9th Circuit Constrains Computer Privacy

April 6, 2007. The U.S. Court of Appeals (9thCir) issued its opinion [13 pages in PDF] in USA v. Heckenkamp, a Section 1030 case in which the issue is the admissibility of evidence acquired in a warrantless remote search of a student's hard drive by a university network administrator who was acting in association with the FBI.

The Court of Appeals affirmed the District Court's denial of Heckenkamp's motion to suppress evidence under the special needs exception to the warrant requirement. The Court of Appeals held that federal prosecutors can use evidence collected in a warrantless computer search to prosecute a student for hacking computers outside of the university network, when the university acted out of an independent concern to protect its own computer systems.

Background. The Federal Bureau of Investigation (FBI) was investigating unauthorized access to the computer systems of Qualcomm. It determined that the intruder likely accessed Qualcomm's computer systems from a computer on the University of Wisconsin (UW) network.

The FBI then sought and received assistance from the UW. A UW investigation of network information led it to focus on one individual, Jerome Heckenkamp, who was a graduate student in computer science, and the computer in his UW dormitory room. The UW investigation determined that a computer, or two computers, it was not sure, under investigation, may have been used to gain unauthorized access to both Qualcomm's computer system and the UW e-mail system.

At this point, neither the FBI, nor UW police, had obtained a search warrant, or permission from Heckenkamp, to search his computer. Nevertheless, a UW network administrator used his computer to remotely search the hard drive of Heckenkamp's computer.

The next day the FBI obtained the first search warrant. Pursuant to the warrant, federal agents seized Heckenkamp's computer and searched his room.

Heckenkamp moved to suppress evidence gathered from the UW's remote search of his computer, an image taken of his hard drive, and the search conducted pursuant to the FBI's search warrant. The District Court denied the motion.

Heckenkamp pled guilty to two counts of violation of 18 U.S.C. § 1030, conditioned upon his right to appeal the denial of his motion to suppress. Heckenkamp then brought the present appeals.

Court of Appeals. The Court of Appeals affirmed. Heckenkamp prevailed on the issue of whether he held a reasonable expectation of privacy in the contents of his computer. The Court of Appeals opinion provides guidance regarding when there is a reasonable expectation of privacy in computers that are attached to networks. However, Heckenkamp lost on the second issue -- the special needs exception to the warrant and probable cause requirement.

The Court of Appeals first addressed the warrant requirement and reasonable expectations of privacy. It wrote that "As a prerequisite to establishing the illegality of a search under the Fourth Amendment, a defendant must show that he had a reasonable expectation of privacy in the place searched."

The Court also noted that the "government does not dispute that Heckenkamp had a subjective expectation of privacy in his computer and his dormitory room, and there is no doubt that Heckenkamp’s subjective expectation as to the latter was legitimate and objectively reasonable." However, it wrote that the "salient question is whether the defendant's objectively reasonable expectation of privacy in his computer was eliminated when he attached it to the university network. We conclude under the facts of this case that the act of attaching his computer to the network did not extinguish his legitimate, objectively reasonable privacy expectations."

The Court added that "privacy expectations may be reduced if the user is advised that information transmitted through the network is not confidential and that the systems administrators may monitor communications transmitted by the user." But, "In the instant case, there was no announced monitoring policy on the network." After reviewing the UW's policies, the Court concluded that "we must reject the government’s contention that Heckenkamp had no objectively reasonable expectation of privacy in his personal computer, which was protected by a screensaver password, located in his dormitory room, and subject to no policy allowing the university actively to monitor or audit his computer usage."

The Court of Appeals then addressed the second issue, the special needs exception. It concluded that "the search of the computer was justified under the ``special needs´´ exception to the warrant requirement. Under the special needs exception, a warrant is not required when `` `special needs, beyond the normal need for law enforcement, make the warrant and probable-cause requirement impracticable.´ ´´"

The Court of Appeals wrote that while the UW knew of the FBI investigation regarding unauthorized access to Qualcomm's computer, it had an independent concern about the security of its own computers. Moreover, this concern about its own computers was enough to allow it to rush the investigation without a warrant.

The evidence collected by the warrantless search of the computer was used to obtain the conviction in the FBI's case. Nevertheless, the Court of Appeals wrote that the actions of the UW investigator "were not motivated by a need to collect evidence for law enforcement purposes or at the request of law enforcement agents."

Hence, the Court of Appeals affirmed the denial of the motion to suppress under this special needs exception to the warrant requirement.

Commentary. Heckenkamp pled guilty to hacking into Qualcomm's computer system. His conviction has withstood appeal, and he will be punished. Suppression of evidence in this case may have enabled Heckenkamp to escape punishment for a crime to which he pled guilty.

However, this opinion may also impact the electronic privacy of persons whose computers are attached to certain networks, both in academia, and elsewhere, including persons who have committed no crimes.

The exclusionary rule can wreak havoc on a prosecution. Occasionally, it enables guilty people to escape punishment. Law enforcement officials and prosecutors hate it when this happens.

Courts and legislators have only limited means by which they can incent overzealous prosecutors and investigators to respect the constitutional privacy rights of the general public. The exclusionary rule can be an effective tool. The loosening of the exclusionary rule in this case removes some of the incentive for prosecutors and investigators, including university police, to respect the privacy of users of their networks.

Also, in the present case, the Court of Appeals noted that the UW investigators had reason to suspect that a computer or computers that may have been used by Heckenkamp had accessed the university's e-mail system without authorization. The Court relied on this in finding that the special needs exception applied in this case.

However, the opinion does not provide clear guidance for related factual scenarios. For example, can a university network administrator remotely search a user's computer without a warrant under the special needs exception solely on the basis that the FBI has asserted that a user of the university network has hacked an outside computer system.

Moreover, the opinion is silent as to investigations by corporations, trade groups, or other non-law enforcement entities. Finally, the opinion does not address application of the special needs exemption in the context of online criminal activity other than Section 1030 unauthorized access.

This case is U.S.A. v. Heckenkamp, U.S. Court of Appeals for the 9th Circuit, App. Ct. Nos. 05-10322 and 05-10323, appeals from the U.S. District Court for the Northern District of California, D.C. Nos. CR-03-20041-JW and CR-00-20355-JW, Judge James Ware presiding. Judge Sidney Thomas wrote the opinion of the Court of Appeals, in which Judges William Canby and Michael Hawkins joined.