Riley v. California started as an ordinary traffic stop and United States v. Wurie started as a narcotics sales surveillance. Combined under Riley, these cases ended as one of the most important Fourth Amendment decisions affecting digital evidence. Understanding the facts of the case matters because they explain the limits of search warrant exceptions and why modern evidence isolation practices exist.
This post walks through how Riley and Wurie’s phones became evidence, what the Supreme Court decided, and how both law enforcement and forensic examiners should apply the ruling today.
Riley v. California, 573 U.S. 373 (2014) – The facts: a routine traffic stop, an impounded car, and a seized phone
In August 2009, a San Diego police officer pulled over David Leon Riley for driving with expired registration tags. During the stop the officer discovered that Riley’s driver’s license was suspended. Under department policy, the officer impounded the vehicle and conducted an inventory search of the car prior to towing. The inventory search uncovered two concealed and loaded handguns hidden under the vehicle’s hood. Officers placed Riley under arrest on weapons charges and seized Riley’s smartphone from his pants pocket.
Law enforcement officers searched the phone’s contents both at the scene and later at the police station. A gang detective reportedly spent about two hours reviewing the phone, locating texts, contacts, photos, and videos that allegedly showed Riley’s gang association and placed the phone at the scene of a shooting weeks earlier. (le.alcoda.org)
The digital evidence was used to enhance charges and Riley was convicted. A California Court of Appeal upheld the conviction under then-existing precedent that allowed warrantless searches of a phone seized incident to arrest. (Justia Law)
United States v. Wurie , No. 11-1792 (1st Cir. 2013) – The facts: a narcotics surveillance, a seized phone and a search of his home
In United States v. Wurie, a Boston police officer conducting routine surveillance observed Brima Wurie engage in what appeared to be a drug transaction from a parked vehicle, prompting the officer to stop and arrest Wurie on suspicion of drug activity. At the police station, officers seized a flip-style cell phone from Wurie’s person and saw on the phone’s external screen that it was receiving calls labeled “my house.” Without a warrant, the officers accessed the phone’s call log, identified the number associated with “my house,” and traced it to an address they believed was Wurie’s apartment.
They obtained a search warrant for that residence based on information from Wurie’s phone and found drugs, a firearm, ammunition, and cash, leading to federal drug and firearms charges. The First Circuit later held that the warrantless search of the phone exceeded the Fourth Amendment’s search-incident-to-arrest exception.
The supreme court ruling: warrant required for phone data
The Supreme Court granted review to decide whether the search-incident-to-arrest exception to the Fourth Amendment permits police to search the digital contents of a cell phone without a warrant. In a unanimous decision, the Court held that:
- A warrantless search of digital information on a cell phone seized during an arrest is generally unconstitutional.
- Officers may still seize and secure a phone at the time of arrest.
- Searching the contents of that phone requires a search warrant supported by probable cause unless a recognized exception applies, like exigent circumstances.
What constitutes a search?
Under the Fourth Amendment, a “search” occurs when government conduct infringes on a person’s reasonable expectation of privacy or physically intrudes into a constitutionally protected area for the purpose of obtaining information. This standard comes from Katz v. United States, 389 U.S. 347 (1967) which established the Katz test: a Trespass + Obtaining Information = Warrantless Search.
Applied to phones, Riley v. California makes clear that any deliberate access to digital information stored on a device in order to obtain information constitutes a search. That includes opening apps, scrolling messages, viewing photos, accessing call logs, or navigating contact lists. Even brief or targeted access qualifies because it exposes private digital data that is not otherwise visible.
By contrast, merely observing information that is already exposed to public view, such as a phone ringing with a visible caller name on the lock screen, may not be a search if officers do not manipulate the device. The key word is manipulation. Many cases that involve plain view observations focus on how law enforcement manipulated the phone, like tapping the screen to make notifications visible. Once an officer interacts with the device in a way that reveals stored digital information that was not otherwise visible, a search has occurred.
Preserving digital evidence: Isolation and Encryption
In the Riley v. California ruling the Court said “If the police are truly confronted with a ‘now or never’ situation—for example, circumstances suggesting that a defendant’s phone will be the target of an imminent remote-wipe attempt—they may be able to rely on exigent circumstances to search the phone immediately.”
Every phone could be remotely wiped, right? Well, maybe. There are several factors that go into remotely wiping a phone like:
- The suspect’s ability to initiate a wipe
- Other people being aware of their arrest and having the necessary passwords required to wipe the device
- The phone being in a state to receive the wipe command
For both Apple and Android phones, the first consideration is network isolation. That means preventing the phone from communicating on either the cellular or Wi-Fi networks. If the suspect sent the wipe command, the evidence is still safe until the command is received.
A Faraday bag is a shielded container designed to block radio frequency signals to and from electronic devices such as cell phones. Once a phone goes into a faraday bag, it can’t come out without risking connection to the network. This presents what I call the Schrödinger’s Phone problem; how can you know if the phone is shielded or not shielded, alive or dead? Some faraday bags have transparent windows that allow you to see inside while keeping them protected and special RF shielded boxes do exist that forensic examiners can use to keep evidence safe through the full extraction process. Inside the bag the phone is safe, but getting the phone out to conduct an examination requires even more specialized equipment.
Airplane Mode is the most common answer, but it is difficult to square with Riley v. California . In order to place a phone in airplane mode the phone’s interface needs to be accessed. That means activating the screen and swiping to access the airplane mode button. This exposes officers to information that they wouldn’t otherwise know, like notifications, message previews, and wallpaper images. (United States v. Sam)
Encryption in iPhones is a significant challenge to law enforcement as Apple has forced all iPhones to restart after 72 hours of inactivity. Restarting an iPhone forces it into a Before First Unlock (BFU) state causing the data to be encrypted and generally inaccessible, even with advanced digital forensic tools.
Searching Phones post Riley
Get a warrant. Riley v. California outlines the additional privacy protections that mobile phone data has and limits search warrant exceptions available to access it. If consent isn’t an option, the safest path forward is with a search warrant.
Best Practices
- Place phones into faraday bags while connected to a portable battery pack.
- Secure a search warrant prior to accessing any digital information.
- Preserve data or get a digital extraction as quickly as possible by preventing a restart.
- Test your faraday bags frequently, with modern phones, to ensure they shield evidence properly.
Riley v. California Q&A
Q. Does placing a phone on a charger constitute manipulation?
A. The case law involving manipulation relates to accessing data and gaining information about the suspect. By connecting the phone to power Officers know that the phone is charging, but nothing related to the case.
Q. Can I rip the phone and then get a warrant to look at the data?
A. Maybe, but barring some extreme circumstance, there is almost always time enough to get a warrant. “Ripping” the phone would constitute a seizure under Katz. Riley references this; If the police are truly confronted with a ‘now or never’ situation they may be able to rely on exigent circumstances to search the phone immediately.
Q. Is preserving a phone using digital forensic tools a search?
A. It depends on what the officer can see during the preservation; Orange County California seems to think so. If a forensic tool can stop the iPhone’s restart timer and place the phone in airplane mode without displaying any user data, it seems to follow that preservation mode would be ok. If the tool displays information like the phone’s number or iCloud account, this would likely constitute a search and require a warrant.
