Police blotter: Can someone else let cops search your PC?

Police Blotter is a weekly CNET News.com report on the intersection of technology and the law.

What: Homeland Security agents obtained permission from elderly father, who lived in the same house, to search his son's computer for contraband.

When: 10th U.S. Circuit Court of Appeals ruled on April 25.

Outcome: By a 2-1 majority, the appeals court ruled the search was permissible because the father had the authority to consent to the search of the computer in his son's bedroom.

What happened, according to court documents:
During an investigation of Regpay, a payment-processing company that has been accused of having ties to child pornography, federal agents with the Department of Homeland Security became interested in a specific subscriber.

The name they obtained from Regpay's records was "Ray Andrus," with a street address in Leawood, Kan. They believed the account was used to access a now-defunct pornographic Web site called SunshineBoys.com. The e-mail address linked to the account was [e-mail], however, which was associated with the name "Bailey Andrus."

But even after investigating for eight months, agents of Homeland Security's Immigration and Customs Enforcement section still didn't have enough hard evidence to make an arrest or get a search warrant from the judge. So they stopped by the house in Leawood for what's known as a "knock and talk," hoping to get permission for a voluntary search.

Customs agent Cheatham and Leawood police detective Woollen (no last names are given) arrived at the Andrus house at approximately 8:45 a.m. on August 27, 2004. Bailey Andrus, a 91-year old physician, answered the door in his pajamas and explained that his son Ray Andrus lived in the house to care for his aging parents.

Ray Andrus had a separate bedroom with the door ajar, and he was not at home. The father gave permission for the police to search his son's bedroom and any computers in it. Cheatham and Woollen called in a computer forensics expert, who had been waiting outside. He immediately unplugged the computer's hard drive and began browsing the contents using the EnCase forensic software (but did not check in advance to see if the contents were password-protected). Eventually the computer was seized by police.

The technician reported finding indications of child pornography after a few minutes of searching for JPEG files. At some point after this discovery, he halted and Ray Andrus was called at work. He agreed to come home. He was indicted on one count of knowingly and intentionally possessing sexually explicit images of minors in violation of federal law.

Andrus' defense counsel raised a number of objections to the search, centering on the argument that the elder Andrus did not have the legal authority to consent to a police search of his son's room and computer. (The computer was password-protected, but unless the contents are encrypted, such protection can typically be bypassed by plugging the hard drive into a second computer.)

That point is crucial. Normally a search warrant is required for a police search. But the U.S. Supreme Court has said that a third party can give consent--this often arises in husband-wife and roommate cases--for police to conduct a search if that person has joint access to that property, or control for most purposes.

Co-habitation is legally trickier, in other words, than a straightforward case of a bachelor living alone in a leased apartment. In a previous installment of Police Blotter, an appeals court ruled that police could not seize a computer without a warrant when the husband declined but the wife consented.

In the case of U.S. v. Andrus, the district court agreed that questions about the father's ability to consent made it a "close call"--but eventually ruled the results of the search could be used as evidence. Ray Andrus pleaded guilty and was sentenced to 70 months in prison. He did, however, reserve his right to raise the question of his father's consent during the appeal.

By a 2-1 majority, the 10th Circuit agreed with the district court and upheld his prison sentence.

Excerpts from the appeals court's majority opinion:
The inquiry into whether the owner of a highly personal object has indicated a subjective expectation of privacy traditionally focuses on whether the subject suitcase, footlocker or other container is physically locked. Determining whether a computer is "locked," or whether a reasonable officer should know a computer may be locked, presents a challenge distinct from that associated with other types of closed containers.

Courts addressing the issue of third-party consent in the context of computers, therefore, have examined officers' knowledge about password protection as an indication of whether a computer is "locked" in the way a footlocker would be. For example, in Trulock, the 4th Circuit held a live-in girlfriend lacked actual authority to consent to a search of her boyfriend's computer files where the girlfriend told police she and her boyfriend shared the household computer but had separate password-protected files that were inaccessible to the other. The court in that case explained, "Although Conrad had authority to consent to a general search of the computer, her authority did not extend to Trulock's password-protected files.

[PzkwVIb]

The dissenting opinion was correct

If you apply a password to your machine you have a reasonable expectation of privacy.

Detaching the hardrive and attaching it to another machine was clearly an attempt not to be impeded by any security that may or may not have been present. I refuse to believe that any computer forensics expert with half a functioning brain would not take this in to account when choosing to attach the HD to a different machine.

[robbtuck]

Illegal search

Even if the guy is a scumbag, removing the hard drive to avoid security measures should constitute illegal searching. Also, if the elderly father has no ownership over the computer and the son is (obviously) an adult, his consent should be meaningless.

[Inetsec]

Law and Hi-teck ignorance

Yes the subject line was misspelled - on purpose.

This is and always has been a problem with Law enforcement / courts / Govt, and any new technology.

Clearly this was an injustice, and to add further insult to injury, there was not enough "hard evidence found" to go for a conviction and I am sure that the mans life is now ruined since he will be a "suspect" from now on.

Is the United States headed back to the days of burning claimed witches on the stake? Yep. Seems to me like it.

[sjit]

The Dissenting Opinion is Faulty

To say that law enforcement used specialized software to specifically bypass password protection is wrong. If that were true, every PC on earth could be considered a specialized tool to specifically bypass password protection because installing the secondary drive on any PC automatically bypasses standard OS passwords. The software law enforcement uses isn't to bypass or hack passwords, it's to group specific file types together in an interface that makes them easy to search and preview.

Bottom line is whatever it takes to catch pedophiles, be my guest. Anyone that is outraged by this decision must have something to hide on their PC or are just paranoid. Be a good human being and this wouldn't bother you.

[gerhard_schroeder]

When Living in Your Parents Basement....

You sound like a big whiner...

[gerhard_schroeder]

Liberals help Pedophiles get off the hook w/ technicalities

The liberals are always willing to get pedophiles off the hook on a technicality. Its quite a disturbing trend. They see the law enforcement as the danger instead of the pedo. What is wrong with the crazed liberal mind? Court cases are not ran by God, therefore, they are not perfect. But the liberals will use any imperfection to get dangerous pedos off the hook.

[solrosenberg]

The Lesson

Never let the cops into your house unless they have a warrant. And make sure everyone else who lives in your house agrees. Cops are not your friends and they don't stop by just to chat.

[MrCoolAce]

I'd like to see the worst case happen

Its very difficult to defend someone that actually had child porn on his computer. I'd really like to see the case where they looked for child porn and came up empty, except maybe they find some other (unrelated) criminal evidence on the PC. This is the person who should scream from the highest mountain that his rights were abused.

[PzkwVIb]

Mr Schroeder

seems to believe that the ends justify the means. I can hardly think of a more unamerican sentiment.

[PzkwVIb]

Mr Schroeder

seems to believe that the ends justify the means. I can hardly think of a more unamerican sentiment.

[gefitz]

OK, pedophiles should pay, but...

The problem is that the justice system works on precedent. When a decision like this is made, it furthers the cause of those who believe ANY information you keep, regardless of the expectation of privacy, is searchable without direct consent of the owner.

I think people that say the decision was correct solely for the reason that it caught a pedophile is having trouble seeing the forest for the trees. The fact is that further precedent has been set for police searches for ANY information (financial, communications, indirect knowledge of wrongdoing, "terrorist" activity, etc) that might be on a computer are legal as long as someone nearby is asked (not even necessarily related to the owner of the computer: a roommate, for example?).

[NoVista]

Partisanshit sucks!

So do _ad_hominem_ comments.

First, this article was too light on details. Bad c/net!

This particular story would never even have featured on Police Blotter if the law enforcement people had gotten a warrant. That's proper procedure and doesn't need agreement.

If those of you who take the moral high ground equate arguments for rule of law with pedophilia, you're just created a lot more pedophiles.

From this article, we do not know what the alleged evidence of pedophilia was, so it is diffuclt to judge the real culpability, to what degree. That he copped a plea is not guarantee of much of anything; sometimes that is just in hopes of a lighter sentence, which even then is not always guaranteed.

There's no indication this was a jury trial, but then, only about 3% of charges go before a jury, anyway.

JPGs are suggested, OK. Let's say this bloke had some pictures of underage boys ... or girls. A crime, under law, yeah? But who is the victim of the crime?

Personally, I see no allure in child porn photos but some kink who likes them of itself is no great threat to the homeland security supposedly being defended. I guess this case ends with one 'criminal' in jail. And I suppose his aged father knows in his heart the right thing was done. But who will look after him [and the wife?'] now.

This is like arresting, trying and convicting of someone with a bit of weed and ignoring the top of the food chain in the drug wars.

Real pedophils are activists. Just ask Mark Foley ...

But for those who have nothing to hide on their computers, don't feel too secure. Everyone has enemies -- you do, too. I'm sure anyone could hire a good hacker to pollute your computer with a 'hidden' folder of child porn. And then be the 'anaonymus tip' to the police or DHS.

Check out the Atlanta story of the 92 y.o. woman who was mortally wounded in a 'no-knock' raid on her house, based on false informant information. When the cops found they were led astray, one planted some marijuana in hopes of covering the tracks.

Do not believe just because are pure of heart that something wrongfully bad could not happen to you. Too many stories of drugs busts on =the wrong house= have already been well-documented.

And if you survive the SWAT team, screaming, "I'm innocent", whether of unknown kiddie porn on your computer or the crack you never knew was there til it was planted, only then might you understand rule of law and people that argue for it.

Have a nice day!

[jsmith1785]

Police violate DMCA

You can take a group of files, and put them together as a collection and copyright that collection. His computer was password protected, and the police circumvented this protection, thus violating the DMCA. Interesting twist of the law?

[MSSlayer]

technicality?

Since when is the Constitution and the Bill of Rights a technicality.

Are you so stupid or frightened that you can't understand that if the lowest form of human has no rights, you don't either?

People like you exhibit some of the most amazing and perverse stupidity and ignorance.

[chris__anderson]

don't be silly

the colonial united states didn't burn witches at the stake. that was england. witches in the colonies were hanged.

and we don't do many hangings in the US anymore. mostly we give them the electric chair. talk about irony.

[lynb]

Cops and searching your PC

I do not want those who traffic in kids porn to escape or weasel out of justice, however,
I do agree with the dissenting Judge McKay on this issue.

A computer that is password protected ultimately says that privacy is important to the owner of the password.

[seannj4989]

Homeland Security?

How does pornography turn into a Homeland Security issue? Was Osama in the jpegs?

This is precisely the abuse that we should be fending off. These are the very ppl who wish to place us in a national database and track us even further.
Our government didn't protect us before the attacks and they aren't protecting us now. They have been so systematic in their reach for more authority it would almost seem to confirm their involvement in the creation and execution of those attacks.

[R.Jefferson]

Police exploited elderly

I?m speculating here but what do you think a 90 year old person is going to do when confronted by police? An old person is going to go above and beyond to help the po po. I suspect that the police exploited the vulnerability of the senior citizen.

It sucks but it?s a fact of life that if you expect privacy with your computer, in your own home, you have to password protect it, and lock the tower and peripherals.

Computers are so cheap now everyone in a household should have their own. I wouldn?t even trust my own Mother on my computer. I don?t need the headaches that come with downloading ?cute_puppies.scr? or any toolbar or ?helpful? program.

[{DvT}Hex]

3rd Party Permission To Search

If a 3rd party, spouse, roommate, parent, whomever, has the authority to authorize a search, then that 3rd party also bears responsibility for the fruits of that search. In other words, responsibility goes along with authority and, in this case, the father should also be held responsible for the presence of the porn on the computer. For that matter, I'll go one step further: the father alone should be held responsible for the porn: he gave permission, thus it can be reasonably assumed that he had knowledge and control over the content of the search object; without such knowledge and control he had no business or authority to permit the search.

[rkt2787]

Customs agent?

CNET, you were doing great...till you referred to an ICE Agent as a Customs Agent. This changed 4 years ago. It's okay, the media...and half the agency is still catching up.