Why We’re Suing the FBI for Records About Best Buy Geek Squad Informants – EFF

Law Enforcement Should Not Be Able to Bypass the Fourth Amendment to Search Your Devices

Sending your computer to Best Buy for repairs shouldnt require you to surrender your Fourth Amendment rights. But thats apparently whats been happening when customers send their computers to a Geek Squad repair facility in Kentucky.

We think the FBIs use of Best Buy Geek Squad employees to search peoples computers without a warrant threatens to circumvent peoples constitutional rights. Thats why we filed a Freedom of Information Act (FOIA) lawsuit today against the FBI seeking records about the extent to which it directs and trains Best Buy employees to conduct warrantless searches of peoples devices. Read our complaint here [PDF].

EFF has long been concerned about law enforcement using private actors, such as Best Buy employees, to conduct warrantless searches that the Fourth Amendment plainly bars police from doing themselves. The key question is at what point does a private persons search turn into a government search that implicates the Fourth Amendment. As described below, the law on the question is far from clear and needs to catch up with our digital world.

A federal prosecution of a doctor in California revealed that the FBI has been working for several years to cultivate informants in Best Buys national repair facility in Brooks, Kentucky, including reportedly paying eight Geek Squad employees as informants.

According to court records in the prosecution of the doctor, Mark Rettenmaier, the scheme would work as follows: Customers with computer problems would take their devices to the Geek Squad for repair. Once Geek Squad employees had the devices, they would surreptitiously search the unallocated storage space on the devices for evidence of suspected child porn images and then report any hits to the FBI for criminal prosecution.

Court records show that some Geek Squad employees received $500 or $1,000 payments from the FBI.

At no point did the FBI get warrants based on probable cause before Geek Squad informants conducted these searches. Nor are these cases the result of Best Buy employees happening across potential illegal content on a device and alerting authorities.

Rather, the FBI was apparently directing Geek Squad workers to conduct fishing expeditions on peoples devices to find evidence of criminal activity. Prosecutors would later argue, as they did in Rettenmaiers case, that because private Geek Squad personnel conducted the searches, there was no Fourth Amendment violation.

The judge in Rettenmaiers case appeared to agree with prosecutors, ruling earlier this month that because the doctor consented both orally and in writing to the Geek Squads search of his device, their search did not amount to a Fourth Amendment violation. The court, however, threw out other evidence against Rettenmaier after ruling that FBI agents misstated key facts in the application for a warrant to search his home and smartphone.

We disagree with the courts ruling that Rettenmaier consented to a de-facto government search of his devices when he sought Best Buy's help to repair his computer. But the court's ruling demonstrates that law enforcement agents are potentially exploiting legal ambiguity about when private searches become government action that appears intentionally designed to try to avoid the Fourth Amendment.

The FBI's use of Geek Squad employees to do their dirty work of searching people's devices without warrants is in part possible because there is a legal distinction between searches conducted by purely private parties and searches by private parties done on behalf of government agents.

The Fourth Amendment protections for persons, houses, papers, and effects, against unreasonable searches and seizures, only protects against searches conducted by state actors or someone deputized to act on their behalf.

That means if a private actorlike your next door neighborbreaks into your home and finds evidence of a crime, theres nothing keeping the police from using your illegally gotten property or information against you. The neighbor may be liable for trespass, but it wouldn't amount to a Fourth Amendment violation. This is called the private search rule and it applies unless a court determines that the private actors are working for the government when conducting the illegal searches.

The federal appeals court covering California and other western states has ruled that determining whether a party is a state or private actor comes down to two elements: (1) whether government officials knew of and agreed to the intrusive search and (2) whether the party conducting the search intended to assist law enforcement or further her own ends.

Under this rubric, the FBI's Geek Squad informants should plainly qualify as agents of the government. The records disclosed thus far indicate that FBI agents paid Geek Squad informants to conduct these wide-ranging searches of customers' devices, suggesting that officials both knew about the searches and directed the informants to conduct them. The payments Geek Squad informants received also demonstrate that they conducted the searches with the intent to assist the FBI.

Because both factors are present in the FBI's use of Geek Squad informants, we think any court encountering facts similar to Rettenmaier's should rule that the Fourth Amendment applies to the searches conducted at Best Buy facilities. Because the Fourth Amendment generally requires the FBI to obtain warrants before searching devices, the warrantless searches by Geek Squad personnel were the result of an unconstitutional search and thus any evidence obtained as a result of the illegal searches should be thrown out of court.

However, even if the Geek Squad is found to be a state actor, the government may still argue that computer owners waived any reasonable expectation of privacy in their digital files when they consented to Best Buys terms for repairing their devices. The U.S. Supreme Court applies a reasonable person standard when a property owner is aware that they are consenting to a government search.

This proved to be the pivotal argument in Rettenmaier's case, as the government argued in its briefs that computer owners waived their Fourth Amendment rights by signing a written form stating that they are on notice that any product containing child pornography will be turned over to the authorities.

We disagree with the government's flawed argument. While the Best Buy service contract does put customers on notice that it will report child porn to the FBI if it finds it, we don't think it comes close to informing customers that Geek Squad employees are working for the FBI and will search their hard drives far beyond the scope of permission customers gave. As the Rettenmaier motions show, it appears that Best Buy staff searched unallocated storage space where the problems with the computer would not be found.

When a customer turns their devices over to Best Buy or any other repair shop, their consent to searches of their devices should be limited to where the problems with the computer are locate. Thus, customers cannot plausibly consent to expansive searches of their entire devices.

A real world analogy highlights the absurdity of the government's argument. When you go to the doctor for a sore throat, you dont expect the doctor to order an MRI of your entire body.

The FBI's exploitation of the private search doctrine by relying on Geek Squad informants to conduct searches of people's devices is incredibly problematic. As technology advances, the wealth of information that may be stored or accessed from our digital devices implicate profoundly more private spheres of our lives, from protected medical and financial information to personal information about our friends, family, and loves ones.

If courts continue to rule that the Geek Squad informants arenot state actors,thenthey are free to turn over any evidence they find to the government and law enforcement can then reconstruct the private partys search free of any Constitutional taint to then obtain a warrant for the evidence. This subverting of Constitutional protections is made possible by an outdated and problematic legal concept known as the Third Party Doctrine that bars Fourth Amendment protection when a user voluntarily shares information with a third party (here, the Geek Squad), thus defeating any reasonable expectation of privacy in the evidence. This legal theory has been applied to eviscerate individual privacy interests in such private information as bank records shared with your financial institution and cell site location information shared with your cell phone providers and produced to law enforcement without a warrant.

Currently, theres a circuit split on how this search reconstruction may take place. In the Fifth and Seventh Circuits, courts permit law enforcement to search the entire computer without a warrant based on the private partys search. In contrast, the Sixth and Eleventh Circuits restrict government searches only to the files searched by the private party. And in at least one district court in the Northern District of Indiana, the court decided that a private computer repairman had the authority to consent to a government search on behalf of the computer owner by virtue of his possession of the device.

We think that the FBI's use of Geek Squad informants is not an isolated event. Rather, it is a regular investigative tactic law enforcement employ to obtain digital evidence without first getting a warrant as the Fourth Amendment generally requires. EFF continues to look for opportunities to challenge this type of law enforcement behavior. If you have had your digital devices sent to the main Best Buy repair hub in Brooks, Kentucky for repair and it resulted in criminal proceedings against you, contact us at info@eff.org.

More:
Why We're Suing the FBI for Records About Best Buy Geek Squad Informants - EFF