Source: https://www.yalelawjournal.org/forum/rileys-implications-in-the-cloud
Timestamp: 2019-04-18 16:39:41+00:00

Document:
Riley’sprotection of cloud-based data for cell phone searches, however, does not address the broader question of whether information stored in the cloud is entitled to Fourth Amendment protection in other contexts. Indeed, the Court went out of its way to state that Riley did “not implicate the question [of] whether the collection or inspection of aggregated digital information amounts to a search under other circumstances.”4 The Court also distinguished the facts of Riley from those in Smith v. Maryland,5 one of the principal cases to apply the so-called “third-party doctrine.” The third-party doctrine, which provides that information voluntarily revealed to third parties is not protected by the Fourth Amendment, may pose the biggest obstacle to whether cloud-based data receives Fourth Amendment protection, since any data stored in the cloud is necessarily conveyed to third-party servers. Yet by sidestepping the third-party doctrine in Riley, the Court never had to address how the doctrine applies to private data stored across remote servers.
Nevertheless, while failing to explicitly afford Fourth Amendment protection to cloud-based data, Riley still provides the best evidence yet that the Court may be ready to reconsider the third-party doctrine and to recognize Fourth Amendment protection for personal data stored in the cloud.
Riley thus does little to clarify how the third-party doctrine applies to information stored in the cloud in other contexts, leaving open the question of whether police can acquire cloud-based information from third parties who host the cloud servers. For example, if an iPhone owner backs up her personal data such as email, contacts, calendars, internet history, notes, photos, and documents on Apple’s iCloud,22 police would be unable to access that data in a search of the iPhone incident to arrest under Riley. But could police acquire the cloud-based data from Apple without a warrant by arguing that the owner, after disclosing the data to Apple via the cloud, no longer had a reasonable expectation of privacy to it under the third-party doctrine?
Yet Riley, despite distinguishing Smith,suggested that cloud-based data nevertheless may enjoy some Fourth Amendment protection. First, the Court emphasized the intrusiveness of police access to cloud-based data. It analogized allowing police to search cloud-based data on a cell phone during an arrest to “finding a key in a suspect’s pocket and arguing that it allowed law enforcement to unlock and search a house.”27 If the key is the cell phone in this analogy, then cloud-based storage is presumably the house. The Court recognized that accessing data in the cloud can often be more intrusive than accessing data on a phone’s internal storage because of the cloud’s ability to hold virtually unlimited amounts of data.
Third, the Court suggested that the precise medium in which digital data is stored is irrelevant to whether that data receives Fourth Amendment protection. The Court observed that “the same type of data may be stored locally on the device for one user and in the cloud for another.”30 And in perhaps Riley’s most significant moment for cloud-based data, the Court explained that “cell phone users often may not know whether particular information is stored on the device or in the cloud, and it generally makes little difference.”31 Whether it makes little difference because personal data stored on the cloud categorically enjoys the same protection as locally-saved data, or because the act of searching a cell phone without a warrant violates the Fourth Amendment regardless of where its content is located, the Court did not say. But the Court’s apprehension about police access to the wide array of private information found on cell phones without a warrant, and its contention that it “makes little difference” whether such data is stored in the cloud, seem to be irreconcilable with a conclusion that cloud-based data receives no Fourth Amendment protection.
Holding that cloud-based data receives Fourth Amendment protection would also cast serious doubt on the constitutionality of the Stored Communications Act (“SCA”), which allows the government to obtain via subpoena, as opposed to warrant, “stored wire and electronic communications and transactional records” that have been in storage for more than 180 days.33 In fact, the Sixth Circuit recently declared part of the SCA unconstitutional on precisely such Fourth Amendment grounds.34 Since there are currently bills in Congress that propose amending the SCA,35 the Court may be reluctant to address the issue and invalidate parts of the statute until Congress amends it.
Finally, while the Riley Court correctly noted that cell phones are utilizing cloud computing “with increasing frequency,”36 the entire concept of local data storage may soon become anachronistic. In Apple’s most recent operating system, for example, any application that is compatible with iCloud, including Apple’s basic text editing program, uses the cloud as its default save location.37 (One prolific Mac blogger noted that “saving [a] file anywhere else [besides iCloud] has become somewhat of a chore.”38) Cloud computing more broadly has also begun to replace local computing in various industries through Software-, Platform-, and Infrastructure-as-a-Service, whereby companies subscribe to or create their own applications for exclusive cloud-based use.
The decision of when to address the issue of cloud-based data thus presents a tradeoff. On the one hand, as the cloud becomes more omnipresent and unavoidable, cloud usage may cease to constitute a “voluntary” disclosure within Smith’s third-party doctrine framework. If the Court waits to address the issue until cloud computing becomes integrated into everyday use, then it may be able to find Fourth Amendment protection for cloud-based data without overruling or reinterpreting Smith. On the other hand, developing industries and consumers relying on the cloud currently have little guidance about what Fourth Amendment protection they can expect for their data.
Riley suggests that the Court is ready to find that cloud-based data receives Fourth Amendment protection, and that cloud users do not waive a reasonable expectation of privacy in every file they save simply because storage is moving to the cloud. The cloud is, to use the Court’s language in Smith, “merely the modern counterpart”39 of internal hard drives and processors that locally store and compute data. Nevertheless, competing concerns—such as the desire to avoid raising the constitutionality of the SCA’s 180-day rule and to delay deciding at what point cloud usage has ceased to be voluntary for purposes of the third-party doctrine—may render the Court reluctant, at least for now, to make explicit Riley’s implications for data in the cloud.
Ryan Watzel is a law clerk for Hon. Christopher F. Droney on the United States Court of Appeals for the Second Circuit. He would like to thank Bert Ma and the Yale Law Journal for excellent edits and feedback.
Preferred Citation: Ryan Watzel, Riley’s Implications for Fourth Amendment Protection in the Cloud, 124 Yale L.J. F. 73 (2014), http://www.yalelawjournal.org/forum/rileys -implications-in-the-cloud.
631 F.3d 266 (6th Cir. 2010).
132 S. Ct. 945, 957 (2012) (Sotomayor, J., concurring).
Brief for the United States at 54, Riley v. California, 134 S. Ct. 2473 (2014)(No. 13-212).
Riley, 134 S. Ct. at 2492-93.
Brief for the United States, supra note 18, at 43-44.
Smith v. Maryland, 442 U.S. 735, 743 (1979).
Riley v. California, 134 S. Ct. 2473, 2491 (2014).
Smith, 442 U.S. at 744.
Riley, 134 S. Ct. at 2491.
18 U.S.C. § 2703 (2012).
United States v. Warshak, 631 F.3d 266 (6th Cir. 2010).
Smith v. Maryland, 442 U.S. 735, 744 (1979).
134 S. Ct. 2473 (2014). Riley was decided together with United States v. Wurie, another case involving the warrantless search of a cell phone incident to arrest.
A pen register records the numbers dialed on a telephone by monitoring electrical impulses caused when the dial on the telephone is released. Smith, 442 U.S. at 736 n.1.
754 F.3d 1205 (11th Cir. 2014). Cell site location data includes a record of calls made by a cell phone user and the cell towers that carried the call. This information allows police to extrapolate the location of the cell phone user at the time in the call record. Id. at 1210-11.
See, e.g., In re U.S. for Historical Cell Site Data, 724 F.3d 600, 623-24 (5th Cir. 2013) (Dennis, J., dissenting).
See, e.g., Miriam H. Baer, Secrecy, Intimacy, and Workable Rules: Justice Sotomayor Stakes Out the Middle Ground in United States v. Jones, 123 Yale L.J. F. 393 (2014), http://www .yalelawjournal.org/forum/secrecy-intimacy-and-workable-rules [http://perma.cc/VN3Q-B4RG].
See, e.g., Riley v. California, 134 S. Ct. 2473, 2490 (2014) (citing Jones, 132 S. Ct. at 955 (Sotomayor, J., concurring)).
iCloud, like other cloud storage and computing, has continued to grow. More than 250 million people worldwide now use the service. See Mikey Campbell, Apple Sees 2 Billion iMessages Sent Daily from Half a Billion iOS Devices, AppleInsider (Jan. 23, 2013), http://appleinsider.com/articles/13/01/23/apple-sees-2b-imessages-sent-every-day-from-half -a-billion-ios-devices [http://perma.cc/C6LZ-F5PD].
Id. at 2490 (citing United States v. Jones, 132 S. Ct. 945, 955 (2012) (Sotomayor, J., concurring)).
For a debate on these third-party issues, see Orin Kerr and Greg Nojeim, The Data Question: Should the Third-Party Records Doctrine Be Revisited?, A.B.A. J. (Aug. 1, 2012), http://www.abajournal.com/magazine/article/the_data_question_should_the_third-party _records_doctrine_be_revisited [http://perma.cc/9MHV-HJPR].
See, e.g.,Email Privacy Act, H.R. 1852, 113th Cong. (2013). See generally Matthew Sipe, Storage Wars: Greater Protection for Messages in Memory, 124 Yale L.J. F. 29 (2014), http:// http://www.yalelawjournal.org/forum/storage-wars-greater-protection-for-messages-in-memory [http://perma.cc/5E8P-ZXXN] (describing proposed amendments to the SCA).
Rob LeFebvre, Mastering iCloud on Your Mac: Dump iCloud as Default Save Location, Cult of Mac (Mar. 26, 2013, 6:00 AM), http://www.cultofmac.com/220906/mastering-icloud -on-your-mac-dump-icloud-default-save-os-x-tips [http://perma.cc/DGH3-SENP].
Michael Steeber, Change Mountain Lion’s Save Default Away from iCloud, Cult of Mac (Sept. 5, 2012, 4:08 PM), http://www.cultofmac.com/188717/change-mountain-lions-save -default-away-from-icloud-video-how-to [http://perma.cc/S6X9-NY67].

References: v. 
 v. 
 v. 
 v. 
 § 2703
 v. 
 v. 
 v. 
 v. 
 v. 
 v.