Intellectual Property Law

Do you Have Reasonable Expectation of Privacy on Data Stored in your Laptop which is Connected to a Network?

By Martha L. Arias

As IBLS Editorial Department has reported in previous legal articles, there is no expectation of privacy on data stored by an employee in the company?s computers.  Yet, a different question arises when a person stores data in his own laptop, which he uses at the place of employment, and that laptop is connected to a network.  Does this person have reasonable expectation of privacy because he is using his own laptop at the place of employment?  A recent decision by the Eleventh Circuit Court of Appeals held that there is no expectation of privacy on a person?s data stored in his personal laptop connected to a network. This article provides information on this topical decision.

The Defendant was a civilian contractor working oversees and lodging at a U.S. military base.  His personal laptop, which he used in his dormitory, was connected to the military base network that had a ?shared? drive.  This means, anything stored in laptops connected to the military base?s network could be easily accessible through the ?shared? drive.  Even though the defendant knew he could be subject to monitoring when accessing the network, he thought he had secured his laptop to prevent intrusion. 

One day, a U.S. military officer was searching the base network for music files and he accidentally saw child pornography stored in the defendant?s laptop.  This officer notified his military superiors and they investigated the defendant?s laptop through the ?shared? drive and discovered the illegal material.  It is clear in the record that the military investigators did not require any computer forensic techniques to access the defendant?s laptop.  The ?shared? drive made content freely accessible by anyone in the base network.  After this, the military investigator obtained a search warrant for the defendant?s dormitory and they seized the defendant?s laptop and found CDs containing similar illegal material. 

The defendant returned to United States (?U.S?) and two years later he was indicated with possession and transportation of child pornography under 18 U.S.C.S. §§2252A(a)(1), 2252A(a)(5)(B).  Another warrant search of defendant?s U.S. home was obtained and more illegal content was found. 

Before the District court, the defendant moved to suppress the evidence collected from his laptop under the Fourth Amendment to the U.S. Constitution (individuals? protection against unreasonable search and seizures). Fourth Amendment arguments require proving both subjective and objective expectation of privacy.  The subjective component requires that a person exhibit and actual expectation of privacy while the objective part requires that the privacy expectation be one that the society is prepared to recognized as reasonable.   The defendant also tried to suppress the evidence collected from his U.S. home arguing that they were fruits of evidence illegally collected from his dormitory in the military base oversees. 

On the defendant?s motion to suppress the laptop evidence and his 4th Amendment argument, the District court, after a careful analysis, held that the data obtained from the defendant?s laptop was obtained from the base network and data stored in a network belong to the network administrator.  Thus, defendant had no reasonable objective expectation of privacy on those files stored in his computer and freely accessible via a shared network drive.    The court also added that the laptop search was a proper workplace (the network) search.  Defendant appealed this decision and the Eleventh Circuit Court of Appeals reviewed the case under a mixed standard of review (clear error for those findings of fact, and de Novo for the application of the law).  The court of appeals, after a lengthy analysis affirmed the District court decision.

In its holding, the Court of Appeals stated that the defendant had a subjective expectation of privacy on his laptop proved by the fact that he ?locked? or tried to secure his files.  Yet, there was no objective expectation of privacy because the society is not ready to accept his subjective expectation in this case as reasonable.  The court quoted the following analogy: ?We have held that tenants of a multi-unit apartment building do not have a reasonable expectation of privacy in the common areas of the building, where the lock on the front door is "undependable" and "inoperable." United States v. Miravalles, 280 F.3d 1328, 1333 (11th Cir. 2002).  Thus, the defendant had not reasonable expectation of privacy on the common ?areas of the network.? 

Full post as published by IBLS Internet Law Blog on February 20, 2008 (boomark / email).