Last month, in United States of America v. Kendra D’Andrea and Willie Jordan, 2007 WL 2076472 (D. Mass. 2007), the United States District Court for the District of Massachusetts declared that internet users have no reasonable expectation of privacy in materials and content stored on a password protected web-site. In a criminal case with background facts too disturbing to detail, the Court expressly denied the Defendants’ claims that the password-protected website was exclusively theirs. The case raises concerns for business and individuals with respect to the privacy of information stored on the internet.
The case began when an inside informant called the Department of Social Services child-abuse hotline and reported that an 8 year old girl was being sexually abused by her mother and the mother’s live-in boyfriend. The caller also notified the DSS that photos of the sexual abuse had been taken with a cellular phone and posted on a website. The caller provided the DSS with the password, log-in name, and telephone number used by the defendants, as well as the defendants’ address. The informant caller was a former girlfriend of the live-in boyfriend, who claimed that the defendants provided her with the website information, login, and password. A senior DSS administrator accessed the website, downloaded the images, and notified the police, who in turn obtained a warrant. Upon the search of the residence, the police arrested the mother and found a mobile camera-phone.
Defendants moved to suppress the downloaded images, the evidence seized from their residence, and any incriminating statements made by the defendants (although made after Miranda rights were read). They alleged that the DSS violated their Fourth Amendment rights by accessing the website and downloading the images. Because the images were critical to the clerk-magistrate’s finding of probable cause, the Defendants argued that the fruits of the search of the residence as well as one defendant’s subsequent confessions should be suppressed as fruit of the poisonous tree.
The court rejected Defendants’ assertions the DSS violated their Fourth Amendment rights. Noting that the information had come from a private party, the court quoted United States v. Jacobsen, 466 U.S. 109, 117 (1980), for the proposition that “[w]here a private party, acting on his or her own, searches a closed container, a subsequent warrantless search of the same container by government officials does not further burden the owner’s already frustrated expectation of privacy.” The court also cited the recent decision in Warshak v. United States, 490 F.3d 455 (6th Cir. 2007), noting that this case fell into the “assumption of the risk” exception identified in Warshak, where any expectation of privacy was unreasonable given that Defendants shared website access information with the caller. In a footnote, the court also made it clear that the result would not have changed if the caller had hacked her way into the website, rather than being voluntarily provided the website access information, stating that the state would not be held responsible for the caller’s actions In another footnote, the court noted that a warrant permitting seizure of “cameras,” “computer storage devices,” and “computer accessory” encompasses the modern camera-equipped cellular telephone.
In sum, the decision indicates that a password does not always protect the content of a webpage from disclosure.