United States v. Ziegler

FOR PUBLICATION UNITED STATES COURT OF APPEALS FOR THE NINTH CIRCUIT

UNITED STATES OF AMERICA,  No. 05-30177 Plaintiff-Appellee, v.  D.C. No. CR-03-00008-RFC JEFFREY BRIAN ZIEGLER, OPINION Defendant-Appellant.  Appeal from the United States District Court for the District of Montana Richard F. Cebull, District Judge, Presiding

Argued and Submitted March 6, 2006—Seattle, Washington

Filed August 8, 2006

Before: Diarmuid F. O’Scannlain, Barry G. Silverman, and Ronald M. Gould, Circuit Judges.

Opinion by Judge O’Scannlain

9076 UNITED STATES v. ZIEGLER COUNSEL

David F. Ness, Assistant Federal Defender, Great Falls, Mon- tana, argued the cause for the defendant-appellant. Anthony R. Gallagher, Federal Defender, District of Montana, was on the briefs.

Marcia Hurd, Assistant United States Attorney, Billings, Montana, argued the cause for the plaintiff-appellee. William W. Mercer, United States Attorney, District of Montana, was on the brief.

OPINION

O’SCANNLAIN, Circuit Judge:

We must determine whether an employee has an expecta- tion of privacy in his workplace computer sufficient to sup- press images of child pornography sought to be admitted into evidence in a criminal prosecution.

I

A

Frontline Processing (“Frontline”), a company that services Internet merchants by processing on-line electronic payments, is located in Bozeman, Montana.1 On January 30, 2001, Anthony Cochenour, the owner of Frontline’s Internet-service provider and the fiancé of a Frontline employee, contacted Special Agent James A. Kennedy, Jr. of the FBI with a tip that a Frontline employee had accessed child-pornographic websites from a workplace computer. 1 Although the district court referred to the company as “Front Line,” we use the single-word formulation which more frequently appears in the record.

UNITED STATES v. ZIEGLER 9077 Agent Kennedy pursued the report that day, first contacting Frontline’s Internet Technology (“IT”) Administrator, John Softich. One of Softich’s duties at Frontline was to monitor employee use of the workplace computers including their Internet access. He informed Kennedy that the company had in place a firewall, which permitted constant monitoring of the employees’ Internet activities.2

During the interview, Softich confirmed Cochenour’s report that a Frontline employee had accessed child pornogra- phy via the Internet. Softich also reported that he had person- ally viewed the sites and confirmed that they depicted “very, very young girls in various states of undress.” Softich further informed Kennedy that, according to the Internet Protocol address and log-in information, the offending sites were accessed from a computer in the office of Appellant Jeffrey Brian Ziegler, who had been employed by Frontline as direc- tor of operations since August 2000. Softich also informed Kennedy that the IT department had already placed a monitor on Ziegler’s computer to record its Internet traffic by copying its cache files.3 2 A firewall is a piece of “computer hardware or software that prevents unauthorized access to private data (as on a company’s local area network or intranet) by outsider computer users (as of the Internet).” MERRIAM- WEBSTER’S COLLEGIATE DICTIONARY 471 (11th ed. 2003). It can also be “programmed to analyze the network traffic flowing between [a] computer and the Internet”; it then “compares the information it monitors with a set of rules in its database,” and “[i]f it sees something not allowed . . . the firewall can block and prevent the action.” NEWTON’S TELECOM DICTIONARY 392 (22nd ed. 2006). Further, “[m]ost firewall programs let you adjust the rules to allow certain types of data to flow freely back and forth without interference.” Id. 3 A cache is “a computer memory with very short access time used for storage of frequently or recently used instructions or data.” MERRIAM- WEBSTER’S COLLEGIATE DICTIONARY 171 (11th ed. 2003). “[I]nformation is cached by placing it closer to the user or user application in order to make it more readily and speedily available . . . .” NEWTON’S TELECOM DICTIONARY 189 (22nd ed. 2006).

9078 UNITED STATES v. ZIEGLER Agent Kennedy next interviewed William Schneider, Sof- tich’s subordinate in Frontline’s IT department. Schneider confirmed that the IT department had placed a device in Ziegler’s computer that would record his Internet activity. He reported that he had “spot checked” Ziegler’s cache files and uncovered several images of child pornography. A review of Ziegler’s “search engine cache information” also disclosed that he had searched for “things like ‘preteen girls’ and ‘underage girls.’ ” Furthermore, according to Schneider, Fron- tline owned and routinely monitored all workplace computers. The employees were aware of the IT department’s monitoring capabilities.

B

The parties dispute what happened next. According to testi- mony that Softich and Schneider provided to a federal grand jury, Agent Kennedy instructed them to make a copy of Ziegler’s hard drive because he feared it might be tampered with before the FBI could make an arrest. Agent Kennedy, however, denied that he directed the Frontline employees to do anything. According to his testimony, his understanding was that the IT department had already made a backup copy of Ziegler’s hard drive. As the government points out, his notes from the Softich interview say, “IT Dept has backed up JZ’s hard drive to protect info.” Thinking that the copy had already been made, Kennedy testified that he instructed Sof- tich only to ensure that no one could tamper with the backup copy.

Whatever Agent Kennedy’s actual instructions, the Fron- tline IT employees’ subjective understanding of that conver- sation seems evident from their actions during the late evening of January 30, 2001. Around 10:00 p.m., Softich and Schneider obtained a key to Ziegler’s private office from Ronald Reavis, the chief financial officer of Frontline, entered

UNITED STATES v. ZIEGLER 9079 Ziegler’s office, opened his computer’s outer casing, and made two copies of the hard drive.4

Shortly thereafter, Michael Freeman, Frontline’s corporate counsel, contacted Agent Kennedy and informed him that Frontline would cooperate fully in the investigation. Freeman indicated that the company would voluntarily turn over Ziegler’s computer to the FBI and thus explicitly suggested that a search warrant would be unnecessary. On February 5, 2001, Reavis delivered to Agent Kennedy Ziegler’s computer tower (containing the original hard drive) and one of the hard drive copies made by Schneider and Softich. Schneider deliv- ered the second copy sometime later. Forensic examiners at the FBI discovered many images of child pornography.

C

On May 23, 2003, a federal grand jury handed down a three-count indictment charging Ziegler with receipt of child pornography, in violation of 18 U.S.C. § 2252A(a)(2); posses- sion of child pornography, in violation of 18 U.S.C. § 2252A(a)(5)(B); and receipt of obscene material, in viola- tion of 18 U.S.C. § 1462.5 At arraignment, Ziegler entered a plea of not guilty.

Ziegler filed several pretrial motions. At issue here is Ziegler’s April 23, 2004, motion to suppress the evidence obtained from the search of Ziegler’s workplace computer. Ziegler argued that Agent Kennedy, lacking a warrant, vio- 4 Agent Kennedy explained that this cooperation was the reason he did not pursue a search warrant. He testified, “At this point, counselor, every- body at Frontline Processing is telling me they’re going to cooperate, so I’m not going to go in and start serving search warrants on a company if they’re going to cooperate. I have no desire to do that.” 5 No explanation appears in the record for the two year, three month interval between delivery of the computer to the FBI and issuance of the indictment. In any event, Ziegler does not raise any issue regarding such delay.

9080 UNITED STATES v. ZIEGLER lated the Fourth Amendment by directing the Frontline employees to search his computer. The government argued that the search was voluntary and therefore private in nature.

On August 10, 2004, the district court held a suppression hearing at which Agent Kennedy and Schneider testified.6 Agent Kennedy, several times, denied that he instructed Sof- tich and Schneider to make a copy of Ziegler’s hard drive or to undertake any search in addition to what the employees had already done. Schneider, however, again testified that Ken- nedy directed him to make a copy of the hard drive. Schnei- der’s account was also reflected in a time-line he had prepared for Kennedy.7

On September 8, 2004, the district court entered a written order denying Ziegler’s motion to suppress. Importantly, the court made the factual finding that “Agent Kennedy contacted Softich and Schneider on January 30, 2001 and directed them to make a back-up of Defendant’s computer files” (emphasis added). However, citing United States v. Simons, 206 F.3d 392 (4th Cir. 2000), the court ultimately held that Ziegler had 6 The defense also offered the testimony of a computer forensics expert, but that testimony was not relevant to the motion to suppress. 7 On appeal, the government attempts to reconcile the contradictory accounts of the January 30, 2001 interview as a case of simple miscom- munication. It explains that confusion ensued when Schneider told Agent Kennedy that they were copying Ziegler’s cache files onto a second hard drive. Kennedy, whom the government characterizes as not particularly tech-savvy, allegedly understood Schneider to mean that the IT depart- ment had already made a copy of Ziegler’s entire hard drive. Thus, it sug- gests that Agent Kennedy’s instructions were only that the IT employees should secure the copy he thought had already been made. There is, in short, a factual dispute concerning the extent of the govern- ment’s involvement in the search and a corresponding legal dispute as to whether that involvement implicates the Fourth Amendment. See United States v. Miller, 688 F.2d 652, 658 (9th Cir. 1982). However, we need not address these issues if Ziegler had no reasonable expectation of privacy in any place searched or any item seized. See, e.g., United States v. Wong, 334 F.3d 831, 839 (9th Cir. 2003).

UNITED STATES v. ZIEGLER 9081 no reasonable expectation of privacy in “the files he accessed on the Internet” and therefore denied Ziegler’s motion.

Ziegler subsequently entered into a written plea agreement with the government. Pursuant to the agreement, the govern- ment agreed to dismiss the child pornography counts in exchange for Ziegler’s agreement to plead guilty to the receipt of obscene material. The parties conditioned the plea agree- ment on Ziegler’s ability to appeal the district court’s denial of the pretrial motions, including the motion to suppress. A change of plea hearing occurred on September 24, 2004.

On March 4, 2005, the district court sentenced Ziegler to a two-year term of probation and imposed a fine of $1,000. Ziegler timely filed a notice of appeal.

II

Ziegler’s sole contention on appeal is that the January 30, 2001 search of his workplace computer violated the Fourth Amendment and, as such, the evidence contained on the com- puter’s hard drive must be suppressed.8

A

Ziegler argues that “[t]he district court erred in its finding that Ziegler did not have a legitimate expectation of privacy in his office and computer.” He likens the workplace com- puter to the desk drawer or file cabinet given Fourth Amend- ment protection in cases such as O’Connor v. Ortega, 480 U.S. 709 (1987). Ziegler further contends that the Fourth Cir- cuit’s Simons case is inapposite. Whereas in Simons “the per- son conducting the search was a network administrator whose purpose was to search for evidence of employee misconduct,” 8 We review de novo the district court’s denial of Ziegler’s motion to suppress. United States v. Noushfar, 78 F.3d 1442, 1447 (9th Cir. 1996).

9082 UNITED STATES v. ZIEGLER in this case “the search was conducted at the behest of Agent Kennedy who was undeniably seeking evidence of a crime.”

The government, of course, views the matter quite differ- ently. It contends that the district court’s ruling was correct— Ziegler did not have an objectively reasonable expectation of privacy in his workplace computer. The government explains in its brief:

Society could not deem objectively reasonable that privacy interest where an employee uses a computer paid for by the company; [sic] Internet access paid for by the company, in the company office where the company pays the rent . . . . This is certainly even more so true where the company has installed a firewall and a whole department of people whose job it was to monitor their employee’s Internet activity.

As we know, the Fourth Amendment protects people, not places. Katz v. United States, 389 U.S. 347, 351 (1967). Although it is often true that “for most people, their comput- ers are their most private spaces,” United States v. Gourde, 440 F.3d 1065, 1077 (9th Cir. 2006) (en banc) (Kleinfeld, J., dissenting), the validity of that expectation depends entirely on its context. Cf. Ortega, 480 U.S. at 715 (“We have no talis- man that determines in all cases those privacy expectations that society is prepared to accept as reasonable.”).

[1] In that vein, a criminal defendant may invoke the pro- tections of the Fourth Amendment only if he can show that he had a legitimate expectation of privacy in the place searched or the item seized. Smith v. Maryland, 442 U.S. 735, 740 (1979). This expectation is established where the claimant can show: (1) a subjective expectation of privacy; and (2) an objectively reasonable expectation of privacy. See id. (citing Katz, 389 U.S. at 351, 361); United States v. Shryock, 342 F.3d 948, 978 (9th Cir. 2003). It is Ziegler’s burden to prove

UNITED STATES v. ZIEGLER 9083 both elements. United States v. Caymen, 404 F.3d 1196, 1199 (9th Cir. 2005) (citation omitted).

B

[2] The threshold question then is whether Ziegler had a legitimate expectation of privacy in his workplace computer and the files stored therein.9 If he had no such expectation, we need not consider whether the Frontline employees acted as agents of the government so as to implicate Fourth Amend- ment protections.

The government does not contest Ziegler’s claim that he had a subjective expectation of privacy in the computer. The use of a password on his computer and the lock on his private office door are sufficient evidence of such expectation. See 9 Ziegler also urges us to suppress the files found on his computer because it was located in his private office. Although an employee may have a legitimate expectation of privacy in his office, here the Frontline employees did not actually search Ziegler’s office. They did not violate a privacy expectation in the office generally, such as through “their conduct of a general search,” Mancusi v. DeForte, 392 U.S. 364, 369 (1968), or video surveillance, see United States v. Taketa, 923 F.2d 665, 672-75 (9th Cir. 1991). Neither did they violate some specific realm of privacy, such as a desk or file cabinet “given over to [Ziegler’s] exclusive use,” Schowengerdt v. Gen. Dynamics Corp., 823 F.2d 1328, 1335 (9th Cir. 1987), in which Ziegler could have kept private papers or effects. See Ortega, 480 U.S. at 717-18. Rather, the Frontline employees entered the office merely to gain access to the computer’s hard drive. As we discuss below, Frontline policy entitled its personnel to administrative access to the employees’ computers, and as such, Softich and Schneider’s entry was an “operational realit[y] of [Ziegler’s] workplace [that] diminished his legitimate privacy expectations.” Simons, 206 F.3d at 399; see also Taketa, 923 F.2d at 672 (noting that “a valid regulation may defeat an oth- erwise reasonable expectation of workplace privacy” (citation omitted)); cf. United States v. Blok, 188 F.2d 1019, 1020-21 (D.C. Cir. 1951) (hold- ing invalid a search of an employee’s desk because the employer itself was not empowered to conduct the search).

9084 UNITED STATES v. ZIEGLER United States v. Bailey, 272 F. Supp. 2d 822, 835 (D. Neb. 2003) (citation omitted).

But Ziegler’s expectation of privacy in his workplace com- puter must also have been objectively reasonable.

a

[3] In United States v. Simons, the case upon which the dis- trict court relied, the Fourth Circuit reasoned that an employ- er’s Internet-usage policy—which required that employees use the Internet only for official business and informed employees that the employer would “conduct electronic audits to ensure compliance,” including the use of a firewall— defeated any expectation of privacy in “the record or fruits of [one’s] Internet use.” 206 F.3d at 395, 398. A supervisor had reviewed “hits” originating from Simons’s computer via the firewall, had viewed one of the websites listed, and copied all of the files from the hard drive. Id. at 396. Despite that the computer was located in Simons’s office, the court held that the “policy placed employees on notice that they could not reasonably expect that their Internet activity would be pri- vate.” Id. at 398.

[4] As the government suggests, similar circumstances inform our decision in this case. Though each Frontline com- puter required its employee to use an individual log-in, Schneider and other IT-department employees “had complete administrative access to anybody’s machine.” As noted, the company had also installed a firewall, which, according to Schneider, is “a program that monitors Internet traffic . . . from within the organization to make sure nobody is visiting any sites that might be unprofessional.” Monitoring was therefore routine, and the IT department reviewed the log cre- ated by the firewall “[o]n a regular basis,” sometimes daily if Internet traffic was high enough to warrant it. Upon their hir-

UNITED STATES v. ZIEGLER 9085 ing, Frontline employees were apprised of the company’s monitoring efforts through training and an employment man- ual, and they were told that the computers were company- owned and not to be used for activities of a personal nature. Ziegler, who has the burden of establishing a reasonable expectation of privacy, presented no evidence in contradiction of any of these practices. Like Simons, he “does not assert that he was unaware of, or that he had not consented to, the Internet [and computer] policy.” Simons, 206 F.3d at 398 n.8.

b

[5] Other courts have scrutinized searches of workplace computers in both the public and private context, and they have consistently held that an employer’s policy of routine monitoring is among the factors that may preclude an objec- tively reasonable expectation of privacy. See Biby v. Bd. of Regents, 419 F.3d 845, 850-51 (8th Cir. 2005) (holding that no reasonable expectation of privacy existed where a policy reserved the employer’s right to search an employee’s com- puter for a legitimate reason); United States v. Thorn, 375 F.3d 679, 683 (8th Cir. 2004), cert. granted and judgment vacated on other grounds by 543 U.S. 1112 (2005) (holding that a public agency’s computer-use policy, which prohibited accessing sexual images, expressly denied employees any per- sonal privacy rights in the use of the computer systems, and provided the employer the right to access any computer in order to audit its use, precluded any reasonable expectation of privacy); United States v. Angevine, 281 F.3d 1130, 1133-35 (10th Cir. 2002) (holding that the employer’s computer-use policy, which included monitoring and claimed a right of access to equipment, and the employer’s ownership of the computers defeated any reasonable expectation of privacy); Muick v. Glenayre Electronics, 280 F.3d 741, 743 (7th Cir. 2002) (“Glenayre had announced that it could inspect the lap- tops that it furnished for the use of its employees, and this destroyed any reasonable expectation of privacy . . . .”); Was- son v. Sonoma County Jr. Coll. Dist., 4 F. Supp. 2d 893,

9086 UNITED STATES v. ZIEGLER 905-06 (N.D. Cal. 1997) (holding that a policy giving the employer “the right to access all information stored on [the employer’s] computers” defeated an expectation of privacy).10

c

[6] To warrant Fourth Amendment protection, an expecta- tion of privacy must “be one that society is prepared to recog- nize as ‘reasonable.’ ” Katz, 389 U.S. at 361 (Harlan, J., concurring). Accordingly, we note that at least one court has examined the reasonableness of an expectation of privacy in a workplace computer from the standpoint of “community norms.” In TBG Ins. Services Corp. v. Superior Court, 117 Cal. Rptr. 2d 155, 96 Cal. App. 4th 443 (Cal. Ct. App. 2002), the California Court of Appeal stated:

We are concerned in this case with the “community norm” within 21st Century computer-dependent businesses. In 2001, the 700,000 member American Management Association (AMA) reported that more than three-quarters of this country’s major firms monitor, record, and review employee communica- tions and activities on the job, including their tele- phone calls, e-mails, Internet connections, and computer files. Companies that engage in these prac- tices do so for several reasons, including legal com- pliance (in regulated industries, such as telemarketing, to show compliance, and in other industries to satisfy “due diligence” requirements), legal liability (because employees unwittingly 10 We have no trouble distinguishing the cases in which a court has found a reasonable expectation of privacy in a workplace computer. In those cases, the employer failed to implement a policy limiting personal use of or the scope of privacy in the computers, or had no general practice of routinely conducting searches of the computers. See United States v. Slanina, 283 F.3d 670, 676-77 (5th Cir. 2002), vacated on other grounds by 537 U.S. 802 (2002), on appeal after remand 359 F.3d 356 (5th Cir. 2004) (per curiam); Leventhal v. Knapek, 266 F.3d 64, 74 (2d Cir. 2001)

UNITED STATES v. ZIEGLER 9087 exposed to offensive material on a colleague’s com- puter may sue the employer for allowing a hostile workplace environment), performance review, pro- ductivity measures, and security concerns (protection of trade secrets and other confidential information).

. . . . For these reasons, the use of computers in the employment context carries with it social norms that effectively diminish the employee’s reasonable expectation of privacy with regard to his use of his employer’s computers.

Id. at 161-62, 96 Cal. App. 4th at 451-52. The court, like the others cited above, held that workplace policies, including the employer’s entitlement to monitor usage on an “as needed” basis, defeated a claim to a reasonable expectation of privacy in the computer. Id. at 163-64, 96 Cal. App. 4th at 452-54.

d

Surely, some lament the general lack of privacy in the mod- ern workplace. See, e.g., Matthew W. Finkin, Employee Pri- vacy, American Values, and the Law, 72 CHI.-KENT L. REV. 221, 226 (1996) (“[T]o the extent the reasonableness of the legitimate expectation of privacy is determined on objective grounds, it would rest upon employer policies, practices, or assurances in the matter . . . . [T]his bids fair to eviscerate any claim to privacy at all.” (citation omitted)). But in applying the Fourth Amendment we take societal expectations as they are, not as they could or (some think) should be. See United States v. Silva, 247 F.3d 1051, 1055 (9th Cir. 2001) (noting that “[t]he reasonableness of an expectation of privacy is eval- uated . . . ‘[by reference] to understandings that are recog- nized and permitted by society’ ” (quoting Rakas v. Illinois, 439 U.S. 128, 143 n.12 (1978))).

[7] Thus, given the nature of our constitutional inquiry, we think the California court’s reasoning is compelling. Social

9088 UNITED STATES v. ZIEGLER norms suggest that employees are not entitled to privacy in the use of workplace computers, which belong to their employers and pose significant dangers in terms of dimin- ished productivity and even employer liability. Thus, in the ordinary case, a workplace computer simply “do[es] not pro- vide the setting for those intimate activities that the [Fourth] Amendment is intended to shelter from government interfer- ence or surveillance.” Oliver v. United States, 466 U.S. 170, 179 (1984); see also Muick, 280 F.3d at 743 (“[T]he abuse of access to workplace computers is so common (workers being prone to use them as media of gossip, titillation, and other entertainment and distraction) that reserving a right of inspec- tion is so far from being unreasonable that the failure to do so might well be thought irresponsible.”). Employer monitoring is largely an assumed practice, and thus we think a dissemi- nated computer-use policy is entirely sufficient to defeat any expectation that an employee might nonetheless harbor.

[8] In short, we see no reason to deviate from the reasoning of the cases cited above. The record evidence in this case establishes that the workplace computer was company-owned; Frontline’s computer policy included routine monitoring, a right of access by the employer, and a prohibition against pri- vate use by its employees.11 As such, Ziegler had no objec- tively reasonable expectation of privacy in his workplace computer and thus no standing to invoke Fourth Amendment protection. 11 We do not hold that company ownership of the computer is alone suf- ficient to defeat an expectation of privacy. “Fourth Amendment privacy interests do not . . . turn on property interests.” Schowengerdt, 823 F.2d at 1333 (citations omitted). As always, the issue depends on what expecta- tions may reasonably coexist with that ownership. At the least, we con- sider the combination of above-noted factors sufficient to defeat an expectation that would confer Fourth Amendment standing. At the same time, we do not hold that all the foregoing factors are necessary to defeat an expectation of privacy in a workplace computer.

UNITED STATES v. ZIEGLER 9089 III

[9] Because the copying of the hard drive on Ziegler’s workplace computer violated no reasonable expectation of privacy, we need not assess whether an agency relationship with the FBI existed here, or whether the search was other- wise reasonable.

AFFIRMED.