TO VIEW OR NOT TO VIEW: Examining the

Plain View Doctrine and Digital Evidence

ROBERT MOOREt
Delta State University

ABSTRACT: The very nature of digital evidence, defined as evidence stored on

any form of magnetic media, makes the proper collection of such evidence an
important consideration during seizure. Historically, courts have attempted to ap-
ply jurisprudence developed for the physical world to cases involving the cyber
world. As a result, confusing guidelines have been created for those who handle
computer-related investigations. This article examined the issue of warrantless
searches and seizures of digital evidence justified under the plain view doctrine.
Through examination of the Fifth Circuit decision, United States v. Carey (1999),
and the Virginia district court decision, United States v. Gray (1999), it was deter-
mined that proper seizure of digital evidence under the plain view doctrine re-
quires: 1) access to the evidence be obtained legally, 2) the apparent illegal nature
of the evidence be immediately known, and 3) the officer cannot abandon their
original search.

INTRODUCTION
In the past, it was stated that computer crimes were infrequently
reported for two reasons. First, there was a perceived fear on the part of
businesses that reporting a computer crime could result in negative
publicity. Second, there was a belief that law enforcement agencies
were incapable of handling computer-related crime (Clark & Diliberto,
1996). Today, more computer-related crimes are being reported and it
appears that more criminal justice agencies are responding to the re-
ports (Hitchcock, 2002). However, as reporting and investigations have
changed, a new problem has developed - - reconciling the crime and the
law. The legality of many issues has yet to be decidedly addressed, with
the United States Supreme Court ruling on relatively few issues involv-
ing technology and criminal investigations (Biegel, 2003). As a result of
this lack of guidance, the lower courts have issued several differing and
oftentimes confusing opinions. These opinions have resulted in debates
concerning the proper course of action in investigations involving com-
puters and high technology devices.

t Direct all correspondence to: Robert Moore, Division of Social Sciences, Delta
State University, Cleveland, MS 38733. Email." [email protected].

AMERICAN JOURNAL OF CRIMINAL JUSTICE, Vol. 29 No. 1, 2004

9 2004 Southern Criminal Justice Association
58 PLAIN VIEW A N D D I G I T A L EVIDENCE

One of the more interesting legal debates involves the application

of the plain view doctrine to the search and seizure of digital evidence.
The plain view doctrine, like other warrantless search doctrines, was
developed for use in the physical world. Attempts to apply this physical
world doctrine to the digital realm have resulted in several problems.
One such problem is the development of what this author refers to as
the "Carey Rule," a doctrine of plain view seizure that addresses
searches of computers and was enumerated in the United States v. Carey
(1999) decision. According to the Carey Rule, an investigator who en-
counters contraband that is outside the scope of a search warrant may
only seize the first file that comes into plain view. Subsequent seizures
require a newly drafted search warrant. The problem with subscribing
to the Carey Rule is that the court decision upon which the doctrine is
based contains opinions that specifically argue the case has little to do
with the plain view doctrine.
In an attempt to better understand the plain view doctrine and how
the courts have begun applying this doctrine to digital evidence, a col-
lection of court decisions discussing plain view and digital evidence will
be examined. Specifically, these decisions will assist in determining
whether the Carey Rule is being misapplied to investigations and
seizures involving digital evidence. However, before addressing the is-
sue of plain view, it is necessary to gain an adequate understanding of
digital evidence. This understanding may be beneficial in understanding
the arguments both for and against the use of the plain view doctrine in
accordance with the Carey Rule.

THE NATURE OF DIGITAL EVIDENCE

Investigations of crimes involving computers require a new ap-
proach to collecting and examining evidence. The physical trail of evi-
dence normally encountered in criminal investigations is often replaced
or augmented with a cyber trail of evidence. Casey (2000) defines the
cyber trail as the trail of evidence that is stored on magnetic media like
that of hard drives, floppy drives, and other similar electronic storage
devices. With this definition in mind, it is possible that many computer-
related crimes may involve little or no physical evidence, as the major-
ity of evidence is digital in nature and falls under the definition of the
cyber trail.
When handling investigations that involve the presence of a cyber
trail, there are several considerations. One consideration is the ease in
which digital evidence can be hidden or destroyed. Within seconds of
activating a special file erasure and disk wipe program, evidence may be
destroyed. These programs can be activated through the pressing of a
 MOORE 59

button on a keyboard or the clicking of a button on a mouse (Wang,

2001). Newer disk wiping programs are capable of overwriting evidence
with multiple layers of useless data. An investigator who fails to prop-
erly collect digital evidence during a first encounter now faces a poten-
tial situation in which the evidence is either entirely destroyed or
damaged beyond use in a criminal prosecution. However, this should
not be construed as meaning that all deleted evidence is unrecoverable.
When a casual computer user deletes a file through the use of the com-
puter's operating system, it may be possible to recover evidence from
the file. Files deleted without specialized programs are not erased, but
are instead considered by the operating system to no longer be in use.
The files remain on the disk until such time as the space is needed to
save a new file. Use of the p r o p e r computer forensics software could
result in the recovery of the file, if the recovery takes place before a
new file is saved over the original (Britz, 2003; Mandia & Prosise, 2001).
Even when a new file is saved over the old file, there is the potential
that the new file will be smaller, thereby leaving a residual amount of
the original file stored on the disk. This residual space of data is re-
ferred to as slack space (Casey, 2000; Kruse & Heiser, 2002) and proper
computer forensics software can also retrieve evidence from this por-
tion of the disk.
A n o t h e r consideration, and one that is often discussed in plain
view cases involving digital evidence, is the ease in which the true na-
ture of a file can be hidden by merely modifying the file's extension.
This modification convinces the operating system that the file is of a
different format (Kruse & Heiser, 2002; Mandia & Prosise, 2001). An
example of this would be a picture file that is normally labeled with the
".jpeg" extension. By changing the extension to ".doc," the operating
system will recognize the file as a document file and will not appear to
be an image file. Investigators who are not using computer forensic
software that accounts for this form of data hiding or who are not famil-
iar with the technique of data hiding may mistakenly neglect to examine
all potential sources of evidence. It is the ease in which files may be
hidden in this manner that has led to the argument that all files should
be examined during a computer forensic examination.

SEARCHES AND SEIZURES OF DIGITAL EVIDENCE

The Fourth A m e n d m e n t of the United States Constitution pro-
vides for protection against unreasonable searches and seizures. In pro-
tecting citizens against unreasonable searches and seizures, the Fourth
A m e n d m e n t has two recognized clauses. The first clause requires a
valid search warrant to conduct a search (Johnson v. United States,
60 PLAIN VIEW A N D D I G I T A L EVIDENCE

1948) and the other allows for certain circumstances where a search is
acceptable without obtaining a valid warrant (Illinois v. Rodriguez,
1990). Since the drafting of the Fourth Amendment, the courts have
allowed very few exceptions to the search warrant requirement. Addi-
tionally, each exception requires justification that obtaining a search
warrant is either not applicable to the case at hand or could result in
loss or damage to evidence (Parkhurst v. Trapp, 1996).
The Supreme Court has yet to address many warrantless search
doctrines in regard to advances in technology, a fact that has forced
lower courts to, in some cases, "stretch" judicial decisions beyond their
original scope. It is for this reason that legal scholars have recom-
mended that searches involving a computer be conducted under a valid
search warrant (Kerr, 2001). However, the Court has begun examining
the use of technology to circumvent the Fourth Amendment. In the
case of Kyllo v. United States (2001), the Supreme Court examined the
use of thermal imaging devices to scan for narcotics operations. It was
the opinion of the Court that such devices could not be used without a
search warrant. More specifically, the court was concerned that the
technology applicable to the case at hand was not technology that was
generally used by the public. This case, while not dealing specifically
with computers, is indicative of the Court's opinion concerning techno-
logical advances and the need to preserve the protections of the Fourth
Amendment.
Lower courts, on the other hand, have considered several warrant-
less search doctrines in regard to the seizure of computers and digital
evidence. For example, the volatile nature of digital evidence has led to
the use of the exigent circumstances exception as justification for a
seizure of a personal data organizer (United States v. David, 1991) and
the use of the search incident to arrest doctrine has been used in seizing
computer disks (United States v. Tank, 2000). Generally, these excep-
tions have only been applied to the seizure of physical storage medi-
ums. However, at least one court has allowed for the warrantless
seizure of computer data under the exigent circumstances doctrine
(United States v. Gorshkov, 2001). Each of these exceptions, however,
has only addressed the seizure of the storage components or the seizure
of data. None of the cases have allowed for seizure of actual file con-
tents. In other words, the exceptions have only allowed for the seizure
of computer disks, personal data assistants, and data. Examination of
the internal components of these devices has required a properly
drafted search warrant. Digital evidence seized under the plain view
doctrine has differed from other warrantless search doctrines in that
evidence seized under this doctrine has generally involved intangible
data stored within files. Attempts to apply the plain view doctrine to
 MOORE 61

seizures of digital evidence have been complicated issues and beg the
question of when can the plain view doctrine be applied to seizures of
digital evidence? To facilitate the answering of this question, the follow-
ing section will address the evolution of the plain view doctrine up to
the time in which computer technology and digital evidence was
considered.

EVOLUTION OF THE PLAIN VIEW DOCTRINE

The Supreme Court addressed the presence of a plain view doc-
trine in three landmark decisions: Coolidge v. New Hampshire (1971),
Arizona v. Hicks (1987), and Horton v. California (1990). These deci-
sions established that evidence coming into an officer's view during the
course of a legal search may be considered sufficient to provide the
officer probable cause to seize such evidence. However, the Court has
limited the amount and type of evidence that officers can claim entered
into plain view. These decisions are important to the current discussion
because they are cited in almost every case involving attempts to justify
or discredit the application of the plain view doctrine to warrantless
seizures of digital evidence.
In Coolidge v. New Hampshire (1971), the issue was whether evi-
dence recovered from a vehicle was admissible absent a valid search
warrant. During a murder investigation, investigators seized a vehicle
from the property of the defendant. Evidence was collected from this
vehicle and used against Coolidge at trial. It was Coolidge's contention
that the evidence was illegally seized, but the government countered by
arguing that the search was valid because the vehicle was in plain view
during Coolidge's arrest. While the Court did not agree with the gov-
ernment's arguments in the case at hand, it was the belief of the Court
that there were occasional circumstances that would allow law enforce-
ment officers to conduct a warrantless search when evidence was dis-
covered in plain view. However, the Court warned that allowing
blanket use of the plain view argument would be unacceptable. The
Court reasoned that blanket use of the plain view doctrine would lead
to arguments that all evidence was in plain view, an argument that is
based upon the fact that at the moment of seizure all evidence is in view
of the seizing officer. To assist in restraining the application of the doc-
trine, the Court determined that arguments involving plain view seizure
were only applicable in certain circumstances.
First, for evidence to have been seized under the plain view doc-
trine, the evidence had to come into plain view during the course of a
lawful search. The Court did, however, make note that their require-
ment of a valid search did not require a valid search warrant. Evidence
62 PLAIN VIEW A N D DIGITAL EVIDENCE

that comes into plain view during the course of a warrantless search or
seizure is admissible under the plain view doctrine. Second, it was the
belief of the Court that along with requiring a valid reason for coming
into contact with the evidence, it was also necessary that the criminal
nature of the evidence be immediately apparent to the seizing officer.
The Court felt that failure to require this immediate level of under-
standing could lead to situations where law enforcement officers ap-
plied the plain view doctrine in an attempt to move from one item in
the ~open to another item in the open and so on until such time as in-
criminating evidence was discovered. Finally, the Court determined that
the discovery of the evidence must be inadvertent or unintentional. The
logic behind this requirement was that the application of a new search
warrant for evidence could potentially hurt an investigation. Further,
the Court felt that plain view alone would never be sufficient for argu-
ing a legal seizure. Therefore, in situations where officers maintained a
reasonable suspicion that evidence may be located at a certain location,
there remained a need for a search warrant to validate a search.
In 1987, the United States Supreme Court once again addressed
the requirements for successful application of the plain view doctrine.
In A r i z o n a v. H i c k s (1987), the Court was asked to determine whether
evidence was properly seized after an officer moved the evidence in an
attempt to verify that the items were, in fact, stolen. During an investi-
gation into a shooting, officers entered the apartment of the victim's
downstairs neighbor. One of the officers noticed a set of expensive
stereo equipment that appeared out of place in the apartment. After
moving the stereo slightly so that the serial number could be checked,
the officer discovered that the equipment was in fact stolen. A search
warrant was obtained and the stereo equipment was seized. The defen-
dant argued that the seizure was invalid on the basis that the informa-
tion for the warrant was obtained in violation of the Fourth
Amendment. The government countered, arguing that the officer was
in a place he was entitled to be in and therefore the serial numbers
came into plain view.
The government's argument revolved around the recording of the
serial numbers being neither a search nor a seizure. It was the officer's
contention that he merely examined information that was placed in
front of him during an investigation of another crime. While the Court
recognized that the recording of the serial numbers was neither a war-
rantless search nor seizure, the Court did determine that the recording
of the serial numbers was prohibited. It was the Court's opinion that
the officer had provided no evidence that the moving of the turntable
was required in the investigation for the crime in which the officers had
been granted access to the apartment. For this reason, the movement of
 MOORE 63

the stereo equipment was deemed an illegal search. Justice Powell, in

writing the minority opinion, attempted to argue that the distinction
between moving an item slightly and looking at the item was so trivial
as to not invoke the Fourth Amendment's protections. The majority,
however, disagreed and ruled that the search was unjustified regardless
of whether any physical evidence was discovered or whether the officer
merely discovered the bottoms of stereo equipment.
The third and final case, Horton v. California (1990), has perhaps
the most impact on the consideration of whether the Carey Rule is be-
ing properly applied. The defendant in this case was suspected of rob-
bery. On the basis of a warrant authorizing a search for stolen property,
an officer searched Horton's home. There was no stolen property dis-
covered during the search, but the officer did locate the weapon used in
the robbery laying out in plain view. Horton attempted to have the evi-
dence removed from consideration on the basis that the officer admit-
ted on the stand that while his search warrant was for stolen property,
he also expected to find the robbery weapon in the course of the search.
It was Horton's contention that the officer's testimony was sufficient to
prove that the evidence could not have been seized under the plain
view doctrine because the requirement of inadvertency was not met.
The government countered by arguing that the requirement of inadver-
tency was not binding because only four of the justices supported the
requirement.
The Supreme Court determined that while their decision in Coo-
lidge was binding, the requirement of inadvertency was not because
only four of the justices agreed with the requirement. Further, the inad-
vertency requirement was deemed to have not been essential to the
Court's decision in the Coolidge case. In re-examining the issue of plain
view seizures, the Court felt that perhaps only two requirements were
necessary to the successful use of the plain view doctrine. First, an of-
ricer must have arrived at the scene of the plain view seizure by a legal
mean that did not violate the Fourth Amendment, and second, the in-
criminating nature of the evidence must have been immediately
apparent.
It was the majority's opinion that "evenhanded law enforcement is
best achieved by the application of objective standards of conduct,
rather than standards that depend upon the subjective state of mind of
the officer" (Coolidge v. New Hampshire, 1971, p. 138). The Court felt
that an officer would not allow a search warrant to be drafted that did
not include a provision for the seizure of all suspected evidence. There-
fore, if an officer who is requesting a search warrant has a level of suspi-
cion that is perhaps less than the required probable cause, the Court
felt it would be counterproductive to remove the additional evidence
64 PLAIN VIEW A N D D I G I T A L EVIDENCE

that was obtained during the course of a lawful search. One considera-
tion here was the issue of diminishing privacy rights. The Supreme
Court felt that an individual's privacy interests diminished with the issu-
ance of the search warrant for the first suspected pieces of evidence.
These three landmark Supreme Court decisions developed the
framework for future court decisions concerning the application of
plain view to searches involving digital evidence. None of the decisions,
however, directly addressed this issue. In fact, the Supreme Court to
dat~e has not addressed the issue of plain view seizures when the poten-
tial evidence is digital in nature. There have, however, been several
cases from the lower courts that have directly addressed the issue of
plain view and digital evidence. It is to these cases that attention is now
focused.

PLAIN VIEW AND DIGITAL EVIDENCE

There are two situations in which the plain view doctrine has been
used to justify the warrantless seizure of digital evidence. The first in-
volves the discovery of digital evidence displayed on a computer screen
during an investigation for physical evidence. In this situation, an inves-
tigator may claim that a computer that was not listed on a search war-
rant was seized under the plain view doctrine after the monitor
displayed an image or file that was immediately recognizable as contra-
band or evidence of a crime. The courts, however, have limited seizures
that are justified under this approach, possibly because failure to do so
could result in a situation where all seizures of computers would at-
tempt to argue plain view as a justification. After all, by the very size of
a computer, the device may come into plain view during an investiga-
tion (Zitter, 1996). An investigator cannot seize a computer under the
plain view doctrine if during the course of a search for evidence of a
violent crime, an image of a woman close in appearance to the victim
should appear on the screen (United States v. Turner, 1999). However,
courts have recognized that text or images displayed on a computer
screen may be used as justification for a plain view seizure if the display
is immediately recognizable as evidence of contraband (City of Akron
v. Patrick, 1982; Oklahoma v. One Pioneer CD-ROM Changer, 1994).
Child pornography would perhaps be the best example for this scena-
rio. Consider an example where an officer is executing a search warrant
for evidence of a violent assault. Upon entering the residence, the of-
ricer notices child pornography displayed on the computer screen. The
officer uses the image of child pornography to develop probable cause
to seize the computer under the plain view doctrine.
 MOORE 65

The aforementioned application of plain view is still relatively simi-

lar to physical world cases involving plain view, but the second applica-
tion is quite different. Plain view has also been used to justify the
seizure of digital evidence from within computers, evidence that is in
the form of images, documents, or other files formats. This use of the
plain view doctrine is significantly more complex because the evidence
does not appear on the screen absent the investigator's opening the files
during an investigation. In fact, the very act of opening the files has
been questioned and compared to the officer's inappropriate actions in
the Hicks decision (Resseguie, 2000). The most widely regarded deci-
sion in the area of plain view and digital evidence is that of United
States v. Carey (1999), in which the court ruled that the use of the plain
view doctrine could only be used to justify the seizure of the first image
of child pornography that came into view by an investigator. Subse-
quent images must be obtained via a valid search warrant or some other
justifiable warrant exception that was not discussed in the decision.
During the course of Carey's arrest, an officer noticed drug para-
phernalia lying around his house. Officers then asked for consent to
search the apartment for evidence of narcotics. Carey provided consent
to the search, and as a result two computers were seized on the belief
that they would contain evidence of narcotics dealings. The computers
were taken back to the police station and investigators obtained a
search warrant for the contents of the hard drives. The search warrant
authorized a search for evidence of names, phone numbers, account
ledgers, addresses, and any other potential evidence dealing with the
distribution of narcotic substances.
The investigator began searching the computer for evidence of nar-
cotics and eventually encountered files with which he was unfamiliar.
By downloading these files to disks and then viewing them on a sepa-
rate computer, the investigator was able to determine that these files
were images. When he opened the first image, the investigator discov-
ered that the image files contained child pornography. The investigator
then downloaded over two hundred separate image files, viewing sev-
eral of the images as they were downloaded. Once all of the image files
had been downloaded, the investigator returned to his original search
for narcotics.
At trial, Carey attempted to have the evidence of child pornogra-
phy dismissed on the grounds that the search warrant did not allow for
their seizure. The government countered by arguing that the evidence
of child pornography came into plain view during the course of a lawful
search for evidence of narcotics. The court determined that the investi-
gator's opening of the files labeled as image files exceeded the search
warrant and therefore was unjustified, regardless of the plain view argu-
66 PLAIN VIEW AND DIGITAL EVIDENCE

ment. In fact, the court examined the issue of plain view, but declined
to rule on what constituted plain view in regard to digital evidence. Fur-
ther, it was the belief of the court that the files were closed and there-
fore could not have been in plain view.
In reaching their decision that the scope of the warrant was ex-
ceeded, the court relied heavily upon the testimony of the investigator
who discovered the child pornography. In reviewing the investigator's
testimony, the court felt that at no time had he been able to justify the
opening of files labeled with the image file extensions. At one point
during his testimony, the investigator made mention of the fact that in-
dividuals who dealt in narcotics were notorious for mislabeling files as a
means of hiding information. Unfortunately, the investigator also noted
that he had never encountered a situation where a file extension was
renamed as a means of hiding the information. It was the investigator's
testimony that when he opened the first image file he could have at best
expected to have discovered pictures related to narcotics.
The court referred to the decision of United States v. Maxwell
(1996) and determined that the case at hand could not allow for the use
of the plain view doctrine because the files that were seized were
reached by means of an illegal search. The court's referral to Maxwell
also contained reference to the fact that the files were opened and were
therefore not in plain view. Also, the plain view doctrine could not be
applied to the case at hand because it was the contents of the files that
were seized and not the files. Therefore, it was the court's belief that
the contents only came into view after the investigator illegally opened
the files. The problem with relying on the Maxwell decision is that the
evidence opened in that case was not authorized by a valid search war-
rant. Because of a mistake in the seizure of electronic mail records, a
screen name not covered by the warrant was provided to investigators
(United States v. Maxwell, 1996). Should evidence of a separate crime
have come into view while examining the records that were authorized
under the search warrant, then it is possible that the court would have
accepted the evidence despite having had to open the files to read the
contents.
Perhaps the most interesting aspect of the Carey decision was the
court's claim that only the first image of child pornography was justifia-
bly seized, as only the first image was inadvertently discovered. It was
the belief of the court that the officer certainly knew that subsequent
image files were child pornography and not related to narcotics. In ex-
plaining why subsequent images were not legally seized, one of the
judges remarked, "Given the officer's testimony that he inadvertently
discovered the first image during his search for documents relating to
drug activity, our holding is confined to the subsequent opening of nu-
 MOORE 67

merous files the officer knew, or at least expected, would contain

images of child pornography" (United States v. Carey, 1999, footnote 4,
p. 1273). What is interesting about this portion of the argument is that
the Supreme Court had long before removed the inadvertency require-
ment of the plain view doctrine (Horton v. California, 1990), leaving
only states with the option to maintain an inadvertency requirement
(Frasier v. State, 2003). In referring to the inadvertency of the discovery,
the court brought back arguments concerning an investigator's state of
mind during an investigation (Dowell, 2001). A much more appropriate
response would allow for seizures that are made during the course of
lawful investigations. Just such a procedure was used and accepted in
the decision of United States v. Gray (1999).
Pursuant to a search warrant for evidence of hacking into federal
computers, four of Gray's computers were seized. After making copies
of the contents of the hard drives onto specialized disks, an agent of the
Federal Bureau of Investigation's Computer Analysis Response Team
(CART) began the process of transferring the files to CD-ROM for
later review. Because CD-ROMs were only capable of holding 650
megabytes of data and the computer hard drives were significantly
larger, the CART agent began opening several directories in an attempt
to discover how many directories would fit on each CD-ROM.
The agent then began the process of transferring the data to a CD-
ROM. In accordance with standard operating procedures, the CART
agent examined the contents of the files as they were transferred to
CD-ROM. The agent was aware of the type of evidence being searched
for and therefore began this search as a means of assisting the agent
assigned to the case. The copying of the files averaged 45 minutes per
CD-ROM and provided sufficient time for the CART agent to investi-
gate about 80% of the contents of the hard drives.
During the course of this process, the CART agent discovered sev-
eral subdirectories that contained names like "Tiny Teen" and "Teen."
Upon viewing the contents of the "Tiny Teen" subdirectory, the CART
agent discovered several images of child pornography. After requesting
another agent confirm the images were child pornography, the CART
agent returned to the "Teen" subdirectory where he located additional
images of child pornography. Finding several images of child pornogra-
phy, the CART agent stopped and obtained an additional search war-
rant for evidence of child pornography. Gray argued that the original
evidence of child pornography was seized outside of the scope of the
original warrant and therefore the subsequent warrant leading to the
discovery of the child pornography was improperly issued. The court
disagreed, finding that the seizure of child pornography did not violate
68 PLAIN VIEW AND DIGITAL EVIDENCE

the Fourth Amendment as its seizure was justified under the plain view
doctrine.
The court accepted that searches outside the scope of a search war-
rant are subject to dismissal under the belief that they allow for rum-
maging through an individual's personal belongings. However, searches
that involve records provide for a deviation from this principle because
few criminals label evidence with easy to distinguish titles. It was the
court's contention that while care must be taken to protect an individ-
ual's p~ivacy, it is equally important that investigators examine all po-
tential sources of evidence. In considering the issue of computers, the
potential for hidden information is exponentially increased. According
to the court, investigators who handle crimes involving this form of evi-
dence would be remiss in their duties if they failed to examine every
potential source of evidence.
Finally, Gray attempted to argue that while a complete search was
necessary, the opening of image files beyond the first image exceeded
the scope of the search warrant and was prohibited by the Carey deci-
sion. The court disagreed, choosing to accept the CART agent's testi-
mony where it was determined that proper digital forensic procedure
was to open every file in storage. This opening of every file was deemed
necessary because of a need to locate all potential evidence. Even after
the initial discovery of child pornography, the CART agent testified
that he returned to other similarly marked folders only as a means of
continuing his search for evidence of hacking. While the court com-
mended the CART agent for halting his search and obtaining an addi-
tional search warrant for child pornography, it was also accepted that
had the agent not obtained an additional warrant then the evidence
would still have been admissible. The determining factor was that the
evidence would have been admissible as long as the agent did not aban-
don his original search for evidence of hacking. It was the belief of the
court that the investigator could certainly have expected to find more
child pornography, but as long as he did not abandon his search for
evidence justified under the search warrant, any additional child por-
nography would have been acceptable because it would have come into
plain view during the course of a lawful search.
If the two decisions are compared, it is possible to argue that had
the investigator involved in the Carey decision been better trained in
the area of computer forensics, then the case could have resulted in a
different decision. If the investigator had been more familiar with com-
puter forensics, which incidentally at this time was not as well-known or
studied as it is today, then the department's procedures concerning fo-
rensic examinations could have contained sections to deal with the
problems addressed in the Carey decision. Specifically, the issue of
 MOORE 69

whether a proper examination required opening all files could have

been better addressed. Recent arguments appear to support the open-
ing of all files on a computer during a search (Commonwealth v. Hinds,
2002; Janik, 2002). Further, the investigator would have been capable of
articulating the need for such an investigation, possibly impacting the
court's decision. Proof of this statement is found in Judge Blalock's
concurring opinion in the Carey decision. Blalock actually stated that
had the officer merely continued to search for evidence of narcotics,
then any additional evidence of child pornography would have most
likely been acceptable in court (United States v. Carey, 1999).

DISCUSSION
Several assistant attorney generals from various states have indi-
cated that training materials for prosecutors cover the issue of plain
view seizure by subscribing to the Carey Rule and only allowing for
seizure of the first item, regardless of the investigator's adherence to
the originally allowed search (Personal communication, June 30, 2003).
However, it would appear that court decisions generally have ruled
more in conjunction with the district court in Gray. These courts have
ruled that law enforcement officers who conduct thorough investiga-
tions involving digital evidence will be required to open all files on a
computer in order to verify that the files are in fact the form of evi-
dence being searched for under the search warrant and have not been
altered in an attempt to deceive law enforcement (State v. Fink, 2001;
United States v. Scott-Emuakpor, 2000).
A closely related argument concerns whether plain view should
even be applicable in digital seizures because the files must be opened
in order to see the evidence. In countering this argument, at least one
court has likened digital examinations to looking through a drawer and
discovering contraband on top of clothing (State v. Schroeder, 2000).
Intrinsic in this discussion is the issue of whether a hard drive is compa-
rable to a closed container. Courts have generally agreed that com-
puters are equivalent to closed containers and may contain a large
amount of personal information (United States v. Barth, 1998). These
decisions have also recognized that the massive storage capacity of
computers makes the devices far more complex than a mere container.
More specifically, the courts have recognized that the massive storage
capacity of computers and the various types of files that can be stored
on a computer allow for a greater potential for personal materials and
illegal materials to become intermingled (United States v. Walser, 2001).
However, the extent of privacy that should remain in computer files is
yet unresolved, as the Fifth Circuit has ruled that once a disk has at
70 PLAIN VIEW AND DIGITAL EVIDENCE

least one file examined then the remaining files are subject to examina-
tion as well (United States v. Slanina, 2002), while the Tenth Circuit, in
the Carey decision, has proposed a much more restrictive requirement
in regards to examinations of computer storage media.
In considering privacy rights in computers, it is perhaps helpful to
consider the following. An officer who discovers files labeled with child
pornography-related terms may not use the plain view doctrine to jus-
tify opening the files. However, should the files be opened in the course
of a qawful investigation, then the plain view doctrine may be used to
justify the warrantless seizure of the evidence. The key consideration in
countering this argument appears to relate to verifying that the officer
does in fact have a lawful right to open a file and that the appearance of
the file provides an officer with probable cause to conduct a warrantless
seizure.
The ruling in Carey also returned to a process of considering an
officer's intentions when determining whether a search or seizure was
justifiable under the plain view doctrine. There are several problems
with relying on this approach. First, the Supreme Court has removed
the inadvertency requirement from consideration of plain view, citing
the fact that inadvertency is characteristic of many searches, but not
required because doing so would potentially result in law enforcement
officers not collecting important evidence. Further, because the officers
are required to be in a place they have a lawful right to be, a suspect's
rights have already been diminished by the means in which the officer
arrived at the evidence (Horton v. California, 1990).
Second, the consideration of an investigator's subjective state of
mind is rather complicated and hard to verify. Because an investigator's
mindset could be difficult to prove, this could lead to scenarios where
law enforcement officers lie about their intent during a search. Of
course, lying about intent is possible regardless of the approach em-
ployed, but objective intent is easier to prove than subjective intent ab-
sent an officer indicating their subjective intent to another person who
is willing to testify at trial (Dowell, 2001). If an agency has a series of
standard operating procedures that addresses the need to conduct thor-
ough searches, then these standards could be used to support an investi-
gator's intent.

POLICY IMPLICATIONS
The Supreme Court has yet to directly address the issue of plain
view seizures when seizing digital evidence. However, if the lower
courts are to continue applying physical realm policies to technological
issues, then it would appear that the courts have opened the door for
 MOORE 71

government actors to possibly use doctrines such as that of plain view as

a justification for seizing computer files. On the basis of this reasoning,
a plain view seizure of digital evidence requires: 1) access to the source
of the evidence be obtained legally, 2) the apparent illegal nature of the
evidence be immediately known, and 3) the officer cannot abandon
their original search. An investigator who encounters contraband, such
as child pornography or narcotics-related records and has satisfied
these criteria, may use this information as a basis for developing proba-
ble cause to seize a computer file.
In satisfying the first criteria, there must be consideration of the
fact that advances in the storage capacity of computers have provided
an immense space for hiding evidence. To ensure that all evidence is
uncovered, it is often necessary for forensic examiners to search the
entire storage device, section by section. Agencies that engage in the
investigation of computer-related cases should account for this issue by
developing policies that address the adequate drafting of a search war-
rant for computers. Even if an agency does not maintain an on-staff
computer forensics technician, adhering to the following procedures
could assist the forensic examiner who will eventually examine the evi-
dence. A search warrant that involves a computer or other electronic
storage device should contain a section discussing the nature of elec-
tronic storage media. This discussion should include a section detailing
the need to examine the entire contents of the storage device and in-
clude an explanation for why such a detailed search is necessary. Agen-
cies should of course check with their local district attorney when
determining the exact extent of searching that should be authorized
under their warrants.
Satisfaction of the second criteria will be based upon the experi-
ence and training of the investigator. Prior experience and proper train-
ing will assist investigators in immediately recognizing computer files as
contraband or evidence of illegal activity. Satisfaction of the third crite-
ria requires objective procedures that corroborate an officer's actions.
Proper operating procedures, similar to those used in the Gray decision,
will better allow forensic investigators to reinforce that they are not
merely "fishing" throughout the storage device. These procedures
should also address the need to conduct a thorough analysis of elec-
tronic storage media. These procedures and proper training in forensic
examinations may provide better support for an officer's claim that ad-
ditional evidence was encountered during a justifiable search for other
forms of evidence.
72 PLAIN VIEW AND DIGITAL EVIDENCE

CONCLUSION
The plain view doctrine is an established exception to the search
warrant requirement of the Fourth Amendment. However, despite the
establishment of the doctrine in regards to physical realm seizures,
there are unsettled issues associated with applying this doctrine to the
digital realm. Conflicting lower court opinions have resulted in at least
two different approaches. The first involves use of the plain view doc-
trine to justify only the seizure of the first piece of contraband that
comes into plain view during a search of a computer. The second ap-
proach involves the possible seizure of multiple illegal items that come
into an officer's view, so long as the officer encounters such evidence
without abandoning their original justified search. Neither approach al-
lows for blanket seizures, with each only allowing for an officer to use
evidence discovered as one factor in determining whether a computer
file should be seized without an additional search warrant.
As computer-related crimes are resulting in more investigations in-
volving digital evidence, it is becoming increasingly important for agen-
cies to develop standard operating procedures that address the seizure
of additional evidence discovered during forensic examinations.
Whether an agency elects to subscribe to the Carey Rule or determines
that the Gray decision is more appropriate, officers and administrative
personnel should develop a working familiarity with such procedures.
Of course, the law in this area is still developing. Many states and fed-
eral courts have yet to fully address issues associated with the search
and seizure of digital evidence. States that have yet to address these
issues may determine that a more restrictive approach is necessary, and
federal courts are under no obligation to adhere to the principles es-
poused in the Gray decision, as Gray is a district court decision and
maintains less precedential weight than circuit court decisions. Put sim-
ply, while proper planning can mitigate potential problems, the current
state of law in this area means that an agency's best efforts could be
ruled insufficient in a case of first impression.

REFERENCES
Biegel, S. (2003). Beyond our control? Confronting the limits of our legal system in the age
of cyberspace. Cambridge, MA: MIT Press.
Britz, M. (2003). Computer forensics and cybercrime. Boston: Prentice Hall.
Casey, E. (2000). Digital evidence and computer crime: Forensic science, computers and
the internet. New York: Academic Press.
Clark, F., & Diliberto, K. (1996). Investigating computer crime. New York: CRC Press.
Dowell, J. (2001). Criminal procedure: Tenth circuit erroneously allows officers' inten-
tions to define reasonable searches. Oklahoma Law Review, 54, 665-684.
 MOORE 73

Hitchcock, J. (2002). Net crimes and misdemeanors. Medford, N J: Information Today, Inc.
Janik, A. (2002). Combating the illicit internet: Decisions by the tenth circuit to apply
harsher sentences and lessened search requirements to child pornographers using
computers. Denver University Law Review, 79, 379-409.
Kerr, O. (2001). Searching and seizing computers and obtaining electronic evidence in
criminal investigations. [On-line]. Available: www.cybercrime.gov/searchmanual.htm.
Kruse, W., & Heiser, J. (2002). Computer forensics: Incident response essentials. New
York: Addison-Wesley Publication.
Mandia, K., & Prosise, C. (2001). Incident response: Investigating computer crime. San
Francisco: McGraw-Hill Osborne Media.
Resseguie, D. (2000). Computer searches and seizures. Cleveland State Law Review, 48,
185-213.
Wang, W. (2001). Steal this computer book 2: What they won't tell you about the internet.
San Francisco: No Starch Press.
Zitter, J. (1996). Propriety of civil or criminal forfeiture of computer hardware or
software. American Law Reports, 5th Edition, 39 A.L.R.5th 87, 87-97.

CASES CITED
Arizona v. Hicks, 480 U.S. 321 (1987).
City o f A k r o n v. Patrick, 1982 WL 5049 (1982).
Commonwealth v. Hinds, 768 N.E.2d 1067 (2002).
Coolidge v. New Hampshire, 403 U.S. 443, 91 S.Ct. 2022, 29 L.Ed.2d 564 (1971).
Frasier v. State, 794 N.E.2d 449 (2003).
Horton v. California, 496 U.S. 128, 110 S.Ct. 2301, 110 L.Ed.2d 112 (1990).
Illinois v. Rodriguez, 497 U.S. 177, 110 S.Ct. 2793, 111 L.Ed.2d 148 (1990).
Johnson v. United States, 333 U.S. 10, 68 S.Ct. 367, 92 L.Ed. 436 (1948).
Kyllo v. United States, 533 U.S. 27, 121 S.Ct. 2038, 150 L.Ed.2d 94 (2001).
Oklahoma v. One Pioneer C D - R O M Changer, 891 P.2d 600 (1994).
Parkhurst v. Trapp, 77 F.3d 707 (1996).
State v. Fink, 2001 WL 660105 (2001).
State v. Schroeder, 613 N.W.2d 911 (2000).
United States v. Barth, 26 F. Supp. 2d 929 (1998).
United States v. Carey, 172 F.3d 1268 (1999).
United States v. David, 756 F. Supp. 1385 (1991).
United States v. Gorshkov, 2001 WL 1024026 (2001).
United States v. Gray, 78 F. Supp.2d 524 (1999).
United States v. Maxwell, 45 M.J. 406 (1996).
United States v. Scott-Emuakpor, 2000 WL 388443 (2000).
United States v. Slanina, 283 F.3d 670 (2002).
United States v. Tank, 200 F.3d 627 (2000).
United States v. Turner, 169 F.3d 84 (1999).
United States v. Walser, 275 F.3d 981 (2001).
United States v. Wong, 334 F.3d 831 (2003).