W.D.N.Y.: No apparent authority to consent to computer search without password

A parent who does not know the child’s computer password doesn’t have apparent authority to consent to a search of the computer; rejecting United States v. Andrus, 483 F.3d 711 (10th Cir. 2007), as illogical and unwarranted. United States v. Griswold, 2011 U.S. Dist. LEXIS 153943 (W.D. N.Y. June 2, 2011) (just now on Lexis):

The government does not argue that the Second Circuit has yet adopted the Andrus holding on apparent authority as to password protected computers and the reasoning behind the Andrus decision has been questioned by both a leading Fourth Amendment scholar and several law review student commentators. See 4 Wayne R. LaFave, Search and Seizure: A Treatise on the Fourth Amendment § 8.3(g) at 180 (4th ed. 2004, 2010-11 Supplement) (“Remarkably, the majority in Andrus, on these facts, upheld the search on an apparent authority basis.”); David D. Thomas, Note, Dangerously Sidestepping the Fourth Amendment: How Courts Are Allowing Third-Party Consent To Bypass Warrants for Searching Password-Protected Computers, 57 Clev. St. L. Rev. 279, 304-05 (2009) (It is constitutionally wrong to “allow police officers to skate around the Fourth Amendment by intentionally avoiding asking questions of third parties while obtaining consent, as well as allowing them to ignore password “locks” on computers that, as shown, courts have held to be analogous to locks on physical items.”); Michael J. Ticcioni, Comment, United States v. Andrus: Does the Apparent Authority Doctrine Allow Circumvention of Fourth Amendment Protection in the Warrantless Search of a Password-Protected Computer, 43 New Eng. L. Rev. 339, 355 (Winter 2009) (“The Tenth Circuit erred in its holding that law enforcement agents were reasonable in relying on the apparent authority of a ninety-one year old man to consent to a search of his son’s password-protected computer.”); Michael Smith, Survey, The Fourth Amendment, Password-Protected Computer Files and Third Party Consent Searches: The Tenth Circuit Broadens the Scope of Warrantless Searches, 85 Denv. U. L. Rev 701, 723 (2008) (“The Andrus rule essentially does three things: first, it removes the requirement for a third party consenter to have a key to a locked container; second, it replaces the key requirement with a government actor’s reasonable belief that there is no need for a key; and third, it allows the use of technology to bypass a key (or password) without first determining whether the container (or computer) is locked.”); Noah Stacy, Comments and Casenotes, Apparent Third Party Authority and Computers: Ignorance of the Lock is No Excuse, 76 U. Cin. L. Rev. 1431 (Summer 2008) (“The court’s holding sets a dangerous precedent under which law enforcement may evade the Fourth Amendment requirement of either a warrant or valid consent by claiming ignorance of any password protection and relying upon the apparent authority of a third party.”); Sarah M. Knight, Casenote, United States v. Andrus: Password Protect Your Roommate, Not Your Computer, 26 J. Marshall J. Computer & Info. L. 183, 184 (Fall 2008) (“As a consequence of this holding, third-parties can consent to searches beyond their authority, and individuals’ efforts to secure their data are rendered useless.”); John-Robert Skrabanek, Note, Apparent Authority in Computer Searches: Sidestepping the Fourth Amendment, 97 Ky. L.J. 721, 728-29 (2008-09) (“By allowing such searches, these courts have created the incentive for law enforcement not to ask questions.”). In addition, in responding to a petition for rehearing, the Tenth Circuit panel in Andrus issued a decision limiting its holding to the “narrow question” presented by the facts and was not controlling authority on facts not presented such as a situation where “law enforcement confronts password protection or user profiles on home computers.” United States v. Andrus, 499 F.3d 1162 (10th Cir. 2007) (rehearing denied).

But aside from doubts as to its constitutional logic, the facts in Andrus are distinguishable in an important way from the search of Griswold’s laptop. In Andrus the court specifically relied on the fact that when the officers began opening files on the computer they were not aware (and did not inquire about) whether the computer was locked or password protected. “Even if [the defendant’s] computer was protected with a user name and password, there is no indication in the record that the officers knew or had reason to believe such protections were in place.” 483 F.3d at 721. Here, however, the proof is the opposite. Investigator Becker testified that before commencing the search he noted that “[t]he laptop was on and it showed a screen and it said Bryan on the screen and it said locked.” (Tr. at p. 67) (emphasis added). Instead of inquiring further about the fact that the computer was locked, Becker testified he then shut down the computer, inserted his special forensic software disk, booted up the computer, and then was able to “browse the hard drive without a password.” (Tr. at p. 67). The need for a password to enter an otherwise locked computer, known to Investigator Becker prior to opening any files and commencing his search, clearly indicated that Griswold had taken steps to protect his privacy and exclude others from looking at files on his laptop computer. At that point, without more information, it was unreasonable for the Investigators to assume that Mrs. Williamee had actual authority to consent to the search of her son’s laptop.

In sum, based on the totality of circumstances present here, I find that the government has failed to meet its burden of demonstrating that it was objectively reasonable for the Investigators to believe that Mrs. Williamee had the authority to consent to a search of a password protected laptop computer belonging to her eighteen year old son and retrieved from her son’s bedroom.