The Sony Hack and “Fruit of the Poisonous Tree”

Posted in: Criminal Procedure

Last month, unknown malefactors who may have been affiliated with the government of North Korea hacked into Sony’s computer databases, seemingly in retribution for the production of “The Interview,” a comic film depicting a plot to assassinate Kim Jong-un, the dictator of North Korea. The hack, especially when understood as motivated by the desire to censor a film, was widely condemned for, among other things, exposing the private lives of Sony executives and employees, whose emails and other personal materials became available and received wide circulation by news sites.

One issue that arose after the hack was whether reporters and journalists were under some obligation to refrain from publishing (and perhaps even refrain from reviewing and scrutinizing) the materials that the hack had unearthed. In this column, I will consider this argument as part of a larger discussion of “Fruit of the Poisonous Tree,” a principle familiar from the context the Fourth Amendment freedom from unreasonable searches and seizures.

In New York Times v. United States, the U.S. Supreme Court held that the First Amendment protected newspapers’ right to disseminate copies of “The Pentagon Papers,” an internal Defense Department report detailing government deception in connection with the Vietnam War. In that case, the relevant materials had been illegally copied and leaked to various newspapers, and the government had attempted to use the courts to prohibit release of the copies. The Court rejected the government’s efforts at restraining speech, concluding that there is a heavy presumption against the constitutional validity of such a prior restraint, a presumption that might be rebutted only with evidence that publication would result in grave and irreparable danger.

Though stealing documents from the government and leaking those documents is plainly illegal (and does not appear to fall within the First Amendment freedom of the press), a reporter or a journalist in a democracy is understood to be tasked with bringing information to the public’s attention, no matter how that information first came into his or her possession. This means that journalists seemingly may safely publish any facts brought to their attention without having to worry about thereby becoming accessories to the theft or other crime through which a source obtained the data in question.

In Bartnicki v. Vopper, the Supreme Court had occasion to more explicitly affirm the principle that the First Amendment protects the disclosure of material dealing with a matter of public concern, obtained through a third party’s illegal conduct. In the words of the Court, “a stranger’s illegal conduct does not suffice to remove the First Amendment shield from speech about a matter of public concern.”

Fourth Amendment Exclusion

In Fourth Amendment law, by contrast, the source of data matters a great deal. The Fourth Amendment requires that police perform only “reasonable” searches and seizures, a mandate understood to protect the privacy and liberty rights of people from potentially zealous and invasively inclined government officials. A classic example of an unreasonable search, conducted in violation of the Fourth Amendment, is the search of a home without a warrant and without probable cause to suspect that criminal evidence will be found in that home.

Under precedents going back to 1914 (Weeks v. United States), for federal agents, and to 1961 (Mapp v. Ohio), for state and local police, if a government official violates the Fourth Amendment in the manner described above—by searching a home without a warrant or probable cause, for example—then any evidence turned up in the course of (or as a result of) the illegal search is suppressed. That is, courts may not admit the resulting evidence at trial against the person whose home was unreasonably searched, even if the evidence is otherwise damning, reliable, and incriminating (say, a dead body).

The rationale for suppressing such unconstitutionally-derived evidence—for excluding the fruit of the Fourth Amendment violation—has evolved over time. Initially, the Supreme Court regarded the introduction of illegally obtained evidence in a courtroom as itself a form of complicity in the constitutional violation and as a stain on the integrity of the judiciary. Since the whole point of obtaining evidence is to introduce it in court, on this theory, the prosecutor who brings the illegally-procured evidence to the jury and the court that allows it in are like the getaway-car driver who then shares in the loot retrieved during a bank robbery, no less reprehensible than the officer/criminal who stole the goods in the first place.

By the mid-1970s, the rationale of the Fourth Amendment Exclusionary Rule had shifted to an instrumental one. The prosecutor and court were no longer considered participants in violating the Fourth Amendment (since the Fourth Amendment governed only investigative conduct), but the prosecutor and court would—if the evidence were admissible—be reinforcing the behavior of the police who conducted the illegal search. Excluding the evidence, then, would function as a deterrent to police misconduct, by removing the ostensible reward for that misconduct. Like the ink containers attached to expensive clothing that spill ink all over the stolen clothing if removed, the Exclusionary Rule renders the initial illegality of an unreasonable search pointless and therefore, correspondingly less attractive to the police-perpetrators inclined to violate the law.

Though still intact, at least in theory, the Fourth Amendment Exclusionary Rule has attracted much criticism and hostility, from academic circles, from law enforcement, and from the populace. This hostility is unsurprising, given that the suppression of evidence necessarily occurs only when police who violated the Fourth Amendment happened to have gotten lucky and actually turned up evidence of crime. What the rule therefore does, in the name of protecting mostly innocent people from unjustified infringements on their well-deserved privacy and liberty, is to prevent the successful prosecution of actual criminals who, I have argued, may not be truly deserving of the privacy that had concealed the incriminating evidence against them (though the police are culpable because they did not know this at the time that they decided to conduct the search).

To paraphrase the words of then-Judge Cardozo, excluding evidence results in letting a criminal go free because the constable has blundered. Due to such hostility from a majority of the Justices on the Supreme Court itself, the scope of the Exclusionary Rule has contracted since it was first announced, to those cases in which the deterrent effect of the rule seems sufficiently powerful and the officers’ misconduct sufficiently blameworthy to justify the considerable costs of suppression.

First Amendment Freedom From Suppression

In contrast to the Fourth Amendment exclusionary doctrine, however enfeebled over the years, the First Amendment freedoms of speech and the press run in the exact opposite direction. Not only is there no legal requirement that data obtained from lawbreakers be kept out of the newspaper, but the First Amendment doctrine has been understood to positively prohibit a statutory requirement to that effect, other than in extraordinary circumstances, as an infringement on the freedom of speech and the press. Under Simon & Schuster v. Members of the New York State Crime Victims Board, in fact, even a criminal serving time in prison has the right to publish—and to be paid for publishing—information that he gathered by committing violent crimes against helpless victims (at least where the law targeting his conduct singles out speech). The fact that information has been obtained through crime may thus have little bearing on the First Amendment right to publish that information.

Yet consider the rationales of the Fourth Amendment Exclusionary Rule and how plainly pertinent they are. First, if a thief steals materials and copies them in order to make them known to the public, he commits a crime that may be punished no matter how much the public wants to know the facts that he hopes to expose. Furthermore, the reporter who accepts copies that are the “fruit” of the theft is arguably no less culpable in connection with the theft, in a moral sense, than the thief himself, since the latter, by hypothesis, acted only with the plan of passing along the stolen data to the reporter, like a fence who will be selling stolen DVDs. The reporter is, in that sense, a true accomplice in the misconduct.

Likewise, a rule that effectively blocked publication of illegally obtained data would likely have a major deterrent effect on the criminals who steal data with the hope of having it published by journalists. Yet despite these parallels, in terms of both shared culpability and potential deterrence, the law permits and even constitutionally protects what we might call the “newswashing” of illegally obtained materials. Why?

Exploring the Difference

One possible account of the difference is that it is very important for people to learn what is going on, and sometimes the only way for that to happen is if we allow publication without attending too closely to what may be a criminal source. But is that any less true of the apprehension and prosecution of criminals? Some criminals will undoubtedly go free because the Fourth Amendment prohibited unreasonable searches and seizures that would have exposed their crimes, yet we still both prohibit the unreasonable searches and seizures and suppress the fruits of unreasonable searches and seizures that do occur, even at the expense of an occasional prosecution.

In the First Amendment context, then, we are arguably hypocrites. We prohibit theft and we prohibit cyber-attacks and the hacking that resulted in an enormous invasion of the privacy of Sony executives and employees. Yet once the theft, the cyber-attack, and the hacking has occurred, we attach no consequences at all to the plumbing of the information for “newsworthy” items and the publication of whatever “news” journalists might deem “fit to print.”

A Formal Answer

In formal terms, there is a difference between the two areas. In one, the wrongdoers at issue are government actors—typically police—whose misconduct itself represents a violation of the Constitution. In the other, the wrongdoers are private actors—or perhaps, in the Sony case, officials from a foreign government—not subject to the commands and prohibitions of our Constitution.

From a constitutional perspective, the greatest threats to privacy and liberty come from the government, and we are therefore inclined to prevent and punish such threats by broadly recognizing complicity and incentives, and responding accordingly. On the other hand, the Constitution does not generally recognize the strength of private (or foreign governmental) threats to privacy (or liberty), and it thus shapes doctrine without closely monitoring the complicity and incentives of criminals and journalists. The Constitution’s main worry, when it comes to journalists, is the threats to their ability to speak freely, rather than the threats of private cyber-attacks to other people’s privacy.

This distinction, however firmly established, may be increasingly an anachronistic one as private actors (and foreign governments) prove themselves to be capable of doing great mischief that threatens both privacy and the freedom of speech of Americans. It may be time for a better alignment between our values in the public and private realms, as we recognize that complicity is complicity, deterrence is deterrence, and threats to privacy and freedom can be just as serious when they come from private (or foreign governmental) cybercriminals as they are when they come from a blundering constable (or a malicious police officer). If we are to have an Exclusionary Rule or suppression doctrine, we should perhaps extend it beyond its current boundaries (at least to include permission to prevent publication of stolen gossip, consistent with the First Amendment). Indeed, many people might have been able to see the film “The Interview” sooner if Sony executives and employees had known all along that all of the data coming from the Sony cyber-attack would be lawfully kept from public scrutiny as the “Fruit of the Poisonous Tree.”