AS THE FBI and Apple fight a media war over whether the federal government can force the computer company to hack an iPhone, in California a new privacy law is raising questions over how deeply government should be allowed to peer into a convicted criminal’s digital life.

That new law, the California Electronic Communications Privacy Act (CalECPA), requires law enforcement to obtain a warrant before searching a person’s cellphone, laptop, or any digital storage device. At issue is whether the law covers people on probation, parole, and other forms of supervised release who’ve agreed to what’s known as a “Fourth waiver,” a condition that allows law enforcement to search their person and property at any time.

CalECPA took effect on January 1, 2016. Three days later, San Diego County prosecutors and Superior Court judges began asking defendants who were eligible for probation to sign a form giving “specific consent” to county probation officers “and/or a law enforcement government entity” to collect information that would be otherwise protected under CalECPA.

The consent form described everything that could be searched and seized:

Call logs, text and voicemail messages, photographs, emails, and social media account contents contained on any device or cloud or internet connected storage owned, operated, or controlled by the defendant, including but not limited to mobile phones, computers, computer hard drives, laptops, gaming consoles, mobile devices, tablets, storage media devices, thumb drives, Micro SD cards, external hard drives, or any other electronic storage devices, by probation and/or a law enforcement entity seeking the information.

The defendant shall also disclose any and all passwords, passcodes, password patterns, fingerprints, or other information required to gain access into any of the aforementioned devices or social media accounts.

Defense attorneys immediately protested, arguing that the form had been drawn up without input from the defense bar and that the language was vague and overly broad.

“Folks on parole, probation, even supervised release, they have a reduced expectation of privacy while they’re under supervision,” said Margaret Dooley-Sammuli, criminal justice and drug policy director for the ACLU of California, “but that’s not the same as no right to privacy online or offline.”

Dooley-Sammuli said she was surprised by the expansiveness of the consent waiver. “Anything, anytime, from the beginning of time until after your death is what it suggests in that language.”

In January, I attended dozens of probation and sentencing hearings in San Diego’s main courthouse. The majority of defendants were told that there would be broad monitoring of their online lives, despite objections from defense attorneys. In one case, a judge told a pair of young co-defendants — a boyfriend and girlfriend who pleaded guilty to robbery — that their emails, cellphones, and social media accounts would be monitored to make sure they weren’t in contact with each other during their five years’ probation. A young woman convicted of felony DUI was told that her probation officer would be checking her email and social media to make sure she wasn’t drinking. As the judge told the DUI defendant, “Law enforcement needs to monitor your physical as well as electronic world.”

Issues with digital privacy aside, probation conditions are supposed to be narrowly tailored to address a person’s crime and what will “reasonably” prevent future criminal acts, said Jeff Thoma, outgoing president of California Attorneys for Criminal Justice. “The whole idea of probation and sentencing is to individualize something,” Thoma said. “When you don’t do that and are just trying to put all these restrictions, it becomes, ‘Oh we might catch this person doing something.’”

In late January, the San Diego County public defender’s office filed a petition with a state appeals court, arguing that the consent form hadn’t gone through the proper vetting process. Shortly after the appeal was filed, judges who had been using the form stopped requiring probationers to sign it, and the district attorney’s office stopped including it in plea deals offering probation.

Getting rid of the form didn’t solve the problem, said Randy Mize, chief deputy public defender in San Diego County. Some judges are now assuming that any probationer who agrees to a Fourth waiver in court is also agreeing to make available to law enforcement all the digital information that had been included in the consent form. Mize said his office plans to appeal a number of these cases. “All we want is the judge to articulate on the record what makes it a constitutional probation condition,” he said.

Specific Consent and the Fourth Amendment

The new digital privacy law doesn’t directly address how to handle Fourth waivers. Rather, it says that absent a warrant, a government agency must obtain an individual’s “specific consent” to search an electronic device. The law defines “specific consent” as “consent provided directly to the government entity seeking information.” The question, then, is whether a defendant who agrees in court to waive his Fourth Amendment rights has given the “specific consent” the law requires.

“Had the legislature wanted to include a Fourth waiver in the definition of ‘specific consent,’ they could have specifically said so,” said Robert Phillips, a retired deputy district attorney and author of the website California Legal Update. “The legislature could have merely referred to the need for ‘consent’ without adding the word ‘specific.’ In interpreting a statute, the courts attempt to give every word meaning. To argue that ‘specific consent’ means no more than just a general consent in effect eliminates the need for the word ‘specific.’”

As for individuals on parole, a Fourth waiver is a mandatory condition, not something a parolee consents to. This has led a number of law enforcement groups to advise obtaining a warrant before searching a parolee’s electronic devices. So even though a parolee’s home, car, and person are open to search, law enforcement now needs a warrant to examine his cellphone or laptop.

“With all its good intentions, I think the ECPA was written in a very one-sided way without necessarily balancing the interests of all of the parties,” said Contra Costa County Deputy District Attorney Satish Jallepalli.

Sean Hoffman, legislative director for the California District Attorneys Association, said other counties are “grappling with how and when to effectuate searches of probationers’ electronic devices,” but so far San Diego is the only county that’s tried to address it through the court. At least three other counties — Contra Costa, Santa Clara, and Sacramento — have discussed implementing a consent waiver similar to San Diego’s.

Confusion over how to interpret CalECPA is happening against the backdrop of two significant recent court decisions. In 2014, in Riley v. California, the U.S. Supreme Court unanimously held that searching a person’s cellphone during arrest is unconstitutional. The Fourth Amendment allows police to conduct unwarranted searches if they’re part of “a lawful arrest,” but Chief Justice John Roberts rejected the government’s argument that searching a cellphone is no different than searching a wallet, purse, or pack of cigarettes.

“Modern cellphones are not just another technological convenience,” he wrote. “With all they contain and all they may reveal, they hold for many Americans ‘the privacies of life.’ The fact that technology now allows an individual to carry such information in his hand does not make the information any less worthy of the protection for which the Founders fought.”

In a recent case, In re: J.B., California’s 1st District Court of Appeals sided with a juvenile probationer who argued it was unconstitutional to require him to give law enforcement access to his cellphone and social media passwords. The court ruled that the probation condition had no relation to his crime — petty theft — nor did it serve any rehabilitative purpose.

The J.B. case is only one of several recent cases in which the appeals court sided with a juvenile probationer over digital privacy issues. Expect to see more of these cases throughout the state, said Arthur Bowie, deputy public defender of Sacramento County.

“These things are going to be challenged until some court decides what they can and cannot do,” he said. “The edges are going to be tested.”