Court: Prosecutors Can’t Rummage Around in a Defendant’s Gmail Account — U.S. v. Cioffi

[Post by Venkat]

The government is prosecuting a couple of Bear Stearns hedge fund managers for securities fraud and related offenses. I came across a story that prosecutors obtained evidence from the gmail account of one of the defendants which prosecutors recently disclosed. (“E-Mails Seen as a Flash Point in Bear Stearns Fund Managers’ Fraud Trial“) In some ways I think this illustrates one of the pitfalls of using a service such as gmail. Gmail stores your data forever – or at least doesn’t give you a ton of control over when it is deleted – so it’s much easier for prosecutors to obtain this evidence. If you stored the data on your own servers, you may be able to get by with deleting the data pursuant to a regular document retention/destruction policy. And more importantly, there’s a much higher likelihood of you knowing when the data has been or is about to be seized. (It’s more difficult to obtain email from a service provider in a civil case.)

Interestingly, the defendant whose email was disclosed by the government as evidence in the Bear Stearns case prevailed in a motion to suppress the gmail evidence. (US v. Cioffi, et al., Case No. 08-CR-415 (FB) (E.D.N.Y.; Oct. 26, 2009).) (Access a copy of the ruling at Scribd [pdf] here; see the WSJ story here (“In Setback for Bear Stearns Case, Judge Suppresses Email“).)

Facts: The government initially obtained an email sent through non-company email accounts between Cioffi and Tannin (the two defendants) talking about how the “subprime market looks pretty ugly . . . .” The government used this email to support its allegations that Tannin used his personal (gmail) account to commit or further the crimes. The government’s affidavit argued it needed to search the gmail account, but offered certain limitations on the access – for example, the search would be limited to emails created on or before the day prior to the defendant’s retention of counsel, in order to avoid interception of privileged communications. The affidavit also noted that “the nature of electronically stored data” required the authorities (rather than Google) to search through the email account.

The magistrate judge issued the warrant, but did not attach the affidavit to the warrant. The government went to Google, which initially wrote to the government that “it was no longer able to extract the information requested in [the warrant] because Tannin’s account had been deleted.” Several months later, “on the eve of trial,” Google advised that it had located a copy of the account and delivered a copy of its contents to the government. (??)

The Court’s Ruling: The critical issue in front of the court was whether the warrant was sufficiently particular as to minimize unnecessary invasions into the suspect’s privacy. The court noted at the outset that Tannin had “a reasonable expectation of privacy in the contents of his personal email account.” The government did not dispute this point. (This doesn’t seem to be a settled issue, as noted in the case mentioned below.) Turning to particularity, the court notes that searches of documents, data, computers, and email accounts raise tricky issues as to what level of particularity is required. A couple of different approaches have been used to avoid a general search by the government: (1) providing keywords or other search parameters in advance; or (2) having a third party conduct the search and segregate responsive information from non-responsive information.

The court noted that an overly broad warrant may be cured by incorporation of an affidavit that would constrain the agents’ search, but Second Circuit cases have been less receptive lately to this approach. (In the context of a digital search, it would seem that this wouldn’t work as well as it would with respect to physical objects. Exposure to data that doesn’t fall within the search warrant would compromise the suspect’s privacy and would undermine the whole point of particularity in this context.) Regardless of whether the affidavit could have cured the warrant’s particularity problem, the affidavit was not actually attached to the warrant, so this argument was not in play.

The court ultimately concludes that the warrant did not comply with the Fourth Amendment. The government sought to invoke exceptions in order to have the evidence admitted notwithstanding these issues, but the court rejected both of these attempts. With respect to the good faith exception, the court was emphatic:

[t]his case . . . is not about search terms or firewalls. It is, rather, about the fundamental and venerable prohibition on general warrants. Since ‘it is obvious that a general warrant authorizing the seizure of evidence without mentioning a particular crime or criminal activity to which the evidence must relate is void under the Fourth Amendment . . . no reasonably well trained officer could believe otherwise.’

As to inevitable discovery – the second exception – the court’s ruling is also interesting. The court seemed to say that the government could only satisfy particularity after having seen the emails procured by the overbroad warrant: “the government’s timing still presents a problem: [h]aving seen the November 23rd email, the government is now in a position to obtain a warrant with perfect particularity. There is, in other words, no way to purge the taint of its unconstitutionally overbroad search.”

***

I can’t tell if the government just dropped the ball here or whether there’s something more to it. One view is that if the government had a narrow warrant application and the magistrate judge issued a narrow warrant, the government could have probably obtained the information they ultimately sought? On the other hand, the court is rightly skeptical that the government could have obtained the emails at issue by providing a set of keywords to Google. After all, wasn’t this the argument the government used to justify the fact that the search needed to be conducted by the government, rather than by Google or by a third party? The court’s rejection of the government’s inevitable discovery argument seems significant. My practice does not stray into the realm of criminal cases so take that with a grain of salt. I’m curious to see what people like Orin Kerr and Scott Greenfield have to say. (Congrats to Professor Kerr, whose “Searches and Seizures in a Digital World” article is cited by the court. He has also posted extensively on a recent Ninth Circuit decision that bears on these issues: United States v. Comprehensive Drug Testing, Inc., 579 F.3d 989 (9th Cir. 2009).)

Interestingly, Professor Kerr notes a recent decision from federal court in Oregon where the court held that email was not covered by the Fourth Amendment. [Clarification: see this post for a clarification.] Pointing to the Google terms of service, the court held that most users expect their emails to be shared with Google employees and other third parties, and the account-holder was thus not entitled to notice before the government obtained a warrant to search someone’s gmail account. I think (but I’m not sure) the account-holder still has the ability to challenge the search after-the-fact, as did the defendant in Tannin. Either way, the ruling seems noteworthy, and raises issues around process where the government subpoenas your email records from the service provider. When do you as the account-holder receive notice of a government search? Does Google have a consistent policy on this?

I’m still sticking with my instinct that using a third party service such as gmail raises the risk that your emails end up in the hands of prosecutors. I’m also curious about Google’s policies for dealing with these sorts of issues.

Added: You can check out Professor Kerr’s post on this ruling here. His conclusion: “the basic Fourth Amendment holding was likely right,” but the court should have applied the good faith exception. He also posts a clarification to his earlier post about the Oregon decision, which I linked to above: court’s conclusion only speaks to notice to subscribers, which the court concludes is not required under the Fourth Amendment.