Ninth Circuit: “Special Needs” Warrantless Searches OK for Dorm Room Computers

By on April 27, 2007

Jennifer Granick, a professor at Stanford Law School and the executive director of the school’s Center for Internet and Society, directs our attention to the Ninth Circuit’s decision in United States v. Heckenkamp, announced earlier this month. In the ruling, the Ninth Circuit held that the warrantless remote search of a computer owned by a student suspected of hacking was constitutional under the “special needs” exception to the Fourth Amendment’s protection against unreasonable search and seizure.
 
First, by way of background, it’s useful to explain the “special needs” exception. The Fourth Amendment to the Constitution protects against unreasonable searches and seizures without a warrant, and states further that “no Warrants shall issue, but upon probable cause.” The “special needs” exception  to the requirement of a warrant was first announced by the Supreme Court in New Jersey v. T.L.O., 469 U.S. 325 (1985), a case concerning the constitutionality of on-site warrantless searches of high school students for drug possession. In his majority opinion, Justice White held that “the special needs of the school environment require assessment of the legality of such searches against a standard less exacting than that of probable cause.” This fairly sweeping statement was reined in by Justice Blackmun’s concurring opinion, which restricted the “special needs” exception for use “[o]nly in those exceptional circumstances in which special needs, beyond the normal need for law enforcement, make the warrant and probable cause requirement impracticable.” Predictably, the doctrine has since expanded in years following, and has been cited by the Court to justify suspicionless drug testing  for railway workers, customs officials, and, back in the high school context, even public high school students involved in athletics and extracurricular activities in general. (The Court declined to approve of suspicionless drug testing of candidates for public office, however.)
 
Back to Heckenkamp. The case before the Ninth Circuit revolved around Jerome Heckenkamp, a former student at the University of Wisconsin – Madison, and his alleged involvement in hacking into corporate websites, using the University of Wisconsin – Madison’s mail servers as a starting point. When the FBI investigation of the corporate hacks pointed to the university’s mail servers, Jeffrey Savoy, a university network administrator began to look more closely at recorded network activity and login records. The evidence available soon seemed to point to Heckenkamp, a former student employee at the university computer help desk who had been fired for “similar unauthorized activity.” Savoy provided the relevant evidence to the FBI, who informed him that they would apply for a warrant.
 
However, upon returning home that night, Savoy, “concerned about the integrity of the university’s system,” decided to have a second look at the network, to see if Heckenkamp was back online. Checking, Savoy determined that Heckenkamp was online, but had switched IP addresses. Nervous about the stability of the university’s servers, Savoy decided to take action, feeling that the IP address switch provided evidence that Heckenkamp was aware of the pursuit. To make sure that Heckenkamp was indeed switching IP addresses, Savoy remotely logged into Heckenkamp’s computer, using passwords he had discovered in his earlier investigation. Once remotely logged in, Savoy checked the temporary files on the computer to confirm that Heckenkamp had in fact been using the computer responsible for the corporate hacks. Additionally, while logged in Savoy searched for incriminating files and took screenshots—evidence the Ninth Circuit deemed admissible under the “special needs” exception. As Granick notes in writing about the ruling for Wired magazine, “the special needs exception applied because Savoy remotely searched Heckenkamp’s computer for the purpose of securing the Mail2 server, and not with a motivation to collect evidence for law enforcement purposes. The court then balanced the need to search against the intrusiveness of the search, and ruled that what Savoy did was permissible.”
 
While the ruling in Heckenkamp helpfully makes clear that university students enjoy a constitutionally protected reasonable expectation of privacy in their dorm room computer, the court nevertheless held that under the “special needs” exception to the Fourth Amendment’s warrant requirements, the remote search of a student computer on a university network is constitutional in situations where requiring a warrant to “investigate potential misuse” of the network would “disrupt the operation of the university and the network that it relies upon in order to function.” Granick is rightly concerned about the potential for broadening a ruling that, while narrowly applied here, may easily be widened to grant universities more power to search student computers without warrants. As she writes:  
The larger problem may be that the court overlooked the fact that, regardless of what Savoy’s stated motives were, it’s clear that he searched a particular person’s computer because he was suspicious of that person, and with the knowledge that whatever information he found he would give to law enforcement. Savoy may have been acting to protect the university, but he was also investigating the offense. That should have made his warrantless search unconstitutional…


While U.S. v. Heckenkamp says networked computers can be private, and applies the "special needs" exception in a narrow way, future prosecutors will try to expand it. Many searches in response to computer security breaches have dual purposes: fix the breach and make a case against the intruder. It will be hard for the courts to parse dual motivations to determine whether the Heckenkamp exception applies. 
If not addressed further, the Ninth Circuit’s Heckenkamp ruling may provide unscrupulous (or just plain snooping) network administrators legal cover when “investigating” online student activity involving university networks without a warrant.
 
You can be sure that FIRE and Professor Granick will be watching the impact of the ruling, both on campus and in the nation’s courts. In the meantime, if you’re interested in learning more about Fourth Amendment rights on campus, check out FIRE’s Guide to Due Process and Fair Procedure on Campus.