IN THE UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF OREGON

UNITED STATES OF AMERICA,

Plaintiff,

v.

AMMON BUNDY, JON RITZHEIMER,

JOSEPH O’SHAUGHNESSY, RYAN

PAYNE, RYAN BUNDY, BRIAN

CAVALIER, SHAWNA COX, PETER

SANTILLI, JASON PATRICK,

DUANE LEO EHMER, DYLAN 

ANDERSON, SEAN ANDERSON,

DAVID LEE FRY, JEFF WAYNE

BANTA, SANDRA LYNN ANDERSON,

KENNETH MEDENBACH, BLAINE

COOPER, WESLEY KJAR, COREY

LEQUIEU, NEIL WAMPLER, JASON

CHARLES BLOMGREN, DARRYL

WILLIAM THORN, GEOFFREY

STANEK, TRAVIS COX, ERIC LEE

FLORES, and JAKE RYAN,

Defendants.

3:16-cr-00051-BR

 

ORDER DENYING MOTIONS

(#712, #741) TO SUPPRESS

FACEBOOK EVIDENCE

1 - ORDER DENYING MOTIONS (#712, #741) TO SUPPRESS FACEBOOK

EVIDENCE

Case 3:16-cr-00051-BR Document 915 Filed 07/20/16 Page 1 of 13
BROWN, Judge.

This matter comes before the Court on the Motion (#712) to

Suppress Facebook Evidence filed by Defendant Ryan Payne1

 and the

Motion (#741) to Suppress Evidence (Facebook Accounts) filed by

Defendant David Lee Fry. The following Defendants join in these

Motions: Ammon Bundy, Jon Ritzheimer, Joseph O’Shaughnessy, Ryan

Bundy, Shawna Cox, Peter Santilli, Jason Patrick, Sean Anderson,

Sandra Anderson, David Lee Fry, Travis Cox, and Darryl Thorn

(collectively referred to herein as Defendants). 

The Court heard oral argument on July 18, 2016, and the

Court received into evidence for purposes of these Motions

Defendants’ Exhibits D through H in addition to the materials

filed with Defendants’ Motion.2

For the reasons that follow, the Court DENIES the Motion

(#712) to Suppress Facebook Evidence filed by Defendant Ryan

Payne and the Motion (#741) to Suppress Evidence (Facebook

Accounts) filed by Defendant David Lee Fry.

1

 Although Payne entered a guilty plea on July 19, 2016, and

Travis Cox pled guilty on July 20, 2016, and, therefore, this

Motion is moot as to them, the Motion is ripe as to those

Defendants who remain in this case. Accordingly, Per Olson

counsel for Defendant David Lee Fry, argued this Motion at oral

argument on July 18, 2016, on behalf of the remaining Defendants.

2 The Court directs the Clerk to return Defendants’ Exhibits

D through H to counsel for David Lee Fry to maintain through any

appeal of this matter.

2 - ORDER DENYING MOTIONS (#712, #741) TO SUPPRESS FACEBOOK

EVIDENCE

Case 3:16-cr-00051-BR Document 915 Filed 07/20/16 Page 2 of 13
BACKGROUND

On April 8, 2016, Magistrate Judge Paul Papak of the United

States District Court for the District of Oregon issued a searchand-seizure Warrant for Facebook accounts that were associated

with Defendants. The Warrant authorized the search of

Defendants’ Facebook accounts for information that constitutes

evidence of a violation of 18 U.S.C. § 372 in connection with

Defendants’ activities at the Malheur National Wildlife Refuge in

January and February 2016. The accounts to be searched were

stored at premises owned, maintained, controlled, or operated by

Facebook (a company headquartered in Menlo Park, California) in

the Northern District of California. In particular, the Warrant

permitted the search and seizure of information pertaining to:

a. Records, including photographs, comments, videos, and

other postings, of or about individuals illegally

occupying the Malheur National Wildlife Refuge (MNWR),

the planning and preparation of that occupation, and

requests for support or assistance and the recruitment

of others in furtherance of the occupation of the MNWR.

b. Records, including photographs and videos or the

sharing of any photographs and videos, of individuals

in possession of firearms or with others in possession

of firearms, while at the MNWR or in Harney County,

Oregon.

c. Records of communications, including private messages,

with other coconspirators.

d. Evidence indicating how and when the Facebook account

was accessed or used, to determine the chronological

and geographic context of account access, use, and

events relating to the crime under investigation and to

the Facebook account owner.

3 - ORDER DENYING MOTIONS (#712, #741) TO SUPPRESS FACEBOOK

EVIDENCE

Case 3:16-cr-00051-BR Document 915 Filed 07/20/16 Page 3 of 13
e. Records relating to who created, used, or communicated

with the user ID, including records about their

identities and whereabouts.

f. Evidence indicating the Facebook account owner’s or

user’s state of mind as it relates to the crimes under

investigation.

g. The identity of the person(s) who communicated with the

user ID about matters relating to the armed occupation

of MNWR, including records that help reveal their

whereabouts.

The Warrant limited the search to information during the period

November 1, 2015, through Defendant-specific dates in lateJanuary 2016 to mid-February 2016.

The Warrant also directed law enforcement to conduct an

initial review of the information that Facebook produced in order

to separate the information into two categories: information

responsive to the Warrant and information that was not responsive

to the Warrant. Although the Warrant specifically authorized the

government to use responsive information in the same manner as

any other seized evidence, the Warrant required the government to

seal and to store nonresponsive information in a secure location

and not to review that information again without further order of

the Court.

DISCUSSION

I. Motion (#712) to Suppress Facebook Evidence 

In their Motion (#712) to Suppress Facebook Evidence

4 - ORDER DENYING MOTIONS (#712, #741) TO SUPPRESS FACEBOOK

EVIDENCE

Case 3:16-cr-00051-BR Document 915 Filed 07/20/16 Page 4 of 13
Defendants contend the Warrant was void ab initio because the

Magistrate Judge in the District of Oregon did not have

jurisdiction to authorize a search to be executed on property

located in the Northern District of California. Defendants rely

on Federal Rule of Criminal Procedure 41(b), which, subject to

certain exceptions, provides a magistrate judge has the authority

to “issue a warrant to search for and seize a person or property

located within the district.” Fed. R. Crim. P. 41(b)(1).

As the government emphasizes, however, the Magistrate Judge

in this case issued the Warrant pursuant to 18 U.S.C. § 2703. 

Section 2703(a) provides:

A governmental entity may require the disclosure by a

provider of electronic communication service of the

contents of a wire or electronic communication, that is

in electronic storage in an electronic communications

system for one hundred and eighty days or less, only

pursuant to a warrant issued using the procedures

described in the Federal Rules of Criminal Procedure

(or, in the case of a State court, issued using State

warrant procedures) by a court of competent

jurisdiction.

Section 2703(b) and (c) similarly authorize “a court of competent

jurisdiction” to issue warrants to search and to seize electronic

communications and remote computing services. “Court of

competent jurisdiction,” in turn, is defined to include “any

district court of the United States (including a magistrate judge

of such a court) or any United States court of appeals that . . .

has jurisdiction over the offense being investigated.” 18 U.S.C.

5 - ORDER DENYING MOTIONS (#712, #741) TO SUPPRESS FACEBOOK

EVIDENCE

Case 3:16-cr-00051-BR Document 915 Filed 07/20/16 Page 5 of 13
§ 2711(3)(A)(I).

Although Defendants concede the Warrant was issued pursuant

to § 2703, they, nevertheless, assert the territorial limitations

of Rule 41(b) apply because § 2703 does not expressly override

Rule 41. According to the terms of Rule 41(a)(1), however,

“[t]his rule does not modify any statute regulating search or

seizure, or the issuance and execution of a search warrant in

special circumstances.” The territorial limitation in Rule 41,

therefore, does not limit warrants issued pursuant to § 2703. 

Accordingly, because, pursuant to 18 U.S.C. § 2703, the

Oregon Magistrate Judge had jurisdiction “over the offense being

investigated,” the Magistrate Judge likewise had jurisdiction to

issue the Warrant in this case.

II. Motion (#741) to Suppress Evidence (Facebook Accounts)

In their Motion (#741) to Suppress Defendants contend the

Warrant was overbroad because there was not sufficient probable

cause to justify a Warrant to search all Facebook functions,

including the private-messaging function.

“Probable cause is established if an affidavit presents a

‘fair probability’ that evidence of criminal activity will be

found in the place to be searched.” United States v. Flores, 802

F.3d 1028, 1043 (9th Cir. 2015)(quoting Illinois v. Gates, 462

U.S. 213, 238 (1983)). Probable cause in a search-warrant

affidavit must be based on the material supplied by the affiant

6 - ORDER DENYING MOTIONS (#712, #741) TO SUPPRESS FACEBOOK

EVIDENCE

Case 3:16-cr-00051-BR Document 915 Filed 07/20/16 Page 6 of 13
as well as “reasonable inferences” drawn from the material. 

Gates, 462 U.S. at 240. See also United States v. Schesso, 730

F.3d 1040, 1045 (9th Cir. 2013). When determining whether the

warrant was supported by probable cause, the court gives “great

deference” to the probable-cause determination of the issuing

judge. United States v. Grant, 682 F.3d 827, 832 (9th Cir.

2012). See also Flores, 802 F.3d at 1043. 

The court considers three factors when analyzing the

overbreadth of a warrant:

(1) whether probable cause existed to seize all items

of a category described in the warrant; (2) whether the

warrant set forth objective standards by which

executing officers could differentiate items subject to

seizure from those which were not; and (3) whether the

government could have described the items more

particularly in light of the information available.

Flores, 802 F.3d at 1044 (quoting United States v. Le Shi, 525

F.3d 709, 731-32 (9th Cir. 2008)).

Defendants assert the Warrant is overbroad because Facebook

functions are obviously severable, and the search-warrant

application only provided probable cause to search Defendants’

public postings and not other features that included the privatemessaging function. According to Defendants, therefore, the

Warrant was overbroad because it permitted a comprehensive

initial seizure of all functions of Defendants’ Facebook accounts

subject to the two-step review and filtering process provided

within the Warrant.

7 - ORDER DENYING MOTIONS (#712, #741) TO SUPPRESS FACEBOOK

EVIDENCE

Case 3:16-cr-00051-BR Document 915 Filed 07/20/16 Page 7 of 13
The government, on the other hand, contends the Ninth

Circuit approved a similar warrant in Flores, including the use

of the two-step search process by which the government initially

seizes the entirety of a Facebook account, then conducts an

initial review of the materials seized to determine which

material is responsive to the search warrant, and then separates

and seals material that is not responsive to the warrant. 

Because the Warrant in this case closely mirrors the warrant in

Flores, which the Ninth Circuit found was not overbroad, the

government contends this Warrant is similarly not overbroad, and,

in any event, suppression would be inappropriate even if the

Warrant was overbroad because the law-enforcement officers acted

in good-faith reliance on the Magistrate Judge’s issuance of the

Warrant.

In Flores the government obtained a search warrant that

permitted the government to search the Facebook account

associated with Flores’s name and email address and only to seize

evidence of the two offenses listed in the warrant. 802 F.3d at

1044. The warrant authorized Facebook to provide agents with the

entire contents of Flores’s Facebook account. Id. at 1046. 

Agents then segregated information that was responsive to the

search warrant from information that was not responsive and

sealed the nonresponsive information so it could not be accessed

absent a new warrant. Id. Ultimately, agents determined 100 of

8 - ORDER DENYING MOTIONS (#712, #741) TO SUPPRESS FACEBOOK

EVIDENCE

Case 3:16-cr-00051-BR Document 915 Filed 07/20/16 Page 8 of 13
the 11,000 pages of data initially seized were responsive to the

search warrant. Id.

Applying the factors from Le Shi, the Ninth Circuit

concluded the warrant in Flores was not overbroad because it

allowed the government to search only the Facebook account

associated with the defendant, authorized the government to seize

permanently only the information that was relevant to the alleged

violations on which the warrant application was based, and

established sufficient “‘objective standards’ for segregating

responsive material from the rest of Flores’s account.” Id. at

1044 (quoting Le Shi, 525 F.3d at 731-32). Although the Ninth

Circuit expressed some concern over the lack of any temporal

limit on the warrant (i.e., the warrant permitted seizure of

relevant information created at any time during the existence of

the Facebook account), the court ultimately concluded the warrant

was not overbroad because “the warrant here specified a crime and

a suspect, the seized data was not used for any broader

investigative purposes, and Facebook, rather than government

agents, segregated Flores’s account to protect third parties’

rights.” Id. at 1045-46. Moreover, any concerns about the lack

of any temporal limit was moot because the only information the

government sought to introduce originated on the day of the

defendant’s arrest. Id.

Here the government is correct that the Magistrate Judge

9 - ORDER DENYING MOTIONS (#712, #741) TO SUPPRESS FACEBOOK

EVIDENCE

Case 3:16-cr-00051-BR Document 915 Filed 07/20/16 Page 9 of 13
issued a Warrant similar to the warrant that the Ninth Circuit

largely approved in Flores. The Warrant here similarly specified

a crime and the suspects, provided for a similar two-step searchand-seizure process to ensure nonresponsive information was

separated and sealed, and only authorized the seizure of

information within the listed accounts associated with

Defendants. Moreover, unlike the warrant in Flores, the Warrant

issued in this case also contained a temporal limitation for

information from November 1, 2015, through the date of the

relevant Defendant’s arrest (each arrest date occurring between

late-January and mid-February 2016). The Warrant in this case,

therefore, was narrower than the one approved by the Ninth

Circuit in Flores. Accordingly, the Court concludes Flores is

controlling, and, therefore, the Court finds the Warrant in this

case was not overbroad.

Moreover, the Court disagrees with Defendants’ contention

that the search-warrant affidavit did not provide probable cause

to search nonpublic features such as the private-messaging

function. To the contrary, the Affidavit provided:

[I]nformation stored in connection with a Facebook

account may provide crucial evidence of the “who, what,

when, where, and how” of the criminal conduct under

investigation, thus enabling the United States to

establish and prove each element or alternatively, to

exclude the innocent from further suspicion. In my

training and experience, a Facebook user’s “Neoprint,”

IP log, stored electronic communications, and other

data retained by Facebook, can indicate who has used or

10 - ORDER DENYING MOTIONS (#712, #741) TO SUPPRESS FACEBOOK

EVIDENCE

Case 3:16-cr-00051-BR Document 915 Filed 07/20/16 Page 10 of 13
controlled the Facebook account. This “user

attribution” evidence is analogous to the search for

“indicia of occupancy” while executing a search warrant

at a residence. For example, profile contact

information, private messaging logs, status updates,

and tagged photos (and the data associated with the

foregoing, such as date and time) may be evidence of

who used or controlled the Facebook account at a

relevant time. Further, Facebook account activity can

show how and when the account was accessed or used.

These assertions were sufficient for the Magistrate Judge to find

there was a fair probability that evidence of the relevant crime

could be found in the private features of Defendants’ Facebook

accounts. In addition, in light of the evidence of public

postings presented in the search-warrant Affidavit as well as the

information that various alleged members of the conspiracy were

Facebook friends, the Magistrate Judge could reasonably infer

there was a fair probability that evidence of the alleged crime

could also be found in many of the private functions of

Defendants’ Facebook accounts.

Finally, Defendants contend the government improperly

executed the Warrant (1) when the government did not set up a

filter team separate from the investigation team to conduct an

initial review of the materials produced by Facebook and (2) when

the government included search terms in their initial review that

were outside the scope of the Warrant. 

Although the use of a filter team separate from the

investigation team to conduct the initial review would have been

11 - ORDER DENYING MOTIONS (#712, #741) TO SUPPRESS FACEBOOK

EVIDENCE

Case 3:16-cr-00051-BR Document 915 Filed 07/20/16 Page 11 of 13
an added layer of protection for ensuring the investigation team

did not benefit from exposure to information that was not

responsive to the Warrant, there is not any such requirement in

the Warrant nor does the Flores court require such an additional

safeguard. Moreover, at oral argument counsel for the government

certified the materials that had been deemed nonresponsive to the

search warrant were not provided to the prosecution team and were

sealed.

During the initial review of the information provided by

Facebook, the government used many different search terms to

locate information responsive to the Warrant and to segregate and

to seal nonresponsive information. Although these search terms

were quite diverse and related to several different topics, the

Court finds each of the search terms relevant in some way to the

alleged occupation of the MNWR that constituted the conspiracy

charge on which the Warrant was predicated. Accordingly, the

Court concludes the search terms did not impermissibly exceed the

scope of the Warrant.

On this record, therefore, the Court concludes the Warrant

was not overbroad, was supported by probable cause, and was

executed properly by the government.

CONCLUSION

For these reasons, the Court DENIES the Motion (#712) to

12 - ORDER DENYING MOTIONS (#712, #741) TO SUPPRESS FACEBOOK

EVIDENCE

Case 3:16-cr-00051-BR Document 915 Filed 07/20/16 Page 12 of 13
Suppress Facebook Evidence filed by Defendant Ryan Payne and the

Motion (#741) to Suppress Evidence (Facebook Accounts) filed by

Defendant David Lee Fry.

IT IS SO ORDERED.

DATED this 20th day of July, 2016.

/s/ Anna J. Brown

 

ANNA J. BROWN

United States District Judge

13 - ORDER DENYING MOTIONS (#712, #741) TO SUPPRESS FACEBOOK

EVIDENCE

Case 3:16-cr-00051-BR Document 915 Filed 07/20/16 Page 13 of 13