Can one roommate consent for the police to search another roommate's password-protected computer? According to this article, the answer is "yes", although this may not be consistent with other precedents:

In United States v. Andrus (.pdf), agents suspected that the defendant was accessing websites containing child pornography, but after eight months of investigation still did not have sufficient probable cause to get a search warrant. Instead, they decided to drop by the defendant's house for an impromptu conversation.

The suspect was not at home. However, his 91-year-old father answered the door in his pajamas, invited the agents in, and eventually gave them permission to enter his son's bedroom and search the hard drive on his son's password-protected computer. The agents used EnCase to perform the search, a common forensic tool programmed to ignore Windows logon passwords. Agents found child pornography on the computer.

Without a judge's permission, the search depended on the father's authority to allow police access to his son's computer. On this point, the fact that the son locked his parents out of the computer with a password is critical.

The Fourth Amendment generally prohibits warrantless searches of an individual's home or possessions. There is an exception to the warrant requirement when someone consents to the search. Consent can be given by the person under investigation, or by a third party with control over or mutual access to the property being searched. Because the Fourth Amendment only prohibits "unreasonable searches and seizures," permission given by a third party who lacks the authority to consent will nevertheless legitimize a warrantless search if the consenter has "apparent authority," meaning that the police reasonably believed that the person had actual authority to control or use the property.

Under existing case law, only people with a key to a locked closet have apparent authority to consent to a search of that closet. Similarly, only people with the password to a locked computer have apparent authority to consent to a search of that device. In Andrus, the father did not have the password (or know how to use the computer) but the police say they did not have any reason to suspect this because they did not ask and did not turn the computer on. Then, they used forensic software that automatically bypassed any installed password.

The majority held that the police officers not only weren't obliged to ask whether the father used the computer, they had no obligation to check for a password before performing their forensic search. In dissent, Judge Monroe G. McKay criticized the agents' intentional blindness to the existence of password protection, when physical or digital locks are such a fundamental part of ascertaining whether a consenting person has actual or apparent authority to permit a police search. "(T)he unconstrained ability of law enforcement to use forensic software such at the EnCase program to bypass password protection without first determining whether such passwords have been enabled ... dangerously sidestep(s) the Fourth Amendment."