S.D.N.Y.: Def had a REP in his university owned computer, but they could consent to search

Defendant was employed by NYU, and he obtained a computer under a grant and encrypted the hard drive with multiple layers of protection. He took that computer home every night. NYU became suspicious of his handling of the grant and demanded to look at the computer. He handed it over but refused to give the passwords. NYU turned it over to the FBI which succeeded in getting into it. The NYU employee handbook and computer policy told everybody that NYU retains control over all computers the university owned. Defendant still had a reasonable expectation of privacy in the computer, but NYU’s third party consent was effective. United States v. Yudong Zhu, 2014 U.S. Dist. LEXIS 77208 (S.D. N.Y. May 27, 2014):

In this case, NYU’s computer policy does not weigh strongly toward a finding that Zhu lacked a reasonable expectation of privacy regarding a law enforcement search. The NYU Staff Handbook contained strong language warning staff of their lack of an expectation of privacy in their NYU-owned computers. Based on the Staff Handbook, “staff should have no expectation of privacy” in NYU computers (Delts Decl., Ex. A, at 4), and NYU reserved the right to search such computers at any time, without notice, even including computers used at home (Id.; id., Ex. A., at 17). Importantly, though, the Staff Handbook did not apply to Zhu, who was a member of the faculty, not the staff. (See id., Ex. A, at 4 (“The information in this handbook applies to all Medical Center employees, other than members of the Faculty ….”).)

Thus, the only NYU computer policy that applied to Zhu concerns the form he signed acknowledging that NYU had the right to “inspect the computers it owns, as well as personal PCs used for work, to ensure that its data and software are used according to its policies and procedures.” (Id., Ex. C.) Zhu’s authorization granted NYU only the right to search his computer; it did not contain a disclaimer of any expectation of privacy such as appeared in the Staff Handbook, and it did not state that NYU could inspect Zhu’s computer at any time, without notice. This is not the type of pervasive policy that could vitiate Zhu’s expectation of privacy vis-a-vis law enforcement. Cf. Angevine, 281 F.3d at 1134 (professor lacked a reasonable expectation of privacy where University maintained right to search work computers at any time, and computer users were notified by a “splash screen” each time they opened the computer that they had no expectation of privacy in any emails); Levanthal, 266 F.3d at 74 (finding defendant had a reasonable expectation of privacy from public employer search of his computer where employer neither “had a general practice of routinely conducting searches of office computers [n]or had placed [defendant] on notice that he should have no expectation of privacy in the contents of his office computer”); Simons, 206 F.3d at 398 (deciding that CIA employee lacked a reasonable expectation of privacy where the policy stated that the employer would monitor the internet usage of all employees, “including all file transfers, all websites visited, and all email messages, as deemed appropriate”).

B. ACTUAL AUTHORITY

While Zhu had a reasonable expectation of privacy in relation to the FBI’s search of his laptop, the Court is persuaded that the search here was performed with NYU’s valid, third-party consent. To find NYU’s consent to be valid, the Government must show first that NYU “had access to the area searched, ” and next that NYU had either “(a) common authority over the area, (b) a substantial interest in the area, or (c) permission to gain access to the area.” Davis, 967 F.2d at 87.

NYU had “access” to Zhu’s computer as required under Davis, based on the authorization Zhu signed acknowledging that NYU could inspect its own computers to ensure that “its data and software are being used according to its policies and procedures.” (Delts Decl., Ex. C.) This authorization granted NYU legal access to Zhu’s laptop, which was purchased with NIH funds granted to NYU and therefore property of NYU. (Carna Decl, at 4.) As Zhu correctly notes, “[c]ommon authority is not to be implied from the mere property interest a third party has in the property.” Matlock, 415 U.S. at 171 n.7. But while NYU’s property interest in the laptop was not sufficient on its own to grant it access to Zhu’s laptop, Zhu’s signed authorization permitted NYU to access the laptop in order to ensure that Zhu had not violated NYU’s policies and procedures.