In State v. McDonnell, __ Md. __, 2023 WL 4393297, at *1 (July 7, 2023), the Supreme Court of Maryland held that a person who had consented to seizure of his laptop, as well as to creation of a mirror image, could withdraw consent to search it before the government examined the data. A subsequent warrantless search of the imaged data was not permitted.

Notably, the Court distinguished digital evidence from paper and other forms of evidence. It concluded that: “The copying of Mr. McDonnell’s hard drive was a precursor to a search, or perhaps a step in preparation, but it was not the search.” Id. at *18.

In the Court’s words:

We must decide whether, for Fourth Amendment purposes, the consensual creation of a copy of the hard drive permanently eliminates the laptop owner’s privacy interest in the data on the hard drive, i.e., what impact the owner’s withdrawal of consent has on the government’s right to examine the data on the copy.

In this case, we conclude that Daniel Ashley McDonnell, Respondent, had a reasonable expectation of privacy in the data contained on his hard drive, whether the data was electronically stored on his laptop’s hard drive or the government’s computer via a copy of the hard drive. We hold that, because the government did not examine the data before he withdrew his consent, Mr. McDonnell did not lose his reasonable expectation of privacy in the data, and the examination of the data was a search. As such, we conclude that the government conducted an unreasonable search by examining the data without any authority to do so, by a warrant or an exception to the warrant requirement.

State v. McDonnell, __ Md. __, 2023 WL 4393297 (July 7, 2023)

The U.S. Army’s Criminal Investigation Command was investigating a child pornography issue. Mr. McDonnell first met with agents during a “knock and talk” meeting. In a later meeting, he signed a written consent form that stated in part:

“I have been informed of my right to refuse to consent to such a search. I hereby authorize the undersigned Special Agent, another Special Agent or other person designated by USACIDC, to conduct at any time a complete search of: … all digital media including cell[ ]phones, thum[b ]drive[s], hard disk drives, laptops & any other media relevant to this investigation.

* * *

I understand that any contraband or evidence found on these devices may be used against me in a court of law.

I relinquish any constitutional right to privacy in these electronic devices and any information stored on them. I authorize USACIDC to make and keep a copy of any information stored on these devices. I understand that any copy made by USACIDC will become the property of USACIDC and that I will have no privacy or possessory interest in the copy….

I understand that I may withdraw my consent at any time.”

The agents later imaged the computer. The Court wrote that:

Imaging a computer’s hard drive is the first of a two-step process in most forensic computer examinations: acquiring the data and analyzing it. See Orin S. Kerr, Searches and Seizures in a Digital World, 119 Harv. L. Rev. 531, 547 (2005). Imaging a hard drive ‘duplicates every bit and byte on the target drive including all files, the slack space, Master File Table, and metadata in exactly the order they appear on the original.’ Id. at 541 (footnote omitted). This creates a replica of the computer’s data at the time of imaging that cannot be edited, but can be searched and analyzed. See id. at 540.… Imaging is necessary because of the length of time that a forensic analysis requires, and the ease with which data on a computer can be inadvertently changed or lost. See id. at 540-41; Stephen Moccia, Bits, Bytes, and Constitutional Rights: Navigating Digital Data and the Fourth Amendment, 46 Fordham Urb. L.J. 162, 184-85 (2019).

Three days later, “counsel for Mr. McDonnell sent an email to USACIDC withdrawing ‘any purported consent to the seizure of [Mr. McDonnell’s] laptop, or examination of its contents’ and requesting the laptop’s return.”

The government subsequently searched the imaged data. The Court wrote that:

The forensic examination did not reveal images of child pornography; however, it did reveal that Mr. McDonnell had run ‘digital forensic deleting software’ on June 7, 2019, a few days after the knock-and-talk. The examination also revealed that Mr. McDonnell had made recent searches with terms consistent with the search for child pornography.

After being charged with possessing, promoting, and distributing child pornography, Mr. McDonnell moved to suppress evidence from the forensic examination of the hard drive.

The State’s position was that “a valid consent to search carries with it the right to examine and photocopy’ and that downloading and creating the ‘mirror image copy’ of the hard drive of Mr. McDonnell’s laptop was ‘essentially photocopying digitally.’ Continuing with that analogy, the State asserted that federal case law instructs that, once the originals of documents are returned, the government can lawfully retain photocopies and then examine them…. The State contended that ‘once something was outside of the possession of the defendant, [ ] there was no more reasonable expectation” of privacy in the item.’”

In response:

“Mr. McDonnell argues that forensic copies enjoy the same Fourth Amendment protections as originals…. For Mr. McDonnell, the act of copying, without accessing, the hard drive does not remove his privacy interest in the data on the hard drive…. Mr. McDonnell contends that the State erroneously relies on opinions treating a copy of a hard drive like a copy of a piece of paper, because ‘[t]he U.S. Supreme Court has already rejected the false equivalency between physical documents and digital media.’…. Mr. McDonnell contends that consent can be withdrawn at any time…. Mr. McDonnell points out that the consent form itself in this case instructed that he could withdraw his consent “at any time.”

After the suppression motion was denied, Mr. McDonnell appealed.

The Court wrote that: “Data stored on electronic devices is both qualitatively and quantitatively different from physical analogues because a search of cell phone or computer data ‘would typically expose to the government far more than the most exhaustive search of a house[.]’” It added that digital information was entitled to “special solicitude….” It is “unique.”

The Court concluded that:

After careful examination of relevant authority, we hold that Mr. McDonnell had a reasonable expectation of privacy in the digital data stored on his laptop, and, as such, in the data stored on USACIDC’s copy of his laptop’s hard drive. Mr. McDonnell’s reasonable expectation of privacy was not eliminated by the making of a copy of his hard drive because the data was not searched or exposed prior to his revocation of consent. Central to this holding is our conclusion that Mr. McDonnell’s privacy interest is in the data on his hard drive, not just the particular computer or apparatus on which the data is stored (his original or USACIDC’s copy). To accept the State’s stance—i.e., that Mr. McDonnell irrevocably lost all privacy interest in the data on his hard drive when he allowed USACIDC to copy it—would be to permit a limitless search through vast quantities and a varied array of personal data that the Supreme Court of the United States has characterized as consisting of more information than would be found in an exhaustive search of a person’s home.

Id. at *13.

The Maryland Court wrote that: “Because making a copy of a hard drive is usually the first step in performing a forensic analysis, if making a copy itself divested a person of a reasonable expectation of privacy in the data, people would lose all expectation of privacy in the entirety of the data on any device the moment the government made a copy of the device’s hard drive. That would permit precisely the kind of unlimited rummaging through a person’s private domain that the Fourth Amendment was designed to prohibit.”

The Court added: “By way of analogy, if Mr. McDonnell had stood on a street corner and offered passersby the opportunity to read his diary, but no one took him up on it, his reasonable expectation of privacy would not be lost. The threat of an invasion of privacy is not an invasion at all.” The imaging was deemed to be no more than a “potential” invasion of privacy, not an “actual” invasion.

Further: “The terms of the consent form guide our assessment of the reasonableness of the search…. Critically, a sentence at the bottom of the form stated without qualification: ‘I understand that I may withdraw my consent at any time.’” Id. at *15. The Court wrote that:

Under the terms of the consent form, Mr. McDonnell never agreed to permanently relinquish a privacy interest in his data, and, as discussed above, the consent form, on its face, provided an unqualified right to withdraw consent at any time. This necessarily included the right to withdraw consent to a search of the data.

In short:

“Because USACIDC did not search or examine any of his data prior to the withdrawal of consent, Mr. McDonnell continued to retain a privacy interest in the entirety of his data on his laptop’s hard drive and the copy thereof. Lacking Mr. McDonnell’s consent, USACIDC needed another justification for the examination of the data on the copy of the hard drive, such as a warrant. But because USACIDC did not obtain a warrant or have any other justification for the search, the search of the data on the copy of the hard drive was unlawful and the evidence obtained as a result of the search should have been suppressed.”

“[T]he differences between papers and digital data, including the need to maintain the integrity of the digital evidence, the vast quantity of digital data or information involved, and the time necessary to conduct the search, require a different approach for hard drives.”

Id. at *17.

Further, the Court noted that the evidence had been preserved and there was no reason why a warrant could not have been requested. It added: “[R]equiring law enforcement officers to get a warrant in this situation would increase the likelihood that people may consent to a search of a laptop or computer, as a person would not fear that the copying of a hard drive as part of the search would result in unfettered governmental access to their data in the future.”