Opinion ID: 3038336
Heading Depth: 4
Heading Rank: 1

Heading: Seizure of All Computer Media

Text: The defendant argues that the search warrant was overbroad because it authorized the officers to seize and remove from his home his computer and storage media without first 9 Although the defendant at trial might have been able to present evidence supporting innocent explanations for the content of the pictures, that does not negate the images’ prima facie appearance of lasciviousness — which is the issue relevant to probable cause. 10 In contrast to the concerns we raised in footnote 8, supra, the defendant does not argue that the affidavit’s description of the images was incomplete in any way; nor does he claim that the attesting officer was aware of but failed to disclose mitigating facts that would tend to show the images were not lascivious. UNITED STATES v. HILL 9387 determining whether they actually contained child pornography. Given the nature of computers and storage media, this argument sweeps too broadly, as the district court explained in addressing the defendant’s suggested limitations on the nature and scope of the search: Search warrants must be specific. “Specificity has two aspects: particularity and breadth. Particularity is the requirement that the warrant must clearly state what is sought. Breadth deals with the requirement that the scope of the warrant be limited by the probable cause on which the warrant is based.” United States v. Towne, 997 F.2d 537, 544 (9th Cir. 1993) (internal quotation marks and citations omitted). A warrant describing a category of items is not invalid if a more specific description is impossible. United States v. Spilotro, 800 F.2d 959, 963 (9th Cir. 1986). The level of specificity required “varies depending on the circumstances of the case and the type of items involved.” Id. The warrant here commanded the officers to search for and seize: “1) An IBM ‘clone’ medium tower personal computer . . . 3) All storage media belonging to either item # 1 or the individual identifying himself as defendant at the location. 4) All sexually explicit images depicting minors contained in item # 3.” Defendant argues the warrant was overbroad because it authorized seizure of storage media whether or not they contained child pornography. He suggests it should have authorized seizure only of media containing child pornography. But it is impossible to tell what a computer storage medium con- tains just by looking at it. Rather, one has to examine it electronically, using a computer that is running the appropriate operating system, hardware and software. The police had no assurance they would find such a computer at the scene — nor did they, for that 9388 UNITED STATES v. HILL matter — or that, if they found one, they could bypass any security measures and operate it. Defendant suggests that the police could have brought their own laptop computer: Having probable cause to seize only computer storage media that contained certain types of files, the police should have been required to bring with them the equipment necessary to separate the sheep from the goats. Defendant’s argument raises an important question about how police must execute seizures pursuant to a warrant. Because seizable materials are seldom found neatly separated from their non-seizable counterparts, how much separating must police do at the scene to avoid taking items that are neither contraband nor evidence of criminal activity? As always under the Fourth Amendment, the stan- dard is reasonableness. To take an extreme example, if police have probable cause to seize business records, the warrant could not authorize seizure of every piece of paper on the premises on the theory that the police conducting the search might not know how to read. . . . [T]he court concludes that the police were not required to bring with them equipment capable of reading computer storage media and an officer competent to operate it. Doing so would have posed significant technical problems and made the search more intrusive. To ensure that they could access any electronic storage medium they might find at the scene, police would have needed far more than an ordinary laptop computer. Because computers in common use run a variety of operating systems — various versions or flavors of Windows, Mac OS and Linux, to name only the most common — police would have had to bring with them a computer (or UNITED STATES v. HILL 9389 computers) equipped to read not only all of the major media types, but also files encoded by all major operating systems. Because operating systems, media types, file systems and file types are continually evolving, police departments would frequently have to modify their computers to keep them up-to- date. This would not be an insuperable obstacle for larger police departments and federal law enforcement agencies, but it would pose a significant burden on smaller agencies. Even if the police were to bring with them a properly equipped computer, and someone competent to operate it, using it would pose two significant problems. First, there is a serious risk that the police might damage the storage medium or compromise the integrity of the evidence by attempting to access the data at the scene. As everyone who has accidentally erased a computer file knows, it is fairly easy to make mistakes when operating computer equipment, especially equipment one is not intimately familiar with. The risk that the officer trying to read the suspect’s storage medium on the police laptop will make a wrong move and erase what is on the disk is not trivial. Even if the officer executes his task flawlessly, there might be a power failure or equipment malfunction that could affect the contents of the medium being searched. For that reason, experts will make a back-up copy of the medium before they start manipulating its contents. Various other technical problems might arise; without the necessary tools and expertise to deal with them, any effort to read computer files at the scene is fraught with difficulty and risk. Second, the process of searching the files at the scene can take a long time. To be certain that the medium in question does not contain any seizable 9390 UNITED STATES v. HILL material, the officers would have to examine every one of what may be thousands of files on a disk — a process that could take many hours and perhaps days. Taking that much time to conduct the search would not only impose a significant and unjustified burden on police resources, it would also make the search more intrusive. Police would have to be present on the suspect’s premises while the search was in progress, and this would necessarily interfere with the suspect’s access to his home or business. If the search took hours or days, the intrusion would continue for that entire period, compromising the Fourth Amendment value of making police searches as brief and non-intrusive as possible. Hill, 322 F. Supp. 2d at 1087-89 (alteration in original and internal citation omitted). [7] We agree with the district court that under the circumstances here, the warrant was not fatally defective in failing to require an onsite search and isolation of child pornography before removing storage media wholesale. That does not mean, however, that the government has an automatic blank check when seeking or executing warrants in computerrelated searches. Although computer technology may in theory justify blanket seizures for the reasons discussed above, the government must still demonstrate to the magistrate factually why such a broad search and seizure authority is reasonable in the case at hand. There may well be situations where the government has no basis for believing that a computer search would involve the kind of technological problems that would make an immediate onsite search and selective removal of relevant evidence impracticable. Thus, there must be some threshold showing before the government may “seize the haystack to look for the needle.” Our cases illustrate this principle. In United States v. Hay, for example, we held permissible a “generic classification” UNITED STATES v. HILL 9391 authorizing seizure of an “entire computer system and virtually every document in [the defendant’s] possession without referencing child pornography or any particular offense conduct” because, although officers “knew that [a party] had sent 19 images [of child pornography] directly to [the defendant’s] computer, [they] had no way of knowing where the images were stored.” 231 F.3d 630, 637 (9th Cir. 2000). Similarly United States v. Lacy allowed “blanket seizure” of the defendant’s “entire computer system.” 119 F.3d 742, 746 (9th Cir. 1997). We reasoned that “no more specific description of the computer equipment sought was possible,” because the agents “did not know whether the images were stored on the hard drive or on one or more of [the defendant’s] many computer disks.” Id.; accord United States v. Upham, 168 F.3d 532, 535 (1st Cir. 1999) (holding, in a child pornography case, that “the seizure and subsequent off-premises search of the computer and all available disks was about the narrowest definable search and seizure reasonably likely to obtain the images”). Significantly, in both Hay and Lacy we carefully noted the critical role played by the officers’ affidavits supporting the warrants. See Hay, 231 F.3d at 637 (“[T]he affidavit explained why it was necessary to seize the entire computer system in order to examine the electronic data for contraband. It also justified taking the entire system off site because of the time, expertise, and controlled environment required for a proper analysis.”); Lacy, 119 F.3d at 746-47 (“In the affidavit supporting the search warrant application, a Customs agent explained there was no way to specify what hardware and software had to be seized to retrieve the images accurately.”). [8] By contrast, although the warrant in this case authorized a wholesale seizure, the supporting affidavit did not explain why such a seizure was necessary. See United States v. Adjani, ___ F.3d at ___ , 2006 WL 1889946 at  n.7 (noting favorably an affidavit’s computer search and seizure protocol explaining when a computer had to be searched offsite, because “[s]uch specificity increases our confidence that the magistrate judge was well aware of what he was authorizing 9392 UNITED STATES v. HILL and that the agents knew the bounds of their authority in executing the search”); U.S. Dep’t of Justice, Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations 43, 69 (July 2002) (recommending that “if agents expect that they may need to seize a personal computer and search it off-site to recover the relevant evidence, the affidavit should explain this expectation and its basis to the magistrate judge. The affidavit should inform the court of the practical limitations of conducting an on-site search, and should articulate the plan to remove the entire computer from the site if it becomes necessary.”); cf. United States v. Tamura, 694 F.2d 591, 596 (9th Cir. 1982) (“If the need for transporting the documents is known to the officers prior to the search, they may apply for specific authorization for large-scale removal of material, which should be granted by the magistrate issuing the warrant only where on site sorting is infeasible and no other practical alternative exists.”).11 [9] We do not approve of issuing warrants authorizing blanket removal of all computer storage media for later examination when there is no affidavit giving a reasonable explanation, such as that provided in Hay and Lacy, as to why a wholesale seizure is necessary.12 See Tamura, 694 F.2d at 595 (“[T]he wholesale seizure for later detailed examination of records not described in a warrant is significantly more intru11 In retrospect, it is clear that not all the storage media needed to be seized as evidence of criminal activity; of the 154 disks seized, only two zip disks contained lascivious images of children. There is no evidence or allegation that the officers knew of this result before they searched and seized. 12 As the defendant pointed out during oral argument, the magistrate must be made aware of what officers are contemplating and why they are doing so. For some people, computer files are the exclusive means of managing one’s life — such as maintaining a calendar of appointments or paying bills. Thus, there may be significant collateral consequences resulting from a lengthy, indiscriminate seizure of all such files. As noted earlier, however, in this case the district court granted the defendant the right to “mirror copies” of the seized storage media. See supra n. 5. UNITED STATES v. HILL 9393 sive, and has been characterized as ‘the kind of investigatory dragnet that the fourth amendment was designed to prevent” (quoting United States v. Abrams, 615 F.2d 541, 543 (1st Cir. 1980))). Without such individualized justification being presented to the magistrate, we cannot be sure that the judge was aware of the officers’ intent and the technological limitations meriting the indiscriminate seizure — and thus was intelligently able to exercise the court’s oversight function. An explanatory statement in the affidavit also assures us that the officers could not reasonably describe the objects of their search with more specificity. See United States v. Kow, 58 F.3d 423, 427 (9th Cir. 2005) (“Generic classifications in a warrant are acceptable only when a more precise description is not possible.” (internal quotation marks and citation omitted)); see also Upham, 168 F.3d at 535 (“Of course, if the [seized] images themselves could have been easily obtained through an on-site inspection, there might have been no justification for allowing the seizure of all computer equipment, a category potentially including equipment that contained no images and had no connection to the crime.”). Accordingly, we hold that the warrant here was overbroad in authorizing a blanket seizure in the absence of an explanatory supporting affidavit, which would have documented the informed endorsement of the neutral magistrate. See Tamura, 694 F.2d at 596 (“The essential safeguard required is that wholesale removal must be monitored by the judgment of a neutral, detached magistrate.”).13 [10] Nonetheless, as in Tamura, we conclude that suppression of the evidence of child pornography found on the defendant’s seized zip disks is not an appropriate remedy. Tamura involved an indiscriminate seizure of all files found in an 13 The district court found no violation because it assumed the state judge must have known it was not technologically feasible to search onsite, and therefore the affidavit did not need to so provide. See Hill, 322 F. Supp. 2d at 1090. We do not think the record is so clear, and our case law requires more. 9394 UNITED STATES v. HILL office even though the warrant authorized the officers to search for only three categories of records for evidence of various alleged crimes. See id. at 594-95. Although we refused to sanction the “wholesale seizure for later detailed examination of records not described in a warrant,” id. at 595, we held that “the exclusionary rule does not require the suppression of evidence within the scope of a warrant simply because other items outside the scope of the warrant were unlawfully taken as well,” id. at 597. See also id. (“Regardless of the illegality of the Government’s seizure and retention of documents not covered by the warrant, however, reversal is not compelled in this case.”). [11] Similarly, the pornographic images from the defendant’s zip disks that he sought to exclude as evidence at trial was “seized and retained lawfully because described in and therefore taken pursuant to the valid search warrant.” Id. As we have discussed above, the officers’ wholesale seizure was flawed here because they failed to justify it to the magistrate, not because they acted unreasonably or improperly in executing the warrant. Because the officers were “motivated by considerations of practicality rather than by a desire to engage in indiscriminate ‘fishing,’ we cannot say . . . that the officers so abused the warrant’s authority that the otherwise valid warrant was transformed into a general one, thereby requiring all fruits to be suppressed.” Id. See also Hudson v. Michigan, 547 U.S. ____, 126 S.Ct. 2159, 2163 (2006) (“Suppression of evidence . . . has always been our last resort, not our first impulse,”and is appropriate “only ‘where its remedial objectives are thought most efficaciously served.’ ” (quoting United States v. Calandra, 414 U.S. 338, 348 (1974)). [12] Therefore, we hold that the district court properly admitted the evidence of child pornography found on the defendant’s computer storage media notwithstanding the lack of a sufficiently detailed supporting affidavit describing the need for wholesale seizure of such media. UNITED STATES v. HILL 9395