What is More Important – Physical Possession of an Electronic Device, or a Password?

An unpublished opinion out of Texas raises an issue of standing to challenge the search of the contents of a cell phone – and then suggests interesting future questions about the use of passwords and encryption. The case is Young v Texas.

This case involves a complicated and illegal relationship between a student and an older woman. It started then the woman checked a student out of school on a number of occasions. This was done, apparently, without the permission of the student's parents. The parents stopped the practice and contacted requested that the student's teachers notify them immediately "if they noticed any odd behaviors."

Later, the student's math teacher confiscated a cell phone from the student because she could see that he was sending or receiving text messages during class. Later, when the teacher turned on the cell phone, she found text messages of a sexual nature and contacted the police.

The actual ownership of the phone was a little confusing. There was some testimony that the student's mother paid the bills for the cell phone service. The student testified that the phone belonged to the defendant and that she let him borrow it. The defendant also left a message for the teacher claiming that she owned the phone.

The issue on this case involves standing -- whether the defendant has the right to contest the search of the phone. The short legal question is whether the defendant has a legally protected expectation of privacy.

The court started with the assumption that the defendant believed that the contents of the phone was private. But that is only half the analysis. The defendant must also show that the expectation of privacy is one that society recognizes as reasonable. The court answered the second question, "no." The key factor for the court was that the defendant did not have possession of the phone when it was confiscated.

The interesting aspect of the decision, I believe, is that the court did not consider the fact that the defendant gave the cell phone to the student conclusive. Rather, the court also considered whether the defendant to steps to protect the information inside, like through the use of a password. I have written about passwords and encryption elsewhere, as I expect this to be one of the most important issues in dealing with the Fourth amendment and Technology going forward. The reasoning of the Texas Court, perhaps, suggests a court might be willing to look beyond physical possession of an object to determine whether an expectation of privacy is reasonable. For example, if I lend a thumb drive to somebody else, do I still retain a reasonable expectation of privacy in password protected files?