by Douglas Ankney

The Supreme Court of Maryland (formerly the Court of Appeals) held that a defendant had a reasonable expectation of privacy in the digital content of the hard drive to his computer; therefore, a warrantless search of the Government’s copy of the hard drive after the defendant had withdrawn consent to search the contents of his computer’s hard drive violated the Fourth Amendment.

On July 12, 2019, Daniel Ashley McDonnell met with agents from the U.S. Army Criminal Investigation Command (“USACIDC”) and signed a written consent form giving USACIDC agents permission to search his home and seize his electronic devices as part of their investigation into McDonnell’s possession/distribution of child pornography. The form also permitted investigators to copy the devices’ hard drives and stated: “I relinquish any constitutional right to privacy in these electronic devices and any information stored on them. I authorize USACIDC to make and keep a copy of any information stored on these devices. I understand that any copy made by USACIDC will become the property of USACIDC and that I will have no privacy or possessory interest in the copy.” The final sentence of the consent form read: “I understand that I may withdraw my consent at any time.”

Between July 12 and July 16, 2019, agents made a copy of the laptop seized from McDonnell’s home pursuant to the consent form. On July 19, 2019, counsel for McDonnell notified USACIDC by email that McDonnell was withdrawing “any purported consent to the seizure of [McDonnell’s] laptop, or examination of its contents” and was requesting the laptop’s return.

From August 5 to 20, 2019, a Special Agent with USACIDC’s Digital Forensics and Research Branch conducted a forensic examination of the data on the copy of McDonnell’s hard drive and generated a report that stated “no evidence of child pornography” was found but explained “[a]n examination of the media revealed evidence of child pornography search terms in the internet browser.”

McDonnell was subsequently indicted on charges of possessing, promoting, and distributing child pornography. He moved to suppress all illegally obtained evidence and later filed a memorandum asking the circuit court to suppress the evidence recovered from the copy of his laptop’s hard drive.

The State argued that making a copy of the hard drive was the functional equivalent of making a photocopy of it, and federal case law permits the government to lawfully retain and examine photocopies once the originals of the document are returned. Furthermore, under Varriale v. State, 119 A.3d 824 (Md. 2015), the government is allowed to analyze DNA, blood samples, or firearms even after consent has been revoked. Thus, once the copy was outside McDonnell’s possession, he no longer had an expectation of privacy in the item, the State argued. Defense counsel countered that McDonnell’s laptop was akin to the cellphone in Riley v. California, 573 U.S. 373 (2014), and thus, investigators needed authority to seize it as well as examine its contents. Counsel argued that the consent form failed to authorize the examination of the copy of the hard drive. The circuit court denied the motion.

In September 2021, McDonnell went to trial on “stipulated facts.” (In Maryland, a defendant may plead “not guilty” but go to trial on an agreed statement of facts or stipulated evidence in order to preserve an appeal on a suppression issue. Bishop v. State, 7 A.3d 1083 (Md. 2010). “The trier of fact is not called upon to determine the facts as the agreement is to the truth of the ultimate facts themselves.… To render judgment, the court simply applies the law to the facts agreed upon.” Id.) The circuit court found McDonnell guilty of three counts of distribution of child pornography and imposed sentence. McDonnell timely appealed.

The Appellate Court of Maryland (formerly the Court of Special Appeals) reversed. The Appellate Court, relying on Riley, concluded that, “because individuals have a legitimate expectation of privacy in the digital data within their computer,” McDonnell’s “revocation of his consent to examine the data from his laptop computer precluded a forensic examination of the mirror-image copy of its hard drive without a warrant.”

The State’s petition for discretionary review in the Maryland Supreme Court was granted on two issues: (1) “Did McDonnell lack any legitimate expectation of privacy in a mirror-image copy of his laptop hard drive that the Government created with his consent, and as to which he expressly disclaimed any possessory or privacy interest before the copy was created?” (2) “Did the Appellate Court of Maryland err in holding that McDonnell’s revocation of consent to examine the contents of his laptop barred investigators from examining the mirror-image copy of his hard drive, when the post-withdrawal examination of the copy was not a search?”

The Court observed the Fourth Amendment provides: “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.”

The Court then engaged in an extensive recitation of the governing legal principles. “The touchstone of the Fourth Amendment is reasonableness.” Florida v. Jimeno, 500 U.S. 248 (1991). The Constitution prohibits only “unreasonable” searches. United States v. Sharpe, 470 U.S. 675 (1985). “A search compromises the individual interest in privacy; a seizure deprives the individual of dominion over his or her property.” Horton v. California, 496 U.S. 128 (1990). “When an individual seeks to preserve something as private, and his expectation of privacy is one that society is prepared to recognize as reasonable … official intrusion into that private sphere generally qualifies as a search[.]” Carpenter v. United States, 138 S. Ct. 2206 (2018). “The burden is on the defendant asserting Fourth Amendment protection to ‘demonstrate that a government actor infringed upon his or her actual, subjective expectation of privacy in an item or place searched and the expectation of privacy is one that society is prepared to recognize as reasonable.’” In re Russell, 211 A.3d 426 (Md. 2019); Katz v. United States, 389 U.S. 347 (1967).

“The contours of the privacy protected by the Fourth Amendment are ‘informed by historical understandings’ at the time of its adoption regarding what constituted unreasonable searches or seizures.” Carpenter. “The ‘basic guideposts’ for such an analysis, as described by the Supreme Court of the United States, include the amendment’s goals of guarding ‘the privacies of life against arbitrary power’ and ‘[placing] obstacles in the way of a too permeating police surveillance.’” Id. “‘As technology has enhanced the government’s capacity to encroach upon areas normally guarded from inquisitive eyes,’ courts should seek to preserve the ‘degree of privacy against government that existed when the Fourth Amendment was adopted.’” Id.

“The Supreme Court has recognized the important distinction between digital media and physical targets of searches, observing that smartphones, for example, have ‘immense storage capacity’ and ‘collect in one place many distinct types of information—an address, a note, a prescription, a bank statement, a video—that reveal much more in combination than any isolated record.’” Riley. “Data stored on electronic devices is both qualitatively and quantitatively different from physical analogues because a search of cell phone or computer data ‘would typically expose to the government far more than the most exhaustive search of a house[.]’” Id. (emphasis in original)

The distinction between a search of physical property and electronic devices was emphasized in Richardson v. State, 282 A.3d 98 (Md. 2022). In Richardson, the court ruled that police may search an abandoned backpack without a warrant. But to search the cellphone retrieved from the backpack, police needed a warrant that described with particularity the types of files on the phone to be searched. Id.

“A search conducted without a warrant is presumed to be unreasonable, but a warrantless search can still be reasonable, such as when ‘conducted pursuant to valid consent[.]’” Jones v. State, 962 A.2d 393 (Md. 2008). “The consent must be voluntary.” Ohio v. Robinette, 519 U.S. 33 (1996). The “search must remain within the scope of the consent.” Jimeno. “Courts examine the scope of consent objectively: ‘what would the typical reasonable person have understood by the exchange between the officer and the suspect?’” Id. “One who gives consent for the search of a particular area or items may subsequently narrow the scope of the consent given or withdraw consent entirely.” State v. Reum, 313 P.3d 1156 (Wash. 2013) (en banc). If “the person withdraws consent before ‘the search is completed, then the police may not thereafter search in reliance upon the earlier consent.’” United States v. Lattimore, 87 F.3d 647 (4th Cir. 1996).

Turning to the present case, the Court stated to “date, relatively few courts have grappled with the effect of governmental copying of a hard drive from a computer or cell phone on a person’s privacy interest in the information stored therein. Some State high courts have rejected the argument that a defendant does ‘not have a legitimate expectation of privacy in’ a copy of a hard drive from the defendant’s computer because the defendant ‘did not create, own, or have lawful access to it.’” People v. McCavitt, 185 N.E.2d 1192 (Ill. 2021). “In contrast, some trial and intermediate appellate courts in other jurisdictions have concluded that a copy of a computer hard drive is analogous to a photocopy of a paper document, which the government may freely examine so long as the copy was lawfully obtained.” United States v. Megahed, 2009 WL 722481 (M.D. Fla. Mar. 18, 2009) (unreported order). “These courts have relied on opinions like [United States v.] Ponder [444 F.2d 816 (5th Cir. 1971)] for the proposition that ‘a valid consent to search … carries with it the right to examine and photocopy’ and that the withdrawal of consent does not limit the government’s ability to examine copies made prior to that withdrawal.”

After its exhaustive review of the relevant case law across numerous jurisdictions, the Court held that “McDonnell had a reasonable expectation of privacy in the digital data stored on his laptop, and, as such, in the data stored on USACIDC’s copy of his laptop’s hard drive.” The Court stated that his reasonable expectation of privacy was not extinguished by the making of a copy of his hard drive “because the data was not searched or exposed prior to his revocation of consent.” It explained that central to its holding is its conclusion that McDonnell’s privacy interest is in the data on the hard drive, not just the physical device on which it’s stored.

The Court further explained that it was persuaded by the reasoning of McCavitt. In McCavitt, law enforcement had copied the defendant’s hard drive. The Illinois Supreme Court was “unconvinced by the government’s emphasis on the ‘defendant’s lack of a formal property interest in the [copy] itself’ because the government’s theory disregarded the ‘defendant’s informal privacy interest in his personal data.’” McCavitt. For the Fourth Amendment’s “reasonableness” purposes, it is the access to the data itself “regardless of whether the data is copied, transferred, or otherwise manipulated[.]” Id.

The Court reasoned because “making a copy of a hard drive is usually the first step in performing a forensic analysis, if making a copy itself divested a person of a reasonable expectation of privacy in the data, people would lose all expectation of privacy in the entirety of the data on any device the moment the government made a copy of the device’s hard drive. That would permit precisely the kind of unlimited rummaging through a person’s private domain that the Fourth Amendment was designed to prohibit.” Riley.

Consequently, the Government’s exposure and examination of the copied hard drive was a “search,” according to the Court. “In the absence of a warrant, a search is reasonable only where it falls within an exception to the warrant requirement.” Riley. Voluntarily and intelligently waiving Fourth Amendment protections by consenting to a warrantless search is one recognized exception. United States v. Cormier, 220 F.3d 1103 (9th Cir. 2000). While the consent form signed by McDonnell initially gave the Government permission to seize, copy, and search the contents of the hard drive, the sentence at the bottom of the form stated without qualification: “I understand that I may withdraw my consent at any time.”

The Court stated that McDonnell withdrew his consent in July 2019. Thereafter, the Government could no longer rely on McDonnell’s consent to search the data. The search occurred in August 2019, without a warrant, without consent, and without meeting any of the other exceptions to the warrant requirement. Thus, the Court held that the search was unreasonable in violation of the Fourth Amendment.

Accordingly, the Court affirmed the Appellate Court’s decision. See: State v. McDonnell, 297 A.3d 1114 (Md. 2023).   

Editor’s note: The full 64-page opinion is a must read for anyone interested in digital evidence and the Fourth Amendment. 

Subscribe today

Already a subscriber? Login

Related legal case