Chapter 15: Computer Searches
Generally
Like any other search, searches of computers are governed by the principles and rules established under the Fourth Amendment. There are, however, some additional issues and requirements.
Searching Electronic Communications
The rules that regulate searches of computer files that contain electronic communications or records of electronic communications are covered in Chapter 39 Electronic Communications and Records Searches.
Search Warrants
Seeking offsite search authorization: Officers should ordinarily seek authorization to conduct computer searches offsite unless officers will be conducting only a superficial search; e.g., they will only be looking for information that can be readily obtained by examining the names of directories and files.[1] Authorization may be express or implied.
Express authorization: The judge who issues the warrant may authorize officers to seize the listed computer equipment and search it off site if the affidavit contains an explanation of why an offsite search is reasonably necessary.[2]
Sample request: See this endnote for language that may suffice.[3]
Sample order: See this endnote for language that may suffice.[4]
Implied authorization: If the warrant does not expressly authorize an offsite search but, upon executing the warrant, it became apparent that one will be necessary, there is authority for seizing the device(s) without express authorization and searching it later.[5] But the better practice is to seize the equipment, then promptly seek a warrant to search it offsite.
Contingent authorization: If officers were unsure whether an offsite search would be necessary, a possible (but untested) solution would be to obtain authorization to search the computer offsite if, upon executing the warrant, officers determined it would be impractical to complete the search on-site. Also see Chapter 35 Search Warrant Special Procedures (Anticipatory Search Warrants).
Sample order: See this endnote for language that may suffice.[6]
Time restrictions: If the warrant was executed within ten days after it was issued, officers do not need specific authorization to continue the search process off site after the warrant expires. See Chapter 36 Executing Search Warrants (Time Restrictions).
Possible exception: Prolonged searches: If an offsite search will be prolonged, officers should seek express authorization from the court for a prolonged search. This is especially important if a legitimate business would be adversely affected by the loss of the device.[7]
Searching deleted files: Because old or “deleted” computer files are not always removed from the computer, probable cause to search may continue to exist unless there is reason to believe otherwise.[8] Also see Chapter 4 Probable Cause to Search (The Evidence if Still There, Fresh vs. stale information).
Infer data stored on hard drive: If officers have proof that incriminating information was downloaded to a certain computer, they will almost always have probable cause to believe the data was saved to the hard drive.[9]
Describing devices and data: See Chapter 33 Search Warrant Basics (Descriptions in document and computer searches).
Executing warrants
General principles: See Chapter 36 Executing Search Warrants
Prevent destruction of data: Because computer records may be easily destroyed,[10] officers should consider the following:
Night service: Seek night service authorization. See Chapter 35 Search Warrant Special Procedures (Night Service).
No-knock entry: Seek no-knock entry authorization. See Chapter 35 Search Warrant Special Procedures (No-Knock Warrants).
Returning unlisted hardware, files: If officers determine that certain things they seized were not covered under the warrant or were not otherwise seizable, they should promptly return them.[11] This is especially important if they were needed for a legitimate business.[12] Officers do not need a judge’s authorization to release evidence that was seized by mistake. See Chapter 35 Search Warrant Special Procedures (Releasing Sealed Property, Property seized by mistake).
Conducting the search
Scope of the search: A computer search “may be as extensive as reasonably required to locate the items described in the warrant.”[13]
Searching connected devices: Authorization to search a computer may reasonably be understood as authorizing a search of an external hard drive attached to the computer.[14]
Utilizing forensic search software: The most efficient method of searching for information is usually to utilize a forensic search program.[15] Some of these programs will even search in “deleted” and hidden files. If officers are searching for graphics, such as child pornography, there are programs that will locate all graphics files, even if the suspect attempted to hide them. If officers use a filtering program to identify a particular type of file or image (e.g., child pornography), do not open a file unless the warrant contains authorization to open that file or files of that type.[16]
Key word searches: Basic key word searches may be useful.[17] However, the courts understand that “files and documents can easily be given misleading or coded names, and words that might be expected to occur in pertinent documents can be encrypted.”[18]
Reading files: It is often necessary to read or skim the contents of all or most files to ensure that officers obtain all data listed in the warrant.[19]
Officers not bound by file names: Officers may read a file even though its name or extension is inconsistent with the types of documents they are expressly authorized to seize. This is because file names may not reflect the contents of the file.[20] Also see Chapter 36 Executing Search Warrants (Scope of the Search, Searching homes, Document searches, Reading documents, Labels are not determinative).
Reading unlisted data: When officers search a computer, they will inevitably read and see things that were not specifically listed in the warrant. This will not render the search unlawful if they were searching places in which some of the listed information could have been stored.[21] Officers should be instructed to stop reading a file when they determine that it contains information that is not covered under the warrant.[22] If, however, their reading of the file established probable cause to search for other evidence, they may seize the computer and seek a warrant that expressly authorizes an expanded search.
Recording the search: Before the search begins, officers should consider recording it or at least taking photographs.[23] This serves three purposes:
Assist prosecutors: It will permit prosecutors to show the jury exactly how the computer equipment was set up or arranged, whether the equipment was turned on or off, and what was displayed on the monitors when officers arrived. Such information is often relevant.
Prevent false claims: The photos or recordings will help show the condition of the equipment when officers arrived, and may therefore help protect officers against false claims that they damaged or lost equipment.
Assist in re-connection: If the equipment will be disconnected for an offsite search, photos and recordings may assist in re-connecting it.
Special problems
Constructing investigative firewalls: If the computer contains large amounts of files pertaining to people who are not suspects, officers should consider implementing an investigative firewall, whereby a civilian computer specialist or trained officer who is not involved in the investigation will separate out the files that are not seizable.[24] See this endnote for a suggested procedure.[25]
Delay in seeking warrant: If officers seized the computer for the purpose of applying for a warrant to search it, they must apply for the warrant within a reasonable time.[26]
Search by computer expert: If reasonably necessary, a civilian expert may accompany officers to the scene, conduct the search, or disconnect the equipment prior to transport. See Chapter 35 Search Warrant Special Procedures (Search Conducted by Expert).
Search by special master: If the computer contains privileged information (e.g., doctor-patient records, attorney-client records), the search must be conducted by a special master. See Chapter 35 Search Warrant Special Procedures (Special Master Procedure).
Seizing unlisted data and graphics
Plain view: Under the plain view rule, officers may seize data that was not listed in the warrant if (1) they had a legal right to open the file on which it was found; and (2), upon opening the file they had probable cause to believe the data they observed constituted evidence of a crime.[27] Also see Chapter 36 Executing Search Warrants (Scope of the Search, Document searches) and Chapter 53 Plain View.
When second warrant will be required: If officers are searching for, say, evidence of drug trafficking, and if they open a file and find evidence of child pornography, that evidence will be admissible under the plain view rule; but officers may not look for more evidence of child pornography unless they obtain a second warrant that specifically authorizes such a search.[28] Also see “Reading files” (Reading unlisted data), above.
Seizing intermingled data: When officers locate data that is listed in the warrant, it will usually have been saved to a hard drive or removable storage device and intermingled with unlisted data. Justification for seizing entire hard drive or clone includes the following:
Evidence integrity: Seizing the entire drive or disk serves the interests of justice and the interests of the suspect because it assures that the data will be kept in its original form.
Necessity: As a general rule, officers may seize whatever materials are reasonably necessary to carry out their duties in executing the warrant.[29] Thus, if it is impractical to isolate the seizable data on a hard drive or removable storage appliance at the scene, officers should be permitted to seize the entire hard drive or disk.[30]
Seizing hardware: Hardware may be seized if it was seizable under the warrant or was subject to state or federal forfeiture.[31]
Return hardware and software promptly: See “Executing warrants” (Offsite search, Returning unlisted hardware), above.
Consent Searches
Is express authorization required? It is unsettled whether a suspect’s consent to search his home or office impliedly authorizes a search of his computer.[32] Recommendation: Seek express consent.
Scope of consent: See “Conducting the search” (Executing warrants, Warrants to Search Computers, Searching connected devices), below.
Third party consent: Officers may conduct a consent search of a computer in the possession of a third party for evidence that incriminates the suspect if the third party had actual or apparent authority to consent. See Chapter 16 Consent Searches (Third Party Consent).
Consent by employer: See Chapter 32 Workplace Searches.
Consent by provider: An operator of a business that stores computer files for a fee on equipment it owns or operates cannot effectively consent to a search of stored files, even if he can access them.[33]
Consent by computer system administrator: It is doubtful that a private network’s system administrator could effectively consent to a search of computer files to which he had access.[34]
Privacy Protection Act
When the Act applies: Pursuant to the Privacy Protection Act,[35] officers may not use a search warrant to obtain documents—including computer documents—if all of the following circumstances existed:
(1) Documents in possession of third party: The documents were in the possession of someone other than the suspect.
(2) Work product: The documents constituted “work product.”
(3) Intent to disseminate: It reasonably appeared that the person who possessed the documents intended to disseminate them to the public.
(4) Not fruits or instrumentalities: The documents were not fruits or instrumentalities of the crime under investigation.
Consequences if PPA applies: Officers must attempt to obtain the documents by means of a subpoena, consent, or some other method that is less intrusive than a search warrant.
Notes
[1] 9th CIR: US v.
Hill (9C 2006) 459 F3 966. 974-75 [officers might have to
“examine every one of what may be thousands of files”].
OTHER: US v. Richards (6C 2011) 659 F3
527, 538, fn.8 [“Unlike a physical object that can be immediately
identified as responsive to the warrant or not, computer files may
be manipulated to hide their true contents.”]; US
v. Stabile (3C 2011) 633 F3 219, 234 [“the practical
realities of computer investigations preclude on-site searches”];
US v. Burgess (10C 2009) 576 F3 1078, 1090
[“Practically speaking, the forensic search of a hard drive (or
its equivalent, such as a flash drive) will rarely be conducted at
the ‘site’ while searching an automobile, given the potential to
corrupt or lose evidence.”]; US v.
Campos (10C 2000) 221 F3 1143, 1147 [Excerpt from FBI
affidavit: “Searching computer systems for criminal evidence is a
highly technical process requiring expert skill and a properly
controlled environment. The wide variety of computer hardware and
software available requires even computer experts to specialize in
some systems and applications, so it is difficult to know before a
search which expert should analyze the system and its data”];
US v. Upham (1C 1999) 168 F3 532, 535 [“It is
no easy task to search a well-laden hard drive.”]; US
v. Walser (10C 2001) 275 F3 981, 986 [“The advent of
the electronic age and, as we see in this case, the development of
desktop computers that are able to hold the equivalent of a
library’s worth of information, go beyond the established
categories of constitutional doctrine. Analogies to other physical
objects, such as dressers or file cabinets, do not often inform
the situations we now face as judges when applying search and
seizure law. This does not, of course, mean that the Fourth
Amendment does not apply to computers and cyberspace. Rather, we
must acknowledge the key differences and proceed accordingly.”].
[2] 9th CIR: US v. Fries (9C
2015) 781 F3 1137, 1151 [“The search warrant affidavit
sufficiently explained that seizure of Fries’ computers was
required because of the difficulty in analyzing the computers
on-site and the potential for alteration or destruction of the
computers’ components.”]; US v. Banks (9C
2009) 556 F3 967, 973 [“the affidavit explained why it was
necessary to seize the entire computer system”]; US
v. Hill (9C 2006) 459 F3 966, 976 [“We do not
approve of issuing warrants authorizing blanket removal of all
computer storage media for later examination when there is no
affidavit giving a reasonable explanation … as to why a
wholesale seizure is necessary.”]; US v.
Hay (9C 2000) 231 F3 630, 637 [affidavit “justified taking
the entire system off site because of the time, expertise, and
controlled environment required for a proper analysis”].
[3] SAMPLE LANGUAGE: To seek express
authorization for an offsite computer search:
Request for Offsite Search Authorization: For the
following reasons, I request authorization to remove the listed
computers and computer-related equipment on the premises and
search them at a secure location:
(1) The amount of data that may be stored in hard drives and
removable storage devices is enormous, and I do not know the
number or size of the hard drives and removable storage devices
that will have to be searched pursuant to this warrant.
(2) The data to be seized may be located anywhere on the hard
drives and removable storage devices, including hidden files,
program files, and “deleted” files that have not been overwritten.
(3) The data may have been encrypted, it may be inaccessible
without a password, and it may be protected by self-destruct
programming, all of which will take time to detect and bypass.
(4) Because data stored on a computer can be easily destroyed or
altered, either intentionally or accidentally, the search must be
conducted carefully and in a secure environment.
(5) To prevent alteration of data and insure the integrity of the
search, I plan to make clones of all drives and devices, then
search the clones; this, too, will take time and special
equipment.
(6) Finally, a lengthy on-site search may pose a severe hardship
on all people who [live][work] on the premises, as it would
require the presence of law enforcement officers to secure the
premises while the search is being conducted.
[4] SAMPLE LANGUAGE:
Order Authorizing Offsite Search: Good cause having been
established in the affidavit filed herein, the officers who
execute this warrant are authorized to remove the computers and
computer-related equipment listed in this warrant and search them
at a secure location.
[5] OTHER: Guest v.
Leis (6C 2001) 255 F3 325, 334-37 [“a seizure of the whole
computer system was not unreasonable, so long as there was
probable cause to conclude that evidence of a crime would be found
on the computer”]; US v. Alexander (8C 2009) 574 F3 484,
490 [“it would have been difficult, and possibly more intrusive to
Alexander’s privacy, for law enforcement to conduct an on-site
review of each of more than 600 photographs to determine whether
they were evidence of illegal conduct”].
[6] EXAMPLE: “Authorization is hereby
given to conduct the search for computer data listed in this
warrant at [insert location where offsite search would occur] if,
upon executing this warrant, the affiant determines that, as a
result of the number and size of the computer storage devices on
the premises, a thorough search of the devices by the officers
executing the warrant could not be completed in [insert number]
hours after the premises have been entered and secured.”
NOTE: Although we are not aware of any law directly on this
subject, there are several cases in which the courts have approved
so-called “anticipatory search warrants.” See Chapter 35 Search
Warrant Special Procedures (Anticipatory warrants).
[7] OTHER: US v.
Mutschelknaus (8C 2010) 592 F3 826, 830 [“Here, the
officers’ explicit request for an extension shows a manifest
regard for the issuing judge’s role in authorizing searches”].
ALSO SEE: US v. Jarman (5C 2017) 847 F3 259.
[8] 9th CIR: US v. Kvashuk (9C
2022) 29 F4 1077, 1087 [“Given the long memory of computers,
evidence of a crime typically remains on a computer even if the
defendant attempts to delete it.”]; US v. Flores (9C 2015)
802 F3 1028, 1043 [“Thanks to the long memory of computers, any
evidence of a crime was almost certainly still on the defendant’s
computer even if he had tried to delete the images.”].
OTHER: US v. Valley (7C 2014) 755 F3 581, 586 [“This
court has discussed the persistence of digital storage, noting
that in only the ‘exceptional case’ will a delay between the
electronic transfer of an image and a search of the computer
destroy probable cause to believe that a search of the computer
will turn up the evidence sought.” Citation omitted.];
US v. Seiver (7C 2012) 692 F3 774, 776 [“And since a
deleted file is not overwritten at all at once, it may be possible
to reconstruct it from the bits of data composing it (called
‘slack data’), which are still retrievable because they have not
yet been overwritten”].
[9] CAL: P v. Ulloa (2002) 101
CA4 1000, 1006 [officers “could reasonably conclude that
examination of defendant’s computer would either confirm or dispel
the allegations of a relationship between defendant and the
minor”]. OTHER: US v. Cartier (8C 2008) 543 F3 442
[FBI agents had probable cause to search the defendant’s home
computer for child pornography because they received information
from Spanish law enforcement that child pornography originating in
Spain had been downloaded to that computer.”]; US v.
Vosburgh (3C 2010) 602 F3 512, 527 [it was reasonable to
believe that data or graphics are now stored on a certain computer
because officers established that the data or graphics were sent
to or received by the IP address assigned to that computer];
US v. Riccardi (8C 2005) 405 F3 852, 860 [“The
presence of a computer with an internet hook-up and a Kinko’s
receipt indicating Mr. Riccardi had converted Polaroid photos into
digitized format, gives rise to a fair inference that the computer
will contain images similar to the photographs.”];
US v. Haymond (10C 2012) 672 F3 948, 959 [officer “observed
a user with an IP address linked to Mr. Haymond’s residence who
had numerous files of child pornography available for other
LimeWire users”]; US v. Hinojosa (6C 2010) 606 F3
875, 885; US v. Terry (6C 2008) 522 F3 645, 648 [“if
a pornographic image has originated or emanated from a particular
individual’s email account, it logically follows that the image is
likely to be found on that individual’s computer or on storage
media associated with the computer”]; US v.
Khanani (11C 2007) 502 F3 1281, 1290 [tax records in tax
preparer’s office computer].
[10] OTHER: US v.
Hunter (D. Vt. 1998) 13 FS2 574, 583 [“Computer records are
extremely susceptible to tampering, hiding, or destruction,
whether deliberate or inadvertent.”].
[11] USSC: US v.
Johns (1985) 469 US 478, 487. 9th CIR:
US v. Tamura (9C 1982) 694 F2 591, 597 [“it was highly
improper for the Government to retain the master volumes as a
means of coercing Marubeni employees to stipulate to the
authenticity of the relevant documents”]. OTHER:
Davis v. Gracey (10C 1997) 111 F3
1472, 1477 [“A failure timely to return seized material which is
without evidentiary value and which is not subject to forfeiture
may state a constitutional or statutory claim.”]; US
v. Hunter (D. Vt. 1998) 13 FS2 574, 583 [“The
wholesale removal of computer equipment can undoubtedly disable a
business or professional practice and disrupt personal lives, and
should be avoided when possible.”].
[12] OTHER: US v.
Hunter (D. Vt. 1998) 13 F.Supp.2d 574, 583 [“The wholesale
removal of computer equipment can undoubtedly disable a business
or professional practice and disrupt personal lives, and should be
avoided when possible.”].
[13] QUOTE FROM: US v.
Wuagneux (11C 1982) 683 F2 1343, 1352.
[14] OTHER: US v. Beckmann (8C
2015) 786 F3 672, 678] [there is a “common understanding that the
term ‘computer’ encompasses the collection of component parts
involved in a computer’s operation”].
[15] OTHER: Steve Jackson Games
v. US Secret Service (5C 1994) 36 F3 457,
463.
[16] OTHER: US v.
Mann (7C 2010) 592 F3 779.
[17] OTHER: US v.
Burgess (10C 2009) 576 F3 1078, 1093 [“Keyword searches may
be useful in locating suspect files, but not always.”].
[18] QUOTE FROM:
US v. Ulbricht (2C 2017) 858 F3 71, 102.
[19] 9th CIR: US v. Schesso (9C
2013) 730 F3 1040, 1046 [“The government had no way of knowing
which or how many illicit files there might be or where they might
be stored”]; US v.
Comprehensive Drug Testing, Inc. (9C 2010) 621 F3 1162,
1171 [court says it has “no cavil” with the general proposition
that every file must be read “if the government can’t be sure
whether data may be concealed, compressed, erased or booby-trapped
without carefully examining the contents of every file”].
OTHER: US v. Cobb (4C 2020) 970 F3 319, 332 [“The
officer has a lawful right of access to all files, albeit only
momentary”]; US v. Triplett (5C 2012) 684 F3 500, 506
[“Although officers should limit exposure to innocent files, for a
computer search, in the end, there may be no practical substitute
for actually looking in many (perhaps all) folders and sometimes
at the documents contained within those folders.”]; US
v. Richards (6C 2011) 659 F3 527, 540 [“so long as
the computer search is limited to a search for evidence explicitly
authorized in the warrant, it is reasonable for the executing
officers to open the various types of files located in the
computer’s hard drive in order to determine whether they contain
such evidence”]; US v. Stabile (3C 2011) 633
F3 219, 234; US v. Williams (4C 2010) 592 F3
511, 522 [“a computer search must, by implication, authorize at
least a cursory review of each file on the computer”]; US
v. Gray (E.D. Va. 1999) 78 FS2 524, 528 [“agents
authorized by warrant to search a home or office for documents
containing certain specific information are entitled to examine
all files located at the site”].
[20] 9th CIR: US v.
Hill (9C 2006) 459 F3 966, 978 [“Criminals will do all they
can to conceal contraband, including the simple expedient of
changing the names and extensions of files to disguise their
content from the casual observer.”]; US v.
Adjani (9C 2006) 452 F3 1140, 1150 [“The government should
not be required to trust the suspect’s self-labeling when
executing a warrant.”]; US v. Giberson (9C
2008) 527 F3 882, 890 [“It would be unreasonable to require the
government to limit its search to directories called, for example,
‘Fake I.D. Documents'”]. OTHER: US v.
Stabile (3C 2011) 633 F3 219, 239 [“criminals can easily
alter file names and file extensions to conceal contraband”];
US v. Williams (4C 2010) 592 F3 511, 522
[“Surely, the owner of a computer, who is engaged in criminal
conduct on that computer, will not label his files to indicate
their criminality.”]; US v. Burgess (10C
2009) 576 F3 1078, 1093 [“It is unrealistic to expect a warrant to
prospectively restrict the scope of a search by directory,
filename or extension or to attempt to structure search
methods—that process must remain dynamic.”]; US v.
Turner (1C 1999) 169 F3 84, 86, fn.2 [officers who are
conducting a search are not required to believe the name on the
file accurately reflects its contents]; Kitty’s East v.
US (10C 1990) 905 F2 1367 [“Evidence of conspiracy is often
hidden in the day-to-day business transactions among the involved
entities.”]; US v. Riley (2C 1990) 906 F2
841, 845 [“few people keep documents of their criminal
transactions in a folder marked ‘drug records'”]; Frasier
v. State (Ind. App. 2003) 794 NE2 449, 466
[“Although such a label might say ‘Tax Records,’ the photograph
inside could be of a nude child. Likewise, a computer image file
containing child pornography could easily be named ‘tax_
records.xls,’ in an attempt to hide its actual contents.”].
[21] USSC: Andresen v.
Maryland (1976) 427 US 463, 482, fn.11 [“In searches of
papers, it is certain that some innocuous documents will be
examined, at least cursorily, in order to determine whether they
are, in fact, among those papers authorized to be seized.”].
9th CIR: US v. Wong (9C 2003) 334 F3
831, 838 [“While searching the graphics files for evidence of
murder, as allowed by the warrant, [the officer] discovered [child
pornography].”]. OTHER: US v.
Otero (10C 2009) 563 F3 1127, 1135-36 [“The fact that some
irrelevant information was viewed resulted more from the ease of
electronically storing (and hiding) vast amounts of invisible
information than any overreaching on the part of the officers.”];
US v. Hunter (D. Vt. 1998) 13 FS2 574, 583
[“Computer searches present the same problem as document
searches—the intermingling of relevant and irrelevant material—but
to a heightened degree.”]; Guest v. Leist (6C 2001)
255 F3 325, 334 [“Although there were presumably communications on
the computers that did not relate to the offenses, a search does
not become invalid merely because some items not covered by a
warrant are seized.”]; US v. Campos (10C
2000) 221 F3 1143, 1148 [“Computers often contain intermingled
documents (i.e., documents containing both relevant and irrelevant
information).”]; US v. Maali (M.D. Fla. 2004)
346 FS2 1226, 1265 [“seizure of superfluous computer files is
virtually inevitable”].
[22] OTHER: US v.
Carey (10C 1999) 172 F3 1268; US v.
Abbell (S. D. Fla. 1997) 963 FS 1178, 1198. COMPARE: US v. Gray (E.D. Va. 1999) 78 FS2
524, 530 [“[The officer in Carey, supra] testified
that, when he thereafter searched the ‘jpg’ files, he was looking
for more child pornography, and not drug-related material. By
contrast, [the officer in this case] testified that at all times,
he was looking for the [listed] documents and hacker materials
that were the subject of the warrant.”].
[23] USSC: Wilson v.
Layne (1999) 526 US 603, 613 [videotaping may be reasonable
“as part of a ‘quality control’ effort to ensure that the rights
of homeowners are being respected, or even to preserve evidence”].
CAL: P v. Hines (1997) 15 C4 997, 1041-42.
[24] 9th CIR: US v.
Comprehensive Drug Testing, Inc. (9C 2010) 621 F3 1162,
1168 [“These computer personnel—not the case agents—were
specifically authorized to examine all the data”]. OTHER:
US v. Aboshady (1C 2020) 951 F3 1, 5 [defendant’s Google
files were sent to officers “who were not part of the prosecution
team” and who filtered out “potentially privileged
communications”]. ALSO SEE: US v.
Simels (2C 2011) 654 F3 161, 166 [“Recognizing the
potential issues, the Government sought to create what it calls a
‘fire wall’ between the agents investigating obstruction offenses
by Simels and the team of prosecutors and agents involved in the
criminal case against Simels’s client, Khan. The resulting
procedures were designed to prohibit disclosure of information
collected during the investigation of Simels to the Khan
prosecution team.”].
[25] NOTE: In US v.
Comprehensive Drug Testing, Inc. (9C 2010) 621 F3 1162 the
court approved a warrant in which federal agents were required to
implement the following procedure:
(1) The agents who execute the warrant must be accompanied by
“computer personnel,” a term defined as “law enforcement personnel
trained in searching and seizing computer data,” (hereinafter,
“computer specialist”).
(2) The computer specialist must attempt to determine if the
listed evidence could be obtained on-site “in a reasonable amount
of time and without jeopardizing the ability to preserve the
data.”
(3) If computer specialist determined that an on-site search was
impractical, the computer specialist—not the case agents”—were
authorized “to examine all the data on location to determine how
much had to be seized to ensure the integrity of the search.”
(4) The agents were then instructed to remove the necessary
hardware and software to a “controlled environment, such as a law
enforcement laboratory,” where the computer specialist was
authorized to do the following:
(a) Take steps to “recover or restore hidden or erased data.”
(b) Separate the data computer files into two groups: (1) data
pertaining to the ten players listed in the warrant and (2) all
unlisted data. The warrant also stated: Within a “reasonable
period of time,” but not more than 60 days after the seizure,
federal agents were to return to CDT all data that was not
seizable.
(5) After the data had been separated, the case agents were
authorized to search the data pertaining to the ten named players.
(6) All data that was not seizable must be returned to
Comprehensive Drug Testing “within a reasonable period of time not
to exceed 60 days from the date of the seizure unless further
authorization was obtained from the court.”
[26] 9th CIR: US v. Sullivan (9C
2014) 753 F3 845, 855-56. OTHER: US v. Smith (2C
2020) 967 F3 198, 205 [“The right of the police to temporarily
seize a person’s property pending the issuance of a search warrant
presupposes that the police will act [with diligence.”].
[27] OTHER: US v.
Stabile (3C 2011) 633 F3 219, 238-40]; US v.
Mann (7C 2010) 592 F3 779, 785.
[28] CAL: P v. Rangel (2012) 206
CA4 1310, 1317 [“Federal cases have recognized that a second
warrant to search a properly seized computer it not necessary
where the evidence obtained in the search did not exceed the
probable cause articulated in the original warrant.” Citations
omitted.]. 9th CIR: US v. Giberson (9C
2008) 527 F3 882, 88 [“it was reasonable for the officers to
believe that seizable items were stored on Giberson’s computer,
and to secure the computer and obtain a specific warrant and
search it”]. OTHER: US v. Loera (10C 2019) 923 F3
907, 920 [“Although officers do not have to stop executing a
search warrant when they run across evidence outside the warrant’s
scope, they must nevertheless reasonably direct their search
toward evidence specified in the warrant.”]; US v.
Burgess (10C 2009) 576 F3 1078, 1095 [“[The officer]
immediately closed the gallery view when he observed a possible
criminal violation outside the scope of the warrant’s search
authorization and did not renew the search until he obtained a new
warrant.”].
[29] 9th CIR: US v.
Beusch (9C 1979) 596 F2 871, 877 [“As long as an item
appears, at the time of the search, to contain evidence reasonably
related to the purposes of the search, there is no reason absent
some other Fourth Amendment violation to suppress it. The fact
that an item seized happens to contain other incriminating
information not covered by the terms of the warrant does not
compel its suppression, either in whole or in part.”].
OTHER: US v. Wuagneux (11C 1982) 683
F2 1343, 1353; US v. Fawole (4C 1986) 785 F2
1141, 1144; Davis v. Gracey (10C 1997)
111 F3 1472, 1480-81 [there are “obvious difficulties attendant in
separating the contents of electronic storage from the computer
hardware during the course of a search.”].
[30] OTHER: US v.
Stabile (3C 2011) 633 F3 219, 234 [seizure of six hard
drives was reasonable because the evidence of financial fraud
“could have been found in any location on any of the six hard
drives”]. NOTE: It would seem the only other option would
be for officers to remain on the scene for days or weeks, sorting
through all of the stored data, trying to separate the seizable
from the unseizable. This would certainly constitute an
unwarranted use of police resources, and it would not be in the
best interest of the occupants of the premises who would be
required to endure a police presence in their home or business for
days or weeks. US v. Wuagneux (11C 1982) 683
F2 1343, 1353 [“It was also reasonable for the agents to remove
intact files, books and folders when a particular document within
the file was identified as falling within the scope of the
warrant. To require otherwise would substantially increase the
time required to conduct the search, thereby aggravating the
intrusiveness of the search.”]; US v. Schandl (11C
1991) 947 F2 462, 465-66 [“Indeed, it might have been far more
disruptive had the agents made a thorough search of each
individual document and computer disc before removing it from
Schandl’s home and office.”]; US v.
Henson (6C 1987) 848 F2 1374, 1383-84 [“We do not think it
is reasonable to have required the officers to sift through the
large mass of documents and computer files found in the Hensons’
office, in an effort to segregate those few papers that were
outside the warrant.”]; US v. Kufrovich (D.
Conn. 1997) 997 FS 246, 264 [“Certainly, many of the files found
on the computer did not constitute evidence in this case. However,
an appendix to the search warrant explained that, because
information may be easily hidden in a computer, it is necessary to
seize the entire system to search adequately for files that might
contain relevant information.”]. ALSO SEE:
P v. Kibblewhite (1986) 178 CA3 783 [officers acted
reasonably in seizing a safe during search for drugs because the
suspect refused to give them the combination].
[31] CAL: Pen. Code§§ 186
et seq. OTHER: 21 USC§ 881; US
v. 5528 Belle Pond Drive (E.D. Va. 1991) 783
FS 253, 256 [computer subject to forfeiture because the computer
contained data detailing the growing characteristics of
marijuana].
[32] OTHER: US v.
Carey (10C 1999) 172 F3 1268, 1274; US
v. Turner (1C 1999) 169 F3 84 [suspect’s consent to “look
around” for an intruder or clues to the intruder’s identity did
not authorize a search of a computer].
[33] OTHER: 18 USC§§ 2702, 2703.
[34] NOTE: Our conclusion that a
private network’s system administrator could not effectively
consent to a search of computer files is based on the rule that
hotel desk clerks, property managers, and landlords (people who
technically have control over property to which others have a
right to exclusive or virtually exclusive access) do not
ordinarily have authority to consent to searches of such property.
See Chapter 16 Consent Searches (Third Party Consent, Consent
given by property manager). A system administrator could probably
consent if the suspect impliedly consented to such access; e.g.,
the suspect knew the administrator had authority to access his
files and had regularly done so. Consent by a system administrator
might also be effective if the suspect had abandoned the files.
Chapter 59
Standing
(Abandonment).
[35] OTHER: 42 USC§§ 2000aa
et seq.