U.S. v. Cotterman: Ninth Circuit Holds Reasonable Suspicion Required for Forensic Laptop Search at the Border
The Fourth Amendment generally requires that government searches must be reasonable, which typically can be satisfied via a warrant. Searches at the border, however, traditionally occupy a special status in connection with U.S. Fourth Amendment law. Recognizing that “the government’s interest in preventing the entry of unwanted persons and effects is at its zenith at the international border,” border searches are generally deemed “reasonable simply by virtue of the fact that they occur at the border.” While the Ninth Circuit has stated that the border is not an “anything goes” zone, the court has nevertheless previously held that reasonable suspicion is not required before searching electronic devices at the border. As a result, laptops and other electronic devices are commonly subject to cursory searches at the border. For some individuals, these searches can move beyond cursory review and include detailed forensic analysis that can reveal not only every file stored on the device, but also files that have previously been deleted.
Recently, however, the Ninth Circuit issued an en banc decision requiring that reasonable suspicion exist before boarder agents engage in forensic computer searches. The court also noted that password protecting an entire electronic device is not a factor that can be used to trigger reasonable suspicion. The decision is likely to impact law enforcement’s ability to engage in border searches of digital devices. Civil liberties groups have recognized the decision as providing some important additional 4th amendment protection for international travelers.
Facts of the Case
While traveling back to the U.S. with his wife, Howard Cotterman drove through the Lukeville, Arizona Port of Entry. During inspection by a border agent, the Treasury Enforcement Communication Systems (TECS) returned a positive “hit” for Cotterman, indicating that he was a sex offender. According to the court, TECS is “an investigative tool of the Department of Homeland Security that keeps track of individuals entering and exiting the country and of individuals involved in or suspected to be involved in crimes.” Boarder agents received information that Cotterman “had a 1992 conviction for two counts of use of a minor in sexual conduct, two counts of lewd and lascivious conduct upon a child, and three counts of child molestation—and that he was potentially involved in child sex tourism.” Immigration and Customs Enforcements agents were then called to the scene. The agents decided en route to the inspection point that Cotterman’s computer would be detained for forensic examination. After reading Cotterman and his wife their Miranda warnings, they interviewed the two separately. The interviews revealed nothing incriminating. Cotterman offered to help the agents access his laptop during the interview, but the agents declined the offer, fearing hat the laptop might be “booby trapped.”
The agents then allowed Cotterman and his wife to cross the boarder, but detained their laptops and a digital camera. The devices were then brought back to the ICE office, where a forensic specialist examined them the next day. During the investigation, the agent first used forensic software to make a full copy of the hard drives. The agent then ran the forensic software program EnCase on the laptop for several hours. The court states that the EnCase program “copied, analyzed, and preserved the data stored on the hard drive and gave the examiner access to far more data, including password-protected, hidden or encrypted, and deleted files, than a manual user could access.” Following this, the agent found 76 images of child pornography on the unallocated disk space of the laptop. Unallocated disk space is defined by the court as “space on a hard drive that contains deleted data, usually emptied from the operating system’s trash or recycle bin folder, that cannot be seen or accessed by the user without the use of forensic software. Such space is available to be written over to store new information.” The agent then contacted Cotterman asking for his assistance in opening password protected files, but Cotterman never returned to provide assistance. The agent eventually was able to open several of the password protected files, which contained approximately 378 additional images of child pornography. Over the next few months, the agent “discovered hundreds more pornographic images, stories, and videos depicting children.”
A grand jury then indicated Cotterman for several offenses related to child pornography. Cotterman moved to suppress the evidence gained from the search of the laptop. A magistrate judge then found that “the forensic examination was an ‘extended border search’ that required reasonable suspicion.” The magistrate judge “found that the TECS hit and the existence of password-protected files on Cotterman’s laptop were suspicious, but concluded that those facts did not suffice to give rise to reasonable suspicion of criminal activity.” The district court adopted the recommendation and granted the motion to suppress. The government than asked for interlocutory appeal, framing the question as “[w]hether the authority to search a laptop computer without reasonable suspicion at a border point of entry permits law enforcement to take it to another location to be forensically examined, when it has remained in the continuous custody of the government.” A divided panel of the 9th Circuit answered the question in the affirmative and reversed. “The panel concluded that reasonable suspicion was not required for the search and that “[t]he district court erred in suppressing the evidence lawfully obtained under border search authority.”
The 9th Circuit then voted to re-hear the case en banc.
Reasonable Suspicion Required for Forensic Search
The 9th Circuit in Cotterman ruled that a forensic examination of a laptop requires reasonable suspicion. The court placed emphasis on the fact that it was the invasive nature of the search that triggers the reasonable suspicion requirement, not the actual location of the search. The court stated that “after their initial search at the border, customs agents made copies of the hard drives and performed forensic evaluations of the computers that took days to turn up contraband. It was essentially a computer strip search.”
For the court, this kind of invasive searching is troublesome first due to the sheer amount of data that devices can contain. The court stated that while “[t]he amount of private information carried by international travelers was traditionally circumscribed by the size of the traveler’s luggage or automobile” in today’s world of modern technology “[t]hat is no longer the case.” The court noted that “[e]lectronic devices are capable of storing warehouses full of information. The average 400-gigabyte laptop hard drive can store over 200 million pages—the equivalent of five floors of a typical academic library.”
The court then noted that this large amount of data means that devices commonly contain very personal materials. The court stated that “[l]aptop computers, iPads and the like are simultaneously offices and personal diaries. They contain the most intimate details of our lives: financial records, confidential business documents, medical records and private emails.”
Finally, the court noted that an additional troublesome aspect of forensic searches is their ability to turn up all of the data that is stored on the devices, including files that have been deleted by the user. The court stated that “[e]lectronic devices often retain sensitive and confidential information far beyond the perceived point of erasure, notably in the form of browsing histories and records of deleted files…It is as if a search of a person’s suitcase could reveal not only what the bag contained on the current trip, but everything it had ever carried.”
The court thus reached the conclusion that forensic searching of technological devices at the boarder requires reasonable suspicion. In reaching this conclusion, the court distinguished technological devices from other materials that commonly pass through the boarder. “Unlike searches involving a reassembled gas tank…or…small hole in the bed of a pickup truck…the uniquely sensitive nature of data on electronic devices carries with it a significant expectation of privacy and thus renders an exhaustive exploratory search more intrusive than with other forms of property.”
The Test at the Border
The court in Cotterman ruled that detailed forensic searches of technological devices require reasonable suspicion. The court, however, distinguished these kinds of searches from more cursory manual reviews of the devices. Such manual reviews, which occur when a law enforcement official simply turns the device on and looks through the files, do not require reasonable suspicion.
The court stated that its holding in Cotterman “requires that officers make a commonsense differentiation between a manual review of files on an electronic device and application of computer software to analyze a hard drive, and utilize the latter only when they possess a “particularized and objective.”
What Constitutes Reasonable Suspicion
The court noted that reasonable suspicion is defined as “a particularized and objective basis for suspecting the particular person stopped of criminal activity.” This assessment is to be made in light of “the totality of the circumstances.” [E]ven when factors considered in isolation from each other are susceptible to an innocent explanation, they may collectively amount to a reasonable suspicion.”
The government agents based their reasonable suspicion on the TECS hit, which took into account Cotterman’s past convictions for child molestation and the fact that he frequently traveled internationally. Additionally, the agents based reasonable suspicion on the fact that Cotterman was returning to the country from Mexico, “a country associated with sex tourism.”
The government also asserted that reasonable suspicion existed because some of the files on Cotterman’s computer were password protected. The court, however, refused to place much weight on this factor “because it is commonplace for business travelers, casual computer users, students and others to password protect their files.” The court stated that law enforcement cannot rely solely on factors that would apply to law abiding citizens. The court noted that “[n]ational standards require that users of mobile electronic devices password protect their files.” The court stated that password protecting individual files could only be “considered in the totality of the circumstances” where there are “are other indicia of criminal activity.” The court noted that password protecting an entire device, however, cannot be a factor supporting a reasonable suspicion requirement, as “using a password on a device is a basic means of ensuring that the device cannot be accessed by another in the event it is lost or stolen.”
Considering these factors as a whole, the court stated that “the border agents ‘certainly had more than an inchoate and unparticularized suspicion or hunch’ of criminal activity to support their decision to more carefully search for evidence of child pornography.” The court thus concluded that the examination of the electronic devices “was supported by reasonable suspicion and that the scope and manner of the search were reasonable under the Fourth Amendment.” The court therefore held that the motion to suppress the evidence was erroneously granted.
Implications and Reaction
Civil liberties groups have stated that the 9th Circuit’s decision in Cotterman is “a step in the right direction towards ensuring our historic Fourth Amendment protections keep pace with modern technological advances, and an important decision in the growing challenges to the government’s border search powers.” Others have noted that Cotterman draws “a line in the sand and recognized that the vast amount of personal information and sensitive data on laptops, cell phones, and other electronic devices is worthy of Fourth Amendment protection.”
Leading Fourth Amendment scholar Orin Kerr has noted that the 9th Circuit’s opinion leaves open the important question of where the exact line between manual and forensic searches should be drawn. Importantly, Kerr states that it is not clear whether there are any limits on what constitutes a manual search of a laptop. Kerr states that it is not clear whether a law enforcement agent can conduct any kind of search as long as it is done manually, or whether manual searches are subject to a reasonableness requirement. If manual searches are subject to a reasonable requirement, additional questions arise as to whether reasonableness is determined by time, the type of files viewed, or some other criteria.
Kerr also asks whether Cotterman allows law enforcement officials to make copies of computer hard drives and then mount the drives on a separate computer and manually search through the files. According to Kerr, “[t]he major reason investigators make images and search only the images is to maintain evidentiary integrity: Searching a computer can alter the evidence on it, so agents work off an image in order to retain the original as original.” It is questionable whether law enforcement officials can engage in such activity without reasonable suspicion post-Cotterman. Kerr also questions whether law enforcement officials can run forensic software on a laptop manually, through the use of a thumb drive.
There is a strong chance that both the government and Cotterman will petition the Supreme Court to consider the case. It is, of course, difficult to predict whether the Supreme Court will decide to hear the case. However, given the practical importance of the case, it is not difficult to imagine that the Court will be interested in hearing the case.
While questions about the future implementation of Cotterman remain, the decision is an important development in Fourth amendment law, and will likely play a significant role in shaping law enforcement activities at the boarder, particularly in 9th Circuit border states such as California and Arizona.