Search and Seizure - Computers

Favorable and Noteworthy Decisions in the Supreme Court and Federal Appellate Courts

United States v. Raymonda, 780 F.3d 105 (2d Cir. 2015)

The government was aware that the defendant had viewed thumbnails of child pornography for a few seconds. This did not provide a probable cause basis to obtain a serach warrant to search his computer nine months later. Leon applied, however, so the evidence was not subject to the exclusionary rule.

United States v. Ganias, 755 F.3d 125 (2d Cir. 2014)

With a sufficient probable cause basis, government agents obtained a search warrant to seize defendant’s computers and search for files related to two particular corporate entities. The agents made mirror images of the hard drives of the computers and brought them back to the forensic laboratory. At no time did the agents delete anything from the hard drives that were unrelated to the entities listed in the warrant. Over the next two and one-half years, however, the agents determined that the defendant was engaged in other crimes. Aware that they were not permitted to review files other than those listed in the warrant, the agents obtained a second search warrant to examine other files in the mirror hard drives. The Second Circuit held that the extended retention of the files violated the Fourth Amendment. While an initial seizure of the entire computer may be permissible in some cases; and the government is permitted to conduct the search the computer off-site (Rule 41(e)(2)(B)), the retention of the files for 2 ½ years knowing that the files were not covered by the warrant violated the principle that searches must be limited by the “to be seized” clause of the warrant in order to avoid the “general searches” that were condemned by the Framers. Permitting the government to seize everything in a computer and retain everything for years despite the absence of any probable cause or authority in the warrant results in suppressing any evidence discovered in the files (even if later authorized by a subsequent warrant) that were not subject to the initial warrant’s “to be seized” clause. The Second Circuit also held that the fact that these files no longer existed on the defendant’s original computers 2 ½ years later is irrelevant.

United States v. Galpin, 720 F.3d 436 (2d Cir. 2013)

The search warrant affidavit provided inadequate probable cause to support the search and seizure of defendant’s computer. The application sought a warrant to look for evidence of the violation of a particular New York statute, “and or federal statutes”. That statute related to the registration of internet service provider and communications accounts (the officer simply cited the wrong code section). The Second Circuit held that this warrant violated the particularity requirement in that it did not proplerly limit the scope of the search, or, for that matter, the type of evidence that the police were authorized to search for. The Second Circuit emphasized the importance of having proper limits when a computer is the subject of the search. The court also addressed the proper method of “severing” the improper portions of a search warrant from the legitimate clauses. If only limited parts of the warrant are valid (in a warrant that is otherwise sweeping and invalid), suppression of the evidence is appropriate. However, where isolated portions are invalid, the court may uphold the search that is authorized by the legitimate portions of the warrant.

United States v. Sedaghaty, 728 F.3d 885 (9th Cir. 2013)

The search warrant authorized the seizure and searching of the defendant’s computer for tax violations. The agents were aware that the tax violations related to the defendant’s terrorist-financing efforts. Nevertheless, the search warrant only authorized the seizure of financial documents and tax-related information. Once the agents seized the computers, they searched for any terrorism-related information, including the search history for terrorist sites. The fact that the search warrant incorporated the affidavit did not change the “To Be Seized” clause of the search warrant. While an affidavit can be used to cure a search warrant that appears to be overbroad, in this case, the warrant was quite precise and the government sought to use the affidavit to broaden the scope of the seizure. The overbroad seizure in this case required that evidence be suppressed that was obtained in violation of the limitations imposed by the warrant.

United States v. Needham, 718 F.3d 1190 (9th Cir. 2013)

Though the suppression of evidence was not required, because of the good faith exception to the exclusionary rule, the Ninth Circuit holds that evidence that the defendant has engaged in acts of child molestation does not suffice to establish probable cause to issue a search warrant to seize the defendant’s computers to search for evidence of child molestation. The officer’s expression of his opinion that “individuals who have sexual interest in children often possess child pornography” does not amount to probable cause.

United States v. Metter, 860 F.Supp.2d 205 (E.D.N.Y. 2012)

In this district court opinion, the judge held that the government waited too long (15 months) to conduct a review of seized and retained electronic evidence in order to determine whether any of the evidence fell outside the scope of the warrant. As a result of this delay all evidence would be suppressed. The fact that the defendant was allowed to get the original computer back (the government had a mirror image) is not determinative, because it is the government’s continued invasion of privacy, not the defendant’s loss of the computer, that is the fourth amendment concern. “The parties have not provided the Court with any authority, nor has the Court found any, indicating that the government may seize and image electronic data and then retain that data with no plans whatsoever to begin review of that data to determine whether any irrelevant, personal information was improperly seized. The government's blatant disregard for its responsibility in this case is unacceptable and unreasonable.”

United States v. Flores-Lopez, 670 F.3d 803 (7th Cir. 2012)

Rejecting limitations placed on cell phone searches that have been advocated by several state appellate courts, the Seventh Circuit held that the police may search a cell phone as part of a search incident to arrest. In this case, the search was limited to determining the cell phone number, though Judge Posner explains that a somewhat more extensive search would also be authorized. The Court did acknowledge, however, that a permissible search is not limitless (comparing the extent to which the police must limit a search to the “minimization” requirement under Title III wiretaps). The Court noted the decisions from several state courts that hold that such searches must be limited in scope due to the amount of personal information that people have on their cell phones.

United States v. Richards, 659 F.3d 527 (6th Cir. 2011)

Judge Moore issued a concurring opinion in this case that explores the complexity of searches of servers that may be shared by more than one user. The search warrant in this case authorized the search of the server, but nobody realized at the time that the server was used by different users. Even Judge Moore recognized that in this situation, the Leon good faith exception applied.

Chism v. Washington, 661 F.3d 380 (9th Cir. 2011)

The plaintiff’s credit card was used to pay the “hosting fee” for a website the contained child pornography. This information, alone, was not sufficient to support the issuance of a search warrant. This was a civil rights case in which the plaintiffs sued the police for the illegal search.

United States v. Krupa, 658 F.3d 1174 (9th Cir. 2011)

Though the majority opinion held that the search warrant in this case was sufficient to support the search of the defendant’s computers for child pornography (based on evidence that the defendant had possession of several computers and one image of a child who was nude was found on one of the computers), a lengthy dissent by Judge Berzon thoroughly reviews the law on this topic and concludes that probable cause did not exist.

United State v. Doyle, 650 F.3d 460 (4th Cir. 2011)

The search warrant in this case failed to allege that pictures possessed by the resident of a house were pornographic and failed to allege when – or where – the pictures were possessed. This warrant lacked probable cause and did not even survive a good faith Leon review. The probable cause basis of the warrant provided the following: “Three minor children have come forward and stated that [Doyle] has sexually assaulted them at the Doyle residence. One victims [sic] disclosed to an Uncle that Doyle had shown the victim pictures of nude children.” This description failed to state that the “nude pictures” were pornographic (i.e., lewd depictions) and because there was no statement of when these events occurred, the information was stale (the court noted that the notion of staleness when it comes to computer evidence is rarely a basis to deny a search warrant, but in this case, there was no indication of when the pictures existed). In addition, the statement does not indicate where the pictures were shown to the child, so there was scant basis for believing that the evidence sought by the search warrant would be located at the residence, though the appellate court did not base its ultimate conclusion on this flaw in the warrant. With regard to the absence of probable cause, the court also noted that evidence of child molestation does not automatically authorize the search for child pornography.

Virgin Islands v. John, 654 F.3d 412 (3rd Cir. 2011)

The defendant was known to have committed child molestation. There was no information to support the claim that there would be child pornography on the defendant’s computer. Issuing a search warrant for the defendant’s computer was not proper and the exclusionary rule applied. The affiant did not allege in the affidavit that there was a known correlation between child molesters and child pornography collectors. The failure to set forth this critical fact in the affidavit rendered the affidavit so lacking in probable cause that no reasonable officer could have relied on the warrant. The court explained that a magistrate may not infer a correlation between child abuse and the presence of evidence on a computer. That is a fact that must be averred in the affidavit. And when it is omitted, the court may not invoke the good faith exception to the exclusionary rule and assume that the officer was aware of this “fact.”

United States v. D’Andrea, 648 F.3d 1 (1st Cir. 2011)

If the defendant’s computer was “hacked,” this does not qualify as a prior “private search” that deprives the defendant of a reasonable expectation of privacy in the contents of the computer. In this case, a tipster called law enforcement officers to inform them that a person had uploaded child pornography to a cell phone. It was not clear how the tipster was able to view the images, however. Though the defendant had apparently uploaded the images and had attempted to share the images with her “partner,” she had inadvertently sent the images to the tipster. The tipster somehow got a hold of the password that enabled her to view the images. The defendant and her partner, however, did not knowingly share the password with the tipster. The agents then investigated by accessing the cell phone website and also viewed the images. The First Circuit remanded the case to the trial court to determine how the tipster initially viewed the images. If the defendant did not “share” the information with the tipster, or “assume the risk” that the tipster would share the information that the defendant shared with her, this did not qualify as a private search that would authorize a subsequent law enforcement search under Jacobsen.

United States v. Cotterman, 637 F.3d 1068 (9th Cir. 2011)

The Ninth Circuit holds that a computer that is seized at the border during a routine border search may be transported 170 miles away to a forensic lab for two days for analysis is a proper border search. The court holds, however, that these types of searches will be evaluated on a case-by-case basis and that prolonged seizures may not be appropriate. The En Banc Court held that this search required a showing of a reasonable suspicion that the computer contained contraband, a showing that the government satisfactorily made in this case, United States v. Cotterman, 709 F.3d 952 (9th Cir. 2013).

United States v. Stabile, 633 F.3d 219 (3rd Cir. 2011)

Rejecting the analysis advocated by Judge Kozinski in Comprehensive Drug Testing, the Third Circuit holds that traditional “plain view” rules permit government agents to search a computer while lawfully executing a search warrant. In this financial crimes investigation, the police uncovered child pornography videos on the defendant’s computer. This case also contains a thorough discussion of various other computer search issues, including consent to search another person’s computer and the length of time that the computer can be kept by forensic law enforcement agents before conducting the search when the computer is seized pursuant to consent versus when it is seized pursuant to probable cause.

United States v. Warshak, 631 F.3d 266 (6th Cir. 2010)

The Sixth Circuit concludes that the government is required to obtain a search warrant before it may obtain stored emails from a service provider’s computer. The Court also held that to the extent that the Stored Commications Act, 18 U.S.C. § 2703(a) allows the government to obtain such information with only a subpoena, it violates the Fourth Amendment. The court held that a person has a reasonable expectation of privacy in emails that are stored with, or sent or received through, a commercial Internal Service Provider. “The government may not compel a commercial ISP to turn over the contents of a subscriber’s emails without first obtaining a warrant based on probable cause.”

United States v. Comprehensive Drug Testing, Inc., 579 F.3d 989 (9th Cir. 2009), amendedon September 13, 2010, 621 F.3d 1162 (en banc)

In this en banc decision, the Ninth Circuit set originally set forth specific rules that govern the search of a computer where a warrant specifically authorizes the search of the computer for certain documents. In the amended opinion issued in September, 2010, however, Judge Kozinski’s opinion was relegated to a concurring opinion. In this case, the warrant authorized the search of the computer to obtain certain patient records. The law enforcement agents, however, searched the entire computer records, claiming that they could not ensure that the target records were not located in other patients’ files. Thus, various non-target records were viewed and then seized under the plain view doctrine. The Ninth Circuit held that this type of search beyond the scope of the warrant is unlawful. Among other rules, Judge Kozinski’s concurring opinion stated that Magistrates should avoid allowing the government to rely on the plain view doctrine; segregation of records should be handled by a neutral third party; the search protocol should explain the steps that will be taken to avoid reviewing the contents of the computer that are not spelled out in the warrant. Two Circuits have rejected the Ninth Circuit’s decision to limit the plain view doctrine in computer search cases: United States v. Mann, 592 F.3d 779 (7th Cir. 2010), and United States v. Williams, 592 F.3d 511 (4th Cir. 2010).

United States v. Mutschelknaus, 592 F.3d 826 (8th Cir. 2010)

The search warrant in this case authorized the police to search the defendant’s home within ten days, and to search any computer seized from the home within 60 days. This was a permissible application of Rule 41 and it was a reasonable component of the search warrant authorization.

United States v. Frechette, 583 F.3d 374 (6th Cir. 2009)

In this child pornography case, the government succeeded in persuading the Sixth Circuit that there was sufficient probable cause to search the defendant’s house and seize his computers. Well worth reading, however, is Judge Moore’s spirited dissent in which she decries the “radical view of probable cause” expressed in the majority opinion. She concludes her dissent with the following: “I cannot think of any other circumstance where we have endorsed an invasion of a person’s privacy with so few facts from which to draw an inference that the intrusion would likely uncover evidence of a crime . . . As reprehensible as our society finds those who peddle, purchase, and view child pornography, we, as judges, must not let our personal feelings of scorn and disgust overwhelm our duty to ensure the protection of individual constitutional rights. . . . There is no such thing as a fair weather Constitution – one which offers the harbor of its protections against unreasonable search and seizure only in palatable contexts and only to worthy defendants.”

United States v. Payton, 573 F.3d 859 (9th Cir. 2009)

The police had a warrant that authorized the seizure of documents and records in connection with a drug investigation. The Ninth Circuit held that this did not justify searching a computer that was found in the location that was searched.

United States v. Otero, 563 F.3d 1127 (10th Cir. 2009)

The search warrant in this case authorized the seizure of all of the defendant’s computers, hard drives, disks, and virtually any other electronic media. The Tenth Circuit held that the warrant failed the particularity requirement. A valid warrant must limit what can be searched for in a computer to evidence of violations of specific laws, or for specific evidence. The evidence would not be suppressed, however, as the government satisfied the Leon good faith standard.

United States v. Mitchell, 565 F.3d 1347 (11th Cir. 2009)

If the police seize an item such as a computer from a house, based on probable cause (without consent to search it and without a search warrant authorizing the search or seizure), they must seek a warrant promptly. In this case, the police went to the defendant’s house and asked if he had any child pornography on his computer. He initially responded, “yes, probably.” He did not give the officers consent to seize the computer. Nevertheless, based on probable cause the officer seized the hard drive. He kept the hard drive in his office for several weeks (during which time he was on training and was otherwise occupied). Thereafter, twenty-one days after the computer was seized, he obtained a search warrant. The Eleventh Circuit held that this delay was impermissible and suppressed the evidence obtained from the computer. The court noted that personal computers contain a substantial amount of private information and depriving the defendant of the computer that length of time without a warrant violated his Fourth Amendment right to be free from unreasonable searches and seizures. Among other arguments rejected by the Eleventh Circuit, the notion that the search would have taken more than three weeks even if the warrant had been obtained on the day of the seizure, did not support the delay. The court observed that a hard drive of a personal computer is the “digital equivalent of its owner’s home, capable of holding a universe of private information.” For that reason, a three-week delay in starting the search process was not reasonable.

United States v. Falso, 544 F.3d 110 (2d Cir. 2008)

The FBI determined that the defendant had a prior conviction from eighteen years ago for misdemeanor child sex abuse and may have accessed a child pornography web site. On the basis of this information, the agent obtained a search warrant to search the defendant’s computer for child pornography. The Second Circuit held that this information was not sufficient to authorize a search warrant. However, the court concluded that the evidence was would not be suppressed in light of the officer’s good faith in executing a warrant signed by the judge.

United States v. Hodson, 543 F.3d 286 (6th Cir. 2008)

The fact that the defendant was indisputably a child molester did not provide probable cause to believe that there was child pornography on his computer. The officer, moreover, could not have executed the warrant in good faith, because the application contained virtually no information that would have supported the search for pornography.

United States v. Arnold, 533 F.3d 1003 (9th Cir. 2008)

Reasonable suspicion is not required before customs officials may search a laptop or any other electronic storage device of a person entering the country. Customs officers may direct a person to turn on the computer and may then click on various icons and photos without any basis for doing so, other than the border search exception to the search warrant requirement. There is, of course, the possibility that a search will become so destructive, that additional information will be required before customs officers may undertake such a search.

United States v. Forrester, 512 F.3d 500 (9th Cir. 2008)

The police employed a device that enabled them to record the “to and from” location of every email that the defendant sent and received and also recorded the IP address of every website visited by the defendant’s computer and the amount of data sent and received from that computer. The Ninth Circuit held that this was not a “search” that required a warrant, analogizing this investigative technique to a pen register, which is not a search. Smith v.Maryland, 442 U.S. 735 (1979). The court noted, however, that if the police actually record the URL of the search (the actual content of a website that was visited), this might constitute a search. Thus, as the court noted, discovering that the suspect visited The New York Times, does not amount to a search. Discovering that that the suspect read a particular article while at that site might constitute a search. Id. at 1049, n. 6.

Warshak v. United States, 490 F.3d 455 (6th Cir. 2007)

A comprehensive guide to the Stored Communications Act, 18 U.S.C. § 2701, et seq. RE-HEARING EN BANC GRANTED, 10/9/07. The en banc court vacated the district court’s decision on standing grounds. 532 F.3d 521 (6th Cir. 2008). The “guide” provided by the panel opinion, however, is still useful in understanding the structure of the statute. Subsequent decision was issued in December, 2010: see above.

United States v. Heckenkamp, 482 F.3d 1142 (9th Cir. 2007)

The defendant had an expectation of privacy in his personal computer, even after he connected it to the University network, because there was no announced monitoring policy on the network, the defendant’s expectation of privacy was objectively reasonable.

United States v. Buckner, 473 F.3d 551 (4th Cir. 2007)

The police went to the defendant’s house and secured his wife’s consent to “mirror image” the computer that was seen on the table in the living room. The wife said that she used the computer occasionally to play solitaire. The agents then used forensic tools to examine the contents of the computer and determined that the defendant had used the computer to engage in various fraudulent acts. The Fourth Circuit held that the consent of the wife was not valid to enable the police to view the password-protected files on the computer, see Trulock v. Freeh, 275 F.3d 391 (4th Cir. 2001), but that she had apparent authority to grant consent. Thus, the evidence would not be suppressed.

United States v. Adjani, 452 F.3d 1140 (9th Cir. 2006)

The court upholds the seizure and subsequent search of a computer that was owned by a person who was present at the defendant’s house, but who was not the target of the search warrant. The court holds that the computer was at the target location and the seizure of that computer was not unauthorized by the search warrant. The owner was identified in the search warrant application as a person who associated with the target.

United States v. Coreas, 419 F.3d 151 (2d Cir. 2005)

The Second Circuit reviews a “Candyman” search that involved searches of dozens of individuals around the country based on their “membership” in an Internet group that purportedly advertised the availability of child pornography. The FBI search warrant affidavit contained numerous erroneous statements about the method by which subscribers became members and whether they automatically received illicit images. The panel indicated that it would have reversed the trial court’s denial of the Motion to Suppress, but for a prior decision of another panel that found no Franks violation (or sufficient residual information to support probable cause) and that the prior decision was binding on this panel. The other “Candyman” decisions in which a Franks violation was found to taint the warrant, include United States v. Strauser, 247 F.Supp.2d 1135 (E.D. Mo. 2003); United States v. Perez, 247 F.Supp.2d 459 (S.D.N.Y. 2003); United States v. Kunen, 323 F.Supp.2d 390 (E.D.N.Y. 2004). See also United States v. Bailey, 272 F.Supp.2d 822 (D.Neb. 2003); United States v. Martin, 426 F.3d 68 (2d Cir. 2005).

United States v. Carey, 172 F.3d 1268 (10th Cir. 1999)

If a search warrant authorizes the search of a computer for drug sales, the police may not search through the hard drive for evidence of child pornography.

United States v. Gourde, 382 F.3d 1003 (9th Cir. 2004) – REVERSED BY EN BANC COURT IN MARCH, 2006. INCLUDED HERE JUST FOR PURPOSE OF ANALYSIS THAT MAY BE APPROPRIATE IN ANOTHER CASE.

The FBI learned about a website that permitted members to download child pornography. Defendant Gourde was determined to have been a member of the web site for two months. The FBI obtained a search warrant, claiming that any member would have had access to the child pornography. The affiant offered various expert opinions about the M.O. for child pornographers on the internet. The Ninth Circuit held that there was no probable cause to search the defendant’s house and seize his computers based on this information. Moreover, Leon did not apply, because no officer could have relied in good faith on this warrant. There was no information that Gourde had actually downloaded any files from the website, though the FBI acknowledged that it had the capability of determining whether he did prior to the time the search was executed. See also United States v. Weber, 923 F.2d 1338 (9th Cir. 1990). NOTE: REVERSED BY EN BANC NINTH CIRCUIT DECISION (3/9/06) – 440 F.3d 1065 (9th Cir. 2006) (en banc).

United States v. Zimmerman, 277 F.3d 426 (3rd Cir. 2002)

The police obtained a search warrant to search the defendant’s home to look for child and adult pornography. There was no information in the warrant application that indicated that any pornography would be found in his home, though there was information that one clip of adult pornography was seen in the home months earlier by one (or perhaps more than one) high school student. That information, however, was stale. The police relied for the most part on evidence that the defendant was believed to have molested numerous high school students (he was a high school teacher). The police also offered expert opinion in the warrant application that child molesters often keep child pornography in their houses. The Third Circuit held that the warrant was lacking in probable cause and, in fact, could not even have been executed in good faith, given the absence of any evidence that pornography was then located in the house. The use of a seven page, single spaced, affidavit which never even mentioned child pornography could not reasonably have been relied upon to obtain a search warrant. Addressing the boilerplate “expert” opinion, the court wrote, “Rambling boilerplate recitations designed to meet all law enforcement needs do not produce probable cause . . . Experience and expertise, without more, is insufficient to establish probable cause.”

United States v. Runyan, 275 F.3d 449 (5th Cir. 2001)

The defendant’s estranged wife went to the defendant’s house to locate some of her personal items. While there, she found disks that contained pornography, as well as pornographic pictures and a vibrator. The wife took the computer and various disks and gave them to the police. The police then reviewed the disks in great detail. The Tenth Circuit analyzed the Supreme Court decisions in Walter v. United States, 447 U.S. 649 (1980) and United States v. Jacobsen, 466 U.S. 109 (1984) and concluded that the appropriate inquiry is whether the government learned something from the police search that it could not have learned from the private searcher’s testimony. Courts have distinguished cases in which the police examine containers (or the contents of containers) that the private searcher never examined and cases in which the police examine the evidence in greater detail or with greater thoroughness than the previous examination by the private party. Here, the Fifth Circuit holds (1) the police may not examine a closed container that was not opened by the private searchers unless the police are already substantially certain of what is inside that container based on the statements of the private searchers, their replication of the private search, and their expertise. Examining all of the contents of the disks and zip disks in this case amounted to an unlawful search, because the private searchers did not know the contents of those disks. (2) the police may search a container – even more thoroughly than a private searcher previously did – assuming the private searcher previously opened and examined the contents of the container. Compare United States v. Rouse, 148 F.3d 1040 (8th Cir. 1998) (holding that police violated fourth amendment when they discovered more items in traveler’s bag than previously seen by airline employee who initially opened the bag). The court finally remanded the case to the district court to make findings relevant to the government’s claim that the evidence should have been admitted under the independent source / inevitable discovery doctrine. See also United States v. Crist, 627 F.Supp.2d 575 (M.D. Pa. 2008) (prior examination of computer by person who took possession of defendant’s computer did not authorize police to utilize forensic tools to conduct more thorough search of same computer).