In recent years a steady stream of authority from the Supreme Court of Canada has made clear that specific prior judicial authorization is required to search a personal computer. The most recent example is the decision of the Supreme Court of Canada in R v Vu, [2013] 3 SCR 657, 2013 SCC 60 (CanLII), which held that computers found while carrying out a search cannot be searched unless specifically authorized by a search warrant.

The Court in R v Vu seemed to leave the door open to the possibility that specific prior judicial authorization might not be required when electronic devices that are mere containers are discovered during a search—items such as USB keys, memory cards for cameras, and similar devices.

The Ontario Court of Appeal appears to have closed the door in R v Tuduce, 2014 ONCA 547 (CanLII).

The analysis in R v Vu

Much of the analysis in R v Vu focused on the difference between a computer and a “receptacle.”

A search warrant issued under s. 487 of the Criminal Code may authorize police officers to search “a building, receptacle or place” for the items named in the warrant, and to seize the items in evidence. A warrant that authorizes police to search a particular place—such as a house—also authorizes police to search places and receptacles within that house. However, the Supreme Court of Canada in R v Vu ruled that this general principle does not apply to computers. The Court held that ordinary receptacles such as cupboards and filing cabinets are markedly different from personal computers, and that specific prior authorization is required to search a computer.

The Court stated four reasons why computers are markedly different from other receptacles:

Computers store immense amounts of information. The scale and variety of the material that can be found on a computer makes comparison with traditional receptacles unrealistic.
Computers contain information that is automatically generated, often unbeknownst to the user. A computer is a “fastidious recordkeeper” that documents when and by whom a file was created and accessed; logs a user’s Internet browsing habits; and stores the user’s search histories. In the context of a criminal investigation this data can enable investigators to access intimate details about a user’s interests, habits, and identity, drawing on a record that the user created unwittingly. This kind of information has no analogue to other types of receptacles found in the physical world.
A computer retains files and data even after users think that they have destroyed them. It creates information without a user’s knowledge, and retains information that the user has tried to erase.
A search of a computer connected to the Internet or a network gives access to information and documents that are not in any meaningful sense at the location for which the search is authorized. [@ paras 41-44]

The Court concluded:

These numerous and striking differences between computers and traditional "receptacles" call for distinctive treatment under s. 8 of the Charter. The animating assumption of the traditional rule -- that if the search of a place is justified, so is the search of receptacles found within it -- simply cannot apply with respect to computer searches. [@ para 45]

The above analysis merits two comments. First, none of the four differences discussed in R v Vu is unique to a computer. A traditional receptacle like a filing cabinet, bookcase, or a banker’s box full of papers is also capable of storing a large volume of information. In any event, the volume of information could not have been determinative. It has never been the case that police searching a building would be entitled to search one or two filing cabinets, but would need a search warrant if they happened to find one hundred filing cabinets. A physical document like a log book, leger, or photo album can retain physical evidence (such as fingerprints and DNA) that could enable an expert to identify exactly what pages had been accessed, and by whom. Firing a gun generates new data unbeknownst to the user, such as firing pin marks, bullet striations, and ejector marks. It has always been true that the search of one place can reveal another building, receptacle, or place, including the exact address and the keys or combination needed to access it. However, a charitable reading of the Court’s analysis should not parse the differences in this manner. It is not any one of the differences on its own, but rather the totality of the differences and their magnitude in combination that justifies the different treatment of a computer.

Second, it was not obvious how the analysis in R v Vu would apply to an electronic device that functions exclusively as a storage container. A floppy disk, USB key, or flash memory card does not have its own operating system, does not generate data, and unless it is connected to a computer it cannot connect to a network or the Internet. Most of the differences in R v Vu did not appear to apply to an electronic device that is more like a container than a computer. Thus, R v Vu appeared to leave the door open to the possibility that specific prior judicial authorization might not be required when electronic devices that are mere containers are discovered during a search.

The decision in R v Tuduce

In R v Tuduce, 2014 ONCA 547 (CanLII), the Ontario Court of Appeal considered the warrantless search of a USB key that was seized incidental to an arrest.

In 2012 Adrian Tuduce was convicted of seven credit card fraud-related offences and sentenced to two years less a day’s imprisonment and two years of probation. His participation in the fraud was discovered by accident. A Waterloo Regional Police officer pulled Mr. Tuduce over for speeding. The officer searched Mr. Tuduce on police databases and discovered he was a suspended driver. The officer arrested Mr. Tuduce and conducted a pat-down search, locating USB key and bundle of credits cards in someone else’s name. The officer found other items in the vehicle that caused him to believe Mr. Tuduce was in possession of stolen credit cards. Fraud investigators seized the USB key incidental to arrest and submitted it for forensic analysis. The USB key contained stolen credit card data and photographs of credit card data skimming equipment.

The trial judge held that the warrantless search of the USB key infringed Mr. Tuduce’s s. 8 Charter rights, but admitted the evidence under s. 24(2): 2011 ONSC 2749 (CanLII).

On appeal, Mr. Tuduce challenged the trial judge’s decision to admit the USB key evidence under s. 24(2). The appeal was dismissed: 2014 ONCA 547 (CanLII).

The Court noted that the Supreme Court of Canada in R v Vu reviewed the privacy considerations that apply to searches of personal computers and held that they apply to USB keys, for three reasons:

A USB key can store a significant amount of data.
Data can be left on a USB key without a user’s knowledge, including information about the date and time a file was created or modified, and information about the user who created or modified the file.
A user does not have complete control over which files an investigator will be able to find on a USB key because—like a computer hard drive—the unallocated space in USB key may contain files that could be retrieved by a forensic expert. [@ paras 71-73]

The Court commented that a USB key may not contain personal information such as a list of contacts, the contents of past communications, and information a user’s web searching habit. This makes a USB key different from a home computer or cell phone. On the other hand, a USB key will attract a greater expectation of privacy than a work computer. This is because the two factors that diminish the expectation of privacy in a work computer—that the computer is not actually owned by the user, and the employee’s use of the computer is often subject to terms and conditions imposed by the employer—do not apply to personal storage devices like a USB key. [@ paras 74-75]

Strictly speaking, the Court of Appeal did not rule that specific, prior judicial authorization is required to search a USB key. That is because the trial judge’s ruling on the lawfulness of the search was favourable to Mr. Tuduce and therefore not a ground of appeal.

However, the broader implication of the decision cannot be ignored. The Supreme Court of Canada in R v Vu concluded that certain factors make a computer markedly different from other things that can be searched; and that specific, prior judicial authorization is therefore required to search a computer. The Ontario Court of Appeal in R v Tuduce held that the factors cited in R v Vu also apply to a USB key. This analysis leaves little doubt about how it would have ruled, had the s. 8 issue been properly before it.

The decision of the Ontario Court of Appeal in R v Tuduce is the strongest possible signal that absent exigent circumstances, police will require specific, prior judicial authorization before searching a USB key.

MGM

The views expressed in this post are those of the author, and do not necessarily represent the views or policy of the Ministry of the Attorney General.