Fourth Amendment Protection for Electronic Privacy in the WorkplaceSpring 2009 American Bar Association Criminal Justice Section - White Collar Crime Committee Newsletter
© Spring 2009, American Bar Association Criminal Justice Section - White Collar Crime Committee Newsletter
From associates in law firms to sales representatives in corporations, standard company-issued equipment for today's employee typically includes date storage devices such as computers and Blackberries. Frequently, employers warn their employees concerning both the proper use of such equipment as well as the employer’s right to monitor that use. Those warnings frequently appear in training manuals, notices of firm policies, and in banners that sprawl across the monitor when a computer is powered on. Human nature being what it is, though, employees still use office equipment to engage in personal, sometimes very private, sometimes even illegal conduct , notwithstanding the most vigorous efforts by employers to constrict and even prevent such use and conduct. Employers, by use of such devices as monitoring software or firewalls designed to supervise internet users, routinely find evidence of a variety of offenses -- from child-pornographic images to financial entries demonstrating an intent to cheat the employer or others. Employer-collected evidence is routinely shared with agents of law enforcement, providing the basis for charging the allegedly offending employee. A sad, recent illustration of the phenomenon was the November 24th sentencing of a partner in a prominent Washington, D.C. law firm in the federal court in the District of Columbia on for receipt of child pornography. In that case, the evidence apparently consisted of one or more videos downloaded to his law firm computer while at the office.
What is an attorney defending such an employee to do? Several circumstances would instinctively suggest that evidence gathered by the employer may be subject to suppression under the Fourth Amendment. The basis for such arguments may include the confidential and exclusive use of technology afforded individual employees, the warrantless nature of employer searches and monitoring efforts, and the close working relationship between employers and agents of law enforcement.
However, a review of the cases in this area suggests that a Fourth Amendment remedy may be difficult to secure. The availability or not of suppression as a remedy has turned largely on a consideration of three factors: (i) whether the employer is a public entity or a private company, and, if the latter, the closeness of the coordination between the company's workplace monitoring effort and law enforcement; (ii) whether the employee holds a subjective expectation of privacy that is also objectively reasonable, measured by the extent to which the office computers are accessible to, and accessed by, persons other than the individual employee assigned to their use; and, (iii) assuming that the requisite privacy expectation can be shown, whether the employer's search or monitoring was reasonable in its nature and scope.
1. Public vs. private employees
In O'Connor v. Ortega, 480 U.S. 709 (1987), a majority of the Supreme Court held that searches by government employers of their employees’ offices are subject to Fourth Amendment constraints. Id. at 721 (although only a plurality could agree on the standards for a constitutional, warrantless employer search). The Supreme Court has not squarely addressed the applicability of the Fourth Amendment to private-employer searches. See Mancusi v. DeForte, 392 U.S. 364, 369 (1968) (recognizing that a private employee, a union official sharing an office with others, had standing to assert a Fourth Amendment objection to a law enforcement search of that office).
The lower courts’ application of a Fourth Amendment analysis to private-employer searches has yielded mixed results. In easier cases, where law enforcement actually directs or monitors the private-employer search, courts have found the private workplace search to require a warrant pursuant to the Fourth Amendment warrant requirement. E.g., United States v. Reed, 15 F.3d 928, 931 (9th Cir. 1994) (when police acted as look-out during search by hotel maid, they made her government actor); Corngold v. United States, 367 F.2d 1, 5-6 (9th Cir. 1966) (when airline employee opened shipping containers in presence of law enforcement and at their request; employee became government actor). But see United States v. Smith, 383 F.3d 700, 705 (8th Cir. 2004) (even though police officer, working a stake-out at FedEx facility, identified package suspected of containing drugs, brought package to FedEx employee, announced his suspicions, and told employee that it would be "fine" to open the package, held that the employee who opened the package and found drugs was not acting as a government agent). Similarly, where an off-duty law enforcement officer conducts the private-employer search, courts have required a warrant. See United States v. Ginglen, 467 F.3d 1071, 1075-76 (7th Cir. 2006) (collecting state cases).
The more difficult cases involve fact patterns where the overlap between private-employer search and law enforcement investigation is less obvious. The cases in which private-employer searches have triggered Fourth Amendment protections have been those in which law enforcement agents have had a pronounced involvement in the search process. A typical case involving a government connection found insufficient to trigger Fourth Amendment scrutiny is United States v. Elmquist, 2008 U.S. Dist. LEXIS 62915 (W.D. Mo., Aug. 18, 2008). In Elmquist, the CEO of a private company, QualServ, had the use of a company-owned laptop. When servicing the laptop, a company employee found child pornography images on the computer. The employee made two copies of the hard drive while the employee's father called the police. Id. at *2-3. Because the laptop continued to experience problems, the employee then removed the hard drive altogether. Id. at *3. The police then obtained a search warrant to examine the hard drive copies and the actual drive. Id. at *4. Elmquist moved to suppress the computer evidence, arguing that the actions of the QualServ employees were attributable to law enforcement. The district court rejected the argument, noting that the police did not know of the hard drive copying and removal until after those actions had been taken in the ordinary course by the company employee. Id. at *10.
The Elmquist court identified several factors pertinent to the determination whether the private employee is functionally a government actor: whether law enforcement had knowledge of and agreed to the conduct; whether the private employee intended to assist law enforcement or to further his/her own purposes; and whether the private employee acted at the government's request. Id. at *10 (citing Smith, 383 F.3d at 705). See also United States v. Shahid, 117 F.3d 322, 325 (7th Cir.) (adding, as criterion, whether government offered the private actor a reward), cert. denied, 522 U.S. 902 (1997). Because the QualServ employee had copied and then removed the hard drive without the knowledge of the police, and without police instigation, he was not acting as a government agent. Id. at *10. Even though the QualServ employee may have intended to benefit law enforcement by his actions, he was motivated at least in part by legitimate private purposes, taking his conduct outside the realm of government action. Id. at *10-11.
Even where law enforcement agents discover additional incriminating evidence by searching computer data more thoroughly than did the private employer who seized it, the Fifth Circuit has held that the warrantless government search does not constitute a Fourth Amendment violation. United States v. Slanina, 283 F.3d 670 (5th Cir.), judgment vacated on other grounds, 537 U.S. 802 (2002), aff'g den. of suppression motion on rem., 359 F.3d 356 (5th Cir. 2004). In Slanina, the FBI's warrantless review a computer initially reviewed and seized by city officials seeking evidence of work-related misconduct yielded even more evidence from the same computer. This evidence, the court determined, fell outside the Fourth Amendment’s protection because the first review by private parties so "eroded" the user's expectations of privacy that no Fourth Amendment violation could exist. 283 F.3d at 680.
In contrast to the Fifth Circuit’s determination in Slanina, the Ninth Circuit has, within in the context of a private employer computer search, determined that the Fourth Amendment’s protections attached at the point where private action transitioned to subsequent law enforcement investigation. In United States v. Ziegler, 474 F.3d 1184 (9th Cir. 2007), for example, an outside Internet service provider for a company called Frontline detected that a Frontline employee had accessed child-pornographic websites from a company computer, and immediately contacted the FBI. Id. at 1185. An FBI agent then contacted Frontline's IT administrator, who confirmed that his own investigation had identified the employee, Ziegler, and that the company had already copied files from Ziegler's computer. Id. at 1186. The FBI then directed Frontline employees to copy Ziegler's entire hard drive and turn the copy and the computer itself over to the FBI. Id. at 1187. The Ninth Circuit treated the seizure of evidence from Ziegler's computer as having been accomplished by government agents and subject to Fourth Amendment protections as a result of the FBI agent's extensive involvement, despite the initial discovery having occurred with no governmental instigation,. Id. at 1190.
2. Indicia of both subjective and objective efforts at establishing and respecting privacy
Moving to suppress evidence under the Fourth Amendment traditionally requires the following two-part showing: (i) the defendant had a legitimate expectation of privacy in the place searched or item seized; and (ii) this subjective expectation of privacy is objectively reasonable. Rakas v. Illinois, 439 U.S. 128, 143 (1978); California v. Greenwood, 486 U.S. 35, 39 (1988).
Even as to certain employee-controlled items of property stored in an open workplace environment, employees nonetheless enjoy both subjectively and objectively reasonable expectations of privacy not vulnerable to diminution by any employer policy or practice. These, according to the Supreme Court, include the contents of items such as closed luggage, handbags, or briefcases. O'Connor, 480 U.S. at 722. However, workplace computers do not appear to enjoy such protection. In determining whether or not an employee held a subjective expectation of privacy in workplace technology, courts have looked to the employee's efforts to retain privacy, such as his/her use of passwords to limit access to computers. In gauging the objective reasonableness of that expectation, weight is assigned to the extent to which the employer has provided warnings to the employee that data stored on the technology was not private and could be accessed by the employer. Ultimately, the circuit courts of appeal are divided concerning the degree to which particular warnings effectively diminish a privacy expectation. The Fourth, Fifth, and Tenth Circuits have sided with employers and the government when there have been employer-issued warnings and policies designed to undercut individual expectations of privacy. The Second and Ninth Circuits have sustained the individual's privacy expectations notwithstanding such employer devices.
In United States v. Simons, 206 F.3d 392 (4th Cir. 2000), cert. denied, 534 U.S. 930 (2001), the defendant, who worked for a division of the CIA, had a private office containing a computer with Internet access. Company policy authorized Internet use only for official government business and informed users that the company would periodically inspect and monitor Internet access. Id. at 395-96. A vendor hired by the CIA to monitor use of computer resources was testing a firewall when its representative discovered substantial Internet usage by Simons. A remote review of Simons' computer revealed numerous pornographic image files there. Id. at 396. The vendor then remotely obtained a list of the image files on Simons' computer and then copied the files from that computer. Id. Affirming a denial of Simons' motion to suppress the use of those files, the Fourth Circuit determined that Simons had no legitimate expectation of privacy because of the agency's Internet policy. "[R]egardless of whether Simons subjectively believed that the files he transferred from the Internet were private, such a belief was not objectively reasonable after [the agency] notified him that it would be overseeing his Internet use." Id. at 398.
Likewise, the Tenth Circuit in United States v. Barrows, 481 F.3d 1246 (10th Cir. 2007) affirmed the denial of a motion to suppress evidence from Barrows' office computer. Barrows was a city treasurer who brought his personal computer into the office because the city computer he used was shared with another employee. Although Barrows’ personal computer was kept in a common work space, no one shared Barrows' personal computer. Nonetheless, Barrows’ personal computer was networked to the computers in city hall, and Barrows used it for official business. Id. at 1247. When a different, networked computer was reported to be running slowly, a police officer with computer skills who happened to be in City Hall examined Barrows' personal computer as a potential source of the problem. During that examination, the police officer opened a program and found child pornography files. Id. A warrant was then obtained to seize the hard drive of Barrows' computer.
The Tenth Circuit was skeptical that Barrows could have subjectively expected the contents of his computer to be private. His ownership of the computer was a factor in favor of establishing a Fourth Amendment privacy right, but was not dispositive when the personally-owned item was being used for work-related purposes. Id. at 1249. More importantly, the computer was not password-protected and was not routinely turned off, and others passed in and out of his work area all day. Id. Thus, even if he possessed a subjective expectation of privacy, Barrows' failure to limit access by other employees made his expectation objectively unreasonable. Id. Despite the absence of any office policy in place to constrict computer use, much less one Barrows violated by his conduct, the court of appeals found no cognizable Fourth Amendment expectation of privacy. See also United States v. Angevine, 281 F.3d 1130, 1135 (10th Cir.) (professor downloaded child pornography onto university computer; university's computer-use policies gave notice of monitoring and established that computer was property of school, and computer started up with banner; held that Angevine could not have had objectively reasonable expectation of privacy), cert. denied, 537 U.S. 845 (2002).
Other courts, however, have upheld individual expectations of privacy even despite employer warnings and policies. In United States v. Ziegler, 474 F.3d 1184 (9th Cir. 2007), an employee who worked for a private employer, had a password-protected office computer the employee kept inside his individual lockable office. These facts, the Ninth Circuit determined, were sufficient to establish a subjective expectation of privacy. Id. at 1189. Moreover, even though the company's administrators had access to all computers, the company employed a firewall that monitored internet traffic, the employees were apprised of the monitoring, and the employees were advised that the computers were owned by the company and were not to be used for personal activities, because this particular employees’ office was not shared and kept locked, the employee’s expectation of privacy in his office and its contents, computer included, was objectively reasonable. Id. at 1190. (However, the court did uphold the search on the basis of employer consent; the Ninth Circuit held that the company had the authority to consent to a search of Ziegler's computer because the computer belonged to the company, its exclusive ownership made clear through its monitoring policies and warnings. Id. at 1192.)
In Leventhal v. Knapek, 266 F.3d 64 (2nd Cir. 2001), a state employee disciplined for operating a private tax preparation service using his Department of Transportation computer sued the agency commissioner for damages under 42 U.S.C. § 1983. Although the Second Circuit upheld a district court order granting summary judgment to the defendants and dismissing the complaint, its analysis of the "expectation of privacy" issue is noteworthy. The Second Circuit cataloged the various employer rules intended to diminish any individual expectation of privacy. The DOT had an "unwritten" rule that only standard DOT software could be uploaded, and a written policy prohibiting the use of State equipment for personal business. Id. at 67. DOT personnel could and did access Leventhal's and other's individual computers to perform troubleshooting and upgrades, and occasionally DOT would obtain needed documents from individuals’ computers without their knowledge. Id. at 67-68. Leventhal, an agency accountant, had added private tax software to his office computer, which was kept in his private, unshared office. Id. at 68-69, 74. Leventhal had not installed any initial, power-on password on his office computer, although some menu selections were password protected. Id. at 68. The DOT searched Leventhal's computer following receipt of an anonymous letter concerning employees engaged in personal business. Id. at 68-69. As a result, Leventhal was administratively disciplined.
Under the circumstances, however, the Second Circuit determined that Leventhal enjoyed a reasonable expectation of privacy in his office computer. This was so because the DOT did not have a routine practice of searching office computers. Leventhal was not on sufficient notice that his expectation of privacy in the contents of his office computer might be unreasonable, especially given the infrequent and selective DOT efforts at maintenance and at locating particular documents, and the lack of a written DOT policy that prohibited employees from storing personal items on their computers. Id. at 74-75. (Nevertheless, there was no Fourth Amendment violation because the search of Leventhal's computer was based on reasonable grounds to believe that evidence of misconduct would be found, and the scope of the search was not unduly intrusive. Id. at 75-76.)
3. Reasonableness of employer search
The O'Connor Court held that government employers may conduct warrantless searches of employee offices if the search is primarily related to workplace misconduct and is reasonable. O'Connor involved a § 1983 action brought by a doctor in a state hospital whose computer hospital officials searched. A plurality of the Court determined that warrantless workplace searches may be justified by the "special needs" of employers where: (i) the employer has conducted the search to further an investigation of workplace misconduct, not criminality; (ii) there are reasonable grounds to suspect that evidence of the misconduct will be located; and, (iii) the scope of the search is reasonably related to its objectives and not excessively intrusive. 480 U.S. at 719-723. However, the Court explicitly left undecided the question whether a warrant was constitutionally required when a government employee is being investigated for criminal misconduct or other non-work related misconduct, Id. at 729 n.*, citing lower court cases for the proposition that a warrant may be required for searches that are either not work-related or which seek evidence of criminal misconduct. Id. at 725 (citations omitted).
The cases demonstrate essentially a continuum between a permissible search for workplace misconduct and an impermissible hunt for evidence of other misconduct or criminality. The Fourth Circuit in Simons, for example, held that, even if the "dominant" purpose of the warrantless search was to obtain evidence of criminal activity, the search remains lawful if it bore some nexus to workplace rules and employee conduct requirements. 206 F.3d at 400 (must be a "conjunction" between employee conduct policy and criminal law). The Simons court did, however, note that a different answer would obtain if the criminal acts of the employee were unrelated to his employment such that, presumably, the warrantless search would run afoul of the Fourth Amendment. See Id. at 401.
The Fifth Circuit in Slanina involved a city fire marshal with a private office in a fire station, where he kept his city-owned computer. Slanina had installed a password to prevent anyone from accessing the computer's hard drive. 283 F.3d at 672. When networking Slanina's computer to the city's other computers, with Slanina having provided the necessary password, a city employee noted file names suggestive of pornography. That employee searched for and located a pornographic image file on the computer, and then subsequent searches by other city officials, including the police chief, turned up child pornography images. Id at 673. Slanina's office computer was taken, and later turned over to the FBI. Id. at 674. Slanina, the Fifth Circuit determined, had been ensnared in what was clearly a criminal investigation initiated by the police director's warrantless search of his computer. Yet, the Fifth Circuit upheld the search, under O'Connor, because the investigation had remained "at least partly" an investigation into employee misconduct. Id. at 679.
Any attorney seeking to suppress evidence gained from an employee's own computer or Blackberry faces an uphill battle. Employees seeking to invoke Fourth Amendment protections against private employer searches must demonstrate a sufficiently close relationship between the private-employer search and agents of law enforcement . Even then, isuch a private employee must establish that the aggregated indicia of employee privacy expectations overcome the employer's policies and practices designed to deny legitimacy to those expectations. And even in those situations where such aggregated indicia of employee privacy expectations exist, the prosecutor may still assert employer consent to save an unlawful warrantless search, drawing upon those same employer policies and practices to argue that the ownership of company equipment was intended to be exclusive to the employer such that the employee has no standing to suppress the evidence the search uncovered.
In the case of a government employee, where the presence of state action presumptively brings the Fourth Amendment into consideration, the same conflict exists between an individual's expectations of privacy and an employer's pronouncements designed to prevent those expectations from reasonably arising. Additionally, the O'Connor rule permitting warrantless "reasonable" searches incident to workplace misconduct investigations must be overcome, by showing that the search was substantially aimed at non-workplace misconduct or at gathering evidence of a crime.