journal). (4.) Id. (5.) U.S. CONST. amend. IV. (6.) See, e.g., United States v. Simpson, 152 F.3d 1241, 1246 (10th Cir. 1998) (citations omitted); United States v. Garcia, 983 F.2d 1160, 1167 (1st Cir. 1993); United States v. Ricciardelli, 998 F.2d 8, 10 (1st Cir. 1993); United States v. Pitts, 6 F.3d 1366, 1369 (9th Cir. 1993). (7.) See Taylor v. State, 54 S.W.3d 21, 24 (Tex. Ct. App. 2001); State v. Nordlund, 53 P.3d 520, 525 (Wash. Ct. App. 2002). (8.) Predicated chat rooms or Internet Relat Chats (IRCs) are those whose names speak for themselves in being predicated on facilitating sexual activity with children, defined as those who are under 18 years of age. Examples include IRCs listed as "Who says 10 year olds aren't fun" or chat rooms such as "dxddy for daughtr." Those who set up these chat rooms may intentionally misspell words in the room names to avoid string search detection by law enforcement. (9.) 256 F.3d 14 (1st Cir. 2001). (10.) Id. at 15. (11.) 468 U.S. 897, 922 (1984) (holding that good faith and objectively reasonable belief search warrant issued by proper magistrate will render warrant valid even if ultimately found to be unsupported by probable cause). (12.) Brunette, 256 F.3d at 19. (13.) See infra section II(G) for a discussion of the issue of an expert component. (14.) 535 U.S. 234 (2002). (15.) Id. at 256 (finding section with language that criminalized any "image or picture

that is or appears to be of a minor engaging in sexually explicit conduct," overbroad and unconstitutional). (16.) Id. at 258 (finding section, with language that criminalizes any sexually explicit image that is "advertised, promoted, presented, described, or distributed in such a manner that conveys the impression" it depicts "a minor engaging in sexually explicit conduct" overbroad and violative of the First Amendment). (17.) M. VYBORNEY, Search Warrants: Where, What, Why (CD-ROM, rel. at Advanced Computer Forensics, California Department of Justice Training, Orange, Cal., Jan. 27, 2003-Feb. 7, 2004) (copy on file with author). (18.) People v. Higgins, No. A092056, 2002 WL 1275774, at *6 (Cal. Ct. App. 2002) (internal quotations omitted) (unpublished) (on file with the Rutgers Computer and Technology Law Journal). (19.) Id. at *10. (20.) 231 F.3d 630, 637 (9th Cir. 2000) (holding that search of defendant's computer was valid where warrant was limited to items the police had probable cause to believe constituted evidence of criminal offenses committed by defendant). (21.) See Higgins, 2002 WL 1275774, at *10. (22.) United States v. Upham, 168 F.3d 532, 535-36 (1st Cir. 1999). (23.) Id. at 534-35. See generally Groh v. Ramirez, No. 02-811 (U.S. 2004) (discussing failure to incorporate supporting affidavit). (24.) United States v. Simpson, 152 F.3d 1241, 1248 (10th Cir. 1998). (25.) United States v. Horn, 187 F.3d 781, 788 (8th Cir. 1999). (26.) Id.; United States v. Layne, 43 F.3d 127, 132 (5th Cir. 1995). (27.) United States v. Kemmish, 120 F.3d 937, 939 (9th Cir. 1997). (28.) Layne, 43 F.3d at 133. (29.) 992 F.2d 817 (8th Cir. 1993).

(30.) Id. at 821 n.6. (31.) E.g., State v. Perrone, 834 P.2d 611, 619 (Wash. 1992). (32.) 88 F.3d 1538, 1551 (9th Cir. 1996) (internal quotations omitted). (33.) Koelling, 992 F.2d at 822. (34.) Upham, 168 F.3d at 535. (35.) Layne, 43 F.3d at 133; see generally, United States v. Lacy, 119 F.3d 742, 74547 (9th Cir. 1997). (36.) Upham, 168 F.3d at 535. (37.) Id. at 537. (38.) 150 F. Supp. 2d 1263 (D. Utah 2001), aff'd, 305 F.3d 1193 (10th Cir. 2002), cert. denied, 123 S. Ct. 1335 (2003). (39.) Id. at 1268. (40.) Id. at 1268-69. (41.) United States v. Loy, 191 F.3d 360, 369 (3d Cir. 1999); United States v. Rowland, 145 F.3d 1194, 1206 (10th Cir. 1998). (42.) Loy, 191 F.3d at 367 (citing United States v. Leon, 468 U.S. 897, 926 (1984); Rowland, 145 F.3d 1207. See also Groh v. Ramirez, 124 S. Ct. 1284 (2004) (discussing limits of good faith defense). (43.) Loy, 191 F.3d at 368-69; Rowland, 145 F.3d 1207-08. (44.) 153 F.3d 58, 58, 60-61 (2d Cir. 1998). (45.) Id at 60-61. (46.) 535 U.S. 234, 256, 258 (2002). (47.) 296 F. Supp. 2d 50 (D. N.H. 2003).

(48.) Id. at 55-56 (citations omitted). (49.) See LANNING, supra note 3, at 84-85. (50.) Id at 29. (51.) See VYBORNEV, supra note 18. (52.) See Jasorka, 153 F.3d 58 (2d Cir. 1998). (53.) United States v. Anderson, Nos. 97-10498, 97-10499, 1999 WL 459586, at **2(9th Cir. 1999) (unpublished disposition) (on file with the Rutgers Computer and Technology Law Journal). (54.) Id. (55.) See 945 F. Supp. 441 (N.D.N.Y. 1996). (56.) Anderson, 1999 WL 459586, at **2-**3; Lamb, 945 F. Supp. at 463-64. (57.) 328 F.3d 655 (D.C. Cir. 2003). (58.) 189 F.3d 576 (7th Cir. 1999), cert. denied, 529 U.S. 1011 (2000). (59.) Long, 328 F.3d at 659. (60.) Romero, 189 F.3d at 582. (61.) For a brief summation of grooming and how it applies to Internet crimes against children, see Duncan Brown, Developing Strategies for Collecting and Presenting Grooming Evidence in a High Tech World, APRI UPDATE, (American Prosecutors Research Institute, Alexandria, Va.), vol. 14 no. 11, 2001, available at http://ndaaapri.org/ publications/newsletters/update_volume_14_number_11 2001.html (last visited Feb. 9, 2004) (on file with the Rutgers Computer and Technology Law Journal). (62.) Romero, 189 F.3d at 583. (63.) Id. (64.) Id.

(65.) Id (66.) Id. (67.) Id. (68.) Long, 328 F.3d at 668. (69.) LANNING, supra note 3, at 99, stating, "Because of characteristics of technology and human behavior, probable cause about information on a computer should not even be considered stale for at least one year." (70.) 2 F.3d 1318, 1322 (3d Cir. 1992). (71.) Id. (72.) Lacy, 119 F.3d at 746. (73.) Id. (74.) See LANNING, supra note 3, at 99. (75.) Anderson, 1999 WL 459586, at * 2. (76.) 187 F.3d 781, 787 (8th Cir. 1999). (77.) Hay, 231 F.3d at 636. (78.) For further information on items that should be included in a child abuse/sexual exploitation warrant, see AMERICAN PROSECUTORS RESEARCH INSTITUTE, NATIONAL CENTER FOR THE PROSECUTION OF CHILD ABUSE, INVESTIGATION AND PROSECUTION OF CHILD ABUSE (3d ed. 2004) [hereinafter Prosecution of Child Abuse]. (79.) Id. (80.) Id. (81.) Id at 112-13. See also FBI Handbook of Forensic Science (2003) available at http://www.fbi.gov/hq/lab/handbook/intro.htm (last visited Apr. 14, 2004)(on file with

the Rutgers Computer and Technology Law Journal). (82.) Prosecution of Child Abuse, supra note 78, at 114. (83.) Id. (84.) See United States v. Albert, 195 F. Supp. 2d 267, 279 (D. Mass. 2002). (85.) FED. R. CRIM. P. 41(e)(2)(A). (86.) Detective Richard Hardy, Address at the National Association Attorney General Cybercrime Conference (Feb. 3, 2003). (87.) Id. (88.) Id. (89.) See FED. R. CRIM. P. 41(e)(2)(A). (90.) 183 F. Supp. 2d 468, 480 (D. P.R. 2002). (91.) Id. (92.) United States v. Habershaw, No. CR. 01-10195-PBS, 2001 WL 1867803 at * 8 (D. Mass. 2001). (93.) Id. (94.) 296 F. Supp. 2d at 59. (95.) Id. (citing United States v. Greene, 56 M.J. 817, 822-23 & n.4 (N.M. Ct. Crim. App. 2002) (finding retention of computer and disks for three months during inspection for child pornography reasonable when defendant consented to seizure, but recognizing that "an excessively long period of retention, following a lawful seizure, could be unreasonable"), rev. denied, 57 M.J. 463 (C.A.A.F. 2002) (internal citations omitted). (96.) United States v. Albert, 195 F. Supp. 2d 267, 279 (D. Mass. 2002). See also Greene, citing United States v. Upham, 168 F.3d 532, 535 (1st Cir. 1999), cert. denied, 527 U.S. 1011, 144 L. Ed. 2d 249, 119 S. Ct. 2353 (1999); Guest v Leis, 255 F.3d 325, 335 (6th Cir. 2001); United States v. Scott-Emuakpor, 2000 U.S. Dist.

LEXIS 3118 (W.D.Mich. 2000). (97.) Albert, 195 F.Supp. 2d at 279. (98.) Id. at 278-79 (quoting Upham, 168 F.3d at 535). (99.) Section III is adapted from Susan Kreston, Exceptions to the Warrant Requirement in Computer-Facilitated Child Sexual Exploitation Cases, APRI UPDATE, (American Prosecutors Research Institute, Alexandria, Va.), vol. 13 no.4, 2000, available at http://ndaa-apri.org/publications/ newsletters/update_volume_13_number_4_2000.html (last visited Feb. 9, 2004) (on file with the Rutgers Computer and Technology Law Journal). (100.) E.g., Minnesota v. Dickerson, 508 U.S. 366, 374-75 (1993). (101.) See id. (102.) See id. at 375. (103.) 334 F.3d 831, 838-39 (9th Cir. 2003). (104.) Id. at 834. (105.) Id. at 835. (106.) Id. (107.) Id. at 838-39. (108.) 262 F.3d 468, 469 (5tb Cir. 2001). (109.) Id. (110.) Id. at 470. (111.) Id. (112.) The court described a "thumbnail" as "a minature display of a page or image that enables you to see the layout of many pages or images on the screen at once." 275 F.3d 981, 985 n.6 (10th Cir. 2001)(referencing PHILIP E. MARGOLIS, RANDOM HOUSE PERSONAL COMPUTER DICTIONARY 481 (2d ed. 1996)).

(113.) Walser, 275 F.3d at 985. (114.) Id. (115.) Id. at 987. (116.) United States v. Gray, 78 F. Supp. 2d 524, 526 (E.D. Va. 1999). (117.) Id. at 527. (118.) Id. at 527-28. (119.) Id. at 529. (120.) Id. (121.) 172 F.3d 1268, 1270-71 (10th Cir. 1999). (122.) Id. at 1271. (123.) Id. at 1273. (124.) Id. (125.) 133 F.3d 943, 954-55 (6th Cir. 1998). (126.) 169 F.3d 84, 86 (1st Cir. 1999). (127.) Id. at 86. (128.) 282 F.3d 920, 925 (7th Cir. 2002). (129.) Id. at 922. (130.) Id. (131.) Id. at 925. (132.) E.g., United States v. Wacker, 72 F.3d 1453, 1470 (10th Cir. 1995), cert. denied, 523 U.S. 1035 (1998) (holding breadth of consent determines scope of

search). (133.) See Stoner v. California, 376 U.S. 483,489 (1964). (134.) See United States v. Matlock, 415 U.S. 164, 171 n.7 (1974). (135.) See United States v. Duran, 957 F.2d 499, 505 (7th Cir. 1992) (finding that a marital relationship creates presumption of common authority that may be rebutted by showing of limited access to item/area searched). (136.) 275 F.3d 391 (4th Cir. 2001). (137.) Id. at 403. (138.) Id. (139.) 353 F.3d 606 (8th Cir. 2003). (140.) Id. at 610. (141.) Id. at 610-11. (142.) Id. at 611. (143.) Id. (144.) Id. at 614, 616. (145.) Id. at 615. (146.) Cf. United States v. Falcon, 766 F.2d 1469, 1474-75 (10th Cir. 1985) (holding that since bailor had complete access to seized information, he gave the necesary consent to search absent a warrant). (147.) See United States v. Rith, 164 F.3d 1323, 1330 (10th Cir. 1999); People v. Goforth, 564 N.W.2d 526, 531 (Mich. Ct. App. 1997) (holding "common authority" over child's bedroom rendered parental consent valid). (148.) See, e.g., State v. Vinuya, 32 P.3d 116, 131 (Haw. App. 2001) (noting emancipation of minor would render parental authority to consent inoperative).

(149.) See Falcon, 766 F.2d at 1474. See also State v. Miyasato, 805 So.2d 818, 820 (Fla. Dist. Ct. App. 2001) (consent given by mother of adult son to search drawers of desk in son's bedroom invalid without parent's establishment of equal access and common authority over the contents of the drawers). (150.) No. 98-10051-02, 1998 WL 684241, at *4-*6 (D. Kan. 1998). (151.) See James, 353 F.3d at 615. See also Colbert v. Com, 43 S.W.3d 777, 784 (Ky. 2001) (parent had apparent authority to give consent to search fireproof safe in adult son's room as parent had superior interest as homeowner). (152.) 27 F. Supp. 2d 1111, 1116 (C.D. Ill. 1998). (153.) See United States v. Hotal, 143 F.3d 1223, 1228 (9th Cir. 1998). (154.) See United States v. Simons, 206 F.3d 392, 398 (4th Cir. 2000) (holding employer's policy to monitor Internet activity precluded finding employee had reasonable expectation of privacy in transferred files). (155.) See e.g., United States v. Bailey, 272 F. Supp. 2d 822, 836 (D. Neb. 2003) (discussing e-mail to employees and screen notification); United States v. Angevine, 281 F.3d 1130, 1134-35 (10th Cir. 2002) (finding professor had no reasonable expectation of privacy on university owned computers). (156.) See Bailey, 272 F. Supp. 2d at 824; Angevine, 281 F.3d at 1134-35. (157.) See United States v. Slanina, 283 F.3d 670, 677 (5th Cir. 2002), cert. granted on other grounds, 537 U.S. 802 (2002). (158.) See O'Connor v. Ortega, 480 U.S. 709, 709 (1987). (159.) E.g., Illinois v. McArthur, 531 U.S. 326, 331 (2001). See also United States v. Turner, 650 F.2d 526, 528 (4th Cir. 1981). (160.) United States v. Reed, 935 F.2d 641,642-43 (4th Cir. 1991), cert. denied, 502 U.S. 960 (1991). (161.) United States v. Anderson, 154 F.3d 1225, 1233 (10th Cir. 1998). (162.) United States v. David, 756 F. Supp. 1385, 1392-93 (D. Nev. 1991).

(163.) See People v. Foley, 731 N.E.2d 123, 126 (N.Y. 2000). (164.) Durham, 1998 WL 684241, at *5-*6. (165.) United States v. Jacobsen, 466 U.S. 109, 113 (1984) (quoting Walter v. United States, 447 U.S. 649, 662 (1980) (Blackmun, J., dissenting)). (166.) See United States v. Barth, 26 F. Supp. 2d 929, 935 (W.D. Tex. 1998); United States v. Hall, 142 F.3d 988, 993 (7th Cir. 1998). (167.) United States v. Grimes, 244 F.3d 375, 383 (5th Cir. 2001) (upholding government search that did not exceed the scope of the private search). (168.) Id. at 377. (169.) Id. at 377-78. (170.) Id. at 378. (171.) Id. (172.) Id. (173.) Id. at 383. (174.) 113 S.W.3d 452, 458 (Tex. Crim. App. 2003). (175.) 766 N.Y.S.2d 482, 484 (N.Y. Sup. Ct. 2003). (176.) Id. (177.) Id. (178.) Id. at 489. (179.) See id at 487-88, stating: [T]he viewing of files on both dates concerned images of child pornography only, and that they were files contained in the only two computer file folders, denominated "xxx" and "MPG," accessed during Mulrooney's private search. Defendant does not allege that the officers ventured into any other computer file folders, or that they accessed other types of private information elsewhere on the computer's hard drive.

Id. (180.) See id. at 488. (181.) 275 F.3d 449 (5th Cir. 2001), appeal after remand, 290 F.3d 223 (5th Cir. 2002), cert. denied, 537 U.S. 888 (2002). (182.) Id. at 452-53. (183.) See id at 453-54. (184.) Id. at 464-65. (185.) See U.S. CONST. amend. IV; see also Coolidge v. New Hampshire, 403 U.S. 443, 487 (1971). (186.) As used in this context, a hacker will be defined as an individual who illegally gains entry to the computer of another, regardless of their motivation for doing so. (187.) United States v. Ellyson, 326 F.3d 522, 527 (4th Cir. 2003). (188.) 318 F.3d 1039 (11th Cir. 2003). (189.) 338 F.3d 339 (4th Cir. 2003). (190.) Id. at 341. (191.) See Steiger, 318 F.3d at 1045. (192.) See Jarrett, 338 F.3d at 341. (193.) Id. at 341-42. (194.) Id. at 343. That correspondence was quoted in the opinion as: I can not ask you to search out cases such as the ones you have sent to us. That would make you an agent of the Federal Government and make how you obtain your information illegal and we could not use it against the men in the pictures you send. But if you should

happen across such pictures as the ones you have sent to us and wish us to look into the matter, please feel free to send them to us. We may have lots of questions and have to email you with the questions. But as long as you are not "hacking" at our request, we can take the pictures and identify the men and take them to court. We also have no desire to charge you with hacking. You are not a US citizen and are not bound by our laws.

Id. (195.) Id. The contents of that e-mail were also contained in the opinion: [T]he FACT still stands that you are not a citizen of the United States and are not bound by our laws. Our Federal attorneys have expressed NO desire to charge you with any CRIMINAL offense. You have not hacked into any computer at the request of the FBI or other law enforcement agency. You have not acted as an agent for the FBI or other law enforcement agency. Therefore, the information you have collected can be used in our criminal trials.

Id. (196.) Id. at 344. (197.) Id. (198.) Id. at 347. (199.) No.2:03-0118, 2003 U.S. Dist. Lexis 23470, at *1 (D. S.C. Nov. 25, 2003). (200.) Id. at *19. (201.) Id. at *4. (202.) Id at *4-*5. (203.) Id. at *19-*21.

(204.) State v. Misiorski, 738 A.2d 595,599-600 (Conn. 1999). (205.) Riley v. Commwealth, 120 S.W.3d 622, 627 (Ky. 2003). (206.) Rowe v. Lamb, 130 F.3d 812, 814 (8th Cir. 1997). (207.) 534 U.S. 112, 122 (2001). (208.) Id. at 116. (209.) United States v. Oakes, No. Crim. 00-76-P-C, 2001 WL 30530, at *5 (D. Me. Jan. 10, 2001). (210.) Id. (211.) 204 F. Supp. 2d 1181 (E.D. Ark. 2002), aff'd, 328 F.3d 454 (8th Cir. 2003). (212.) Id. at 1182-83 (citations omitted). (213.) See Tucker, 150 F.Supp.2d at 1263. (214.) People v. Slusher, 844 P.2d 1222, 1225 (Colo. Ct. App. 1992). (215.) Id. (216.) Id. (217.) Id.; see also People v. Tafoya, 985 P.2d 26, 28-29 (Colo. Ct. App. 1999). (218.) This section was adapted from Susan Kreston & Robert Morgester, Federal Privacy Statutes and Computer Related Evidence, CYBERCRIME NEWSLETTER, (Nat'l Ass'n. of Att'y Gen., Washington, D.C.), Feb./Mar. 2003, and INVESTIGATION AND PROSECUTION OF STALKING AND RELATED CRIMES, CALIFORNIA DISTRICT ATTORNEYS ASSOCIATION (2004). (219.) For an excellent resource on federal issues, see Computer Crime and Intellectual Prop. Div., U.S. DEP'T OF JUSTICE, SEARCHING AND SEIZING COMPUTERS AND OBTAINING ELECTRONIC EVIDENCE IN CRIMINAL INVESTIGATIONS (2002), available at http://www.cybercrime.gov/s&smanual2002.htm (last visited Feb. 28, 2004) (on file with the Rutgers Computer and Technology Law Journal).

(220.) 18 U.S.C. [subsection] 2510-2522 (2000). (221.) Id. [subsection] 3121-3127. (222.) Id. [subsection] 2701-2711. (223.) 42 U.S.C. [subsection] 2000aa-2000aa-12 (2000). (224.) See 18 U.S.C. [subsection] 2510-2522. (225.) Id. [section] 2510. (226.) Thompson v. Dulaney, 970 F.2d 744, 747-48 (10th Cir. 1992). (227.) See 18 U.S.C. [section] 2511(1)(c). (228.) See id. [section] 2511(2)(c)-(d). (229.) Id. [section] 2511(2)(a)(i). (230.) Id. [section] 2511(3)(b)(iv). (231.) Id. [section] 2511(2)(g)(i). (232.) See id. [subsection] 3121-27. (233.) See id. [section] 3127(3)-(4). (234.) See FIELD GUIDANCE ON NEW AUTHORITIES THAT RELATE TO COMPUTER CRIME AND ELECTRONIC EVIDENCE ENACTED IN THE USA PATRIOT ACT OF 2001, Computer Crime and Intellectual Property Division, US Dep't of Justice, at http://www.usdoj.gov/ criminal/cybercrime/PatriotAct.htm (last visited Mar. 26, 2004)(on file with the Rutgers Computer and Technology Law Journal). (235.) A header is "a unit of information that precedes a data object." Webopedia Online Dictionary at http://www.webopedia.com/TERM/H/header.htm (last visited Mar. 26, 2004) (on file with the Rutgers Computer and Technology Law Journal). (236.) An ECS is "any service which provides to users thereof the ability to send or

receive wire or electronic communications." 18 U.S.C. [section] 2510(15). (237.) Id. [section] 3121(b)(3). (238.) Id. [section] 3121(b)(1). (239.) See id. [subsection] 3121-3127. (240.) Id. [section] 3125(a)(1)(B). (241.) 18 U.S.C. [section] 3122. (242.) Id. [section] 3123. (243.) Id. [section] 3123(c). (244.) Id. [section] 3123(d). (245.) See id. [section] 2701. (246.) See id. [section] 2701(a). (247.) See id. [section] 2701(c). (248.) See id. [section] 2702(c)(4). (249.) See id. [section] 2702 (c)(3). (250.) See id. [section] 2702 (b)(6). (251.) See id. [section] 2703 (c). (252.) See id. [section] 2703 (c). (253.) See id. [subsection] 2703(b)(1)(B), 2705. (254.) See id [subsection] 2703(b)(1)(B), 2705 (a). (255.) Id. (256.) See id. [section] 2705(a)(5). The government must send a copy of the request

or process used as well as notify the subscriber why the notice was delayed. See id. (257.) Id. [section] 2703(d). (258.) Id. (259.) Id [section] 2703(i)(1)(A). (260.) Id. [section] 2703(a). (261.) See id. [section] 2703(b)(1)(A). (262.) See id. [subsection] 2705(a)(1)(A)-(2). (263.) See id. [section] 2703(f). (264.) See id. (265.) See United States v. Kennedy, 81 F. Supp. 2d 1103, 1110 (D. Kan. 2000). (266.) See 18 U.S.C. [subsection] 2707, 2708. (267.) See id. [section] 2707(c). (268.) See id. (269.) E.g., United Laboratories, Inc. v. Rukin, 1999 WL 608712 at *5-*6 (N.D.Ill. Aug. 4, 1999). (270). 18 U.S.C. [section] 2707(d). (271.) See id. [section] 2707(e) ("A good faith reliance on (1) a court warrant or order, a grand jury subpoena, legislative authorization, or a statutory authorization ... is a complete defense to any civil or criminal action brought under this chapter or any other law." Id.) (272.) See 42 U.S.C. [section] 2000aa. See also DePugh v. Sutton, 917 F. Supp. 690 (W.D. Mo. 1996) (providing a succinct summary of the history of the PPA, and holding, in part, that PPA did protect the documents that police sought in their investigation of plaintiff).

(273.) Id. (274.) See id. [subsection] 2000aa(a)-(b). (275.) See id. [section] 2000aa(c). (276.) See id. [section] 2000aa(b). (277.) Id. [section] 2000aa(b)(3). This applies to "documentary materials" as defined by 42 U.S.C. [section] 2000aa-7(a). (278.) Id. 88 2000aa(a)(1), (b)(1). (279.) Id. [section] 2000aa(a)(1). (280.) Id. [section] 2000aa(b)(3). (281.) See generally United States v. Hunter, 13 F. Supp. 2d 574 (D. Vt. 1998). (282.) 255 F.3d 325,342 (6th Cir. 2001). (283.) See id.; Hunter, 13 F. Supp. 2d at 582; Capra v. Smith, 208 F.3d 220 (9th Cir. 2000) (unpublished). (284.) See generally Guest, 255 F.3d at 325; Steve Jackson Games, Inc. v. United States Secret Service, 816 F. Supp. 432 (W.D. Tex. 1993). (285.) See 42 U.S.C. [subsection] 2000aa-6(a),(d),(e); Davis v. Gracey, 111 F.3d 1472, 1482 (10th Cir. 1997). (286.) See 42 U.S.C. [subsection] 2000aa-6(f). (287.) See id [subsection] 2000aa-6(b). (288.) See id [subsection] 2000aa-6(c). (289.) Stephan K. Bayens, The Search and Seizure of Computers: Are We Sacrificing Personal Privacy for the Advancement of Technology?, 48 DRAKE L. REV. 239 (2000) (citing State v. One (1) Pioneer CD-ROM Changer, 891 P.2d 600, 607 (Okla. Civ. App. 1994)).

SUSAN S. KRESTON, Visiting Professor of Law, University of Mississippi. The author wishes to thank Lisa Grace Beard, my brilliant, relentless and generously patient research assistant, without whom this article could not have been completed. The author would also like to thank Detective Rick Hardy of the San Diego Regional Computer Forensic Laboratory for his help and support with this project. This article was supported by Grant No. 2000-DD-VX-0032 awarded by the Bureau of Justice Assistance. The Bureau of Justice Assistance is a component of the Office of Justice Programs, which includes the Bureau of Justice Statistics, the National Institute of Justice, the Office of Juvenile Justice and Delinquency Prevention, and the Office of Victims of Crime. Points of view or opinions in this document are those of the author and do not represent the official position of the United States Department of Justice. COPYRIGHT 2004 Rutgers University School of Law - Newark No portion of this article can be reproduced without the express written permission from the copyright holder. Copyright 2004 Gale, Cengage Learning. All rights reserved.