dissenting:
The court provides two separate rationales for affirming the district court’s denial of Stanley’s motion to suppress: (1) the district court properly concluded that *953Stanley’s ex-girlfriend at the time, Tiana Stockbridge (“Stockbridge”), had common authority to consent to the search, or apparent authority to do so; and (2) the district court properly concluded that Stanley had no expectation of privacy in the computer’s contents. I respectfully disagree.
In this case, law enforcement agents relied on an invalid warrant to search a criminal defendant’s computer without his consent. The government’s reliance on the defendant’s ex-girlfriend’s consent is terribly flawed and cannot justify an otherwise invalid search under the Fourth Amendment. As I explain below, the district court’s factual findings were clearly erroneous.
Accordingly, I would reverse the district court’s decision not to suppress this evidence.
I
Consent
The “cardinal principle” in Fourth Amendment search and seizure jurisprudence is that “ 'searches conducted outside the judicial process, without prior approval by judge or magistrate, are per se unreasonable under the Fourth Amendment.’ ” Mincey v. Arizona, 437 U.S. 385, 390, 98 S.Ct. 2408, 57 L.Ed.2d 290 (1978) (quoting Katz v. United States, 389 U.S. 347, 357, 88 S.Ct. 507, 19 L.Ed.2d 576 (1967) (footnotes omitted)). This rule, however, is not ironclad, and like most constitutional edicts, there are exceptions. Id. One such exception to the warrant requirement is consent, given either by the defendant himself or by a third party who has “common authority” over the property. Schneckloth v. Bustamonte, 412 U.S. 218, 222, 93 S.Ct. 2041, 36 L.Ed.2d 854 (1973). But if the government wishes to introduce evidence seized during a warrantless search, it has the burden of demonstrating that an exception to the cardinal principle exists. Id.; see also Vale v. Louisiana, 399 U.S. 30, 34, 90 S.Ct. 1969, 26 L.Ed.2d 409 (1970); United States v. Davis, 332 F.3d 1163, 1168 n. 3 (9th Cir.2003).
Because Stanley himself never gave consent to search his computer, the government had the burden to prove that a third-party — in this case, Stockbridge, who was Stanley’s ex-girlfriend at the time — had actual or apparent authority to consent to the search, and did in fact consent to the search.
For her part, Stockbridge unequivocally denies that she ever provided consent in the first place, an assertion that the court dismisses out of hand.1 But even if Stock-bridge did consent to the search, the question remains whether she had the authority do so. The court concludes that she did for three reasons. First, the court concludes that Stockbridge was a co-owner of the computer, which enabled her to consent to the search. Second, even if Stock-bridge was not a co-owner, the court argues that her joint-use of the computer gave her common authority to consent to a search of its files. And finally, even if Stockbridge was not a co-owner or did not have common authority to consent, the court believes that the agents properly relied upon her apparent authority to consent to the search.
As explained below, the court’s reasoning finds no support either in the record or in this court’s precedent.
A. Co-Ownership
The court writes that while Stanley and Stockbridge lived together (before they broke up), they “jointly owned and used *954the computer.” This claim cannot be squared with the facts. To begin, there is no factual basis for this conclusion anywhere in the record. The district court’s conclusion that Stockbridge was a co-owner was clearly erroneous.
Between 1996 and 2004, Stanley and Stockbridge were in a romantic relationship. During their relationship, they lived together in Barstow, California. In 2001, as a gift, Stanley’s father gave him the laptop computer in question. There is no evidence whatsoever that Stanley’s father gave the laptop to both of them; indeed, it is clear from the record that the gift was for Stanley alone.
Although the computer was his alone, Stanley allowed Stockbridge to use the laptop while they were living together. However, Stanley made sure to limit Stockbridge’s access. Two different user accounts were set up on the computer, and during their cohabitation Stanley’s account was password protected, while Stock-bridge’s account was not password protected. Stockbridge only used the computer to store her music files; she did not access Stanley’s files because she did not believe she had the right to do so. Stanley also did not believe Stockbridge had any right to access his files.
In 2004 the couple broke up, and Stanley moved to Porterville, California, taking his computer with him. After he stopped living with Stockbridge, Stanley removed the password protection that locked his user account.
Later that year, while he was living in Porterville, Stanley was arrested and sent to state prison for an unrelated criminal charge. Before his arrest Stanley kept his personal property (including his laptop computer) at a friend’s house, where he had been staying. After his arrest, the property was moved to Stanley’s parents’ home. While Stanley was in prison Stock-bridge went to his parents’ home and took possession of some of his property to hold while Stanley was in prison, including: music discs, video games, clothing, and his laptop computer. Both agree that Stock-bridge was to hold Stanley’s property while he was in prison, but that he was to receive all of it back once he was released.
But because Stanley did not anticipate his arrest, he did not have a chance to reinstall his password before entering prison. As a result, when Stockbridge took possession of the computer, Stanley’s files and directories were not password protected. However, the computer still had two separate accounts that Stanley had created for himself and Stockbridge.
Two critical facts from this record demonstrate that Stanley did not co-own his computer with Stockbridge. First, the computer was a gift to Stanley from his father. Second, Stanley affirmed his sole ownership by taking the computer with him when the couple split up and he moved to Porterville. The district court never explains how an ex-girlfriend can jointly own a gift that her ex-boyfriend’s father gave to him, not to her.
Additionally, even when the couple was living together, Stanley only gave Stock-bridge limited access to the computer. Throughout their joint use, Stanley and Stockbridge had an understanding that Stockbridge could not access Stanley’s files; there is no evidence that this understanding changed when Stanley went to prison. If she were a co-owner, why would her access be so limited?
Given these facts, it’s hard to find that Stockbridge was a co-owner. Instead of considering these details before settling on its co-ownership theory, the court’s decision relies almost entirely on Agent Prado’s declaration. However, in his testimony, Agent Prado never said that Stockbridge used the word “owned,” and Agent Prado himself equivocated on *955whether he used the word “ownership,” or whether he used the word “possess” or “use” when he was questioning Stock-bridge. That Agent Prado later clarified that he “most likely” used “ownership” is not particularly availing, especially in light of Stockbridge’s unequivocal, and uncontested, statements to the contrary.
Additionally, the court’s reliance on Agent Prado’s testimony is out of context. The court’s decision relies on Agent Prado’s use of the following phrase: “the computer [Stanley] jointly owned with Tiana Stockbridge.” But the entire statement is part of Agent Prado’s declaration about what Stanley admitted and includes Agent Prado’s characterization of ownership, not Stanley’s. The entire statement, in context, reads as follows: “Defendant used the computer he jointly owned with Tiana Stockbridge to view images of child pornography.” If one were to read the whole sentence, and not just that isolated phrase, one would discover that the operative declaration there is what Stanley admitted he used the computer for — that is, he confessed to storing child pornography on it — not who owned the computer. By selectively reading the statement out of context, the court fails to realize that the ownership reference is an after-the-fact characterization that Agent Prado inserted himself.
Essentially, the government wants us to believe that Stanley co-owned a computer that his father gave to him, with his ex-girlfriend who he hadn’t lived with for years, and who was currently dating somebody else. The absurdity of this logic would be comical if it were not so tragic for Mr. Stanley and so detrimental to this court’s future precedent.
The co-ownership theory isn’t just clearly erroneous — it’s patently false. Because the record does not support a co-ownership theory of consent, the only way this warrantless search can pass muster under the Fourth Amendment is if Stockbridge had either common authority or apparent authority to consent.
B. Common Authority
The court also agrees with the government’s assertion that Stockbridge had common authority over the laptop because of her previous joint use while she was living with Stanley, and because Stanley allowed her to hold the laptop while he was in prison. Citing United States v. Matlock, 415 U.S. 164, 170, 94 S.Ct. 988, 39 L.Ed.2d 242 (1974), the court points out that “the consent of one who possesses common authority over premises or effects is valid against the absent, nonconsenting person with whom that authority is shared.” The problem, however, is that here the authority was not shared. The court’s conclusion that Stockbridge, through her most recent possession and limited past joint use, had common authority over the computer is inconsistent with Ninth Circuit precedent.
It is by now axiomatic that possession does not confer “common authority.” For example, we have previously held that a girlfriend does not cede authority to her boyfriend to consent to a search of a purse that she left in the trunk of his car. United States v. Welch, 4 F.3d 761, 764 (9th Cir.1993). Similarly, a defendant does not authorize his friend to consent to a search of his boxes simply because that friend agreed to store the defendant’s boxes in his garage. United States v. Fultz, 146 F.3d 1102, 1105 (9th Cir.1998); see also United States v. Basinski, 226 F.3d 829, 834 (7th Cir.2000) (same reasoning and similar facts). And a friend does not have the authority to consent to a search of a prisoner’s computer discs simply because that friend was given those discs to hold while the defendant was in prison. United States v. James, 353 F.3d 606, 614 (8th Cir.2003). “Put another way, one does not *956cede dominion over an item to another just by putting him in possession [of it].” Id.
The record shows that Stockbridge possessed Stanley’s computer — along with his clothing, video games, and other items— only because Stanley was in prison, and they both expected Stanley to re-possess the computer once he got out. This arrangement did not somehow give Stock-bridge the right to allow law enforcement to mosey around Stanley’s computer files anymore than it gave her the right to allow law enforcement to sift through Stanley’s underwear. That Stockbridge possessed the computer does not mean she had common authority over it.
The court also agrees with the government that Stockbridge had common authority through her joint use because she could have accessed Stanley’s files at any time. This circuit’s precedent and other circuit court decisions, demonstrate that even if a bailee (Stockbridge) can potentially access the contents of an item or container (that is, the bailee can break the seal, turn the knob, lift the top, or in this case, click on a username), this potential access does not mean that the bailee has the authority to do so, much less the authority to consent for law enforcement to do so. Ninth Circuit cases subsequent to Matlock have emphasized that a joint-user with limited permission to the searched property lacks common authority to consent to a search. See, e.g., United States v. Warner, 843 F.2d 401, 402 (9th Cir.1988); United States v. Impink, 728 F.2d 1228, 1233 (9th Cir.1984). In those cases where we have found that the consent-giver had common authority, we relied on the consent-giver’s unlimited access to the property to find that the joint-user had common authority to consent to a search. See, e.g., United States v. Guzman, 852 F.2d 1117, 1122 (9th Cir.1988); United States v. Sealey, 830 F.2d 1028, 1031 (9th Cir.1987). Additionally, in those cases where we found that the joint-user had common authority, the consent-giver was a spouse who had been living with the defendant. Here, we have an ex-girlfriend who hadn’t lived with the defendant for years. To meet its burden of showing “common authority,” the government needed to introduce evidence beyond simply that Stockbridge had used the computer and that she was once again in possession of it. But that’s all the government showed, which isn’t enough to establish common authority.
For instance, in Fultz the defendant asked his friend to store some boxes in a garage that the friend owned. 146 F.3d at 1105. The government asserted that the friend had actual authority to consent to a search of the defendant’s boxes because the friend had “full access to the garage, thereby negating any expectation of privacy that Fultz might have had in his cardboard boxes.” Id. at 1106. The Ninth Circuit rejected the government’s argument, pointing out that the friend did not use the boxes, nor did he claim to have a right to access the boxes. Id. Additionally, the court emphasized that the boxes “were segregated in one area of the garage.” Id. “Thus, [the friend] lacked actual authority to consent to the search.” Id. at 1106. Similarly, here the government asserts that Stockbridge had authority to consent to a search, even though Stockbridge adamantly denies ever having such authority. Like the friend in Fultz, Stockbridge did not use Stanley’s files or access them in any way. Like the boxes in Fultz, Stanley’s files were segregated in one area of the computer — that is, under his user-name. Like the defendant in Fultz, Stanley expected Stockbridge to leave his files alone. Yet, without any explanation, the court disregards Fultz altogether.
Furthermore, in United States v. Davis, the Ninth Circuit concluded that a room*957mate could not consent to the search of a bag belonging to her roommate’s boyfriend, even if the boyfriend left the bag at the apartment. 332 F.3d 1163, 1169 (9th Cir.2003). Applying the “container within a container” logic from Welch and Fultz, we reasoned that the key inquiry was not whether the consent-giving roommate had joint access to the apartment, but whether she had joint access to that particular bag. Id. Applied here, the question is not whether Stockbridge simply had joint use of the computer, but whether she had joint use and access to Stanley’s files. “The shared control of ‘host’ property does not serve to forfeit the expectation of privacy of containers within that property.” Id. (emphasis added).
Like the apartment in Davis, in this case the computer functions as the “host” property; Stanley’s username, directories, and files, are the separate containers within that property. The computer hard drive is a modern-day “container within a container.” Stockbridge could no more consent to a search of these files than the roommate in Davis could lawfully consent to the search of the duffle bag. Indeed, an unlocked duffle bag can be just as easily unzipped as an unlocked username can be accessed through the click of a mouse. Yet, if the former is protected, there is little reason not to protect the latter.
Additionally, there is no evidence in the record that Stanley ever gave Stockbridge permission to exercise control over his hard drive, or to consent to a search of the hard drive. Stanley, like all prisoners, had no choice but to allow someone to hold onto his property for him while he served his sentence. When Stockbridge received the computer, Stanley’s flies were behind a sealed username that she had to “breach.” Stanley marked these files confidential by placing them under his username, and by previously password-protecting them, evidencing a desire that no one, including Stockbridge — but especially law enforcement — view the files.
That Stanley allowed Stockbridge to access her music on the computer does not change this calculus: when accessing those files, Stockbridge was acting pursuant to an express authorization that was narrowly tailored. It strains credulity to expand this limited instruction into an all-purpose license that includes not only full access, but also “common authority.” If Stanley had intended to grant Stockbridge common authority over his files, why would he segregate them? Why would he set up a password while living with her? Why would he hide them deep within the computer directories? Every action that Stanley took, from setting up separate user-names to taking the computer with him when he moved out, indicates that he never intended for anyone but him to access his files. Taken together, the totality of the circumstances demonstrates that Stanley did not cede any authority to Stock-bridge to view his files, much less consent to a search. I would follow this circuit’s guidance in Fultz, Davis, and Welch, and reverse the district court’s decision not the suppress this evidence.
For its part, the court cites the Supreme Court’s decision in Matlock, as well our decisions in United States v. Ruiz, 428 F.3d 877 (9th Cir.2005), and United States v. Brannan, 898 F.2d 107 (9th Cir.1990). However, upon closer inspection, these cases would not support the court’s conclusion.
Take Brannan, which the court cites for the following proposition: “ ‘Common authority’ rests upon mutual use of the property by those generally having joint access or control such that it is reasonable to recognize that each of the parties has the right to permit inspection and has assumed the risk that the other party might consent to a search.” 898 F.2d at 108. *958But here the court’s decision never explains how an ex-girlfriend who was serving as a bailee was somehow imbued with the authority to consent to a search of her ex-boyfriend’s property, when a current girlfriend had no such authority in Davis. Or why it is “reasonable to recognize” in this instance that a prisoner “assumes the risk” that a bailee will consent to a search, but it was not reasonable for the bailee to consent in Fultz.
In fact, in Brannan the Ninth Circuit concluded that the defendant’s wife had actual authority to consent to a search of a house that she jointly-owned, even though she had recently moved out. 898 F.2d at 108. But the key in Brannan was that the consent-giver had authority to consent because she (1) was married to the defendant, and (2) actually owned the house that was searched (that is, her name was on the title). Id. The parallel with this case is nonexistent, because Stanley and Stock-bridge were never married, had been broken up for two years, weren’t living together, and Stockbridge has no ownership stake in the computer.
With the co-ownership theory void of any factual support, and the common authority theory void of any precedential support, the only remaining way to justify the government’s warrantless search is by finding apparent authority.
C. Apparent Authority
The court also agrees with the government that the agents were reasonable to conclude that Stockbridge had apparent authority to consent to the computer search, even if Stockbridge was not a co-owner and did not possess common authority. But here, once again, we are reminded that facts are stubborn things.
The test for apparent authority is straight forward: whether the facts available to the agents at the time of the search would lead a reasonable person to conclude that the consenting party had authority over the property. Illinois v. Rodriguez, 497 U.S. 177, 188, 110 S.Ct. 2793, 111 L.Ed.2d 148 (1990) (internal citation omitted); see also Welch, 4 F.3d at 764 (“Under the apparent authority doctrine, a search is valid if the government proves that the officers who conducted it reasonably believed that the person from whom they obtained consent had the actual authority to grant that consent.”).
This, of course, is a fact-based inquiry. Indeed, it’s impossible to apply this test without discussing the facts that the agents knew at the time of the search. But it’s hard to tell how the court concludes that Stockbridge had apparent authority because it chooses not to “revisit [the facts] at this juncture.”
So what is it that the agents knew at the time of consent? For starters, the agents knew that Stockbridge had once dated Stanley, but that the couple had broken up and had not lived together for two years. The agents also knew that Stockbridge was currently dating someone else at the time (David Trimm, the man who tipped off law enforcement about the files in the first place). The agents knew that Stock-bridge was holding the computer while Stanley was in prison. The agents also knew that there was reason to suspect that Stanley’s files contained illicit photographs. And finally, the agents knew that the computer had two separate usernames, one for Stanley and another for Stock-bridge.
There is no way that any reasonable person would believe that, under these circumstances, Stockbridge had the authority to consent to a search of Stanley’s property. How is it reasonable to conclude that an ex-girlfriend has authority to consent to a search of her ex-boyfriend’s computer while he is in prison and while she is dating someone else? It’s not. And, of *959course, that is why the agents sought a search warrant in the first place.
What’s more, the officers knew too much about Stanley’s manifested desire to keep others out of his files, and about his ownership of the computer. That is, they knew that the files were hidden, that the files were saved under Stanley’s username, and that Stanley had taken the computer with him when he moved to California. See Davis, 332 F.3d at 1170 (noting that “the officers were aware” that the defendant’s items “were in a specific area separate from” everything else); Fultz, 146 F.3d at 1106 (noting that officers were aware that the defendant’s boxes were segregated into a separate area of the garage); James, 353 F.3d at 614 (noting that the officers knew the defendant had placed his discs in separate envelopes that would have to be opened, thereby undermining the government’s apparent authority claim).
The court also agrees with the government’s argument that it was objectively reasonable to conclude that Stockbridge had apparent authority because she possessed the computer. But this is a misapplication of the law because possession, in itself, does not translate to authority. Recall that in Welch the boyfriend could not consent to a search of his girlfriend’s purse, even though he possessed it in his car. 4 F.3d at 764. And in Fultz a friend could not consent to a search of a defendant’s boxes even though the friend possessed the boxes. 146 F.3d at 1105. “An officer’s mistaken belief as to the law, even if reasonable, cannot establish apparent authority.” Davis, 332 F.3d at 1170 (citing Welch, 4 F.3d at 764-65). By accepting the government’s apparent authority argument, the court is rubberstamping the government’s errors and ignoring key precedents.
In its decision, the court also apparently agrees with the government’s argument that because Stanley’s files were not password protected (thereby giving Stock-bridge potential access to his files), the agents were reasonable to conclude that Stockbridge had authority to consent. But this, too, is a misapplication of the law. Recall that in Fultz the defendant’s Mend had potential access to the defendant’s boxes, which were unlocked and sitting in the Mend’s garage. We concluded in Fultz that this potential access did not confer authority to consent. 146 F.3d at 1105. Again, conclusions are not “reasonable” if they are based on misapplications of the law. Davis, 332 F.3d at 1170.
Additionally, the court’s reliance on the Fourth Circuit's decision in United States v. Buckner, 473 F.3d 551 (4th Cir.2007), is misplaced. In Buckner the defendant’s wife consented to a search of her husband’s computer files that were stored on a computer that was leased in her name. Id. at 555. Because the files were password-protected, the court concluded that she did not have authority to consent to the search. Id. at 554. The court reasoned that the password protection indicated the defendant’s intent to exclude others from his files. Id. However, the court concluded that the wife had apparent authority to consent based on the information the officers knew at the time, namely,
that the computer was located in a common living area of the Buckners’ marital home, [the officers] observed that the computer was on and the screen lit despite the fact that Frank Buckner was not present, and [the officers] had been told that fraudulent activity had been conducted from that computer using accounts opened in [the wife’s] name. The officers also knew that the machine was leased solely in[the wife’s] name and that she had the ability to return the computer to the rental agency at any time, without Frank Buckner’s knowledge or consent.
*960Id. at 555. None of these facts finds any parallel in the present case. If anything, the reasoning in Buckner counsels against apparent authority. Unlike the couple in Buckner, Stanley and Stockbridge were not living together or even dating one another at the time of the search. Unlike the computer in Buckner, which was leased in the wife’s name, the computer here belonged solely to Stanley.
Given what the agents knew at the time of the search, it cannot be said that they acted pursuant to a reasonable belief that Stockbridge had authority to consent to the warrantless search.
II
Password Protection
Alternatively, the court insists that because Stanley’s files were not password protected when Stockbridge took the computer, Stanley had no reasonable expectation of privacy. But this myopic focus on whether Stanley’s files were password protected ignores key facts.
First, Stanley’s username was password protected while he was living with Stock-bridge. Only when Stanley stopped living with Stockbridge, and began using his computer by himself, did he remove the password. In other words, Stanley took precautions to protect his files when he knew that others would have easy access to them.
Second, the computer did not have a password when Stockbridge took control of it because Stanley was behind bars. Stanley did not have the opportunity to reinstall a password because he did not anticipate the arrest. Prisoners are not allowed furloughs for the sole purpose of reinstalling a password on their computers before turning it over to a custodian. Therefore, Stanley’s failure to install the password does not speak to whether he had an expectation of privacy.
And third, the court’s reasoning would necessarily mean that no prisoner would have any reasonable expectation of privacy in his personal effects the second he enters the jail-house — unless that property happens to be stored in a locked container. Under this interpretation of the Fourth Amendment, a police dragnet could extend to whatever property a prisoner did not place under lock and key before he entered his jail cell. Of course, because most prisoners rarely place their property into storage in anticipation of arrest, this dragnet would functionally include everything a defendant might own. As a matter of policy, this argument is troubling; as a matter of law, it is without support. The court certainly cites no law or case (from any court) to support this sweeping circumvention of the Fourth Amendment.
The court does cite the Fourth Circuit’s decision in Trulock v. Freeh, 275 F.3d 391 (4th Cir.2001), and indeed that case is instructive. In Trulock the Fourth Circuit considered whether one joint-user of a computer can consent to a warrantless search of another’s password-protected files. Id. at 403. The Trulock court concluded that the joint-user’s authority did not extend to the password protected files because by installing a password the defendant had “affirmatively intended to exclude [the joint-user] and others from his personal files.” Id. That reasoning is crucial because here Stanley demonstrated his intention to exclude Stockbridge from his files when he password protected them while living with her. He had no reason to keep that password after he moved out because at that point he was the only user. But that previous intention to exclude others, such as Stockbridge, never went away. Stanley’s files were always segregated under his login name. Password or not, Stanley considered those files his, and that section of the computer closed off. The mechanical focus on whether the computer *961had a password at the very moment when Stockbridge took the computer strips Trulock of its logical moorings. To the extent that password-protected files are more constitutionally private than non-password-protected files, the key fact is that Stanley did secure his directories while he was living with Stockbridge. The court’s formalism misses the forest for the trees.
Additionally, the Supreme Court does not make distinctions between locked and unlocked containers when it comes to expectations of privacy. In Robbins v. California> the Supreme Court considered whether police officers who are conducting a lawful, but warrantless, search of a vehicle during a traffic, stop, may also search an unlocked container found within that car. 453 U.S. 420, 425, 101 S.Ct. 2841, 69 L.Ed.2d 744 (1981). In his plurality opinion, Justice Stewart flatly rejected the argument that there is a constitutional distinction between containers that are more “secured” than others.
First, it has no basis in the language or meaning of the Fourth Amendment.... The contents of Chadwick’s footlocker and Sanders’ suitcase were immune from a warrantless search because they had been placed within a closed, opaque container and because Chadwick and Sanders had thereby reasonably “manifested an expectation that the contents would remain free from public examination.” Once placed within such a container, a diary and a dishpan are equally protected by the Fourth Amendment. Second, even if one wished to import such a distinction into the Fourth Amendment, it is difficult if not impossible to perceive any objective criteria by which that task might be accomplished. What one person may put into a suitcase, another may put into a paper bag. And as the disparate results in the decided cases indicate, no court, no constable, no citizen, can sensibly be asked to distinguish the relative “privacy interests” in a closed suitcase, briefcase, portfolio, duffel bag, or box.
Id. at 426-27, 101 S.Ct. 2841 (internal citations omitted). The Supreme Court reiterated this conclusion in United States v. Ross, and clarified that the scope of the Robbins rule is broad:
This rule applies equally to all containers. One point on which the Court was in virtually unanimous agreement in Robbins was that a constitutional distinction between “worthy” and “unworthy” containers would be improper. Even though such a distinction perhaps could evolve in a series of cases in which paper bags, locked trunks, lunch buckets, and orange crates were placed on one side of the line or the other, the central purpose of the Fourth Amendment forecloses such a distinction. For just as the most frail cottage in the kingdom is absolutely entitled to the same guarantees of privacy as the most majestic mansion, so also may a traveler who carries a toothbrush and a few articles of clothing in a paper bag or knotted scarf claim an equal right to conceal his possessions from official inspection as the sophisticated executive with the locked attaché case.
456 U.S. 798, 822, 102 S.Ct. 2157, 72 L.Ed.2d 572 (1982) (emphasis added). A frail cottage might not have the padlock that a majestic mansion has, but under the Fourth Amendment, that does not matter. Justice Stewart’s logic, which applies as equally to locked suitcases as it does to paper bags (which cannot be “locked” in any meaningful way), should be applied to our modern-day containers, such as computer directories. If an individual can maintain a reasonable expectation of privacy in an unlocked paper bag that’s stuffed with a toothbrush, then likewise he can maintain a reasonable expectation of privacy in his unlocked computer.
*962Constitutional protections do not turn on the frailty of a container’s securities because the Fourth Amendment does not concern itself with passwords or locks. See Miller v. United States, 357 U.S. 301, 307 n. 7, 78 S.Ct. 1190, 2 L.Ed.2d 1332 (1958) (quoting William Pitt’s speech to Parliament in 1763, “ ‘The poorest man may in his cottage bid defiance to all the forces of the Crown. It may be frail; its roof may shake; the wind may blow through it; the storm may enter; the rain may enter; but the King of England cannot enter-all his force dares not cross the thresh-old of the ruined tenement.’ ”) (citing The Oxford Dictionary of Quotations 379 (2d ed.1953)).
Ultimately, the court’s laser-like focus on whether the computer was password protected is much ado about nothing.
Ill
Clearly Erroneous
The court argues that I overlook a difference between our role as an appellate court, and the district court’s role as the fact finder. The court is quite right that we review the district court’s factual findings for “clear error.” Indeed, I apply this standard and conclude that the district court’s conclusion that Stockbridge was a co-owner of the computer was clearly erroneous. An ex-gnifriend does not co-own a computer given to her ex-boyfriend by his father.
But the issue of consent is not a factual question; it is a legal question. This entire dissent is predicated on the assumption that Stockbridge did consent to the search — thereby deferring to the district court’s conclusion. The issue is not whether Stockbridge consented, the issue is whether she had the authority to consent. That is a legal question that we review de novo. The court’s argument is predicated on the assumption that this is a factual issue, which misses the point. Upon review, I conclude that as a matter of law, an ex-girlfriend, acting as a bailee, cannot consent to a search of her ex-boyfriend’s property while he is serving a prison sentence. Additionally, the “apparent authority” question is also a legal issue, even though it involves a fact-based inquiry. Again, as a matter of law, I conclude that based on this court’s precedent and Supreme Court precedent, given what the agents knew at the time, it was unreasonable for them to believe that an ex-girlfriend had the authority to consent to this search. Indeed, as stated above, the agents’ conclusion that Stockbridge had apparent authority was based on two misapplications of the law — which can never be reasonable.
Conclusion
After law enforcement agents took possession of Stanley’s computer, they sought and received a search warrant that allowed them to search the laptop’s files. But warrants are not diamonds; they are not forever.
By failing to renew the search warrant, the government had no choice but to rely on an alternative justification: consent. But this after-the-fact justification cannot be squared with the facts, much less the Constitution. I, for one, do not believe that the Fourth Amendment can be so easily ignored or circumvented. Warrant-less searches are not trivial events. Serious events ought to be taken seriously.
An ex-girlfriend has no authority to consent to a search of her ex-boyfriend’s computer while he is in prison. Under the cardinal principle embedded in the Fourth Amendment, this warrantless search was illegal. I would reverse the district court’s *963decision not to grant Stanley’s Motion to Suppress.
I dissent.
. Although Stockbridge was present and available for cross-examination, the government decided not to question her, meaning her testimony went uncontested.