Computer Search and Seizure Policy

Computer Search & Seizure Policy

• The policy establishes procedures for seizing computer equipment and electronic information.
• The established exceptions to the search warrant requirement can apply to searching and seizing computers, data, and equipment.
• Due to the unique nature of computer related evidence, a distinction exists between procedures for seizing computer related evidence and the actual search of computer evidence.
• Because of the technical nature of computer searches and legal liabilities, only trained officers can seize computer evidence.
• Computer systems in a networked business environment must be seized by a computer crimes specialist trained in computer network evidence seizures.
• Officers can assist the computer crimes specialist with packaging and transportation under direct supervision.
• Officers or investigators must not examine computer systems or evidence without specialized training in computer forensics examination.

Procedures for Searching and Seizing Computer Hardware

• Patrol officers and investigators who find a computer or its components during an investigation must cordon off and protect it as a crime scene if probable cause exists that it was used in a crime, constitutes fruits of a crime, or is evidence of a crime.
• Officer safety is the highest priority when seizing a computer.
• Remove all individuals from the area near the computer to prevent remote data destruction.
• Data should not be damaged by premature searches like clicking on desktop icons, viewing files or photos can render the evidence useless in court.
• Unauthorized examination of computers will show up during the computer forensics examination.
• If you feel that a computer will destroy evidence, unplug the power supply cord from the back.
• With laptop computers, pulling the power cord will not work because of the battery, instead turn it off by ejecting the battery so call someone to help.

Preliminary Computer Crime Scene Management

• If discovered during a regular investigation, officers must notify their supervisor, who will then notify computer crimes investigative personnel.
• Personnel must not seize or move the computer system without specialized training.
• If it is necessary to shut the computer system off, the officer can pull the power plug at the back of the system.

Actual Computer Search

• Only individuals with training conducting Computer Forensics Examinations can examine computer evidence seized by the department.
• Officers and investigators must obtain a search warrant before the search and seizure of any computer evidence.
• Consent searches are permitted if a signed consent to search form is obtained from an individual with authority to give consent.
• Consent can be withdrawn at any time, requiring a warrant before continuing the search.

Seizing the Computer: With a Warrant

• Officers must protect equipment from damage during seizure and transport to avoid data loss and system malfunction.
• The is a need for a detailed plan for documenting and preserving electronic evidence and brief participating search officers.
• Traditional forms of evidence i.e., fingerprints from the keyboard, computer case, notes, and printed materials, should be in kept in mind.
• The computer must be sealed at the scene to protect the chain of custody.
• The computer forensics examiner can refuse to analyze an improperly handled system.
• The investigating officer will take special precautions when disassembling and packing equipment.
• Before disconnecting cables, take a video or photograph of the site and all wiring connections, backed up by diagrams or drawings of the wiring scheme.
• All external disk drives should be sealed with evidence tape.

Seizing the Computer: Exigent Circumstances Guidelines

• A computer can be seized without a warrant only under extreme exigent circumstances to prevent damage or destruction of data or to protect human life.
• A detailed report must be written documenting if it is seized or moved.
• When seizing a computer under exigent circumstances, guidelines will minimize possible damage to the computer.
• Document any image on the computer screen with a quick photograph of the display.
• Primary responsibility is to preserve computer evidence and transport the computer to a safe location.
• The decision to unplug the computer from its power source at the back of the computer depends on circumstances.
• A stand-alone personal computer can generally be shut down, a computer in a business or network environment should not be shutdown with out precaution.
• Before unplugging, shutting down, or moving the computer and its components, a photograph must first be taken of all connective cables and their relationship to the computer and its components.
• Tape should mark each cable end and its location, so that it can be reconfigured as it was when seized.
• Chain of custody is relevant for computers, and each item should be recorded and marked by different personnel.

Transporting the Computer

• The trunks of patrol cars that contain radio transmitter equipment should not be use when transporting computers.
• Magnetic fields generated by the radio equipment can destroy computer evidence.
• Moisture, heat, cold, and magnetic fields can destroy a computer system and its data.
• Smaller computers should be transported in a box with proper packaging.
• The computer should be placed in an area of the evidence/property room where it will not be contaminated or damaged,