It is important to remember that computer systems can be
configured in an unlimited number of ways with assorted input
and output devices. In some cases, a specific device may have
particular evidentiary value (e.g., if the case involves a bookie
who prints betting slips, the printer may constitute valuable
evidence); in others, it may be the information stored in the
computer that may be important. In either event, the warrant
must describe, with particularity, what agents should search for
and seize.
Table of Contents - Main Federal Guidelines
Supplement - Definitions
B. LIST OF COMPUTER SYSTEM COMPONENTS
The following is an abridged list of hardware components
which may play a role in a criminal offense and, therefore, be
subject to search and seizure under warrant. For a more extensive
list, see the "GLOSSARY" at APPENDIX B, p. 132.
It is important to remember that electronic components are constantly
changing, both in nature and in number, and no list can be comprehensive.
Device Name Description
CPU: The central processing unit.
Hard Disk A storage device based on a fixed, permanently-mounted
Drive: disk drive. It may be either internal or external.
Both applications and data may be stored on the disk.
Floppy Disk A drive that reads from or writes to floppy
Drive: diskettes. Information is stored on the diskettes
themselves, not on the drive.
Mouse: A pointing device that controls input. Normally,
the user points to an object on the screen and then
presses a button on the mouse to indicate her selection.
Modem: A device allowing the computer to communicate with
another computer, normally over standard telephone
lines. Modems may be either external or internal.
Fax Peripheral: A device, normally inserted as an internal
card, that allows the computer to function as a fax
machine.
CD ROM: CD ROM stands for Compact Disk Read-Only Memory.
CD ROMs store and read massive amounts of information
on a removable disk platter. Unlike hard drives and
diskettes, CD ROMs are read-only and data cannot be
written to the platter.
Laser Disk: Similar to a CD ROM drive but uses lasers to
read and write information.
Scanner: Any optical device which can recognize characters
on paper and, using specialized software, convert
them into digital form.
Printer: A number of technologies exist, using various
techniques. The most common types of computer
printers are:
1. Dot matrix - characters and graphics are created by
pins hitting the ribbon and paper;
2. Laser - electrostatically charges the printed page
and applies toner;
3. Ink jet - injects (sprays) ink onto the paper;
4. Thermal - a hot printer head contacts special paper
that reacts to heat;
5. Band - a rotating metal band is impacted as it spins;
6. Daisy wheel - a small print wheel containing the form
of each character rotates and hits the paper, character
by character;
7. Plotter - moves ink pens over the paper surface, typically
used for large engineering and architectural drawings.
Table of Contents - Main Federal Guidelines
C. DETERMINING THE COMPUTER'S ROLE IN THE OFFENSE
Before preparing a warrant to seize all or part of a computer
system and the information it contains, it is critical to determine
the computer's role in the offense. First, the computer system
may be a tool of the offense. This occurs when the computer system
is actively used by a defendant to commit the offense. For example,
a counterfeiter might use his computer, scanner, and color printer
to scan U.S. currency and then print money. Second, the computer
system may be incidental to the offense, but a repository of evidence.
For example, a drug dealer may store records pertaining to customers,
prices, and quantities delivered on a personal computer, or a
blackmailer may type and store threatening letters in his computer.
In each case, the role of the computer differs. It may constitute
"the smoking gun" (i.e., be an instrumentality of the
offense), or it may be nothing more than an electronic filing
cabinet (i.e., a storage device). In some cases, the computer
may serve both functions at once. Hackers, for example, often
use their computers both to attack other computer systems and
to store stolen files. In this case, the hacker's computer is
both a tool and storage device. Whatever the computer's role
in each case, prosecutors must consider this and tailor warrants
accordingly.
By understanding the role that the computer has played in
the offense, it is possible to focus on certain key questions:
- Is there probable cause to seize hardware?
- Is there probable cause to seize software?
- Is there probable cause to seize data?
Where will this search be conducted? Is it practical to
search the computer system on site, or must the examination be
conducted at a field office or laboratory?
If agents remove the system from the premises to conduct
the search, must they return the computer system, or copies of
the seized data, to its owner/user before trial?
Considering the incredible storage capacities of computers,
how will agents search this data in an efficient, timely manner?
Before addressing these questions, it is important to recognize
that general Fourth Amendment principles apply to computer searches,
and traditional law enforcement techniques may provide significant
evidence of criminal activity, even in computer crime cases.
Therefore, we begin with a brief overview of the Fourth Amendment.
----- footnotes ------
[1] Peripheral equipment means "[t]he input/output
units and auxiliary storage units of a computer system, attached
by cables to the central processing unit." Webster's Dictionary
of Computer Terms 279 (3d ed. 1988).
[Back]
Go to . . .
Table of Contents - Main Federal Guidelines
CCIPS || Justice Home Page
Updated Page May 9, 1999
usdoj-jmd/irm/css/imc