Opinion ID: 183984
Heading Depth: 1
Heading Rank: 14

Heading: A.4.a. View of Files in Kazvid Folder

Text: The first issue is whether, pursuant to the state search warrant to search for evidence of financial crimes, Detective Vanadia properly viewed the files in the Kazvid folder. The District Court found that Vanadia properly opened this file because he reasonably believed that it could contain evidence of financial crimes. Stabile contends that Detective Vanadia stumbled upon the videos in the Kazvid folder by failing to limit the scope of his search to evidence of financial crimes. Appellant's Br. 29. According to Stabile, Vanadia's decision to open Kazvid was an unreasonably overbroad search, not limited to evidence of financial crimes, and a pretext for searching for child pornography. See Appellant's Br. 29-30, 37 n.19. We disagree. Resolution of this issue forces us to reconcile two competing principles. On one hand, it is clear that because criminals canand often dohide, mislabel, or manipulate files to conceal criminal activity, a broad, expansive search of the hard drive may be required. See United States v. Burgess, 576 F.3d 1078, 1092-94 (10th Cir. 2009) ([T]here may be no practical substitute for actually looking in many (perhaps all) folders and sometimes at the documents contained within those folders, and that is true whether the search is of computer files or physical files.); United States v. Mann, 592 F.3d 779, 782 (7th Cir.2010) (relevant files are often hidden and can be mislabeled and manipulated to hide their true contents); Adjani, 452 F.3d 1140, 1150 (9th Cir.2006). On the other hand, as Stabile argues, granting the Government a carte blanche to search every file on the hard drive impermissibly transforms a limited search into a general one. Marron v. United States, 275 U.S. 192, 196, 48 S.Ct. 74, 72 L.Ed. 231 (1927) (The requirement that warrants shall particularly describe things to be seized makes general searches under them impossible and prevents the seizure of one thing under a warrant describing another.); see United States v. Tracey, 597 F.3d 140, 146 (3d Cir.2010). To reconcile these competing aims, many courts have suggested various strategies and search methodologies to limit the scope of the search. In United States v. Comprehensive Drug Testing, Inc ., the federal government investigated the Bay Area Lab Cooperative (Balco), suspected of providing steroids to professional baseball players. 621 F.3d 1162, 1166 (9th Cir.2010). In 2002, the Major League Baseball Players Association entered into a collective bargaining agreement that provided for drug testing of all players (performed by Comprehensive Drug Testing) for the purpose of determining only whether more than five percent of players tested positive. Id. The players were assured that the results would remain anonymous and confidential. Id. During the Balco investigation, the government learned of ten players who had tested positive, and it sought and obtained a warrant limited to the records of ten players as to whom there was probable cause to search. Id. However, when the government executed the warrant, the government seized and reviewed the drug testing record for hundreds of players. Id. On appeal to the Ninth Circuit en banc, the en banc court discussed proper procedures for handling seized data premised on its earlier opinion in Tamura. Id. at 1167. For example, the initial review and segregation of the data was to be performed not by the case agents but by law enforcement personnel trained in search and seizing computer data. Id. at 1168. The government was to return any data that did not fall within the scope of the warrant. Id. at 1168-69. As the Ninth Circuit stated: We recognize the reality that over-seizing is an inherent part of the electronic search process and proceed on the assumption that, when it comes to the seizure of electronic records, this will be far more common than in the days of paper records. This calls for greater vigilance on the part of judicial officers in striking the right balance between the government's interest in law enforcement and the right of individuals to be free from unreasonable searches and seizures. The process of segregating electronic data that is seizable from that which is not must not become a vehicle for the government to gain access to data which it has no probable cause to collect. Id. at 1177. In United States v. Carey, the Tenth Circuit suggested methods to avoid searching files of the type not identified in the warrant, such as observing files types and titles listed on the directory, doing a key word search for relevant terms, or reading portions of each file stored in the memory. 172 F.3d 1268, 1276 (10th Cir.1999). The Tenth Circuit has refined its approach since Carey. In Burgess, the Tenth Circuit considered the appropriate standards for searching a hard drive, offering the following guidance: while officers must be clear as what it is they are seeking on the computer and conduct the search in a way that avoids searching files of types not identified in the warrant, United States v. Walser, 275 F.3d 981, 986 (10th Cir.2001), a computer search may be as extensive as reasonably required to locate the items described in the warrant based on probable cause. United States v. Grimmett, 439 F.3d 1263, 1270 (10th Cir.2006) (quotations omitted). But the search warrant itself need not contain a particularized computer search strategy. United States v. Brooks, 427 F.3d 1246, 1251 (10th Cir. 2005). Given that it would be folly for a search warrant to structure the mechanics of the search because imposing such limits would unduly restrict legitimate search objectives, Burgess, 576 F.3d at 1094, the scope of the search must be constrained by content. Id. at 1093. In Burgess, that content was computer files containing evidence of drug use or trafficking. Id. To avoid transforming a limited search into a general one, the court cautioned that [a]s the description of such places and things becomes more general, the method by which the search is executed become[s] more importantthe search method must be tailored to meet allowed ends. Id. at 1094. Speaking directly to search methodology, Burgess recommended that computer searches begin by using search protocol to structure the search with an analysis of the file structure, followed by a search for suspicious file folders, and then looking for files and types of files most likely to contain the objects of the search by doing keyword searches. Id. In the end, however, the Burgess court noted that there may be no practical substitute for actually looking in many (perhaps all) folders and sometimes at the documents contained within those folders. . . . Id. Finally, in United States v. Mann , the defendant argued that the government's search of his computer for evidence of voyeurism exceeded the scope of the search warrant where the search produced evidence of child pornography. 592 F.3d at 781. The Seventh Circuit held that the search was lawful, and noted the particular difficulties in attempting to locate image files on a computer because the files may be manipulated to hide their true contents. Id. at 782; see Hill, 459 F.3d at 978 (Images can be hidden in all manner of files, even word processing documents and spreadsheets. Criminals will do all they can to conceal contraband, including the simple expedient of changing the names and extensions of files to disguise their content from the casual observer.). Turning to the instant case, the scope of the consent and state search warrant were limited to evidence of financial crimes. For a number of reasons, we believe that Detective Vanadia's decision to highlight and view the contents of the Kazvid folder was reasonable and permissible under the Fourth Amendment. First, Detective Vanadia's decision to highlight and view the contents of the Kazvid folder was objectively reasonable because criminals can easily alter file names and file extensions to conceal contraband. See Williams, 592 F.3d at 522; Hill, 459 F.3d at 978. Second, Detective Vanadia's search procedures complied with the search procedures outlined in Carey a case which advocates more restrictive search procedures than the broader search procedures approved in Williams and Burgess. For example, Carey suggested search methods such as focusing on the file type identified in the warrant, file names, key word search, and directory structure. 172 F.3d at 1276. Conversely, Williams stated that a computer search authorized at least a cursory review of each file on the computer. 592 F.3d at 522. Likewise, Burgess suggested that there may be no practical substitute for actually looking in many (perhaps all) folders and sometimes at the documents contained within those folders while conducting an electronic search. 576 F.3d at 1094. Here, Vanadia took steps to ensure that his investigation complied with the state search warrant. Vanadia began by physically inspecting the hard drive and creating a copy of the drive to ensure that the original drive was not damaged or corrupted during the search. Next, Vanadia examined the file signatures to see if any files had been corrupted. He then conducted a hash value analysis to see if any files had been copied. Finally, he examined suspicious and out-of-place folders, such as the Kazvid folder. Appx. at A-521-27, A-531-32, A-536-37. These procedures demonstrate that Vanadia engaged in a focused search of the hard drives rather than a general search. [13] Finally, Stabile argues that Detective Vanadia exceeded the scope of the state search warrant because Vanadia testified that he knew that there may have been child pornography contained in the Kazvid folder. [14] This argument fails because an investigator's subjective intent is not relevant to whether a search falls within the scope of a search warrant. See Maryland v. Garrison, 480 U.S. 79, 84, 107 S.Ct. 1013, 94 L.Ed.2d 72 (1987) (the scope of a lawful search is defined by the object of the search and the places in which there is probable cause to believe it may be found) (internal citation omitted); Williams, 592 F.3d at 524 (where investigators executed search warrant for evidence of computer harassment on defendant's hard drive, plain view seizure of child pornography discovered during search was permissible even if finding child pornography was their hope from the outset). [15] Here, the state search warrant objectively authorized Vanadia to search for evidence of financial crimes, and Vanadia's testimony that he subjectively believed the Kazvid folder could harbor evidence of child pornography does not render the search of the Kazvid folder invalid. Moreover, as Vanadia made clear in his testimony, the Kazvid folder required further investigation because evidence of financial crimes could be hidden within. Appx. at A-536-37. For the foregoing reasons, we conclude that highlighting the Kazvid folder was reasonable and did not exceed the scope of the state search warrant.