Appeals Court: Bad Cloud Data Warrant Good Enough To Jail Someone For Crime Cops Weren’t Even Investigating

Ars Technica 2023-11-08

Adding to the unearned wins racked up by cops is this decision [PDF] from the Eleventh Circuit Appeals Court. According to the court, figuring out digital stuff is just too complicated. And if it can’t handle the nuances, it certainly can’t expect cops to follow the constitutional rules.

And who can blame it? The guidance it has comes from the Supreme Court, which has limited review of potential rights violations to cases directly on point. If no on-point precedent exists, the cops win and the Constitution loses, even if most people (including more than a few judges) can clearly see the rights violations.

It’s all about precedent. When there isn’t much of it, cops are free to violate constitutional protections until a court finally puts it foot down. But feet are rarely placed down because of the circular reasoning the Supreme Court says must be deployed in these cases. If there’s nothing on point, nothing gets established. And since no rights violations are being clearly established, the next rights violation gets a pass because… well, the court had to pass on generating precedent the last time around.

That’s how it goes and that’s how this went. Kevin McCall found himself on the losing end of a high-stakes poker game. Hoping to regain some of his losses, McCall allegedly used his cell phone to set up a robbery of the winners.

The investigators took “but on a phone” and ran with it. And they ran far past any notions of probable cause.

Because a cell phone was directly tied to the crime, no one disputes that there was probable cause to search that device. But the police went one step further. They secured a warrant to search an iCloud account that backed up the phone twelve hours before the poker game and robbery. The iCloud warrant permitted a search of almost all the account’s data with no time limitation. Based on evidence secured by that warrant, the government prosecuted and a jury convicted McCall of being a felon in possession of a firearm.

So… let’s take a look at this. Obviously, a phone was instrumental in the spur-of-the-moment robbery. But cops sought information that was at least 12 hours old before McCall allegedly arranged the at-gunpoint recovery of his gambling funds.

On top of that, no limits were placed on the search of the iCloud data that may have prevented investigators from utilizing anything not related to the crime they were investigating. Understandably, the stale content contained nothing investigators could use to prosecute McCall for the robbery. But, because the warrant wasn’t limited, investigators decided to prosecute McCall for a crime they weren’t even investigating: illegal possession of a firearm.

All else being equal, this should have been an easy dismissal of charges following an even easier suppression of this so-called “evidence.” Sure, it may have been evidence of some crime, but this wasn’t exactly plain view. Investigators didn’t see the illegal weapon because they happened upon it during the normal course of a robbery investigation. They saw it because they obtained (via a faulty warrant) an all-access pass to McCall’s iCloud account.

This subpar warrant was approved and Apple complied with it, sending back the latest backup of McCall’s iCloud data. That led to this:

Apple emailed the detective the iCloud backup data, which spanned about two-and-a-half months leading up to the robbery. Supervisor of the Digital Forensics Unit James KempVanEe then processed the data, discovering photographs and videos of McCall, a felon, holding a 9 millimeter semi-automatic pistol. The photographs dated back to the month before the robbery.

The gun could have been a replica or an altered Airsoft for all the detectives knew. It also could have been taken prior to McCall’s felony conviction, making it possibly a legal weapon. Those were all possibilities, no matter how remote. What these photographs definitively weren’t were evidence of his involvement with this robbery. So, the cops should have disregarded this irrelevant info. And the magistrate should have rejected the overly-broad warrant demanding information that could not have possibly been relevant to the criminal act under investigation.

Instead, that photo turned into federal charges and this suppression attempt, which has been rejected by the Eleventh Circuit because… well, tech is complicated and stuff.

Although Fourth Amendment standards are largely settled, their application to developing areas of technology is not. Like judges, law enforcement officers operating in good faith may struggle to apply existing standards to new circumstances. That is where the exclusionary rule’s good faith exception comes in. The government concedes that the iCloud warrant fell short in certain respects, but it argues that reasonable officers could have believed it to be valid. We agree that the warrant was not so deficient in probable cause, particularity, or otherwise that it would be unreasonable for an officer to rely on it in good faith.

lol

Imagine an iCloud account being a “new circumstance.” Cloud storage and personal data repositories are nearly as old as the internet itself. Apple’s iCloud has been around since 2011. How something 12 years old can be considered a “new circumstance” by judges or cops is beyond me. Just because it’s easier to investigate from a desk than applying shoe leather to concrete doesn’t mean the Fourth Amendment no longer applies.

McCall’s point — that an account last backed up 12 hours before an alleged crime — could not be reasonably expected to contain evidence of the crime committed 12 hours later is a much better point, no matter these supposed “newness” of 12-year-old technology. Even if everyone agrees it might be difficult for cops and courts to wrap their minds around storage options that have been in common use for more than a decade, surely we can all agree the rules of time and space have not been significantly altered over the last decade. Unless the cops truly believed the crime was pre-planned some time in advance (which they clearly did not believe), there was no justification for the search of cloud storage that contained no data created during the time the crime occurred or after it.

This is a blown call. But that’s the way cops like it. A storage option that made its debut in 2011 is still considered by an appellate court to be a novel invention worthy of years of future debate before cautiously establishing extremely narrow precedent. This is little more than a court talking itself out of upsetting the prosecutorial apple cart because doing so might mean future alleged criminals might expect their rights to be respected. It’s not only lazy, it’s cowardly. The world continues to advance. The nation’s courts, unfortunately, still insist on taking a wait-and-see approach to tech, as though every widely used content storage option is just another Pets.com.