When Access Is Shared, Be Scared

U.S. v. King509 F.3d 1338 (11th Cir. 2007)

FACTS

In February 2003, while serving as a civilian contractor, Michael D. King resided in a dormitory at the Prince Sultan Air Base in Saudi Arabia. During his stay in the dormitory, King kept his personal laptop computer in his room and connected it to the base network. All users of the base network signed agreements indicating that they understood that their communications over and use of the base network were subject to monitoring.

An enlisted airman was searching the base network for music files when he came across King's computer on the network. The airman was able to access King's hard drive because it was a "shared" drive. The airman discovered a pornographic movie and text files "of a pornographic nature." The airman reported his discovery to a military investigator who in turn referred the matter to a computer specialist. This specialist located King's computer and hard drive on the base network and verified the presence of pornographic videos and explicit text files on the computer. She also discovered a folder on the hard drive labeled "pedophilia." Military officials seized King's computer and also found CDs containing child pornography.

Two years later, the government obtained an indictment charging King with possession of child pornography. After his arrest, the government searched his residence pursuant to a search warrant and found additional CDs and hard drives containing over 30,000 images of child pornography.

King entered a guilty plea and was sentenced to 108 months in prison. King then appealed his conviction on the grounds that there had been an illegal search and seizure of his computer and files.

Judicial Opinion

PER CURIAM

King contends that the district court denied his motions to suppress based on the erroneous finding that he did not have a reasonable expectation of privacy in his computer files that were remotely accessed over a military computer network, because the search of those files by the computer specialist exceeded the scope of her authority to monitor usage of the base network. King asserts that he sought to protect his computer files through security settings, he never knowingly exposed them to the public, and he was unaware that the files were shared on the network. King further challenges the district court's alternative finding that the military officials conducted a proper workplace search, arguing that this was a criminal investigation into King's personal computer located in his private dorm room. Finally, King asserts that the subsequent search warrant was invalid, as it was based on information that was obtained improperly through the remote search of his computer files.

The Fourth Amendment's prohibition against unreasonable searches and seizures "protects an individual in those places where [he] can demonstrate a reasonable expectation of privacy against government intrusion," and "only individuals who actually enjoy the reasonable expectation of privacy have standing to challenge the validity of a government search."

Accordingly, the threshold issue in this case is whether King had a legitimate expectation of privacy in the contents of his personal laptop computer when it was connected to the base network from his dorm room.

We have held that tenants of a multiunit apartment building do not have a reasonable expectation of privacy in the common areas of the building, where the lock on the front door is "undependable" and "inoperable." We have also held that even though a company has a subjective expectation of privacy in documents that are shredded and disposed of in a garbage bag that is placed within a private dumpster, the company's "subjective expectation of privacy is not one that society is prepared to accept as objectively reasonable" when the company fails to "take sufficient steps to restrict the public's access to its discarded garbage."

King has not shown a legitimate expectation of privacy in his computer files. His experience with computer security and the affirmative steps he took to install security settings demonstrate a subjective expectation of privacy in the files, so the question becomes "whether society is prepared to accept [King's] subjective expectation of privacy as objectively reasonable."

It is undisputed that King's files were "shared" over the entire base network, and that everyone on the network had access to all of his files and could observe them in exactly the same manner as the computer specialist did. As the district court observed, rather than analyzing the military official's actions as a search of King's personal computer in his private dorm room, it is more accurate to say that the authorities conducted a search of the military network, and King's computer files were a part of that network. King's files were exposed to thousands of individuals with network access, and the military authorities encountered the files without employing any special means or intruding into any area which King could reasonably expect would remain private. The contents of his computer's hard drive were akin to items stored in the unsecured common areas of a multiunit apartment building or put in a dumpster accessible to the public.

Because his expectation of privacy was unreasonable King suffered no violation of his Fourth Amendment rights when his computer files were searched through the computer's connection to the base network. It follows that his additional claim that the later search warrant was invalid because it incorporated information obtained from the search of his computer files also lacks merit.

Affirmed.

Case Questions

1. Why does the court draw the comparisons with noncyber searches?
2. What lessons should employees learn from this case?