State v. McDonnell

• Court: Court of Appeals of Maryland
• Decided: July 7, 2023
• Docket: 36/22
• Status: Published

Opinion

State of Maryland v. Daniel Ashley McDonnell, No. 36, September Term, 2022

CONSTITUTIONAL LAW – FOURTH AMENDMENT – SEARCHES AND SEIZURES – REASONABLE EXPECTATION OF PRIVACY – CONSENT – FORENSIC COPY OF DIGITAL DATA – Supreme Court of Maryland held that defendant had reasonable expectation of privacy in data stored on his laptop’s hard drive, whether data was electronically stored on his hard drive or government’s copy of hard drive made with defendant’s consent. Defendant’s reasonable expectation of privacy was not eliminated by government’s copying of hard drive because no data was exposed prior to his withdrawal of consent. Supreme Court held that, under circumstances of defendant’s consent, reasonable person would not think that government could examine data on copy after withdrawal of consent when no examination occurred prior to withdrawal. Government’s examination of data after defendant withdrew consent was search, which was unreasonable because government lacked any authority to conduct search, by warrant or exception to warrant requirement. Circuit Court for Anne Arundel County Case No. C-02-CR-21-000487

Argued: June 2, 2023 IN THE SUPREME COURT

OF MARYLAND*

No. 36

September Term, 2022 ______________________________________

STATE OF MARYLAND

v.

DANIEL ASHLEY MCDONNELL ______________________________________

Fader, C.J. Watts Hotten Booth Biran Gould Eaves,

JJ. ______________________________________

Opinion by Watts, J. ______________________________________ Pursuant to the Maryland Uniform Electronic Legal Materials Act (§§ 10-1601 et seq. of the State Government Article) this document is authentic. Filed: July 7, 2023 2023-07-07 13:50-04:00

Gregory Hilton, Clerk

*At the November 8, 2022 general election, the voters of Maryland ratified a constitutional amendment changing the name of the Court of Appeals of Maryland to the Supreme Court of Maryland. The name change took effect on December 14, 2022. In this case, we must determine what protection, if any, the Fourth Amendment

provides to a person who voluntarily consents to the government seizing his laptop

computer, creating an exact copy of its hard drive, and searching the data on it, but who,

after the copy is made but before the government has examined the data, withdraws the

consent. We must decide whether, for Fourth Amendment purposes, the consensual

creation of a copy of the hard drive permanently eliminates the laptop owner’s privacy

interest in the data on the hard drive, i.e., what impact the owner’s withdrawal of consent

has on the government’s right to examine the data on the copy.

In this case, we conclude that Daniel Ashley McDonnell, Respondent, had a

reasonable expectation of privacy in the data contained on his hard drive, whether the data

was electronically stored on his laptop’s hard drive or the government’s computer via a

copy of the hard drive. We hold that, because the government did not examine the data

before he withdrew his consent, Mr. McDonnell did not lose his reasonable expectation of

privacy in the data, and the examination of the data was a search. As such, we conclude

that the government conducted an unreasonable search by examining the data without any

authority to do so, by a warrant or an exception to the warrant requirement. We, therefore,

affirm the judgment of the Appellate Court of Maryland1 reversing the Circuit Court for

Anne Arundel County’s decision that examination of the data was not a search in violation

of the Fourth Amendment.

1 At the November 8, 2022 general election, the voters of Maryland ratified a constitutional amendment changing the name of the Court of Special Appeals of Maryland to the Appellate Court of Maryland. The name change took effect on December 14, 2022. BACKGROUND

On June 1, 2019, agents of the United States Army Criminal Investigation

Command (“USACIDC”)2 visited Mr. McDonnell’s home for a “knock-and-talk” with

him. Lacking a warrant, the agents asked for Mr. McDonnell’s consent to search his home,

phone, and computers as part of an investigation into his possession and distribution of

child pornography. Mr. McDonnell declined. On July 12, 2019, however, Mr. McDonnell

met with the agents and signed a written consent form, permitting the agents to search his

home and seize electronic devices. With his signature on the consent form and initials next

to each paragraph of the document, Mr. McDonnell indicated his understanding of and

consent to the search of his home and the seizure and search of his electronic devices and

media as follows:

I have been informed of my right to refuse to consent to such a search. I hereby authorize the undersigned Special Agent, another Special Agent or other person designated by USACIDC, to conduct at any time a complete search of: . . . all digital media including cell[ ]phones, thum[b ]drive[s], hard disk drives, laptops & any other media relevant to this investigation.

***

I understand that any contraband or evidence found on these devices may be used against me in a court of law.

I relinquish any constitutional right to privacy in these electronic devices and any information stored on them. I authorize USACIDC to make and keep a copy of any information stored on these devices. I understand that any copy made by USACIDC will become the property of USACIDC and that I will

2 In 2021, USACIDC was renamed the United States Army Criminal Investigation Division, or “CID.” See U.S. Dep’t of the Army Crim. Investigation Div., Our History, https://www.cid.army.mil/The-Agency/Our-Mission/ [https://perma.cc/7TGL-EWX4]. Because the events at issue occurred before the name change, we will refer to the agency as “USACIDC,” as the parties do.

-2- have no privacy or possessory interest in the copy.

I give this written permission voluntarily. I have not been threatened, placed under duress, or promised anything in exchange for my consent. I have read this form or it has been read to me and I understand it. . . .

I understand that I may withdraw my consent at any time.

(Some capitalization omitted).

After Mr. McDonnell signed the consent form, the agents entered his home and

seized a number of electronics, including a Dell laptop computer. Shortly thereafter, at

their offices, the agents imaged,3 i.e., copied, the laptop’s hard drives,4 between July 12

and July 16, 2019. On July 19, 2019, counsel for Mr. McDonnell sent an email to

USACIDC withdrawing “any purported consent to the seizure of [Mr. McDonnell’s]

3 Imaging a computer’s hard drive is the first of a two-step process in most forensic computer examinations: acquiring the data and analyzing it. See Orin S. Kerr, Searches and Seizures in a Digital World, 119 Harv. L. Rev. 531, 547 (2005). Imaging a hard drive “duplicates every bit and byte on the target drive including all files, the slack space, Master File Table, and metadata in exactly the order they appear on the original.” Id. at 541 (footnote omitted). This creates a replica of the computer’s data at the time of imaging that cannot be edited, but can be searched and analyzed. See id. at 540. The identical nature of this mirror-image (also called a bitstream) copy and the original drive is verified by a mathematical function called hashing. See id. at 541. Imaging is necessary because of the length of time that a forensic analysis requires, and the ease with which data on a computer can be inadvertently changed or lost. See id. at 540-41; Stephen Moccia, Bits, Bytes, and Constitutional Rights: Navigating Digital Data and the Fourth Amendment, 46 Fordham Urb. L.J. 162, 184-85 (2019). 4 According to the Agent’s Investigation Report dated July 16, 2019, two hard drives from the Dell laptop were “imaged.” The agent who authored the report stated for each hard drive that “[t]he image was verified to be an exact, bit-for-bit-copy of the hard drive through a comparison of hash values with no errors.” The image copies of Mr. McDonnell’s hard drives were put onto a new hard drive and the new hard drive containing the copy of Mr. McDonnell’s hard drives was submitted to the agency’s evidence repository. In this opinion, we will refer to the hard drives imaged from Mr. McDonnell’s laptop as the “laptop’s hard drive” and the imaged copies as the “copy of the hard drive” or the “copy.”

-3- laptop, or examination of its contents” and requesting the laptop’s return. On September

3, 2019, a Special Agent of the USACIDC’s Digital Forensics and Research Branch

authored a report concerning the results of a forensic examination of the data on the copy

of Mr. McDonnell’s hard drive, which the agent had conducted between August 5 and 20,

2019. The report noted that the evidence examined was a hard disk drive containing the

forensic images of the Dell laptop’s operating system hard disk drive and storage hard disk

drive. The report stated that “no evidence of child pornography” was found but explained

that “[a]n examination of the media revealed evidence of child pornography search terms

in the internet browser history[.]”

Proceedings in the Circuit Court

On March 26, 2023, Mr. McDonnell was indicted in the circuit court on charges of

possessing, promoting, and distributing child pornography. Thereafter, Mr. McDonnell

filed an omnibus motion that included a request to suppress illegally seized evidence, and

later filed a memorandum in which he asked the circuit court to suppress the evidence from

the forensic examination of the copy of his laptop’s hard drive.

On August 16, 2021, the circuit court held a hearing on Mr. McDonnell’s motion to

suppress. The relevant facts relating to the motion were not disputed. The State argued

that “a valid consent to search carries with it the right to examine and photocopy” and that

downloading and creating the “mirror image copy” of the hard drive of Mr. McDonnell’s

laptop was “essentially photocopying digitally.” Continuing with that analogy, the State

asserted that federal case law instructs that, once the originals of documents are returned,

the government can lawfully retain photocopies and then examine them. Relying on our

-4- holding in Varriale v. State, 444 Md. 400, 119 A.3d 824 (2015), the State argued that, in

circumstances involving DNA, blood samples, or firearms, the government can analyze

samples even after consent has been withdrawn. The State contended that “once something

was outside of the possession of the defendant, [] there was no more reasonable

expectation” of privacy in the item.

Mr. McDonnell’s counsel asserted that the laptop was akin to the cell phone in Riley

v. California, 573 U.S. 373 (2014), and, therefore, the agents needed authority both to seize

it and then to examine its contents. Mr. McDonnell’s counsel contended that the language

of the consent form purported to waive his Fourth Amendment rights and permit copying

of the laptop, but did not permit the examination of the data on the copy. Mr. McDonnell’s

counsel argued that applying this Court’s holding in Varriale concerning the ability to test

DNA samples in a case that did not involve the withdrawal of consent would be contrary

to the holding of the Supreme Court of the United States in Riley. At the conclusion of the

hearing, the circuit court indicated that within one week’s time either party could submit

research on whether defense counsel is authorized to withdraw consent. On August 30,

2021, the circuit court issued a one-page order denying Mr. McDonnell’s motion to

suppress.

On September 24, 2021, the circuit court conducted a plea proceeding at which Mr.

McDonnell entered a plea of not guilty with an agreed statement of facts, reserving the

-5- right to appeal the circuit court’s denial of the motion to suppress.5 The prosecutor advised

the circuit court of agreed-upon facts, which we summarize as follows. Special Agents of

USACIDC had identified an IP address6 connected to a network that was sharing files

depicting child pornography. The agents contacted Comcast to determine the IP address.

The result of a subpoena revealed that the IP address that was associated with the uploaded

pornography came back as Comcast subscriber Daniel McDonnell at an address in Severn,

Maryland. Thereafter, on June 1, 2019, the agents conducted a knock-and-talk with Mr.

McDonnell and subsequently on July 12, 2019, Mr. McDonnell met with the agents and

signed the written consent form. The laptop computer was copied between July 12 and 16,

2019. On July 19, 2019, Mr. McDonnell’s counsel sent an email withdrawing consent to

search the laptop. Between August 5 and 20, 2019, the copy of Mr. McDonnell’s hard

drive was forensically analyzed. The forensic examination did not reveal images of child

pornography; however, it did reveal that Mr. McDonnell had run “digital forensic deleting

software” on June 7, 2019, a few days after the knock-and-talk. The examination also

5 In Maryland, a defendant can plead not guilty, forgo a full trial, and proceed “on an agreed statement of facts or stipulated evidence to preserve appeal on a suppression issue.” Bishop v. State, 417 Md. 1, 16, 7 A.3d 1074, 1083 (2010). “Under an agreed statement of facts[,] both the State and the defense agree as to the ultimate facts” and “the facts are not in dispute[.]” Taylor v. State, 388 Md. 385, 396, 879 A.2d 1074, 1081 (2005) (cleaned up). “The trier of fact is not called upon to determine the facts as the agreement is to the truth of the ultimate facts themselves. . . . To render judgment, the court simply applies the law to the facts agreed upon.” Id. at 396-97, 879 A.2d at 1081 (cleaned up). 6 “The term ‘IP address’ is derived from the phrase ‘Internet protocol[,]’ and means ‘the numeric address of a computer on the Internet[.]’” State v. Sample, 468 Md. 560, 572 n.6, 228 A.3d 171, 179 n.6 (2020) (citing IP Address, Merriam-Webster, https://www. merriam-webster.com/dictionary/IP%20address [https://perma.cc/2C7G-TX4Q]) (alterations in original).

-6- revealed that Mr. McDonnell had made recent searches with terms consistent with the

search for child pornography. The State introduced into evidence Exhibits 1 through 6,

which, among other things, included images that the parties agreed would in fact have

constituted child pornography, and were related to Counts I, II, and III of the indictment.

The circuit court found Mr. McDonnell guilty of three counts of distribution of child

pornography and sentenced him to ten years’ incarceration on each of the three counts,

consecutively, for a total of thirty years’ incarceration, all suspended, and five years of

supervised probation with the conditions that Mr. McDonnell register as a Tier II sex

offender, have no unsupervised contact with minors, and allow authorities to monitor his

computer and phone. Mr. McDonnell timely appealed.

Opinion of the Appellate Court of Maryland

On December 1, 2022, the Appellate Court of Maryland reversed the circuit court’s

judgment. See McDonnell v. State, 256 Md. App. 284, 297, 286 A.3d 113, 120 (2022).

Relying on Riley, 573 U.S. 373, the Appellate Court concluded that, “because individuals

have a legitimate expectation of privacy in the digital data within their computer,” Mr.

McDonnell’s “revocation of his consent to examine data from his laptop computer

precluded a forensic examination of the mirror-image copy of its hard drive without a

warrant.” McDonnell, 256 Md. App. at 296, 286 A.3d at 120. The Appellate Court did

not accept the State’s argument that Mr. McDonnell had no privacy interest in the copy of

the hard drive. See id. at 295-96, 286 A.3d at 119-20.

The Appellate Court distinguished Varriale, 444 Md. 400, 119 A.3d 824, and

Wallace v. State, 373 Md. 69, 816 A.2d 883 (2003), because, unlike the defendants in those

-7- cases, Mr. McDonnell unequivocally revoked his consent, which “expressly limited or

eliminated the examination of the data” and “reclaimed [his] reasonable expectation of

privacy in the data.” McDonnell, 256 Md. App. at 296, 286 A.3d at 120. The Appellate

Court held that, because Mr. McDonnell revoked his consent before the data on the copy

was examined, the government’s examination of the data was precluded without a warrant.

See id. at 296, 286 A.3d at 120. The Appellate Court relied on this Court’s discussion in

Richardson v. State, 481 Md. 423, 282 A.3d 98 (2022), regarding the “importance and

sensitivity of digital information” and the need for courts to be vigilant in enforcing the

requirements of the Fourth Amendment in the digital age, as support for its conclusion.

McDonnell, 256 Md. App. at 296, 286 A.3d at 120. The Appellate Court emphasized the

obligation of courts to not allow “subtler and more far-reaching means of invading privacy

[that] have become available to the Government . . . [to] erode Fourth Amendment

protections.” McDonnell, 256 Md. App. at 296, 286 A.3d at 120 (quoting Carpenter v.

United States, ___ U.S. ___, 138 S. Ct. 2206, 2223 (2018)) (internal quotation marks

omitted).

Petition for a Writ of Certiorari

On January 19, 2023, the State petitioned for a writ of certiorari, raising the

following two issues:

1. Did McDonnell lack any legitimate expectation of privacy in a mirror-image copy of his laptop hard drive that the government created with his consent, and as to which he expressly disclaimed any possessory or privacy interest before the copy was created?

2. Did the Appellate Court of Maryland err in holding that McDonnell’s revocation of consent to examine the contents of his laptop

-8- barred investigators from examining the mirror-image copy of his hard drive, when the post-withdrawal examination of the copy was not a search?

On March 2, 2023, we granted the petition. See State v. McDonnell, 483 Md. 263, 291

A.3d 776 (2023).

DISCUSSION7

A. The Parties’ Contentions

The State contends that USACIDC’s examination of the copy of the hard drive was

not a search because Mr. McDonnell had consented to his laptop’s seizure, search, and

copying. According to the State, by consenting to the copying of his laptop’s hard drive,

Mr. McDonnell “retain[ed] no reasonable expectation of privacy in any copies the

government create[d] within that consent.” The State asserts that the lack of case law

addressing “whether a defendant retains any reasonable expectation of privacy in copies of

digital data created within the scope of consent” merits reliance on case law regarding

photocopies of paper evidence for guidance. (Citation omitted). The State brings to our

attention opinions from federal appellate courts, such as United States v. Ponder, 444 F.2d

816, 820 (5th Cir. 1971), and United States v. Ward, 576 F.2d 243, 244-45 (9th Cir. 1978),

holding that a defendant’s consent to search also signifies consent to copy and that the

government can retain and examine copies of papers made before consent is withdrawn.

The State argues that courts in other jurisdictions have applied this approach and

determined that a defendant has no reasonable expectation of privacy in a copy of digital

7 We address the two questions raised in the petition for certiorari together because of the interrelation of the issues.

-9- data made while consent was in effect. The State cites unreported decisions of federal

District Courts that treated imaged copies of hard drives as photocopies of papers and

determined that copying prior to revocation of consent allowed the ongoing use of the

copies.8 The State argues that, in two cases, United States v. Lutcza, 76 M.J. 698, 703

(A.F. Ct. Crim. App. 2017), and United States v. Campbell, 76 M.J. 644, 658 (A.F. Ct.

Crim. App. 2017), the United States Air Force Court of Criminal Appeals has reached the

conclusion that a defendant consenting to the initial copying allows examination of the

copied hard drive after the defendant withdraws consent. The State also asserts that, in

United States v. Thomas, 818 F.3d 1230, 1242 (11th Cir. 2016), the Eleventh Circuit

affirmed the validity of consent to the copying of files from the defendant’s computer with

the use of a forensic tool and law enforcement’s reliance on the copy where the copy was

made before consent was withdrawn but the examination occurred afterward.

The State contends that, because a warrantless search under the consent exception

is legitimate only within the scope of the consent, we should assess the scope of Mr.

McDonnell’s consent based on an objective standard of what a reasonable person would

have understood the consent to include. According to the State, “[n]o reasonable person

would let the government search their digital information, then expect to retain a privacy

8 The State cites United States v. Megahed, No. 8:07-cr-342-T23-MAP, 2009 WL 722481 (M.D. Fla. Mar. 18, 2009) (unreported order); United States v. Thomas, No. 8:13- cr-462-T-33-TBM, 2014 U.S. Dist. LEXIS 33443 (M.D. Fla. Feb. 14, 2014) (unreported report and recommendation); United States v. Sharp, No. 1:14-cr-229-TCB, 2015 WL 4641537 (N.D. Ga. Aug. 4, 2015) (unreported order), contending that, under our precedent, although such citation “‘ordinarily is not appropriate,’” it is permissible in the face of a lack of authority on the issue. (Quoting Clancy v. King, 405 Md. 541, 558 n.17, 954 A.2d 1092, 1102 n.17 (2008)).

- 10 - interest in copies that the government made with their consent.” (Emphasis in original).

The State contends that, in this case, Mr. McDonnell lost any reasonable expectation of

privacy when he signed a form consenting to the seizure, search, and copying of his

laptop’s hard drive, and disclaiming his possessory and privacy interests in the copy.

The State asserts that this Court’s holding in Varriale, 444 Md. at 418-19, 423-24,

119 A.3d at 835, 838-39, supports its position because, in that case, we held that, by

consenting to the use of his DNA in a rape investigation and any future criminal

prosecution, without placing any constraints on its use, the defendant waived his

expectation of privacy in the DNA sample with regard to the State’s subsequent analysis

that linked him to an unrelated crime. For the State, because Mr. McDonnell similarly did

not limit his consent when he gave it, he lost any privacy interest he had in the data on his

laptop’s hard drive and the copy made while his consent remained in effect.

The State contends that the Appellate Court erred by concluding that Mr.

McDonnell’s withdrawal of consent after USACIDC copied his laptop’s hard drive

precluded subsequent examination of data on the copy. According to the State, Mr.

McDonnell’s withdrawal of consent after the copy was made did not change USACIDC’s

ability to examine the copy, as the copy was USACIDC’s property. The State asserts that

the language on the consent form indicating that Mr. McDonnell could withdraw his

consent at any time is not applicable, because, according to the form, once the copy was

made, Mr. McDonnell had no privacy interest in the data on the copy.

The State contends that the Appellate Court improperly applied the holding of the

Supreme Court of the United States in Riley, which the State distinguishes as being focused

- 11 - on the privacy interest implicated in a search of a cell phone’s data and not answering the

question of whether law enforcement’s examination of a copy of digital data constitutes a

search. The State asserts that Riley’s emphasis on a person’s privacy interest in the digital

contents of a cell phone does not support the proposition that a person “always retains

identical expectations of privacy in all copies of one’s digital data.”

The State acknowledges that there is another view, as expressed by law professor

Orin Kerr, that “[c]ourts should apply identical rules regardless of whether the data

analyzed is the original version or a government-generated copy.” (Quoting Orin S. Kerr,

Searches and Seizures in a Digital World, 119 Harv. L. Rev. 531, 563 (2005)). The State

acknowledges that the Supreme Court of Illinois determined that this was the appropriate

approach in People v. McCavitt, 185 N.E.3d 1192, 1207 (Ill. 2021), where the Court

observed that the defendant had an informal privacy interest in his personal data and that

this privacy interest extended to an image copy. According to the State, in McCavitt, after

a defendant had been acquitted in a criminal case, a law enforcement officer re-examined

a copy of the defendant’s computer that had been previously obtained pursuant to a search

warrant and new charges were brought against the defendant. The State distinguishes

McCavitt from this case, however, on the ground that, here, Mr. McDonnell consented to

USACIDC copying the hard drive and, according to the State, treating it as USACIDC’s

own property, thereby affirmatively relinquishing his privacy interest in it.

In sum, the State asserts that, pursuant to the consent form signed by Mr.

McDonnell, the copy of the hard drive was USACIDC’s property and, therefore, Mr.

McDonnell had no privacy interest in the data on it at any time. The State argues that the

- 12 - forensic analysis of the copy was therefore not a search. The State contends that, under a

reasonableness analysis, in signing the consent form, Mr. McDonnell disclaimed any

privacy interest in the data on the copy of the hard drive.

Mr. McDonnell responds that he “had a reasonable expectation of privacy in his

digitally-stored personal information[.]” (Cleaned up). Mr. McDonnell asserts that, under

Riley, 573 U.S. at 386, 393-94, a search of such information must be independently

justified apart from any legal seizure of the physical apparatus containing the information

or data, because searches of a cell phone or computer “bear ‘little resemblance’ to searches

of containers like bags, which are ‘limited by physical realities’” or boundaries. Mr.

McDonnell contends that the Supreme Court of the United States reinforced the distinction

between a privacy interest in digital information and its physical storage apparatus in

Carpenter, 138 S. Ct. at 2213, 2219-20, by holding that “an individual maintains a

legitimate expectation of privacy in the record of his physical movements as captured

through [cell site location information,]” collected and stored by a third party. According

to Mr. McDonnell, recognizing this distinction, the Supreme Court therefore concluded

that “the Government’s acquisition of the cell[]site records is a search and seizure within

the meaning of the Fourth Amendment.” (Cleaned up).

Mr. McDonnell contends that, in Richardson, 481 Md. at 472, 282 A.2d at 126, this

Court took the same approach by holding that an abandoned backpack could legitimately

be searched without a warrant, but a warrant authorizing a search of information on a cell

phone found therein did not satisfy the particularity requirement for search warrants. Mr.

McDonnell argues that our holding in Richardson “necessarily recognizes an independent

- 13 - expectation of privacy in information as distinguished from the digital media on which it

is stored[.]” Mr. McDonnell asserts that, because he had a reasonable expectation of

privacy in the information on his laptop, and because USACIDC did not examine the

information before he withdrew his consent, the examination of the data thereafter was a

search for which a warrant was required. Mr. McDonnell argues that the USACIDC

agents’ possession of the copy of his hard drive after he withdrew consent left them “in the

same position as the officers in Riley and Richardson, who had lawfully seized the cell[

]phones at issue but did not yet have authorization to search the information stored

thereon.”

Mr. McDonnell argues that forensic copies enjoy the same Fourth Amendment

protections as originals and asserts that Katz v. United States, 389 U.S. 347, 352-53 (1967),

and Walter v. United States, 447 U.S. 649, 652-54 (1980) (plurality opinion), stand for the

proposition that, to have a reasonable expectation of privacy in a searched item, an

individual need not have a possessory or property interest in the item. Mr. McDonnell

contends that the Supreme Court applied this concept to the electronic and digital realm in

United States v. Karo, 468 U.S. 705, 714-15 (1984), and Carpenter, 138 S. Ct. at 2219-20,

by recognizing the defendants’ privacy interests in their data or personal information

despite their lack of a “property interest in the devices and media used to collect their

personal information[.]” At bottom, Mr. McDonnell asserts, these cases instruct “that if an

individual has a reasonable expectation of privacy in his personal information,” the person

“retains that expectation regardless of where that information is stored[,]” i.e., the original

hard drive or the copy of the hard drive.

- 14 - For Mr. McDonnell, the act of copying, without accessing, the hard drive does not

remove his privacy interest in the data on the hard drive. Mr. McDonnell contends that, in

McCavitt, 185 N.E.3d at 1206, the Supreme Court of Illinois came to the same conclusion

where a hard drive was copied pursuant to a search warrant. Mr. McDonnell asserts that

this approach is consistent with the principle reflected in a number of cases, including

Richardson, that the justification needed for seizing an electronic device is distinct from

the justification needed to search its digital contents.

Mr. McDonnell contends that the State erroneously relies on opinions treating a

copy of a hard drive like a copy of a piece of paper, because “[t]he U.S. Supreme Court

has already rejected the false equivalency between physical documents and digital media.”

Mr. McDonnell asserts that, in Riley, 573 U.S. at 393, the Supreme Court dispositively

ruled out the idea that searches of a cell phone’s digital contents and physical containers

are “materially indistinguishable” because the breadth of information contained in a cell

phone merits “privacy concerns far beyond those implicated by the search of a cigarette

pack, a wallet, or a purse.” Mr. McDonnell points out that the Fourth Amendment’s

“touchstone” is reasonableness and argues that it is unreasonable “to categorically equate

digital media with paper documents” due to the difference in sophistication between the

two, particularly because “a forensic copy of a personal device gives insight into ‘many

distinct types of information’ that can ‘reveal much more in combination than any isolated

record[,]’ Riley, 573 U.S. at 394[,]” in a way that copies of paper documents do not.

Mr. McDonnell argues that, while his signing of the consent form made the seizure

of his laptop reasonable under the Fourth Amendment and any search of it reasonable while

- 15 - his consent was effective, by withdrawing his consent, he preserved a reasonable

expectation of privacy in his unexamined digital data. Mr. McDonnell contends that

consent can be withdrawn at any time and “does not extinguish the individual’s reasonable

expectation of privacy[.]” Mr. McDonnell argues that his revocation of consent nullified

the consent provided to USACIDC, including the disclaimer in the consent form of any

“privacy or possessory interest in the copy” of his laptop. Mr. McDonnell maintains that

accepting the State’s contention otherwise would allow consent to become permanent when

framed as a “disclaimer” and that this would contravene the principle that consent can be

withdrawn at any time. Mr. McDonnell points out that the consent form itself in this case

instructed that he could withdraw his consent “at any time.” In addition, Mr. McDonnell

contends that this Court’s holding in Varriale is not dispositive because it did not involve

a withdrawal of consent.

B. Standard of Review

“The validity of a suppression ruling is a mixed question of law and fact.”

Richardson, 481 Md. at 444, 282 A.3d at 110 (citation omitted). We consider only the

record from the suppression hearing, which we assess in the light most favorable to the

prevailing party, and we accept the trial court’s factual findings absent clear error. See id.

at 444-45, 282 A.3d at 110. However, when assessing the constitutionality of a search or

seizure, we conduct “an independent constitutional evaluation . . . applying the law to the

facts found in each particular case.” Id. at 445, 282 A.3d at 110 (cleaned up). We review

de novo any legal conclusions about the constitutionality of a search or seizure. See id. at

445, 282 A.3d at 110.

- 16 - C. Fourth Amendment Protections

The Fourth Amendment provides:

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

U.S. Const. amend. IV. The Fourth Amendment9 does not prohibit all searches and

seizures, just unreasonable ones. See United States v. Sharpe, 470 U.S. 675, 682 (1985).

“A search compromises the individual interest in privacy; a seizure deprives the individual

of dominion over his or her person or property.” Horton v. California, 496 U.S. 128, 133

(1990) (citation omitted). “The touchstone of the Fourth Amendment is reasonableness.”

Florida v. Jimeno, 500 U.S. 248, 250 (1991).

Two tests can determine whether government action constitutes a search that

implicates the Fourth Amendment. The first approach, set forth in Katz, 389 U.S. at 351,

focuses on “people, not places[.]” Under this test, “[w]hen an individual seeks to preserve

something as private, and his expectation of privacy is one that society is prepared to

recognize as reasonable, . . . official intrusion into that private sphere generally qualifies as

a search[.]” Carpenter, 138 S. Ct. at 2213 (cleaned up). The burden is on the defendant

asserting Fourth Amendment protection to “demonstrate that a government actor infringed

9 The Fourth Amendment is applicable to the States through the Fourteenth Amendment. See Varriale, 444 Md. at 411, 119 A.3d at 831. Additionally, we interpret Article 26 of the Maryland Declaration of Rights in pari materia with the Fourth Amendment, such that it provides the same protections. See King v. State, 434 Md. 472, 482, 76 A.3d 1035, 1041 (2013).

- 17 - upon his or her actual, subjective expectation of privacy in an item or place searched and

that the expectation of privacy is one that society is prepared to recognize as reasonable.”

In re Russell, 464 Md. 390, 406, 211 A.3d 426, 435 (2019) (cleaned up). The second prong

of this test requires that the defendant show an objectively reasonable expectation of

privacy, “either by reference to concepts of real or personal property law or to

understandings that are recognized and permitted by society[.]” Williamson v. State, 413

Md. 521, 535, 993 A.2d 626, 634 (2010) (cleaned up).

Next, because the amendment’s text “reflects its close connection to property,”

historically, “the Fourth Amendment was understood to embody a particular concern for

government trespass upon the areas (‘persons, houses, papers, and effects’) it enumerates.”

Jones, 565 U.S. at 405-06 (footnote omitted). This property-focused approach related to

“common-law trespass[.]” Carpenter, 138 S. Ct. at 2213 (cleaned up). Under this test,

government action that causes “physical intrusion” on “private property” constitutes a

search, such as attaching a GPS device to a person’s car. Jones, 565 U.S. at 404-05.

Generally, there is no bright-line rule for determining the reasonableness of a search.

See Ohio v. Robinette, 519 U.S. 33, 39 (1996). Instead, courts apply a totality of the

circumstances analysis, based on the unique facts and circumstances of each case. See

Missouri v. McNeely, 569 U.S. 141, 150 (2013). The nature of the intrusion, whether

severe or “negligible[,] is of central relevance to determining reasonableness[.]” Maryland

v. King, 569 U.S. 435, 446 (2013); see also Riley, 573 U.S. at 396 (quoting Judge Learned

Hand’s observation in United States v. Kirschenblatt, 16 F.2d 202, 203 (2d Cir. 1926),

“that it is ‘a totally different thing to search a man’s pockets and use against him what they

- 18 - contain, from ransacking his house for everything which may incriminate him’”);

Richardson, 481 Md. at 453, 282 A.3d at 115 (“Without understating the problem posed

by a general warrant to search someone’s home prior to the digital age, a general warrant

to search a computer or a smartphone today magnifies that problem exponentially.”).

Another consideration is whether any facts reduced or heightened the defendant’s

expectation of privacy. See King, 569 U.S. at 462 (discussing a person’s diminished

expectation of privacy as a student at school, an employee on the job, or a person in custody

of law enforcement). An additional factor is the governmental interest or need that

allegedly justifies the intrusion. See McNeely, 569 U.S. at 152 (concluding that a

warrantless blood-alcohol test is unreasonable when the facts show that “police officers

can reasonably obtain a warrant before a blood sample can be drawn without significantly

undermining the efficacy of the search”).

The contours of the privacy protected by the Fourth Amendment are “informed by

historical understandings” at the time of its adoption regarding what constituted

unreasonable searches or seizures. Carpenter, 138 S. Ct. at 2213-14. The “basic

guideposts” for such an analysis, as described by the Supreme Court of the United States,

include the amendment’s goals of guarding “the privacies of life against arbitrary power”

and “plac[ing] obstacles in the way of a too permeating police surveillance.” Id. at 2214

(cleaned up). The Supreme Court has “kept this attention to Founding-era understandings

in mind when applying the Fourth Amendment to innovations in surveillance tools.” Id.

“As technology has enhanced the Government’s capacity to encroach upon areas normally

guarded from inquisitive eyes,” courts should seek to preserve the “degree of privacy

- 19 - against government that existed when the Fourth Amendment was adopted.” Id. (quoting

Kyllo v. United States, 533 U.S. 27, 34 (2001)) (internal quotation marks omitted). The

Supreme Court has been particularly concerned with “th[e] power of technology to shrink

the realm of guaranteed privacy.” Kyllo, 533 U.S. at 34.

1. Consent

A search conducted without a warrant is presumed to be unreasonable, but a

warrantless search can still be reasonable, such as when “conducted pursuant to valid

consent[.]” Jones v. State, 407 Md. 33, 51, 962 A.2d 393, 403 (2008) (citations omitted).

The consent must be voluntary, see Robinette, 519 U.S. at 40, and the search must remain

within the scope of the consent, see Jimeno, 500 U.S. at 252. Courts examine the scope of

consent objectively: “what would the typical reasonable person have understood by the

exchange between the officer and the suspect?” Id. at 251 (citations omitted). “The scope

of a search is generally defined by its expressed object.” Id. (citing United States v. Ross,

456 U.S. 798 (1982)). One who gives consent for the search of a particular area or items

may subsequently narrow the scope of the consent given or withdraw consent entirely. See,

e.g., State v. Reum, 313 P.3d 1156, 1164 (Wash. 2013) (en banc) (“A person consenting

to a search has the right to restrict or revoke that consent at any time.” (Citations omitted)).

If consent is withdrawn, thereafter, the government must have other justification to make

the search reasonable. See, e.g., United States v. Williams, 898 F.3d 323, 330 (3d Cir.

2018). That is, if the person withdraws consent before “the search is completed, then the

police may not thereafter search in reliance upon the earlier consent.” United States v.

Lattimore, 87 F.3d 647, 651 (4th Cir. 1996) (en banc) (citations omitted). In the context

- 20 - of the taking, testing, and matching of a DNA sample, this Court has held that consent that

is neither limited beforehand nor withdrawn permits the government to use the sample

consistent with the reasonable understanding of the consent, including in unrelated

investigations. See Varriale, 444 Md. at 423-25, 119 A.3d at 838-39.

In Varriale, id. at 425, 119 A.3d at 839, this Court held that, under the circumstances

of the case, “the Fourth Amendment [did] not preclude the police from retaining and using

a suspect’s DNA profile created from a DNA sample lawfully obtained by consent.”

Varriale consented to provide samples for DNA testing in relation to an investigation into

a rape. See id. at 404-05, 119 A.3d at 827. After the testing ruled Varriale out as a suspect

in the rape, the police uploaded his DNA profile to county and State databanks and

compared it to “unidentified DNA profiles developed from crime scene evidence” in other

unsolved cases, leading to a match to a profile associated with a burglary. Id. at 406, 119

A.3d at 827-28. When Varriale was prosecuted for that crime, he challenged the use of his

DNA as an unauthorized search, but it was not suppressed. See id. at 403-04, 119 A.3d at

826.

This Court concluded that the database search was not beyond the scope of

Varriale’s consent, because there was no express limitation on his consent, and it was

objectively reasonable for the police to retain and compare his DNA profile against the

cold case evidence. See id. at 418-19, 119 A.3d at 835. We determined “that DNA profiles

are like fingerprints, which police routinely catalog and compare in the course of criminal

investigations” and, therefore, when police validly have such an identifying profile in their

possession, “[n]o further Fourth Amendment authorization is required” to indefinitely store

- 21 - and reuse them to “identify criminals.” Id. at 416, 119 A.3d at 833-34 (citations omitted).

In other words, this Court held that, once police lawfully obtain a person’s DNA sample

during an investigation, the person no longer has any expectation of privacy in that sample.

See id. at 423, 119 A.3d at 838.

2. Digital Information

The Supreme Court has recognized the important distinctions between digital media

and the physical targets of searches, observing that smartphones, for example, have

“immense storage capacity” and “collect[] in one place many distinct types of

information—an address, a note, a prescription, a bank statement, a video—that reveal

much more in combination than any isolated record.” Riley, 573 U.S. at 393-94. Searches

of computers, cell phones, and the like can reveal the “sum of an individual’s private life”

and bear “little resemblance” to searches of containers like bags, which are “limited by

physical realities.” Id. at 386, 393-94. Data stored on electronic devices is both

qualitatively and quantitatively different from physical analogues because a search of cell

phone or computer data “would typically expose to the government far more than the most

exhaustive search of a house[.]” See id. at 396 (emphasis in original). A device’s hard

drive “not only contains in digital form many sensitive records previously found in the

home; it also contains a broad array of private information never found in a home in any

form—unless the [device] is.” See id. at 396-97.

The remarkable ability of digital information in the modern age to permit “official

intrusion” into an individual’s “private sphere” requires “special solicitude” for this

information. Carpenter, 138 S. Ct. at 2213, 2219. The unique nature and scope of digital

- 22 - information warrants particular limits on the government’s ability to access it, such as

determining that cell site location information requires a warrant or other authorization

despite it being collected and held by third parties, whereas in other contexts “the

Government is typically free to obtain such information from the recipient without

triggering Fourth Amendment protections” because a person usually has no reasonable

expectation of privacy in information shared with third parties. Id. at 2216, 2223.

Riley, 573 U.S. at 378, required the Supreme Court to resolve “whether the police

may, without a warrant, search digital information on a cell phone seized from an

individual who has been arrested.” The Supreme Court noted the pervasiveness of cell

phones and the “vast quantities of personal information” they contain. Id. at 385-86. The

Court concluded that the rationales justifying searches incident to arrest—officer safety

and preventing evidence destruction—did not justify a search of digital data on an

arrestee’s cell phone. See id. at 386. Citing the quantity and quality of information stored

on cell phones, the Court determined that the warrantless examination of the digital

contents of a phone implicates greater privacy interests than a search of an arrestee. See

id. at 386. Thus, the Court held that “a warrant is generally required” before “a search” of

a cell phone’s digital contents, even if the cell phone was lawfully “seized incident to

arrest.” Id. at 401.

In Richardson, 481 Md. at 434, 282 A.3d at 104, this Court reiterated “[t]he privacy

concerns implicated by cell phone storage capacity and the pervasiveness of cell phones in

daily life” and pointed out that these concerns “do not fade away when police obtain

warrants to search cell phones.” The defendant’s abandonment of his backpack provided

- 23 - justification for the warrantless search of it, but this Court explained that the government

needed separate justification to search the contents of the cell phone found inside. See id.

at 435-36, 282 A.3d at 105. We held that the search warrant at issue failed to comply with

the particularity requirement of the Fourth Amendment because it lacked any limitations

on the authority to search the contents of the phone. See id. at 472, 282 A.3d at 126.

Because “[t]he particularity requirement is arguably of even greater importance in the

context of computers and smartphones than it is in the physical world,” we concluded that

it must be enforced to realize the “meaningful constraints” on government power required

under Riley. Richardson, 481 Md. at 452, 282 A.3d at 114-15 (cleaned up).

To date, relatively few courts have grappled with the effect of governmental copying

of a hard drive from a computer or cell phone on a person’s privacy interest in the

information stored therein. Some State high courts have rejected the argument that a

defendant does “not have a legitimate expectation of privacy in” a copy of a hard drive

from the defendant’s computer because the defendant “did not create, own, or have lawful

access to it.” McCavitt, 185 N.E.3d at 1206 (citation omitted); see also People v. Hughes,

958 N.W.2d 98, 115 (Mich. 2020) (holding that search and extraction of data from a cell

phone pursuant to a search warrant in a drug trafficking investigation did not permit law

enforcement officers to later search the data for evidence of unrelated crimes without a

warrant). In contrast, some trial and intermediate appellate courts in other jurisdictions

have concluded that a copy of a computer hard drive is analogous to a photocopy of a paper

document, which the government may freely examine so long as the copy was lawfully

obtained. See, e.g., United States v. Megahed, No. 8:07-cr-342-T23-MAP, 2009 WL

- 24 - 722481, *3 (M.D. Fla. Mar. 18, 2009) (unreported order). These courts have relied on

opinions like Ponder, 444 F.2d at 818-19, for the proposition that “a valid consent to search

. . . carries with it the right to examine and photocopy” and that withdrawal of consent does

not limit the government’s ability to examine copies made prior to that withdrawal. See

Megahed, 2009 WL 722481, at *3.

In McCavitt, 185 N.E.3d at 1198-99, the Illinois State Police seized the defendant’s

computer and created a copy of the hard drive under a warrant that the defendant did not

challenge. The warrant permitted law enforcement to search for digital evidence of two

unrelated crimes. See id. at 1196. The defendant was acquitted of one offense before the

second offense was investigated. See id. After the defendant’s acquittal, without seeking

a new warrant, a different police department, the Peoria Police Department, acquired a

copy of the hard drive, searched it, and uncovered evidence of child pornography, which

was not a crime mentioned in the warrant. See id. The defendant was charged and

convicted of possession of child pornography. See id.

The Supreme Court of Illinois concluded that the defendant’s privacy interest in his

computer’s contents extended to the copy of the hard drive made by law enforcement after

seizing the computer pursuant to the search warrant. See id. at 1206. The Court was

unconvinced by the government’s emphasis on the “defendant’s lack of a formal property

interest in the [copy] itself” because the government’s theory disregarded the “defendant’s

informal privacy interest in his personal data.” Id. The Court was persuaded by the

defendant’s argument that police examination of the copy was the same as an examination

of the original, because its “evidentiary value . . . resides in the data itself, not in the

- 25 - medium on which it is stored.” Id. According to the Court, the idea that the “defendant

lacked an expectation of privacy in the contents of his personal computer because those

contents were copied to another medium contravene[d] the requirement of

reasonableness[.]” Id. (citation omitted). In concluding that “[t]reating a digital copy as

the original recognizes that the key to fourth-amendment reasonableness is the access to

data, regardless of whether the data is copied, transferred, or otherwise manipulated[,]” the

Supreme Court of Illinois found insight in the opinion of a key legal scholar on the topic.

Id. (citing Kerr, Searches and Seizures, supra, 119 Harv. L. Rev. at 564). The Court

ultimately held, however, that the defendant’s appeal turned on his privacy interest in light

of the warrant and the reasonableness of the examination of the copy after his acquittal and

concluded that the examination was reasonable under the circumstances of the case. See

id. at 1214.

In his law review article, Professor Kerr wrote that “important differences exist

between the mechanisms of physical and digital evidence collection[,]” which create a

“thorny issue” with respect to the Fourth Amendment’s application to searches of

computers and other electronic devices. Kerr, Searches and Seizures, supra, 119 Harv. L.

Rev. at 532-33. Professor Kerr proposed that, for Fourth Amendment purposes, “a search

of data stored on a hard drive occurs when that data, or information about that data, is

exposed to human observation.” Id. at 548. Under this approach, every “observable

retrieval of information stored on a computer hard drive, no matter how minor, should be

considered a distinct Fourth Amendment search[,]” which requires authorization from a

warrant or an exception to the warrant requirement. Id. This emphasis on data, rather than

- 26 - the hard drive as physical property, led Professor Kerr to the conclusion that “the same

Fourth Amendment rules that apply to searching a suspect’s computer should also apply to

searching the government’s [] copy.” Id. According to Professor Kerr, treating the digital

original and the copy as the same is consistent with the circumstance that generating a copy

is normally a requisite step before searching the data stored in a hard drive, that “[a]ll

computer data is a copy[,]” and that “the key is access to the data.” Id. at 564.

On the other side of the ledger, in Megahed, 2009 WL 722481, *1, the United States

District Court for the Middle District of Florida declined to suppress the internet history

uncovered on a copy that the government had made of the hard drive of a computer seized

from the Megahed family residence. The defendant’s father had consented to the seizure

and search of the computer, but later the defendant and his parents withdrew the consent.

See id. at *1, *3. Although the Court held the suppression motion was untimely and moot,

it also addressed the merits and reasoned that the defendant had no “reasonable expectation

of privacy in the mirror image copy that the FBI had obtained already with [the defendant’s

father’s] consent and had begun already to search.” Id. In reaching this conclusion, the

Court relied on Ponder, 444 F.2d at 818, and Mason v. Pulliam, 557 F.2d 426, 429 (5th

Cir. 1977), cases in which the Fifth Circuit concluded that, when the government has

obtained consent to seize and search paper documents, it may photocopy them, and if the

defendant withdraws consent, the government may retain and continue to examine any

- 27 - copies made while the consent was operative. See Megahed, 2009 WL 722481, at *3.10

In United States v. Thomas, No. 8:13-cr-462-T-33-TBM, 2014 U.S. Dist. LEXIS

33443, at *1-2, *17 (M.D. Fla. Feb. 14, 2014) (unreported report and recommendation), a

case cited by the State, the defendant sought to suppress evidence gathered by law

enforcement from a computer that he shared with his wife, which officers accessed for a

brief period with his wife’s consent. Initially, the defendant also consented, but then

withdrew his consent. See id. at *17. During approximately 50 minutes of access, police

viewed (and photographed) websites that the defendant had allegedly visited on the

computer, which included images of “child erotica” and links that officers considered

“indicative of child pornography.” Id. at *3-4, *18 (footnote omitted). Law enforcement

also scanned the computer with a “forensic preview tool for searching live active files [that]

allows the user to scan the computer’s registry including internet history, and to scan for

images of child pornography or child erotica.” Id. at *10. Once the defendant withdrew

his consent, the police stopped the scan and later secured a warrant to further search the

computer based on examination of the results of the initial scan. See id. at *12-14. The

additional search pursuant to the warrant revealed images of child pornography, which the

defendant sought to suppress. See id. at *14-15.

The United States District Court for the Middle District of Florida did not suppress

the evidence, reasoning that “revocation of consent does not require the suppression of

10 Decisions of the Fifth Circuit prior to the creation of the Eleventh Circuit are binding precedent for the Eleventh Circuit’s courts. See Bonner v. City of Prichard, Ala., 661 F.2d 1206, 1209 (11th Cir. 1981) (en banc).

- 28 - evidence already lawfully obtained.” Id. at *18 (citing Megahed, 2009 WL 722481, at *3).

The Court agreed with the government’s position that “a valid consent to search carries

with it the right to examine and photocopy.” Id. at *20 (citing Ponder, 444 F.2d at 818).

Because “the initial search . . . was supported by valid consent,” the Court concluded that

the police were “free to copy the data obtained by use of the” forensic tool “for further

review without the necessity of obtaining a warrant to authorize such.” Id. at *19-20.

On appeal, the defendant contended that his wife “did not have the authority to

consent to a forensic search of the [] computer,” and that the lack of consent made the

search unlawful, as well as everything that flowed from it, including the warrant. See

Thomas, 818 F.3d at 1239 (emphasis in original). The Eleventh Circuit disagreed, holding

that the wife had the authority to consent and that, in getting the warrant, the police “relied

on information obtained before Thomas even objected and attempted to revoke” that

consent. Id. at 1241 (emphasis in original) (citation omitted). The Eleventh Circuit did

not address the District Court’s treatment of the forensic scan results as akin to a photocopy,

but concluded that the warrant was valid because “the only information” utilized “in

obtaining the search warrant was data collected prior to Thomas’s objection.” Id. at 1242.

D. Application of Above Principles to This Case

After careful examination of relevant authority, we hold that Mr. McDonnell had a

reasonable expectation of privacy in the digital data stored on his laptop, and, as such, in

the data stored on USACIDC’s copy of his laptop’s hard drive. Mr. McDonnell’s

reasonable expectation of privacy was not eliminated by the making of a copy of his hard

- 29 - drive because the data was not searched or exposed prior to his revocation of consent.11

Central to this holding is our conclusion that Mr. McDonnell’s privacy interest is in the

data on his hard drive, not just the particular computer or apparatus on which the data is

stored (his original or USACIDC’s copy). To accept the State’s stance—i.e., that Mr.

McDonnell irrevocably lost all privacy interest in the data on his hard drive when he

allowed USACIDC to copy it—would be to permit a limitless search through vast

quantities and a varied array of personal data that the Supreme Court of the United States

has characterized as consisting of more information than would be found in an exhaustive

search of a person’s home. See Riley, 573 U.S. at 396. Absent a warrant supported by

probable cause or an exception to the warrant requirement, the Fourth Amendment does

not permit such an unfettered governmental intrusion of a person’s “private sphere[.]”

Carpenter, 138 S. Ct. at 2213, 2221 (citation omitted).

Like the Supreme Court of Illinois, we focus on the data as the significant factor

here, not the fact that USACIDC lawfully made a replica of Mr. McDonnell’s hard drive.

See McCavitt, 185 N.E.3d at 1206. We agree that Mr. McDonnell has a privacy interest in

the data itself. “The evidentiary value of data resides in the data itself, not in the medium

on which it is stored.” Id. This conclusion flows logically from our explanation in

Richardson that the defendant’s abandonment of his cell phone made its seizure lawful, but

did not permit the government, without a particularized warrant, to search the data stored

on it. See Richardson, 481 Md. at 435-36, 282 A.3d at 105. So, too, here: Mr. McDonnell’s

Neither the voluntariness of Mr. McDonnell’s consent nor the validity of his 11

withdrawal of it is disputed.

- 30 - consent made the creation and retention of the copy of his hard drive lawful, but after

withdrawal of his consent, USACIDC needed additional authority to search the data on the

copy. For the duration of Mr. McDonnell’s consent, USACIDC had the authority to

examine the data; once the consent was withdrawn, the authority to examine went with it.

Likewise, Riley, 573 U.S. at 386, dictates that law enforcement’s justification for a search

of the data stored on an electronic device must be assessed independently from the

justification for seizure of the device. Therefore, copying the same data to a different

device that law enforcement officers have legal authority to possess makes no difference

in the Fourth Amendment analysis.12

Because making a copy of a hard drive is usually the first step in performing a

forensic analysis, if making a copy itself divested a person of a reasonable expectation of

privacy in the data, people would lose all expectation of privacy in the entirety of the data

on any device the moment the government made a copy of the device’s hard drive. That

would permit precisely the kind of unlimited rummaging through a person’s private domain

that the Fourth Amendment was designed to prohibit. See Riley, 573 U.S. at 386. The

legitimate subjective and objective reasonable expectation of privacy that people have in

their electronically stored data should not be so easily defeated. Focusing on the data in

12 The logistics of digital storage also support this conclusion because data saved on a computer is automatically copied multiple times in the course of using a computer. See Kerr, Searches and Seizures, supra, 119 Harv. L. Rev. at 562. In addition, digital information is often deliberately or automatically copied to remote servers to be stored “in the cloud.” Riley, 573 U.S. at 397 (“Cell phone users often may not know whether particular information is stored on the device or in the cloud, and it generally makes little difference.” (Citation omitted)). Yet, the owners of such data, regardless of where it is copied and stored, have a reasonable expectation of privacy in the information.

- 31 - question rather than on the possession of an apparatus containing a copy of the data

“recognizes that the key to fourth-amendment reasonableness is the access to data,

regardless of whether the data is copied, transferred, or otherwise manipulated.” McCavitt,

185 N.E.3d at 1206 (citing Kerr, Searches and Seizures, supra, 119 Harv. L. Rev. at 564).

Obviously, in this case, if any data had been revealed prior to the revocation of Mr.

McDonnell’s consent, that data would have lost any reasonable expectation of privacy that

was previously attached to it. That is because, as to that data, Mr. McDonnell’s privacy

interest would have been eliminated. And lawfully so, because USACIDC had the

authority, while Mr. McDonnell’s consent was in effect, to search and examine his data.

In such a scenario, the cat could not be put back into the bag.

As to data that was not exposed before the withdrawal of consent, however, Mr.

McDonnell retained an expectation of privacy. By way of analogy, if Mr. McDonnell had

stood on a street corner and offered passersby the opportunity to read his diary, but no one

took him up on it, his reasonable expectation of privacy would not be lost. The threat of

an invasion of privacy is not an invasion at all. See Karo, 468 U.S. at 712. In this way,

the creation of the copy was akin to the placement of the tracking device in Karo, id.,13

because with the making of the copy, USACIDC created only the “potential for an invasion

13 In Karo, 468 U.S. at 712, the Supreme Court held:

The mere transfer to Karo of a can containing an unmonitored beeper infringed no privacy interest. It conveyed no information that Karo wished to keep private, for it conveyed no information at all. To be sure, it created a potential for an invasion of privacy, but we have never held that potential, as opposed to actual, invasions of privacy constitute searches for purposes of the Fourth Amendment.

- 32 - of privacy” rather than an actual invasion of the subjective and objective expectation of

privacy in Mr. McDonnell’s data. It would be objectively reasonable to believe that data

could be exposed to law enforcement through an owner’s consent to copy a laptop’s hard

drive and could lose its private nature if examined—but, absent an enforceable waiver to

the contrary, if law enforcement had not already become privy to the data, upon withdrawal

of consent to access the data, the data remains private, i.e., the owner retains a reasonable

expectation of privacy in the data by withdrawal of consent.

1. The Consent Form

The quintessential test or criterion for determining the applicability of the Fourth

Amendment’s protection is one of “reasonableness.” Riley, 573 U.S. at 381 (cleaned up).

In the absence of a warrant, a search is reasonable only where it falls within an exception

to the warrant requirement. See id. at 382. It is well settled that “[a]n individual may waive

[] Fourth Amendment rights by giving voluntary and intelligent consent to a warrantless

search of his person, property, or premises.” United States v. Cormier, 220 F.3d 1103,

1112 (9th Cir. 2000) (cleaned up). In this case, we must assess the reasonableness of the

search of data on the copy of the hard drive in light of the content of the consent form.

The terms of the consent form guide our assessment of the reasonableness of the

search. Per the terms of the consent form, Mr. McDonnell authorized a Special Agent or

other person designated by USACIDC to conduct a complete search of all “digital media

including cell[ ]phones, thum[b ]drive[s], hard disk drives, laptops & any other media

relevant to this investigation.” (Capitalization omitted). According to the language of the

form, among other things, Mr. McDonnell relinquished his constitutional right to privacy

- 33 - in his electronic devices and all of the information stored on them, and “authorize[d]

USACIDC to make and keep a copy of any information stored on [his] devices.” The form

stated that Mr. McDonnell understood that any copy made by USACIDC would be the

property of USACIDC and that he would have no privacy or possessory interest in the

copy. Critically, a sentence at the bottom of the form stated without qualification: “I

understand that I may withdraw my consent at any time.”

Using the reasonableness approach discussed by the Supreme Court of the United

States in Riley and Carpenter, and used by this Court in Varriale for that matter, we

conclude that it was not reasonable for USACIDC to examine the data on the copy of Mr.

McDonnell’s hard drive after he withdrew his consent and that the examination was a

search. It would have been objectively reasonable for Mr. McDonnell, or anyone else, to

believe that the final sentence of the form advising of the ability to withdraw consent at

any time applied to all of the language in the form, i.e., that the withdrawal of consent

applied to all of the matters agreed or consented to earlier in the form. See Riley, 573 U.S.

at 386 (determining that it would be unreasonable to apply the search incident to arrest

exception to permit a warrantless search of a cell phone because the rationale for the

exception’s application to physical objects did not extend to the digital contents of a cell

phone); Carpenter, 138 S. Ct. at 2217-20 (determining that it would be unreasonable to

apply the third-party doctrine to permit a warrantless search of 127 days’ worth of cell site

location records because society does not expect law enforcement to secretly track an

individual’s every movement without a warrant); Varriale, 444 Md. at 418-19, 119 A.3d at

835 (determining that it was reasonable for the State to retain and compare a defendant’s

- 34 - DNA sample to samples from cold cases under the totality of the circumstances of the

consent to the taking of the sample). In this case, it would not be reasonable, under the

totality of the circumstances, to interpret the consent form to mean that the withdrawal of

consent applied only to certain language on the form and not to the entire document.

The State focuses on language on the form stating “I understand that any copy made

by USACIDC will become the property of USACIDC and that I will have no privacy or

possessory interest in the copy.” The State refers to this language as a disclaimer and

argues that the language could not be rendered ineffective by Mr. McDonnell’s withdrawal

of consent. We disagree. No language in the form states or even suggests that the

acknowledgement of having no privacy or possessory interest in any copy made by

USACIDC is irrevocable and not subject to withdrawal of consent at any time as provided

by the language at the bottom of the consent form. The language setting forth the alleged

disclaimer is contained in the fifth paragraph of the seven-paragraph form and is in no way

distinguished from the other language of the form. It is included in the same paragraph in

which Mr. McDonnell relinquished his right to privacy in his laptop itself, and, as the State

agrees, the withdrawal of consent precluded further examination of the laptop. The

paragraph is stylistically identical to every other paragraph in the document. In no way

does the purported disclaimer stand out. Neither its express terms nor its appearance would

suggest to a reasonable person that the last sentence of the fifth paragraph of a seven-

paragraph document should be treated differently than the other language of the form with

respect to the withdrawal of consent, as the State contends.

- 35 - The language in the consent form did not convey that Mr. McDonnell relinquished

for all time a privacy and possessory interest in the data on his laptop. Instead, the

language sought to establish that Mr. McDonnell had no privacy or possessory interest in

the copy of his data made by USACIDC based on the copy being property of USACIDC.

But that cannot be. The copying of the data, without the data being examined, did not

vitiate Mr. McDonnell’s privacy interest in the data itself. As explained, a person has an

independent privacy interest in the data on a laptop or hard drive, no matter where the data

may be stored. See McCavitt, 185 N.E.3d at 1206. Due to the personal content and far-

reaching consequences of allowing access to such data, the data on a laptop, like the digital

information on a cell phone, warrants its own discrete privacy interest. See Riley, 573 U.S.

at 386; Richardson, 481 Md. at 434, 452, 282 A.3d at 104, 115. Under the terms of the

consent form, Mr. McDonnell never agreed to permanently relinquish a privacy interest in

his data, and, as discussed above, the consent form, on its face, provided an unqualified

right to withdraw consent at any time. This necessarily included the right to withdraw

consent to a search of the data.14

14 On brief and at oral argument, counsel for Mr. McDonnell asserted that even if the disclaimer had been written to accomplish what the State claimed it did, Mr. McDonnell retained a constitutional right to withdraw consent. This contention has significant rational force, as a person has a constitutional right to not consent in the first instance, and, as Mr. McDonnell points out, at least one court in another jurisdiction has so held. See United States v. McWeeney, 454 F.3d 1030, 1035 (9th Cir. 2006) (concluding defendants “had a constitutional right to modify or withdraw their general consent at any[ ]time”). Nothing in this opinion should be construed to mean that clauses in consent forms purporting to irrevocably waive the right to consent are enforceable. However, because the language in the consent form did not purport to irrevocably waive Mr. McDonnell’s privacy or possessory interest in his data, we need not address the issue to resolve this case. See

- 36 - The State argues that Mr. “McDonnell’s reading would treat the disclaimer as

meaningless[,]” but the State’s treatment of the consent form’s language regarding the copy

would render a different portion of the document meaningless: Mr. McDonnell’s right to

withdraw consent “at any time.” Mr. McDonnell’s agreement that USACIDC could search

his hard drive at any time was limited by his right to withdraw consent at any time. Based

on the language of the consent form, it would not be reasonable to believe that, by

consenting to the government’s searching the laptop and making of a copy of its hard drive,

a person could not withdraw consent before the search occurred and prevent the

government from examining anything that had not yet been searched.15

When Mr. McDonnell revoked his consent to the search of the laptop, he retained a

reasonable expectation of privacy in any data that had not been exposed. Because

Robinson v. State, 404 Md. 208, 217, 946 A.2d 456, 461 (2008) (“[I]t is this Court’s established policy to decide a constitutional issue only when necessary.” (Citations omitted)). 15 As an alternate basis for affirming the Appellate Court’s decision, Mr. McDonnell argues that he “enjoys a protectable property interest in his digitally-stored personal information, which was not extinguished by his transient consent or the agents’ making of a forensic copy.” (Emphasis omitted). Mr. McDonnell contends that the reasonable expectation of privacy analysis from Katz did not displace “property-based conceptions of Fourth Amendment rights.” (Citations omitted). Due to our decision under the Katz reasonable expectation of privacy analysis, however, we need not reach the issue. In addition, in a reply brief, the State contends that Mr. McDonnell’s “property- based rationale” for the alleged Fourth Amendment violation is not properly before this Court because he did not raise the argument before the circuit court. We agree with the State that Mr. McDonnell raised only the reasonable expectation of privacy analysis before the circuit court. The record reflects that Mr. McDonnell did not raise the property-based theory of unlawful search before the circuit court, nor did that court address such an approach in denying the motion to suppress. Likewise, Mr. McDonnell failed to present the argument to the Appellate Court of Maryland, and that Court relied solely on the reasonable expectation of privacy analysis in its decision. See McDonnell, 256 Md. App. at 296, 286 A.3d at 120.

- 37 - USACIDC did not search or examine any of his data prior to the withdrawal of consent,

Mr. McDonnell continued to retain a privacy interest in the entirety of his data on his

laptop’s hard drive and the copy thereof. Lacking Mr. McDonnell’s consent, USACIDC

needed another justification for the examination of the data on the copy of the hard drive,

such as a warrant. But because USACIDC did not obtain a warrant or have any other

justification for the search, the search of the data on the copy of the hard drive was unlawful

and the evidence obtained as a result of the search should have been suppressed.

Government action in consent searches is restrained in two ways: by limits placed

on the scope of consent, see Varriale, 444 Md. at 412, 119 A.3d at 831, and withdrawal of

the consent, see Williams, 898 F.3d at 330. Here, Mr. McDonnell provided his consent for

USACIDC to seize, search, and copy his hard drive, limited by the scope of the

investigation. Anything uncovered in the course of that consent would have been lawfully

in USACIDC’s possession. But once he withdrew his consent, a right he always had and

which the consent form that he signed confirmed, USACIDC’s authority to search ended.

USACIDC could keep the copy, as Mr. McDonnell had consented to its creation; he could

not un-ring that bell.

However, because USACIDC had not examined the data on the copy of the hard

drive in any way while Mr. McDonnell’s consent was in effect, it could not claim the right

to search his data under the authority of his consent after his consent was withdrawn. This

case involves the undifferentiated copying of the entirety of a hard drive before the

examination of any data on it, which distinguishes it from those in which recipients

consensually share with government actors emails or text messages, or law enforcement

- 38 - gains access through other means to items with readily visible content. See United States

v. Barber, 184 F. Supp. 3d 1013, 1016 (D. Kan. 2016); State v. Carle, 337 P.3d 904, 910

(Or. Ct. App. 2014).16 In this case, the copying process exposed none of the data on the

laptop’s hard drive and the process did not differentiate between data that might have

implicated child pornography and data that did not. Prior to his withdrawal of consent,

USACIDC had not yet intruded upon Mr. McDonnell’s privacy interest in the data on the

copy of the hard drive; that bell was never rung, and upon the withdrawal of his consent,

Mr. McDonnell retained a reasonable expectation of privacy in the data.

2. Consent and Digital or Electronic Data

As with a warrant for a search of electronic data, respect for the limits of consent

“is arguably of even greater importance in the context of computers and smartphones than

it is in the physical world, given the[ir] ability . . . to store ‘millions of pages of text,

thousands of pictures, or hundreds of videos[.]’” Richardson, 481 Md. at 452, 282 A.3d at

115 (quoting Riley, 573 U.S. at 394).17 The difference between a photocopy of a paper

16 For similar reasons, the State’s argument that different iterations of data can have different reasonable expectations of privacy does not hold up when no data was examined or revealed before or during the copying of the laptop’s hard drive, unlike the viewing of a physical copy of a digital photo. Because different facts could support the loss of a reasonable expectation of privacy in data on a hard drive, there may, of course, be other circumstances under which a forensic copy of a hard drive may not maintain the same Fourth Amendment protections as an original. 17 As noted by amici, the American Civil Liberties Union and the ACLU of Maryland, electronic storage capacities have grown dramatically since Riley, as forecast by the Supreme Court. See Riley, 573 U.S. at 394. The maximum storage capacity of a cell phone todays is more than 15 times what it was when Riley was decided. Compare id. (describing the “top-selling smart[]phone” as having a storage capacity of “up to 64 gigabytes”); with Apple Inc., iPhone 14 Pro, https://www.apple.com/iphone-14-pro/specs

- 39 - document and a copy of a hard drive is obvious in this context, and therefore we do not

find that analogy persuasive, despite the decisions of courts in other jurisdictions cited by

the State. With paper documents, law enforcement officers may first search the documents,

i.e., review the data contained in them, and then seize only the relevant ones (and likely

copy them). However, the differences between papers and digital data, including the need

to maintain the integrity of the digital evidence, the vast quantity of digital data or

information involved, and the time necessary to conduct the search, require a different

approach for hard drives. First, the laptop or computer is seized and the hard drive copied,

and then, the search is conducted. So, whereas paper copies may have already been

examined “to determine whether they are, in fact, among those papers authorized to be

seized[,]” Andresen v. Maryland, 427 U.S. 463, 482 n.11 (1976), copying a hard drive does

not expose any information about its contents to the government.

To the extent that there are cases such as Ponder from other jurisdictions that permit

law enforcement officers after consent has been withdrawn to examine copies where papers

have been bulk copied or copied without having been reviewed, this Court has not

addressed the issue and adopted that approach. It may well be that if, or when, the issue is

before us, this Court will conclude that, as with digital data, where law enforcement officers

[https://perma.cc/KUW9-6AKG] (listing smartphones with available capacity of one terabyte). A terabyte is equivalent to 1,000 gigabytes, which can store more than 83.3 million pages of text. See Univ. of Alaska Anchorage, How many files can I store? (July 13, 2022), https://service.alaska.edu/TDClient/36/Portal/KB/ArticleDet?ID=95 [https:// perma.cc/4KE7-PVYA]. Contemporary laptops have even greater storage space. See, e.g., Apple Inc., Which Mac is right for you?, https://www.apple.com/mac [https://perma.cc/ B9BA-HE4J] (listing laptops with available capacity of 8 terabytes).

- 40 - have not reviewed or examined paper copies before a withdrawal of consent, the

examination of the copies would be precluded if consent is withdrawn.

But, even if, for argument’s sake, we were to apply the reasoning of cases like

Ponder and its progeny, and the information in a thousand-page paper document was not

entirely examined by the government prior to or in the course of photocopying the pages,

such a copy would not begin to approximate a copy of a hard drive, which allows “[t]he

sum of an individual’s private life [to] be reconstructed[.]” Riley, 573 U.S. at 394. A copy

of a paper document does not give access to the “many distinct types of information” found

in a copy of a hard drive, which can reveal much more than any isolated record. Id.18 A

copy of a hard drive, the search of which “would typically expose to the government far

more than the most exhaustive search of a house[,]” has as much in common with a

18 For comparison, in the cases cited by the State for the proposition that consent includes the right to copy and thereafter examine the copies, the paper documents that were copied while consent was operative were far less voluminous than the amount of digital data that may be contained on a copy of a hard drive. In Ponder, 444 F.2d at 818 n.3, documents that the government copied

consisted of a ‘Receipts Book’ which was photocopied, admitted in evidence, and its contents used against Ponder; and numerous deposit records shown on check stubs giving names of those who paid him and amounts of settlements on claims of clients, not introduced in evidence, but which were used as sources for leads.

Approximately “600 pieces of documentary evidence” were in evidence per the Fifth Circuit, which did not distinguish between those that were contested copies and those that were not. See id. at 818. In Ward, 576 F.2d at 244, the defendant consensually gave an agent of the Internal Revenue Service four boxes of records, which were not copied in their entirety until after he withdrew consent five days later. Despite the obvious privacy interest of the defendant in such financial documents, it cannot be said that accessing data on a hard drive would be an equivalent and, therefore, permissible level of intrusion into a person’s personal or private affairs.

- 41 - photocopy of paper documents as “a flight to the moon” has in common with “a ride on

horseback[.]” Riley, 573 U.S. at 393, 396 (emphasis in original).19

With respect to digital information or data on a hard drive, and perhaps even

photocopies for that matter, withdrawal of consent after copying but before analysis is like

interruption of a consented-to search of a home by withdrawal of consent—police would

have to promptly leave the home and seek a warrant, or other authorization, in order to

further search.20 The copying of Mr. McDonnell’s hard drive was a precursor to a search,

or perhaps a step in preparation, but it was not the search. An inexact comparison could

be made to police securing a house, with the owner’s consent, as precursor to a consent

search. If the person were to withdraw consent after the securing but before the search, the

search of the house would not occur and the owner would have lost a reasonable

expectation of privacy only to the extent of what the officers may have observed before the

consent was withdrawn. The advancement of technology that allows the digital equivalent

19 As such, we decline to adopt the reasoning of courts in other jurisdictions that a forensic copy of a hard drive is akin to a photocopy of a paper document that, if made while consent was effective, can still be examined after consent is withdrawn. See, e.g., Lutcza, 76 M.J. at 702; Campbell, 76 M.J. at 658; Megahed, 2009 WL 722481, at *3; Thomas, 2014 U.S. Dist. LEXIS 33443, at *20. 20 In some of the cases relied on by the State for the proposition that a copy of a hard drive is no different from a photocopy of a paper document, law enforcement officials had already begun to examine data on the hard drives in question prior to the revocation of consent. See Thomas, 2014 U.S. Dist. LEXIS 33443 at *4, *9-10, *18 (during approximately 50 minutes of consensual access to the defendant’s computer, police viewed and photographed websites on the computer that the defendant had allegedly visited and scanned the hard drive for images of child pornography or erotica); Lutcza, 76 M.J. at 702 n.2 (“We recognize that in Megahed, unlike the instant case, the investigators began the actual review of the copied data prior to the revocation of consent.”). This factual distinction further dilutes those opinions’ persuasive value here.

- 42 - of making a copy of a person’s home and all its contents, see Riley, 573 U.S. at 396, should

not permit invasion of a privacy interest that otherwise would be prohibited, see Kyllo, 533

U.S. at 34.

In this case, there is no indication in the record that law enforcement could not have

sought a warrant to search the copy, once consent was withdrawn. The copying of the hard

drive effectively preserved the evidence, just as police may secure a location while

obtaining a warrant. See Illinois v. McArthur, 531 U.S. 326, 332 (2001). In this case, the

fact that weeks passed between the completion of the copying and the start of the

examination of the data shows that time was not of the essence. This contributes to the

unreasonableness of the search after Mr. McDonnell withdrew his consent. See McNeely,

569 U.S. at 152 (“[W]here police officers can reasonably obtain a warrant before a blood

sample can be drawn without significantly undermining the efficacy of the search, the

Fourth Amendment mandates that they do so.” (Citation omitted)).

Additional support for our conclusion comes from the Supreme Court’s discussion

in Carpenter, 138 S. Ct. at 2219, differentiating between physical and digital information

in the context of another exception to the warrant requirement, the third-party doctrine. In

Carpenter, id. at 2216, the Supreme Court stated that it has held that “a person has no

legitimate expectation of privacy in information he voluntarily turns over to third parties.”

(Cleaned up). The Supreme Court explained, though, that given the unique nature of cell

phone location records, the fact that the information was held by a third party did not alone

overcome the user’s claim to Fourth Amendment protection. See id. at 2217.

Likewise, the “qualitatively different” nature of “detailed, encyclopedic, and

- 43 - effortlessly compiled” digital information merits a different analysis than that applied to

physical records. Id. at 2216-17. Similar to a person’s retention of a reasonable expectation

of privacy in the unique and unprecedented information held in cell site location records,

despite the data’s collection by cell phone companies, see id. at 2223, a person maintains

a reasonable expectation of privacy in the information stored on a hard drive even when

the government creates a copy. Just as the cell site location information’s creation “for

commercial” purposes did “not negate Carpenter’s anticipation of privacy in his physical

location[,]” id. at 2217, the creation of the copy, without more, did not negate Mr.

McDonnell’s expectation of privacy in the data in his hard drive. Like the detailed records

of a person’s movements in Carpenter, the data at issue here contains unique information

of unprecedented comprehensiveness and breadth, including information that was

previously unknowable, and deserves “special solicitude[.]” See id. at 2219.

The State’s argument that the copy of the hard drive is like abandoned property is

even less persuasive because a warrantless search of an electronic device lawfully within

the government’s custody is unreasonable, unless the government has authority to search

the data specifically. See Riley, 573 U.S. at 386; Richardson, 481 Md. at 435-36, 282 A.3d

at 105. Put simply, our case law and that of the Supreme Court of the United States leads

to the conclusion that Mr. McDonnell had a reasonable expectation of privacy in his data,

regardless of whether the data was stored on his laptop’s hard drive or a copy of the hard

drive, and, with the withdrawal of his consent, he maintained a reasonable expectation of

privacy in the data, as it had not yet been examined.

- 44 - 3. Varriale

Just as we decline the State’s invitation to treat copies of digital data as equivalent

to copies of paper documents, we do not see cases involving consented-to blood and DNA

sampling as controlling here. Although this Court has held that it may be objectively

reasonable for police to indefinitely retain a DNA profile created with consent and use it

in subsequent investigations, see Varriale, 444 Md. at 415-16, 119 A.3d at 833, the same

cannot be said of a copy of a person’s laptop hard drive. Moreover, this Court has not

determined that it is objectively reasonable for law enforcement to retain and use a

consented-to blood or DNA sample after consent has been withdrawn. Varriale did not

involve an attempt by the defendant to withdraw consent to the testing or use of a

previously consented-to sample. Rather, in Varriale, id. at 403, 119 A.3d at 826, the State

used a DNA profile obtained from the consented-to sample in a different investigation than

the one in which consent had been given for testing. This Court held that, given that there

was no express limitation on the consent, the use of the DNA profile did not exceed the

scope of consent and it was objectively reasonable for the police to retain and compare the

DNA profile against evidence in another case. See id. at 418-19, 119 A.3d at 835. We

likened the retention and use of the DNA profile to fingerprints, which law enforcement

agencies “routinely catalog and compare[.]” Id. at 416, 119 A.3d at 833 (citations omitted).

Unlike a DNA profile that is held exclusively for identification purposes, a copy of

a hard drive is not “like fingerprints,” and police do not “routinely catalog and compare”

copies of hard drives “in the course of criminal investigations.” Id. at 416, 119 A.3d at 833

(citations omitted). A copy of a person’s hard drive contains vast troves of personal data

- 45 - that go far beyond serving to identify the owner, which has been the focus of this Court

and others when assessing the use of DNA samples or similar evidence, like fingerprints.

See id. at 416, 119 A.3d at 834; see also King, 569 U.S. at 461.

To be sure, there is an appealing simplicity to treating the seizure and copying of a

hard drive within the framework of cases viewing “the collection and testing of blood” or

other bodily fluids as “a single event for [F]ourth [A]mendment purposes[.]” People v.

Woodard, 909 N.W.2d 299, 306 (Mich. Ct. App. 2017) (cleaned up). Both involve

invasion of “an individual’s most personal and deep-rooted expectations of privacy[,]”

McNeely, 569 U.S. at 148 (cleaned up), and the outcome of a blood sample test is just as

incomprehensible or unknown prior to testing as the data on a copy of a hard drive is prior

to searching.

But the similarity stops there. Government examination of a copy of a hard drive

would potentially violate far more of a person’s “private sphere” than the testing of a blood

sample. Carpenter, 138 S. Ct. at 2213 (citation omitted). As with a DNA sample held and

analyzed for the purpose of identification, a blood test could reveal only so much or a

limited sphere of information about a person’s “privacies of life.” Id. at 2214 (cleaned up).

Most commonly, a blood sample is used to identify a person, via DNA, or to detect the

presence of alcohol or other substances in a person’s system, although other important

information could also be revealed by certain tests if authorized, such as medical

- 46 - conditions.21 See Vernonia Sch. Dist. 47J v. Acton, 515 U.S. 646, 658 (1995) (concluding

that a “significant” factor in the reasonableness of compulsory drug testing of student

athletes was “that the tests at issue here look only for drugs, and not for whether the student

is, for example, epileptic, pregnant, or diabetic” (citation omitted)). That this Court held,

in Varriale, 444 Md. at 418-19, 119 A.3d at 835, that the use of the results of a consented-

to DNA sample for an identification match in an unrelated case was reasonable, where

there was no express limitation on the consent, does not by analogy make the examination

of data on a copy of a hard drive reasonable, after the owner withdraws consent.22

4. Public Policy and Consent Searches

Undeniably, there are significant governmental interests in conducting consent

searches generally and consent searches of computer hard drives containing digital

21 Although the examination of Mr. McDonnell’s data here sought only to locate images or data related to child pornography, this was not the kind of binary search that would give only a positive or negative result (e.g., an identification match or lack thereof, or the presence or absence of alcohol). Instead, law enforcement would need to examine and assess each piece of data to see if it did in fact constitute or relate to child pornography. In the process, such a search could reveal a significant amount of innocuous information that would invade Mr. McDonnell’s privacy in a way that a test for a DNA match or alcohol could not. 22 The better analogy, though still imperfect, is between a hard drive lawfully copied but unexamined and cases involving the government’s ability to examine the contents of packages lawfully obtained. The government’s lawful possession of a package of undeveloped film does not permit examination of the film without a warrant or warrant exception, see Walter, 447 U.S. at 651-52, 654 (plurality op.), whereas the government can freely examine the contents of a package that has already been inspected by Federal Express employees before the package was provided to the government, because the government would “learn nothing that had not previously been learned during the private search[,]” United States v. Jacobsen, 466 U.S. 109, 111, 120 (1984) (footnote omitted). The previously uninspected data on the copy of Mr. McDonnell’s hard drive is like an undeveloped roll of film, not a package’s already-examined contents.

- 47 - information in particular. Allowing officers to search based on a person’s consent

promotes the important social goal of cooperation between law enforcement and the public.

See United States v. Drayton, 536 U.S. 194, 207 (2002). Further, a consent search “may

result in considerably less inconvenience for the subject of the search” and may “be the

only means of obtaining important and reliable evidence.” Schneckloth v. Bustamonte,

412 U.S. 218, 227-28 (1973) (footnote omitted). But allowing the State to examine the

data on a copy of a person’s hard drive after a person has withdrawn consent would permit

severe intrusions into one of the single most comprehensive repositories of a person’s

private information.

On the other hand, requiring law enforcement officers to get a warrant in this

situation would increase the likelihood that people may consent to a search of a laptop or

computer, as a person would not fear that the copying of a hard drive as part of the search

would result in unfettered governmental access to their data in the future. Nor would the

requirement of a warrant to search data where consent is withdrawn after copying of a hard

drive necessarily cause inconvenience to law enforcement officers or impede

investigations. To the contrary, it would incentivize law enforcement to act more

expediently after obtaining consent to search the contents of a hard drive, i.e., such a

requirement would minimize delay.

E. Conclusion

The unique nature of digital information presents new challenges for the application

of the Fourth Amendment’s requirements concerning concepts such as the particularity of

warrants, reasonableness of searches, and withdrawal of consent. See Richardson, 481 Md.

- 48 - at 452-53, 282 A.3d at 115. Modern computers, cell phones, and other devices contain

vast and varied types of personal information yet lack the inherent physical boundaries of

other searchable items, such as backpacks or cars, thus requiring courts to find new ways

to address the potential intrusion into privacy interests by unauthorized searches. See

Riley, 573 U.S. at 393-97; Kerr, Searches and Seizures, supra, 119 Harv. L. Rev. at 556.

In this case, we hold that Mr. McDonnell had a reasonable expectation of privacy

in his digital data, regardless of whether the data was electronically stored on his laptop’s

hard drive or USACIDC’s copy of the hard drive, made with his consent. USACIDC’s

creation of a copy of the laptop’s hard drive with his consent, in order to search it, did not

annul Mr. McDonnell’s reasonable expectation of privacy in the data, given that the

examination of the data did not occur while the consent was effective. In light of Mr.

McDonnell’s withdrawal of consent, USACIDC’s examination of the data on the copy was

a search and was unreasonable in the absence of a warrant supported by probable cause or

an exception to the warrant requirement.

JUDGMENT OF THE APPELLATE COURT OF MARYLAND AFFIRMED. ANNE ARUNDEL COUNTY TO PAY COSTS.

- 49 -