Police blotter: Can someone else let cops search your PC?

Police Blotter is a weekly CNET News.com report on the intersection of technology and the law.

What: Homeland Security agents obtained permission from elderly father, who lived in the same house, to search his son's computer for contraband.

When: 10th U.S. Circuit Court of Appeals ruled on April 25.

Outcome: By a 2-1 majority, the appeals court ruled the search was permissible because the father had the authority to consent to the search of the computer in his son's bedroom.

What happened, according to court documents:
During an investigation of Regpay, a payment-processing company that has been accused of having ties to child pornography, federal agents with the Department of Homeland Security became interested in a specific subscriber.

The name they obtained from Regpay's records was "Ray Andrus," with a street address in Leawood, Kan. They believed the account was used to access a now-defunct pornographic Web site called SunshineBoys.com. The e-mail address linked to the account was bandrus@kc.rr.com, however, which was associated with the name "Bailey Andrus."

But even after investigating for eight months, agents of Homeland Security's Immigration and Customs Enforcement section still didn't have enough hard evidence to make an arrest or get a search warrant from the judge. So they stopped by the house in Leawood for what's known as a "knock and talk," hoping to get permission for a voluntary search.

Customs agent Cheatham and Leawood police detective Woollen (no last names are given) arrived at the Andrus house at approximately 8:45 a.m. on August 27, 2004. Bailey Andrus, a 91-year old physician, answered the door in his pajamas and explained that his son Ray Andrus lived in the house to care for his aging parents.

Ray Andrus had a separate bedroom with the door ajar, and he was not at home. The father gave permission for the police to search his son's bedroom and any computers in it. Cheatham and Woollen called in a computer forensics expert, who had been waiting outside. He immediately unplugged the computer's hard drive and began browsing the contents using the EnCase forensic software (but did not check in advance to see if the contents were password-protected). Eventually the computer was seized by police.

The technician reported finding indications of child pornography after a few minutes of searching for JPEG files. At some point after this discovery, he halted and Ray Andrus was called at work. He agreed to come home. He was indicted on one count of knowingly and intentionally possessing sexually explicit images of minors in violation of federal law.

Andrus' defense counsel raised a number of objections to the search, centering on the argument that the elder Andrus did not have the legal authority to consent to a police search of his son's room and computer. (The computer was password-protected, but unless the contents are encrypted, such protection can typically be bypassed by plugging the hard drive into a second computer.)

That point is crucial. Normally a search warrant is required for a police search. But the U.S. Supreme Court has said that a third party can give consent--this often arises in husband-wife and roommate cases--for police to conduct a search if that person has joint access to that property, or control for most purposes.

Co-habitation is legally trickier, in other words, than a straightforward case of a bachelor living alone in a leased apartment. In a previous installment of Police Blotter, an appeals court ruled that police could not seize a computer without a warrant when the husband declined but the wife consented.

In the case of U.S. v. Andrus, the district court agreed that questions about the father's ability to consent made it a "close call"--but eventually ruled the results of the search could be used as evidence. Ray Andrus pleaded guilty and was sentenced to 70 months in prison. He did, however, reserve his right to raise the question of his father's consent during the appeal.

By a 2-1 majority, the 10th Circuit agreed with the district court and upheld his prison sentence.

Excerpts from the appeals court's majority opinion:
The inquiry into whether the owner of a highly personal object has indicated a subjective expectation of privacy traditionally focuses on whether the subject suitcase, footlocker or other container is physically locked. Determining whether a computer is "locked," or whether a reasonable officer should know a computer may be locked, presents a challenge distinct from that associated with other types of closed containers.

Courts addressing the issue of third-party consent in the context of computers, therefore, have examined officers' knowledge about password protection as an indication of whether a computer is "locked" in the way a footlocker would be. For example, in Trulock, the 4th Circuit held a live-in girlfriend lacked actual authority to consent to a search of her boyfriend's computer files where the girlfriend told police she and her boyfriend shared the household computer but had separate password-protected files that were inaccessible to the other. The court in that case explained, "Although Conrad had authority to consent to a general search of the computer, her authority did not extend to Trulock's password-protected files.

More from News.com on this story's topics

Law enforcement

RSS feed

See more CNET content tagged:
Police Blotter, bedroom, father, police, homeland security