State v. Steven W. Bowers, 2023 WI App 4; case activity (including briefs)
In this important decision addressing a novel Fourth Amendment issue, the court of appeals holds that Bowers had a reasonable expectation of privacy in the contents of his Dropbox account, despite the fact he (1) used his work email address to create the account and (2) uploaded case files and shared them without permission. (Opinion, ¶43). The court further holds that although investigators had probable cause to search the account for evidence of Bowers’ alleged crime, no exigent circumstances justified the warrantless search. (¶3).
The backstory here begins in 2017 when the Taylor County Sheriff’s Department was working with the television program “Cold Justice” on a homicide cold case. Apparently, the show works with local law enforcement to solve cold cases and then turns its work into true crime TV. The state discovered that Bowers, a Taylor County Detective, shared two additional homicide files without the department’s permission. When confronted, Bowers admitted to sharing the files without permission. Two days after Bowers’ admission, the county’s IT Director asked Dropbox for access to Bowers account, but Dropbox was “uncooperative” and refused to “turn over any documents from anyone’s account.” (¶6).
Undeterred, the IT Director “performed a password reset” on Bowers’ Dropbox account and accessed Bowers’ county email account to change Bowers’ Dropbox password. The subsequent search of Bowers’ Dropbox account revealed that one of the two unauthorized homicide case files had been uploaded to the Dropbox account and shared with individuals outside of law enforcement. (¶7).
Bowers moved to suppress the evidence found in his Dropbox account. The circuit court ultimately granted the motion after concluding that Bowers had a reasonable expectation of privacy in his Dropbox account and that the search was not justified by exigent circumstances. The state appealed, and the court of appeals affirms.
First, the court of appeals rejects the state’s claim that Bowers didn’t have a reasonable expectation of privacy in the contents of his Dropbox account. (¶45). A Fourth Amendment search occurs when a person has a reasonable expectation of privacy in the place search, which is determined by using factors set forth in State v. Dumstrey, 2016 WI 3, 366 Wis. 2d 64, 873 N.W.2d 502. (¶19).
The state agreed the first two factors–whether Bowers had a property interest in the Dropbox account and whether he used it lawfully — “cut in Bowers’ favor” — because he independently set it up and paid for it and “he maintained the Account lawfully.” (¶20). The court of appeals disagrees with the state’s arguments that the other four factors weigh against Bowers.
The court concludes that Bowers exercised “complete dominion and control” over the account because he did not share the password to his account with anyone and “merely shared certain files he had uploaded to that Account with others.” (¶¶21, 27). The court dismissed, as a “slippery slope,” the state’s argument that because Bowers used his county email address to create the Dropbox account he had “diminished his dominion and control” over the account. “In essence, the State argues that an individual’s expectation of privacy is diminished where a location or item is accessible or capable of being broken into.”(¶22). In other words, the fact that his employer’s IT department broke into Bowers’ private Dropbox account by accessing his work email account did not negate Bowers privacy interest in the contents of his Dropbox account.
With regard to the fourth factor, whether Bowers took precautions customarily taken by those seeking privacy, the court again rejects the state’s argument that because Bowers shared documents uploaded to his Dropbox account that he took “few precautions customarily taken by those seeking privacy.” To the contrary, Bowers’ account was password protected and the state introduced no evidence that Bowers shared access to the account itself (vs. individual files) with anyone else. (¶23).
As to the fifth factor, whether Bowers put his Dropbox account to “private use,” the court noted that the state presented no evidence that Bowers did not also use the Dropbox account for private use and even the state’s witnesses acknowledged that the account could have contained “photographs and personal documents.” (¶24).
The final factor is whether the claim of privacy is consistent with historical notions of privacy. The court agreed with Bowers that a “Dropbox account is most reasonably comparable to a modern-day version of a container used to store personal documents and effects” and not, as the state claimed, “a shared space” generally accessible by others and therefore not entitled to privacy protections. (¶¶25-26) (citing Riley v. California, 573 U.S. 373, 397 (2014)).
The state also argued that regardless of the Dumstrey factors, under the “third-party doctrine,” Bowers lacked a reasonable expectation of privacy in the information stored in his Dropbox account because he “deliberately shared it with several other people.” (¶30). In addition to not sharing his account or password with anyone, the court distinguished Bowers’ case from cases dealing with financial business records held by a bank (United States v. Miller, 425 U.S. 435 (1976)), phone numbers dialed and held by a telephone company (Smith v. Maryland, 442 U.S. 735 (1979)), and child pornography stored on Dropbox by a defendant who shared his password with other users (United States v. Maclin, 393 F.Supp. 3d 701 (N.D. Ohio 2019)). (¶¶31-34). While recognizing that “the application of the third-party doctrine in the context of a cloud-storage account like Dropbox is unclear and undeveloped,” the court agrees with Bowers “that the third-party doctrine does not apply to the type of search performed here.” (¶39). The court analogized the situation here to a safe-deposit box, in which one locks personal effects in and thereafter “trusts the bank to not break the lock” and explained that the “[u]se of cloud storage to house an individual’s private information is just the latest technological development seeking to test the boundaries of the Fourth Amendment.” (¶¶43-44).
The court also rejects the state’s argument that exigent circumstances justified the warrantless search, concluding that sufficient time existed to seek and obtain a search warrant. (¶¶46-56). As to the state’s argument that the sensitivity of the information contained within the case files and the need to prevent the potential destruction of evidence by Bowers created an emergency, the court finds the state’s “delay in seeking a search warrant appears to have created the State’s claimed emergency.” (¶52). Moreover, Dropbox archives files for a period of time after they are deleted, undercutting the state’s destruction of evidence argument. (¶¶52-53). Finally, there’s no legal authority for the state’s claim that “release of confidential information itself could create an exigency sufficient to eclipse the protections of the Fourth Amendment.” (¶54).
The significance of the court of appeals’ decision, regardless how thorough, thoughtful, and principled it is, will of course depend on whether the state petitions the Wisconsin Supreme Court for review. Of some further note is the “parallel litigation” federal litigation noted by the court of appeals. (¶20, n.12). See Bowers v. County of Taylor (Bowers I), No. 20CV928-JDP, 2022 WL 1121376 (W.D. Wis. Apr. 14, 2022). While Bowers § 1983 claim was denied on grounds of qualified immunity, the federal court determined that Bowers had a reasonable expectation of privacy in his Dropbox account and that defendants should have obtained a warrant before searching his account.” Id. at 7.
As it stands, it’s clear the case turned on some key facts: (1) Bowers created and had control over his Dropbox account; (2) while he shared individual files stored in the account with others, he didn’t share his password or access to the account with anyone; and (3) linking his Dropbox account to his work email address didn’t provide his employer with access to the account and no policy provided notice that his employer was permitted to utilize access to Bowers work email to access an employee’s private accounts. In short, the court accepted Bowers arguments that “cloud storage has become the equivalent of a 21st century container used to hold private papers and effects…cloud storage has become the digital equivalent of a traditional storage area,” and that “[t]he cloud is now used to store many of the same materials as a briefcase or backpack.” (¶43) (cleaned up).
