If a prosecutor finds a password, can he or she use it?

April 21, 2010 8:23 AM

What are the legal implications of subpoenaing or obtaining a warrant for digital papers (such as a Gmail or Google Apps account) and finding a password? Could the prosecutor use the password to obtain more information from another digital source, such as another email account or a Facebook account?

Previously (somewhat related) on the blue. Also related.

posted by Michael Pemulis to Law & Government (1 answer total)

Best answer: In the abstract, I think that it would be a horrible, horrible idea for a prosecutor or investigator to use a password that they stumbled across in a stack of subpoenaed documents. Among other things, the Stored Communications Act provides for criminal penalties for intentionally accessing things "without authorization".

Conceptually, I think the analog is that if there was a search warrant for a house, and the warrant revealed a key to an off-site storage locker. On Law & Order the cops usually go straight from the house to the storage locker, but in order to do so on the up-and-up, I'm pretty sure you'd either need the original search warrant to specify the storage locker, or you'd need to go back to the judge to expand the original scope.

So even without worrying about the Stored Communications Act, law enforcement would have to worry about Fourth Amendment issues.

Note that accessing data in the cloud is very much different from accessing encrypted data that's already in the possession of the authorities. I think the analysis is different if the cops have an encrypted thumb drive, they subpoena the Gmail account, and get a copy of the encryption key that way. Devil's in the details, of course.
posted by QuantumMeruit at 8:39 AM on April 21, 2010