When Steve Jobs introduced the iPhone as a "revolutionary" device, he probably wasn't thinking of its effect on the Fourth Amendment. But a new paper by Adam Gershowitz, a professor at the South Texas College of Law, argues that unless courts or legislators make significant changes to the rules governing law enforcement searches, the increasing ubiquity of devices like Apple's übergadget will permit police to routinely gather massive amounts of citizens' sensitive personal data without a warrant.
The Fourth Amendment guarantees that Americans will not be subject to "unreasonable searches and seizures." Normally, this means police must show a judge that there is "probable cause" to believe a search will uncover evidence of a crime before tapping our phones or digging through our papers. But the courts have always recognized a variety of special circumstances under which a search may be reasonable even without a court warrant. One important such exception is for "search incident to arrest." This allows police to search the person and immediate vicinity of anyone being placed under arrest, to ensure that the arrestee can't destroy evidence or pull a concealed weapon.
The problem with this, argues Gershowitz, is that with the proliferation of iPhone-like devices, the officer digging through your coat pocket suddenly has access to gigabytes worth of potentially sensitive e-mail, videos, photographs, browsing histories, and other documents. If you're in the habit of keeping your passwords saved, they may even be able to reach bank statements, file servers, and that Nerve Personals account you opened "just for fun." Though the underlying rationale for searches incident to arrest is officer safety, courts have adopted a "bright line" rule permitting an arresting officer to search any object in a suspect's possession, such as a cigarette pack, even if it unlikely to conceal a miniature Glock. And since the Supreme Court has ruled that police have broad authority to arrest people for even trivial infractions, such as failure to wear a seat belt, the current rule gives law enforcement officers broad discretion to transform a routine traffic stop into a highly intrusive excavation of your digital life.
The thorny privacy questions posed by portable digital storage are already making headlines, as courts take up the question of whether border agents conducting routine searches need any special justification to go rummaging through a traveler's notebook computer. One judge has ruled that they do, writing that while "not physically intrusive as in the case of a strip or body cavity search, the search of one's private and valuable personal information stored on a hard drive or other electronic storage device can be just as much, if not more, of an intrusion into the dignity and privacy interests of a person." But most courts have taken the opposite view: If airport security can open up your laptop bag, then they're entitled to look through your laptop files as well.
As with many legal questions, of course, metaphors matter. If we think of a laptop or an iPhone as fundamentally like a backpack, or even a pager, then there's clear precedent suggesting that a border agent or an arresting officer can snoop through such devices, even in the absence of any individualized suspicion that they contain incriminating information. But like all metaphors, this one breaks down eventually. With the possible exception of Mary Poppins, most people did not previously carry the equivalent of whole libraries worth of archived information in their luggage. And since iPhones are networked, perhaps a closer analogy is to a backpack containing a wormhole that leads to your office or bedroom. The casual comparison with more traditional types of searches conceals the ways routine warrantless search of networked digital storage devices would shift the balance between law enforcement and privacy interests.
George Washington University law professor Orin Kerr, who authored the Justice Department's manual on digital searches, considers a range of alternative metaphors in his Harvard Law Review article "Searches and Seizures in a Digital World." On the "container model," which would treat the iPhone as a tiny but capacious suitcase, there is only one threshold question: Does the officer have any right to examine the contents of the object, to pop the latch on the suitcase? But on "virtual file" or "exposure" models, each file that is opened, or each operation that reveals data contained in a storage device, can be considered a distinct "search." This matter because, as Kerr stressed when Ars contacted him by telephone, the ultimate legal standard for any search is still "reasonableness." The courts recognize that a pat down is not the same as a strip search, and that there will be many situations in which the former is reasonable, but not the latter. If judges begin to move away from the "container" metaphor, they may similarly be able to draw finer distinctions between simply picking up or switching on a device and doing an exhaustive survey of its contents.
Gershowtiz considers a range of possible distinctions courts or legislatures might draw. They could revamp the general rules governing searches incident to arrest, requiring that they hew more closely to their official purpose. So, for instance, police might be permitted to look through the text messages of a suspected drug dealer, but not those of a reckless driver or a loud drunk. Alternatively, the law could be changed in a more ad hoc way to distinguish search from seizure in the case of specific kinds of devices, allowing police to take a device away from an arrestee, but requiring a warrant to examine its contents.
Another option is to establish specific limitations on the kinds of operations officers may carry out on a particular device. Gershowitz offers the example of a a "five steps test," which would, in essence, allow searches but limit the number of buttons an officer could push. Still more constraining would be an "open application test," permitting police only to look at whatever program a suspect was using at the time of arrest. Additionally, courts could distinguish between searches of data contained on the device itself and data stored remotely that can be accessed by the device—though this line becomes fuzzy when the device is set to download remote data (such as e-mails) automatically whenever it is turned on. Kerr—who feels certain that courts will at the very least enforce a local/remote distinction—offers another possible test: Anything police can look at during the time required to carry out a routine arrest is fair game, but an exhaustive search back at the station house requires a warrant.
Until the rules have been hashed out, though, a word of caution to iPhone owners: Buckle your seat belt!