Whether a reasonable person who verbally consents to a limited search of their cell phone authorizes law enforcement to download that phone’s entire contents, store a copy of the data indefinitely, and use it in unrelated investigations based on a vague consent form.
The Fourth Amendment generally requires the government to get a warrant which specifically describes the scope of a search in order to protect individuals from unreasonable searches of their “persons, houses, papers, and effects.” There are several exceptions to the warrant requirement, and one that law enforcement frequently uses is consent. Researchers have raised concerns that consent searches could be used too frequently or be overly broad given the power dynamics at play in interactions between law enforcement and subjects. Consent searches of cell phones are particularly problematic given the quantity and sensitivity of data stored on those devices and the fact that law enforcement agencies use sophisticated forensic devices to extract and analyze all of the data stored the phone. These forensic cell phone searches expose a huge amount of sensitive personal data and should not be made based on vague consent forms that do not explain the parameters of the extraction, search, or retention of the data.
In this case, the Defendant, who was interviewed during a hit-and-run investigation, verbally consented to a limited search of his text messages and then signed a generic consent form. The police then used a forensic device to extract all of the data from the Defendant’s phone, retained a copy of the data even after the investigation was closed, and eventually disclosed data outside the scope of the Defendant’s verbal consent and the scope of the original investigation with another police department for use in an unrelated homicide investigation. The Defendant was convicted of homicide and appealed, arguing that the initial extraction of his phone data exceeded the scope of his consent and should not have been used in the homicide investigation months later. The appeals court asked the Wisconsin Supreme Court to decide this novel issue. The case is currently before the Wisconsin Supreme Court.
In June 2016, the Green Bay Police Department (GBPD) was investigating a hit-and-run incident involving a vehicle recently used by the defendant. While questioning him, an officer asked to see certain text messages on the Defendant’s cell phone that were sent on the night of the incident. Mr. Burch allowed the officer to momentarily take his phone to download the messages, and he signed a generic consent form for the search. The officer did not obtain a warrant but relied instead on the consent form to have a forensic examiner download all of the data from Mr. Burch’s phone. The investigation eventually concluded without linking Burch to the hit-and-run, but the GBPD kept a copy of his phone data.
The forensic examiner used a mobile device forensic tool to download and sort through all of the data from Burch’s phone. Many law enforcement agencies across the country use these powerful forensic devices to access all types of information stored on a cell phone, as well as information stored off-device in the cloud and even previously deleted files. These devices download all the phone data information into folders and can organize and search the data in a variety of ways that would not be possible to an average user. The forensic software includes search functions that can quickly pick out certain types of data based on keywords or filters. Police frequently use these tools to search cell phones when the owners “consent” to a search, even when they use written consent forms that fail to inform individuals that such tools will be used on their device. The consent form Mr. Burch signed was just such a form; the document did not detail the scope of the extraction, search, or retention of his data.
In August 2016, a separate police department learned that the GPBD had a copy of Burch’s cell phone data and requested it after he became a suspect in an unrelated homicide investigation. They did not obtain a warrant to access and search the data. An officer used Burch’s mobile internet history and phone location information from a month before the hit-and-run incident to build a case against him in the homicide investigation. The Defendant was arrested and charged with homicide. At trial, the State relied on the internet history and phone location evidence. Mr. Burch was convicted and appealed to the Wisconsin Court of Appeals, arguing that the evidence from his phone should not have been used during his trial. Burch argued that the GBPD’s initial extraction exceeded the limited scope of consent he had given to search his text messages, and the second police department should not have had access to the copy of his data without a warrant.
The Court of Appeals determined that the case raised important Fourth Amendment issues never before considered in the state and asked the Wisconsin Supreme Court to decide the appeal. The Wisconsin Supreme Court took the case and presented a number of questions, including whether a reasonable person authorizes the warrantless extraction of their entire phone data when they verbally consent to a more limited category of data but sign a general consent form.
For years, EPIC has sounded the alarm on the significant threat to privacy posed by warrantless searches of cell phones. EPIC filed an amicus brief in Riley v. California, in which the U.S. Supreme Court cited EPIC’s brief and recognized that the massive amounts of sensitive information stored on modern cell phones requires heightened constitutional protections. EPIC also filed a brief in Carpenter v. United States, arguing that law enforcement must obtain a warrant before accessing and using phone location information, which can reveal intimate and private details of individuals’ lives based on their movements over time. EPIC regularly files amicus briefs in Fourth Amendment cases concerning privacy in personal data, including cable subscription information.