20 January 1998
Source: http://www.usdoj.gov/criminal/cybercrime/supplement/ssgsup.htm

For more information see U.S. Department of Justice cybercrime Web site: http://www.usdoj.gov/criminal/cybercrime/index.html

SUPPLEMENT TO FEDERAL GUIDELINES FOR SEARCHING AND SEIZING COMPUTERS


COMPUTER CRIME & INTELLECTUAL PROPERTY SECTION
CRIMINAL DIVISION
OCTOBER 1997

Updated December 30, 1997 usdoj-jmd/irm/css/mc





PREFACE



This Supplement is intended to update the Federal Guidelines for Searching and Seizing Computers that was published in July 1994. The Supplement describes relevant federal and state cases decided since July 1994 as well as a number of additional earlier decisions.(1) The cases in this Supplement are organized according to the sections in the Guidelines.(2) Where a case relates to more than one section, it is discussed in more than one place.

In order for us to stay abreast of the current developments in this fast changing area of the law, we invite you to contact us about your experiences. Please also contact us with any comments, corrections or contributions regarding the Guidelines or this Supplement at (202) 514-1026. This Supplement was prepared by David Movius, who was a student intern for the Computer Crime and Intellectual Property Section, under the supervision of David Goldstone and Peter Toren.

Scott Charney, Chief
Martha Stansell-Gamm, Deputy Chief
Computer Crime & Intellectual Property Section
Criminal Division
U.S. Department of Justice

TABLE OF CONTENTS



I. KEY TERMS AND CONCEPTS 1

A. DEFINITIONS 1

II. GENERAL PRINCIPLES 2

B. PLAIN VIEW 2

STATE CASES 2

E. CONSENT SEARCHES 3 >2. Third-Party Consent 3

d. Employers 3

STATE CASE 3

III. SEIZING HARDWARE 4

C. HARDWARE AS AN INSTRUMENTALITY OF THE OFFENSE 4

2. Instrumentalities Defined 4

STATE CASE 4

E. TRANSPORTING HARDWARE FROM THE SCENE 5

IV. SEARCHING FOR AND SEIZING INFORMATION 6

D. INFORMATION AS EVIDENCE 6

1. Evidence of Identity 6

E. PRIVILEGED AND CONFIDENTIAL INFORMATION 7

1. In General 7

a. Doctors, Lawyers, and Clergy 7

G. SEARCHING FOR INFORMATION 8

2. Data Created or Maintained by Targets 8

4. Discovering the Unexpected 9

a. Items Different from the Description in the Warrant 9

STATE CASE 9 Table of Contents

c. Deleted Information (New) 11

STATE CASES 11

H. DECIDING WHETHER TO CONDUCT THE SEARCH ON-SITE OR TO REMOVE HARDWARE TO ANOTHER LOCATION 13

1. Seizing Computers Because of the Volume of Evidence 13

b. Warrant is Narrowly Drawn but Number of Documents to be Sifted through is Enormous. 13

STATE CASE 14

2. Seizing Computers Because of Technical Concerns 15

a. Conducting a Controlled Search to Avoid Destroying Data 15

I. EXPERT ASSISTANCE 16

1. Introduction 16

3. What the Experts Can Do 17

a. Search Planning and Execution 17

STATE CASE 17

V. NETWORKS AND BULLETIN BOARDS 18

A. INTRODUCTION 18

B. THE PRIVACY PROTECTION ACT 20

6. Liability Under the Privacy Protection Act (NEW) 21

STATE CASE 22

C. STORED ELECTRONIC COMMUNICATIONS 23

STATE CASE 26

VI. DRAFTING THE WARRANT 27

A. DRAFTING A WARRANT TO SEIZE HARDWARE 27


STATE CASES 27

B. DRAFTING A WARRANT TO SEIZE INFORMATION 29

1. Describing the Place to Be Searched 29

c. Handling Multiple Sites in Different Districts 29

2. Describing the Items to be Seized 31

VII. POST-SEARCH PROCEDURES 36

B. PROCEDURES FOR PRESERVING EVIDENCE 36

4. Returning Seized Computers and Materials 36

a. Federal Rules of Criminal Procedure: Rule 41(e) 36





TABLE OF AUTHORITIES



CASES



Andresen v. Maryland, 427 U.S. 463 (1976)) 33

Bohach v. Reno, 932 F. Supp. 1232 (D. Nev. 1996) 24

City of Akron v. Patrick, 1982 WL 5049 (Ohio Ct. App. 1982) 9

City of Akron v. Patrick, C.A. No. 10428, 1982 WL 5049, at *4 (Ohio Ct. App. 1982) 2

Copenhefer, 587 A.2d at 1356 12

Davis v. Gracey, 111 F.3d 1472 (10th Cir. 1997) 21, 22, 25, 26, 31

Florida v. Wade, 544 So.2d 1028 (Fla. Dist. Ct. App. 1989) 17, 34

Franks v. Delaware, 438 U.S. 154 (1978) 33

Iowa v. Gogg, 561 N.W.2d 360 (Iowa 1997 27

Ivatury v. Texas, 792 S.W.2d 845 (Ct. App. 1990) 2

Louisiana v. Tanner, 534 So.2d 535 (Ct. App. La. 1988) 35

Mahlberg v. Mentzer, 968 F.2d 772 (8th Cir.), cert. denied, 506 U.S. 1026 (1992) 15

Marcus v. Search Warrant, 367 U.S. 717 (1961) 18

Marvin v. United States, 732 F.2d 669 (8th Cir. 1984) 13

Massachusetts v. Pasqualino, 3 Mass.L.Rptr. 382 (Mass. Super. 1995) 27

New York v. Loorie, 165 Misc.2d 877, 630 N.Y.S.2d 483 (Monroe Cty. Ct. 1995) 34

Ohio v. Amvets, No. 93 CA 50, 1994 WL 116174 (Ohio Ct. App. April 6, 1994) 4

Ohio v. Chubb, No. 70648, 1997 WL 10142, at *1 (Ohio App. 8th Dist. Jan. 9, 1997) 3

Ohio v. McGuire, 1994 WL 700082 (Ohio App. 9 Dist. 1994) (unpublished decision) 14

Ohio v. Redd, No. CA93-12-019, 1994 WL 178451 (Ohio Ct. App. May 9, 1994) 5

Ohio v. Sevrence, 1997 WL 89100 (Ohio Ct. App. 1997) (unpublished decision) 16

Oklahoma v. One Pioneer CD-Rom Changer, 891 P.2d 600 (Okla. App. 1994) 22, 26, 27

Oklahoma v. One Pioneer CD-ROM Changer, et. al., 891 P.2d 600, 605 (Okla. App. 1994) 2

Ortega 3

Pennsylvania v. Copenhefer, 587 A.2d 1353, 526 Pa 555 (1991) 11

Pennsylvania v. McEnamy, 667 A.2d 1143 (Pa. Super. Ct. 1995), 35

Schalk v. Texas, 767 S.W.2d 441 (Ct. App. Tex. 1988) 28

Stanford v. Texas, 379 U.S. 476 (1965) 18

Steve Jackson Games, 36 F.3d 457 (5th Cir. 1994) 24, 25

U.S. v. Campbell, No. 92-1104, 1992 WL 332255 (4th Cir. Nov. 16, 1992) 4

United States v. Denman, 100 F.3d 399 (5th Cir. 1996), cert. denied, 117 S. Ct. 1256 (1997) 29, 30

United States v. Falon, 959 F.2d 1143 (1st Cir. 1992) 31

United States v. Gomez-Soto, 723 F.2d 649 (9th Cir.) 9

United States v. Hersch, Crim. A. No. 93-10339-Z, 1994 WL 568728 (D. Mass. 1994) (unpublished decision) 33

United States v. Humphrey, 104 F.3d 65 (5th Cir.), cert. denied, 117 S. Ct 1833 (1997) 31

United States v. Hurt, 808 F.2d 707 (9th Cir.) cert. denied, 484 U.S. 816 (1987) 19

United States v. Kimbrough, 69 F.3d 723 (5th Cir. 1995), cert. denied, 116 S. Ct 1547 (1996) 18

United States v. Kow, 58 F.3d 423 (9th Cir. 1995) 32 33

United States v. Lacy, -- F.3d --, 1997 WL 378104 (9th Cir. 1997) 33

United States v. Lamb, 945 F. Supp. 441 (N.D.N.Y. 1996) 6, 14

United States v. Lamb, 945 F. Supp. 441, 462 (N.D.N.Y. 1996) 4, 8

United States v. Layne, 43 F.3d 127 (5th Cir. 1995) 18

United States v. Lyons, 992 F.2d 1029 (10th Cir. 1993) 31

United States v. Maxwell, 45 M.J. 406 (Ct. App. Armed Forces 1996) 32

United States v. Ramirez, 112 F.3d 849 (7th Cir. 1997) 29, 30

United States v. Real Property & Premises Known as 5528 Belle Pond Drive, 783 F. Supp. 253 (E.D. Va. 1991) 4

United States v. Rodriguez, 968 F.2d 130 (2d Cir.), cert. denied, 506 U.S. 847 (1992) 29, 30

United States v. Ross, 456 U.S. 798 (1982) 34

United States v. Schandl, 947 F.2d 462 (11th Cir. 1991), cert. denied 504 U.S. 975 (1992) 13

United States v. Schwimmer, 692 F. Supp. 119 (E.D.N.Y. 1988) 17

United States v. Scott, 975 F.2d 927 (1st Cir. 1992) 11

United States v. Sissler, No. 1:90-CR-12, 1991 WL 239000 (W.D. Mich. Aug. 30, 1991) (unpublished decision), aff'd, 966 F.2d 1455 (6th Cir. 1992), cert. denied, 506 U.S. 1079 (1993) 9

United States v. Sprewell, No. 89-50571, 1991 WL 113647 (9th Cir.) (unpublished decision), cert. denied 502 U.S. 885 (1991) 9

United States v. Stewart, 1997 WL 189381 (E.D. Pa. 1997) 7

United States v. Stewart, 1997 WL 189381 (E.D. Pa. April 16, 1997) (unpublished decision) 13, 33

United States v. Stowe, 1996 WL 467238 (N.D. Ill. 1996) (unpublished decision) 36

United States v. Thomas, 746 F. Supp. 65 (D. Utah 1990) 33

United States v. Turk, 526 F.2d 654 (5th Cir.), cert. denied, 429 U.S. 823 (1976) 24

United States v. United States Dist. Court, 407 U.S. 297 (1972) 18

United States v. Wuagneux, 848 F.2d 1374 (11th Cir. 1982), cert. denied, 464 U.S. 814 (1983)) 13

United States v. Yung, 786 F. Supp. 1561 (D. Kan. 1992) 13

Walter v. United States, 447 U.S. 649 (1980) 18

Washington v. Riley, 121 Wash.2d 22, 846 P.2d 1365 (1993) 34

Williams v. Philadelphia Housing Authority, 826 F. Supp. 952 (E.D. Pa. 1993) 3







STATUTES



18 U.S.C. § 2510(4) 24, 25

18 U.S.C. § 2511 24, 25

18 U.S.C. § 2518(3) 29-31

18 U.S.C. § 2701 24, 25

18 U.S.C. § 2703 24

18 U.S.C. § 3105 (1997) 16, 17

18 U.S.C. §§ 2701-2711 25, 26

21 U.S.C. § 841(a)(1) 4

21 U.S.C. § 881(a)(2) 4

42 U.S.C. § 2000aa-6(a) 21, 22







I. KEY TERMS AND CONCEPTS



A. DEFINITIONS

(Insert at page 4)

Internet --

"(a) Generally, (not capitalized) any collection of distinct networks working together as one.

(b) Specifically (capitalized), the world-wide 'network of networks' that are connected to each other, using the IP protocol and other similar protocols. The Internet provides file transfer, remote login, electronic mail, news, and other services."

Ed Krol, The Whole Internet 509 (2d ed. 1994).

IP -- "The Internet Protocol; the most important of the protocols on which the Internet is based. It allows a packet to traverse multiple networks on the way to its final destination."

Ed Krol, The Whole Internet 509 (2d ed. 1994).









II. GENERAL PRINCIPLES



B. PLAIN VIEW

STATE CASES

(Add to end of discussion at page 9)

In Ivatury v. Texas, 792 S.W.2d 845 (Ct. App. 1990), the appellant contended that the trial court should have suppressed evidence in the form of computer tape obtained by the search of a safety deposit box. Officers executing the search had procured a valid warrant for the deposit box to search for a photograph, but failed to specifically describe the computer tape. The court upheld the seizure pursuant to the plain view exception to the warrant requirement. Id. at 850-51. First, according to the court, the officer was lawfully searching the safety deposit box where the tape was found pursuant to the warrant. Second, the agent inadvertently discovered the computer tape. Third, the agent, who first had become aware of the appellant as part of an espionage investigation, had immediately recognized the tape as a kind used by the defense industry and as the kind of tape on which the appellant had previously offered to sell him stolen defense information. The court emphasized that the immediacy with which an agent should recognize the evidence requires only a "reasonable belief." Id. at 851.

See also City of Akron v. Patrick, C.A. No. 10428, 1982 WL 5049, at *4 (Ohio Ct. App. 1982) (unpublished decision) (approving seizure of computers pursuant to search warrant authorizing seizure of gambling paraphernalia because police officer "immediately deduced" from words on computer screen that computers were being used in gambling operation); Oklahoma v. One Pioneer CD-ROM Changer, et. al., 891 P.2d 600, 605 (Okla. App. 1994) (approving seizure of computer system in search for obscene material and equipment used in violation of state obscenity laws where computer screen display indicated that computer was being used to view or copy files named "lesbian sex" or "oral sex").

E. CONSENT SEARCHES

2. Third-Party Consent

d. Employers

(Insert at page 20)

In Williams v. Philadelphia Housing Authority, 826 F. Supp. 952 (E.D. Pa. 1993), aff'd mem, 27 F.3d 560 (3d Cir. 1994), the court rejected a state employee's challenge to the seizure of a computer disk by his supervisor. During a leave of absence, the plaintiff's supervisor had entered his workplace and removed a computer disk that contained work-related documents as well as personal items. The court reasoned that, under O'Connor v. Ortega, 480 U.S. (1987), employers are granted wide latitude to enter employees' offices for work-related reasons. Here, the superior was acting in her official capacity in retrieving the disk, the employee was asked to clear the office of any personal property, and the search was no broader than necessary to retrieve the work-related files from the disk. Thus, the court held that the plaintiff had failed to allege facts sufficient to state a claim for a violation of his Fourth Amendment rights. Williams, 826 F. Supp. at 954.

STATE CASE

See Ohio v. Chubb, No. 70648, 1997 WL 10142, at *1 (Ohio App. 8th Dist. Jan. 9, 1997) (unpublished decision) (describing briefly an administrative search of a state employee's computer pursuant to an internal investigation that led to indictments for Theft in Office and Unauthorized Access to a Computer System based on the original investigative file).









III. SEIZING HARDWARE

C. HARDWARE AS AN INSTRUMENTALITY OF THE OFFENSE

2. Instrumentalities Defined

(Insert at page 29 after first paragraph)

A case from the Northern District of New York provides a helpful example of hardware as an instrumentality of an offense. The defendant in United States v. Lamb, 945 F. Supp. 441, 462 (N.D.N.Y. 1996) argued that the computer equipment had been improperly seized during a child pornography case on the theory that only the material on the hard drive, and not the computer, could be seized as either the instrumentality or the fruit of the crime. The court explicitly rejected this theory, asserting that the computer was the instrumentality of the offense because it might have been the computer that facilitated the sending and receiving of the images.

Computer equipment can be an instrumentality of the offense even where it is less intimately associated with the offense. In United States v. Real Property & Premises Known as 5528 Belle Pond Drive, 783 F. Supp. 253 (E.D. Va. 1991), aff'd on other grounds, U.S. v. Campbell, No. 92-1104, 1992 WL 332255 (4th Cir. Nov. 16, 1992), the Eastern District of Virginia held that a computer, monitor, printer, keyboard, and related accessories found during a search of property for marijuana were properly seized and forfeited to the government under 21 U.S.C. § 881(a)(2) as being equipment used for manufacturing, processing, delivering, importing, or exporting any controlled substance under the statute. During the search for drugs, officers found a computer printout that detailed the growing characteristics of the marijuana plants. The same file was also stored on the defendant's computer. The court held that "[b]ecause storing marijuana-growing data in a computer is use of the computer in manufacturing a controlled substance in violation of 21 U.S.C. § 841(a)(1), the court finds that the defendant computer is forfeitable to the government under 21 U.S.C. § 881(a)(7)." Real Property, 783 F. Supp. at 256.

STATE CASE

In Ohio v. Amvets, No. 93 CA 50, 1994 WL 116174 (Ohio Ct. App. April 6, 1994) (unpublished decision), a forfeiture case regarding the seizure of computer equipment allegedly involved in gambling operations by the Amvets and Elks Lodge, the appellate court overruled the judgment of the trial court and held that although the primary purpose of the computer may not have been gambling, the computer was used to make betting odds, to maintain information as to amounts still owed by pool participants, and to otherwise keep track of the gambling operations. As such, the court held that the computer equipment was properly classified under the state forfeiture statute as an instrumentality of the offense.



E. TRANSPORTING HARDWARE FROM THE SCENE

STATE CASE

(Insert at page 33)

See Ohio v. Redd, No. CA93-12-019, 1994 WL 178451 (Ohio Ct. App. May 9, 1994) (unpublished decision) (discussing disassembly and reassembly of computer, and approving sufficiency of evidence derived in part therefrom, without discussing the merits of the search).









IV. SEARCHING FOR AND SEIZING INFORMATION

D. INFORMATION AS EVIDENCE

1. Evidence of Identity

(Add after first paragraph at page 39)

Network operators exercise considerable control and authority over data and information stored on their systems. In United States v. Lamb, 945 F. Supp. 441 (N.D.N.Y. 1996), the defendant was charged with multiple related violations of the child pornography statutes. During the course of its investigation, the government signed on to America Online and obtained files depicting children engaged in explicit sexual conduct from an individual using various screen names. Pursuant to a search warrant, AOL matched the defendant's identity to the previously-obtained screen names and provided copies of all files in the defendant's account. The court denied the defendant's challenge to the scope of the warrant and ruled that the specific information in the warrant, in connection with information about the broader investigation, logically would lead to the conclusion that evidence of child pornography trafficking would be found at America Online's headquarters. Lamb, 945 F. Supp. at 456.

More specifically, the government had been able to trace the identity of the defendant through the screen names contained in his e-mail messages. Each mail message contained the screen name of the AOL subscriber who first uploaded the pornographic image to the system, the screen names to whom it was forwarded, the date and time of transmission, and the title of the image file. A Grand Jury subpoena to AOL had confirmed that the screen name for some of the transmissions belonged to the defendant. A trap and trace on the defendant's home number confirmed he was logged on to AOL. Based on this electronic trail, the court found that the warrant was properly issued. Lamb. 945 F. Supp. at 441.

E. PRIVILEGED AND CONFIDENTIAL INFORMATION

1. In General

a. Doctors, Lawyers, and Clergy



(Insert after second paragraph at page 41)

United States v. Stewart, No. Crim. A. 96-538, 1997 WL 189381 (E.D. Pa. April 16, 1997) (unpublished decision), illustrates how law enforcement agents can protect the confidentiality and privacy of the targets of searches, while still gaining access to pertinent evidence. In Stewart, agents sought to search and seize computer equipment as part of a fraud investigation. Already having determined that the co-targets of the investigation were represented by attorneys and that one was an attorney himself, the agents executing the search received briefings on attorney-client issues, where they were instructed not to remove any documents received from attorneys or regarding legal representation. Following the seizure of the computer equipment, a computer expert duplicated the computer files, and the computers were returned. An uninvolved Assistant United States Attorney reviewed the seized documents for any potential attorney-client privilege problems. The court upheld the seizure of the computer evidence over the defendant's overbreadth objection, but reserved judgment regarding attorney-client privilege on only one document.

G. SEARCHING FOR INFORMATION

2. Data Created or Maintained by Targets

(Insert at page 51)

In United States v. Lamb, 945 F. Supp. 441, 461 (N.D.N.Y. 1996), the appellant contended that because agents did not execute the search on his house until five months after the last known transmission of child pornography, the warrant was stale. The court, however, disagreed, basing its decision on the changes in the way people store information on computers. The court stated that "[t]he declining costs and increasing capacity and availability of computer storage devices convinces many users to buy more hardware rather than delete old files." Id. at 461. The court held that due to this change in the way people store computerized information, the magistrate had sufficient information to find that computer image files of child pornography might be retained even longer than hardcopy child pornography.

4. Discovering the Unexpected

  1. a. Items Different from the Description in the Warrant

(Insert after last paragraph at page 53)

In some instances, officers who did not expect to encounter computerized evidence may need to search and seize evidence in electronic form. In United States v. Sprewell, No. 89-50571, 1991 WL 113647 (9th Cir.) (unpublished decision), cert. denied 502 U.S. 885 (1991), LAPD officers seized a personal computer along with programs and disks. These items were taken to the police station where a computer specialist found files that contained evidence of narcotics sales. The defendant challenged the admission of the computer evidence on the grounds that the police exceeded the scope of the warrant because it specified evidence of pay and owe sheets and did not include computer records, despite the police detective's purported knowledge of the presence of the computer from a previous search. The court, however, upheld the search, finding that the warrant's description of "tally sheets or pay and owe sheets" was sufficiently particular to justify the seizure of the computer: "A computer is 'by its nature a device for recording information.' . . . An officer searching for pay-and-owe sheets could reasonably expect to find them within the memory of a computer." Sprewell, 1991 WL 113647 at *4, (quoting United States v. Gomez-Soto, 723 F.2d 649 (9th Cir.) (holding that failure of warrant to specify microcasettes as object of search does not invalidate warrant), cert. denied, 446 U.S. 977 (1984)).

In United States v. Sissler, No. 1:90-CR-12, 1991 WL 239000 (W.D. Mich. Aug. 30, 1991) (unpublished decision), aff'd, 966 F.2d 1455 (6th Cir. 1992), cert. denied, 506 U.S. 1079 (1993), police were authorized by warrant to search and seize records of drug transactions maintained by the defendant. In addition to documents, the police seized nearly 500 computer disks and a personal computer. The defendant challenged the warrant as overbroad and the seizure of the computer disks as outside the scope of the warrant because it merely described the items to be seized as "documents." The court rejected this argument, holding that, "[t]he police were permitted to examine the computer's internal memory and the disks since there was every reason to believe that they contained records whose seizure was authorized by the warrant." Sissler, 1991 WL 239000 at *4.

STATE CASE

In City of Akron v. Patrick, 1982 WL 5049 (Ohio Ct. App. 1982), the defendant, convicted of gambling and operating a gambling house, appealed his conviction on the ground that, inter alia, the police illegally searched and seized two home computers. Pursuant to a valid warrant, the police entered the defendant's home, where they saw a computer screen which showed the words, "Advanced, Declined, Unchanged." Recognizing these terms to be consistent with gambling based on daily stock quotations, the police officers summoned a police computer expert, who confirmed that the computers were being used in conjunction with a gambling operation. The computers and diskettes were then seized.

The defendant moved to suppress the computer evidence because it was not specifically named in the search warrant. The search warrant had authorized the search and seizure of phones, U.S. currency, and gambling paraphernalia. The court held that although the computer equipment was not specifically identified in the warrant, the police officer had the authority to seize the computer because its incriminating nature as gambling paraphernalia was readily apparent to the officer from the display on the monitor.

c. Deleted Information (New)

(Insert at page 55)

In United States v. Scott, 975 F.2d 927 (1st Cir. 1992), a case dealing with the expectation of privacy in shredded documents found in trash bags on public streets, the court, in dicta, discussed the level of privacy created by new technologies, finding that although someone using a secret code or obscure language may have a subjective expectation of privacy even when discarding such materials, this expectation does not elevate to a constitutionally recognized one. The court stated:

Should the mere use of more sophisticated "higher" technology in attempting destruction of the pieces of paper grant higher constitutional protection to this failed attempt at secrecy? We think not. There is no constitutional requirement that police techniques in the detection of crime must remain stagnant while those intent on keeping their nefarious activities secret have the benefit of new knowledge. A person who prepares incriminatory documents in a secret code (or for that matter in some obscure foreign language), and thereafter blithely discards them as trash, relying on the premise or hope that they will not be deciphered (or translated) by the authorities could well be in for an unpleasant surprise if his code is "broken" by the police (or a translator is found for the abstruse language), but he cannot make a valid claim that his subjective expectation in keeping the contents private by use of secret code (or language) was reasonable in a constitutional sense.

Scott, 975 F.2d at 930.

STATE CASES

In Pennsylvania v. Copenhefer, 587 A.2d 1353, 526 Pa 555 (1991), the appellant claimed that the recovery and seizure of documents he mistakenly thought he had deleted from his computer was an impermissible intrusion on his expectation of privacy under the Fourth Amendment. During the investigation of a kidnapping and murder, the police obtained a warrant to search the appellant's computer. Using special software, the FBI searched the hard drive and recovered a series of drafts of and amendments to the texts of a ransom call, notes, and a twenty-two point plan for the entire kidnapping scheme, which the appellant believed he had deleted.

The appellant argued that even though his computer was seized pursuant to a valid warrant, his attempted deletion of the documents created an expectation of privacy under the Fourth Amendment requiring the police to obtain a second warrant to search the computer for such documents. The court rejected the contention that searching the deleted files violated his Fourth Amendment rights, holding that "a defendant's attempt to conceal evidence of a crime is not synonymous with a legally cognizable expectation of privacy. A mere hope for secrecy is not a legally protected expectation. . . . An attempt to destroy evidence is not equivalent to a legally protected expectation of privacy." Copenhefer, 587 A.2d at 1356.

H. DECIDING WHETHER TO CONDUCT THE SEARCH ON-SITE OR TO REMOVE HARDWARE TO ANOTHER LOCATION

1. Seizing Computers Because of the Volume of Evidence

b. Warrant is Narrowly Drawn but Number of Documents to be Sifted through is Enormous.

(Insert after first paragraph at page 58)

Several cases have upheld the constitutionality of seizing entire computers based on the volume of evidence to be searched. In United States v. Schandl, 947 F.2d 462 (11th Cir. 1991), cert. denied 504 U.S. 975 (1992), agents seized a computer disk containing a Bible home study course pursuant to a warrant authorizing the search and seizure of, inter alia, ". . . computer disks, and/or any other computer memory storage devices, plus computer mainframe which operates the memory storage devices relating to any financial transactions." The defendant moved to suppress the evidence resulting from the search on the ground that the agents exceeded the scope of the warrant. The court affirmed the district court's order upholding the removal of the items from the defendant's house, stating that "it might have been far more disruptive had the agents made a thorough search of each individual document and computer disk before removing it from [the defendant's] home and office. To insist on such a practice 'would substantially increase the time required to conduct the search, thereby aggravating the intrusiveness of the search.'" 947 F.2d at 465-66 (quoting United States v. Wuagneux, 848 F.2d 1374, 1353 (11th Cir. 1982), cert. denied, 464 U.S. 814 (1983)).

InUnited States v. Yung, 786 F. Supp. 1561 (D. Kan. 1992), the court held that the seizure of files outside the scope of the warrant did not invalidate the entire search. Because the court concluded that the videotapes and computer files specifically listed in the warrant could not be individually viewed during the search, the court found that the officers acted in "good faith" in attempting to stay within the boundaries of the warrant. Accordingly, the extensive seizure of certain types of items, such as computer disks, "was prompted largely by practical considerations and time constraints." 786 F. Supp. at 1569 (citing Marvin v. United States, 732 F.2d 669, 675 (8th Cir. 1984)(upholding seizure of entire files that contained information outside the scope of the warrant)).

In United States v. Stewart, No. Crim. A. 96-583, 1997 WL 189381 (E.D. Pa. April 16, 1997) (unpublished decision), pursuant to a valid warrant, police seized several computers along with related accessories. A police computer expert then copied the files and returned them to the defendant. Over the defendant's challenge, the court held that such a procedure was proper and did not violate the Fourth Amendment. The court reasoned that searching all files on the hard drives and diskettes at the scene of the crime is often not practical for the agents executing a warrant. Therefore, agents' seizing voluminous computer files was a permissible search technique.

In United States v. Lamb, 945 F. Supp. 441, 458-59 (N.D.N.Y. 1996), the Court of Appeals held that because a warrant issued for a child pornography investigation articulated probable cause to believe that stored files contained evidence of the crime, the warrant properly authorized the search and seizure of the disks containing the incriminating files. The language of the warrant did not limit investigators to seizing specific graphic files because the actual contents of a computer file usually cannot be determined until it is reviewed with the appropriate application software on a computer. The court elaborated, stating that:

"[e]ven when the filename is known ahead of time, it would rarely if ever be possible to know if the data in the file contains child pornography, without viewing it on a monitor. . . . In these circumstances it is unreasonable to require the executing officers to identify which files actually contain child pornography and which do not in AOL's Virginia headquarters. The task may be more properly performed by a government computer technician at an FBI lab or office." Lamb, 945 F. Supp at 458 n.10.

STATE CASE

In Ohio v. McGuire, No. 16423, 16431, 1994 WL 700082 (Ohio App. 9 Dist. 1994) (unpublished decision), the police executed a warrant authorizing the search and seizure of, inter alia, "one (1) computer system, computer disks, VCR tapes containing scenes of sex acts." The court upheld the search and seizure of more than seventy-eight computer disks (which contained both personal and business records) stating that "[g]iven the fact that contents of a computer disk are not readily apparent from mere observation, the police were justified in seizing all defendant's computer disks in order to fully review their contents to determine if they were evidence of the crimes that defendant had allegedly committed." McGuire, 1994 WL 700082 at *9.

2. Seizing Computers Because of Technical Concerns

a. Conducting a Controlled Search to Avoid Destroying Data

(Insert at top of page 62)

In Mahlberg v. Mentzer, 968 F.2d 772 (8th Cir.), cert. denied, 506 U.S. 1026 (1992), the plaintiff brought a § 1983 action against a police officer, claiming that the officer had violated the plaintiff's Fourth Amendment rights by seizing approximately 160 computer disks along with instruction manuals, directory printouts, and library books pursuant to a warrant that had listed only two computer programs as objects of the search.(3) Judgment was entered for the defendant after a jury trial, and the plaintiff's motion for a new trial was denied. On appeal, the Eighth Circuit considered the question of whether the seizure of items not listed on a warrant violated the subject's Fourth Amendment rights when the officer believed that the diskettes and computers were "booby-trapped" to destroy the evidence. In affirming the district court, the Eighth Circuit held that the finding that the officer's legitimate concern that the disks may have been "booby trapped" to erase themselves if examined on the defendant's home computer, combined with the officer's testimony that he believed the manuals and printouts were related to criminal activity, justified the seizure of the disks and related manuals, printouts, and books for later review away from the scene of the search.

I. EXPERT ASSISTANCE

1. Introduction

(Insert as first paragraph of section at page 63)

Federal law explicitly provides for the use of experts while executing search warrants.

18 U.S.C. § 3105 states that:

[a] search warrant may in all cases be served by any of the officers mentioned in its direction or by an officer authorized by law to serve such warrant, but by no other person, except in aid of the officer on his requiring it, he being present and acting in its execution.

18 U.S.C. § 3105 (1997) (emphasis added).

STATE CASE

In Ohio v. Sevrence, No. F-96-001, 1997 WL 89100 (Ohio Ct. App. 1997) (unpublished decision), a police officer presented a warrant to the appellant for the search of his business for stolen computer parts. Because the officer was "computer illiterate," he demanded that the appellant produce the items in the warrant. The court held that requiring the appellant to produce the items in the warrant violated his Fifth Amendment right against testimonial conduct and ruled that the computer evidence must be suppressed. Although the state had tried to justify the seizure by arguing that there was a high probability that the items enumerated on the warrant would have been found by the executing officer in the absence of the appellant's assistance, the court rejected this "inevitable discovery" theory. Instead, the court held that, based on the fact that (1) the officer admitted he was "computer illiterate," (2) the warrant did not specify the serial numbers of the equipment to be seized, and (3) there was a large quantity of computer equipment at the search location, there was not a high likelihood that the officers would have inevitably discovered the stolen goods.

3. What the Experts Can Do

a. Search Planning and Execution

(Insert at page 68)

The courts have specifically upheld the use of experts when carrying out searches and seizures of computer equipment. In United States v. Schwimmer, 692 F. Supp. 119 (E.D.N.Y. 1988), in an investigation for racketeering, conspiracy, and tax evasion, federal agents obtained a warrant authorizing them to search a bank's premises and the offices of the bank's counsel. Seizure was permitted of "books and records" including computer tapes related to special deals concerning the bank. Additionally, the warrant authorized the assistance of a private computer expert to operate the bank's computer terminals. The defendant challenged the execution of the warrant, in part because it was executed by a private computer expert. The court ruled, however, that "the assistance of this individual, however, was specifically permitted by the warrant pursuant to statutory authority." Schwimmer, 692 F. Supp. at 126-27 (citing 18 U.S.C. § 3105).

STATE CASE

In Florida v. Wade, 14 Fla. L. Weekly 1071, 544 So.2d 1028 (Fla. Dist. Ct. App. 1989), the appellant challenged the use of computer experts who were employed by the victim corporation to help identify the stolen computer equipment listed in the search warrant. The court held that in exceptional circumstances such as these, it is proper to use computer experts, including those employed by the victim corporation, to assist in the execution of a warrant. Here, the court found that because the stolen property was of a technical nature not generally familiar to law enforcement officers, the use of computer experts was permissible.









V. NETWORKS AND BULLETIN BOARDS

A. INTRODUCTION

(Insert after second paragraph at page 71)

Computers often contain information and works that are subject to at least some degree of protection under the First Amendment. In searches and seizures where materials protected by the First Amendment are the object of the search, courts review Fourth Amendment issues with heightened care. "Fourth Amendment protections become the more necessary when the targets of official surveillance may be those suspected of unorthodoxy in their political beliefs." United States v. United States Dist. Court, 407 U.S. 297, 314 (1972). The courts have extended heightened Fourth Amendment protections to all works covered by the First Amendment. "When the contents of a package are books or other materials arguably protected by the First Amendment, and when the basis for the seizure is disapproval of the message contained therein, it is especially important that [the Fourth Amendment's warrant] requirement is scrupulously observed." Walter v. United States, 447 U.S. 649, 655 (1980). Further, "the constitutional requirement that warrants must particularly describe the 'things to be seized' is to be accorded the most scrupulous exactitude when the 'things' are books, and the basis for their seizure is the ideas which they contain." Stanford v. Texas, 379 U.S. 476, 485 (1965).

In United States v. Kimbrough, 69 F.3d 723 (5th Cir. 1995), cert. denied, 116 S. Ct 1547 (1996), the defendant challenged the validity of warrants which in a child obscenity investigation allowed the search and seizure of "commercial software and manuals, hardware, computer disks, disk drives, monitors, computer printers, modems, tape drives, disk application programs, data disks, system disk operating systems, magnetic media-floppy disks, CD ROMs, tape systems and hard drives, other computer related operational equipment, and other similar materials . . . . " The defendant contended that the warrants were unconstitutional on their face because, considering that many of the items were "presumably protected speech," the warrants failed to sufficiently specify with particularity the items to be seized. The court rejected this argument noting that the language of the warrants properly limited the executing officers' discretion by informing them what items were to be seized.

In United States v. Layne, 43 F.3d 127 (5th Cir. 1995), the defendant challenged a warrant authorizing the search and seizure of "assorted pornographic videotapes; assorted pornographic magazines," on the ground that the warrant enumerated items protected by the First Amendment. The Fifth Circuit, however, rejected this claim, holding that although the Supreme Court has required a heightened showing of particularity under Marcus v. Search Warrant, 367 U.S. 717, 732 (1961), this level of particularity is only required where there is a danger of prior restraint. In this case, the Fifth Circuit found that the items to be seized were not being seized on the basis of their content; instead, they were being seized because they corroborated a victim's testimony. Further, the court held that a warrant authorizing the search and seizure of material depicting children under the age of 16 engaged in "sexually explicit conduct" was particular enough to limit an officer's discretion. See United States v. Hurt, 808 F.2d 707 (9th Cir.) cert. denied, 484 U.S. 816 (1987).

B. THE PRIVACY PROTECTION ACT

(Insert before section 1 at page 72)

The development of the Internet has changed both the scope and coverage of the Privacy Protection Act ("PPA). As an ever-increasing number of computers become connected to this global network, almost any computer may be a repository of information being prepared for electronic publication. Before executing a search warrant on a computer that might contain files protected by the PPA, agents and prosecutors are H2ly encouraged to carefully review the facts of the case and the status of the law in this area. If questions arise, prosecutors and agents are always welcome to contact the Computer Crime and Intellectual Property Section (202-514-1026).

6. Liability Under the Privacy Protection Act (NEW)

(Insert at page 86)

The Privacy Protection Act ("PPA") creates a civil cause for damages resulting from a search or seizure of materials in violation of the Act. The PPA states that an aggrieved person shall have a cause of action

(1) against the United States, against a State which has waived its sovereign immunity under the Constitution to a claim for damages resulting from a violation of this chapter, or against any other governmental unit, all of which shall be liable for violations of this chapter by their officers or employees while acting within the scope or under color of their office or employment; and

(2) against an officer or employee of a State who has violated this chapter while acting within the scope of or under color of his office or employment, if such State has not waived its sovereign immunity as provided in paragraph (1).

42 U.S.C. § 2000aa-6(a).

In Davis v. Gracey, 111 F.3d 1472 (10th Cir. 1997), plaintiff brought a civil suit against the city of Oklahoma City, the Oklahoma City Police Department, and the individual officers who had executed a search of a BBS, alleging that the seizure of the computer system which contained shareware intended for future publication, violated the Privacy Protection Act.(4) The police had obtained a warrant that authorized the search and seizure of "equipment, . . . and other paraphernalia pertaining to the distribution or display of pornographic material in violation of state obscenity laws." During the execution the warrant, officers determined that the materials could be remotely accessed via the plaintiff's BBS system. As a result, the officers seized the computer equipment used to operate this BBS as an instrumentality of the crime.

The plaintiff asserted that because the computer system contained shareware which the plaintiff planned to "publish" on a forthcoming CD-ROM, the seizure of the computer equipment violated the Privacy Protection Act. Noting that all municipal entities had previously been dismissed from the case,(5) leaving only the police officers in their individual capacities, the district court had granted summary judgment, holding that the defendants were entitled to the "good faith" defense under 42 U.S.C. § 2000aa-6(b) because the officers had relied on a warrant. On appeal, the Tenth Circuit held that it lacked subject matter jurisdiction over the PPA claim. According to the court, a PPA action may only be brought against a governmental entity, unless the applicable state has not waived sovereign immunity. In that event, state employees may be sued in their official capacities. By its terms, however, the PPA does not authorize a suit against municipal officers or employees in their individual capacities. Thus, even though the parties in this action had stipulated to jurisdiction under the PPA, the court dismissed the plaintiff's PPA claim, sua sponte, for lack of subject matter jurisdiction.

STATE CASE

In Oklahoma v. One Pioneer CD-Rom Changer, 891 P.2d 600 (Okla. App. 1994), a companion civil forfeiture case to Davis v. Gracey, the owner of the equipment at issue sought to prevent forfeiture of his computer equipment by claiming, inter alia, that the computers in question contained information protected by the PPA. Pursuant to an investigation for distributing obscene material, the police had seized several CD-ROM drives, power supplies, modems, and computers, all of which were connected to a network.

The owner of the equipment contended that because the system contained 500 megabytes of non-obscene software that was to be pressed into a compact disc to be published, the search and seizure violated the PPA's requirement that such publication materials be obtained by subpoena. The owner contended that by not using a subpoena, the police had violated his First Amendment rights. In rejecting this claim, the court held that even if the PPA had been violated, such a violation would not shield equipment seized pursuant to an otherwise lawful search and seizure from forfeiture under state law.

C. STORED ELECTRONIC COMMUNICATIONS

(Insert at page 87 before last paragraph)

In October 1994, Congress amended the Stored Wire and Electronic Communications Act by adding provisions for governmental access to subscriber or transactional information (excluding the content of communications).

Specifically, if the government is acting without the consent of the customer or subscriber, governmental entities must use some compulsory process to obtain subscriber or transactional information. The government may use a subpoena if the material sought is the "name, address, local and long distance telephone toll billing records, telephone number or other subscriber number or identity, and length of service of a subscriber to or customer of such service and the types of services the subscriber or customer utilized. . . ." 18 U.S.C. § 2703(C).

(Insert at page 88 after discussion of Steve Jackson Games)

On appeal, the Fifth Circuit further addressed the privacy issues raised in the Steve Jackson Games case to decide whether the seizure of a computer, used to operate an electronic bulletin board system and containing private unopened electronic mail, constitutes an unlawful interception under 18 U.S.C. § 2511. The statute defines "intercept" as "the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device." 18 U.S.C. § 2510(4).

The Fifth Circuit held that while the interception of electronic communications in transit would violate 18 U.S.C. § 2511(1)(a), that statute does not proscribe the seizure of electronic communications while in "electronic storage" as defined at 18 U.S.C. § 2510(17). Steve Jackson Games v. United States Secret Service, 36 F.3d 457, 461 (5th Cir. 1994). At the same time, the court upheld the district court's determination that the seizure in this case violated 18 U.S.C. § 2701.

The court relied on the decision in United States v. Turk, 526 F.2d 654 (5th Cir.), cert. denied, 429 U.S. 823 (1976), which held that an interception does not occur when the acquisition of the communications is not contemporaneous with their transmission. The appellants argued that Turk did not apply, because that case did not address the situation where the government both acquires the communication prior to delivery of the communication and prevents its delivery. In such an instance, the appellant argued, an interception has occurred.

The court rejected this contention, relying on the integrated structure of § 2510 and

§ 2701. Congress clearly intended to treat wire communications (human voice) differently from electronic ones in this regard. Although § 2701 treats the unauthorized access of e-mail and voicemail the same (if they were in "electronic storage," as defined), the rules for law enforcement access to these two types are different. Indeed § 2703 explicitly lays out a regime for government's acquisition of stored electronic communications only. Thus, government agents who need to acquire wire communications in electronic storage should look to the wiretap statute rather than § 2703. Differences in the definitions of "wire communication" and "electronic communication" in § 2510 underscore this. "Wire communication," as defined at 18 U.S.C. § 2510(1) also covers those in "electronic storage," while the definition of "electronic communication" does not. "Congress did not intend for 'intercept' to apply to 'electronic communications' when those communications are in 'electronic storage.'" Steve Jackson Games, 36 F.3d at 462.

The District Court for the District of Nevada addressed a similar argument in Bohach v. Reno, 932 F. Supp. 1232 (D. Nev. 1996). In Bohach, two police officers used a police-owned computer-controlled paging system to send communications that later became the subject of an internal affairs investigation. The officers had entered the messages on a police-owned computer terminal that forwarded each message to the police-operated computer paging system, which logged each message and then forwarded a copy to the individual pagers. Internal Affairs recovered the messages in question from the log file on the paging computer.

The plaintiffs brought suit claiming that the department illegally intercepted the messages in violation of 18 U.S.C. § 2511 by recovering them from the log files. Relying on Steve Jackson Games, the court held that, by definition, a communication in electronic storage cannot be "intercepted" under the definition in 18 U.S.C. § 2510(4). Instead, stored electronic communications are governed under 18 U.S.C. §§ 2701-2711. Because 18 U.S.C. § 2701 allows service providers to access communications in electronic storage and the police department was the service provider for the paging service, the court held that neither the department nor its employees could be held liable for violating 18 U.S.C. § 2701.

In Davis v. Gracey, 111 F.3d 1472 (10th Cir. 1997), in addition to claiming PPA violations by Oklahoma City police officers, the plaintiff also claimed that the search and seizure violated 18 U.S.C. § 2701 (see "Liability Under the PPA supra, p.21). In seizing the computer th contained and had distributed obscene images, police incidentally seized approximately 150,000 e-mail messages on the same machine, some of which had not been opened. The plaintiff contended that the officers "obtain[ed] . . . or prevent[ed] authorized access to a[n] electronic communication while it is in electronic storage" within the meaning of 18 U.S.C. § 2701(a).

In making this claim, the plaintiff relied on Steve Jackson Games. The Tenth Circuit, however, distinguished Steve Jackson Games on two separate grounds. First, in Steve Jackson Games, the owner of the seized computer was not a target of the investigation, whereas in Davis, the owner of the BBS was under investigation for distributing and displaying obscene materials. Second, unlike Steve Jackson Games, where the Secret Service read and deleted e-mail messages stored on the seized computers, the officers in Davis did not attempt to read the seized e-mail. Davis, 111 F.3d at 1483.

Having held that the officers did not gain access to or read the seized e-mail, the court addressed whether the incidental seizure of electronic communications, standing alone, is a violation of ECPA. The court assumed, without deciding, that the defendants had accessed a stored electronic communication in violation of § 2701. The court held, however, that because the officers relied on a warrant supported by probable cause, the officers were entitled to a "good faith" defense because the seizure of the stored electronic communications was incidental to the execution of the warrant. Davis, 111 F.3d at 1472.

The plaintiff also claimed that the officers executing the search were not entitled to the "good faith" defense because prior to obtaining the warrant, they knew that the same computer system was an e-mail server and did not include this in the warrant affidavit. The court, however, held that as a matter of law the seizure of the e-mail messages fit within a good-faith defense to liability under § 2707(e), which states that "reliance on . . . a court warrant or order, a grand jury subpoena, a legislative authorization, or a statutory authorization . . . is a complete defense to any civil or criminal action brought under this chapter." Even the inference of bad faith while procuring the warrant did not eliminate the officers' ability to rely on a valid warrant supported by probable cause. Davis, 111 F.3d at 1484. In reaching this conclusion, however, the court emphasized that the seized computer system not only contained evidence of crime, it also contained contraband and was itself an instrumentality of crime. As a matter of policy, CCIPS H2ly recommends advising magistrates whenever target computer systems are also mail servers. If prosecutors have any questions in this regard, they are encouraged to contact us at (202) 514-1026.

In Tucker v. Waddell, 83 F.3d 688 (4th Cir. 1996), the court held that no governmental liability attaches under 18 U.S.C.§ 2703(c) for the use of improper subpoena. In 1991, police officers in Durham, North Carolina served two improper subpoenas on Cora Tucker's telephone service provider for her subscriber information. (Plaintiff's counsel has advised that the administrative subpoenas were issued without the authorization required by state statute.) Tucker sued the city and the officers under 18 U.S.C. § 2703(c).

Defendants argued successfully that a cause of action does not lie against a government actor under § 2703(c). In accepting this view, the Fourth Circuit relied upon the fact that

§ 2703(c) "does not expressly proscribe any action by governmental entities or their employees. Rather, § 2703(c) only prohibits the action of [communications] providers . . . . " 83 F.3d at 692.

The Court found this conclusion reinforced by the fact that sections 2703(a) and (b), by contrast, "focus on the conduct of governmental entities." As a result, the Court concluded (in dicta) that government violations of those provisions may give rise to civil liability (citing Steve Jackson Games v. United States Secret Service, 36 F.3d 457, 461 (5th Cir. 1994)) against the government.

In the final footnote of the opinion, the Fourth Circuit held out the possibility that "[a]rguably, it might be possible for a government entity to violate § 2703(c) by aiding and abetting or conspiring in the provider's violation. Id. at 693 n.6. Because Tucker failed to plead either of these theories, her claims were dismissed.

STATE CASE `

In Oklahoma v. One Pioneer CD-Rom Changer, 891 P.2d 600, 606 (Okla. App. 1994), a companion civil forfeiture case to Davis v. Gracey, the owner of a BBS who was being charged with distributing obscene material, sought to halt forfeiture of his computer equipment by the state by asserting that the computer system seized by the police contained e-mail messages protected by the 18 U.S.C. § 2510 et. seq. The state had originally offered to return the messages as long as this did not compromise its criminal case. The court held that defendant did not make a sufficient showing that the "lawful, physical seizure of computer equipment which was allegedly used to distribute obscene material and which contained private communications in the form of e-mail, constituted an 'interception'" under ECPA.









VI. DRAFTING THE WARRANT

A. DRAFTING A WARRANT TO SEIZE HARDWARE

(Insert at page 91)

STATE CASES

In Oklahoma v. One Pioneer CD-Rom Changer, 891 P.2d 600 (Okla. App. 1994), the operator of the BBS contended that the warrant authorizing seizure of the computer equipment was overbroad because it did not describe the networking equipment seized, even though the police knew of its existence. The warrant permitted the police to search the premises for "obscene materials" and specified "equipment, order materials, papers, membership lists, and other paraphernalia pertaining to the distribution or display of pornographic material in violation of state obscenity laws." The appellate court upheld the granting of summary judgment against the owner of the BBS and held that the warrant was as specific as it could be with regard to the officer's knowledge. Furthermore, the equipment and the status messages on the monitor were in plain view to the officers, thus there was an exception to the Fourth Amendment's warrant requirement.

In Massachusetts v. Pasqualino, 3 Mass.L.Rptr. 382 (Mass. Super. 1995), the defendant filed a motion to suppress items seized from his house in a search for stolen computer equipment. Police obtained a warrant that allowed them to search "any room in the house where any computer, or piece of computer, as listed may be concealed from view, including the basement, including a shed located in the backyard as well as any motor vehicle on the property." The defendant claimed that this language did not meet the particularity requirement of the Fourth Amendment because it mostly described the place, not the items, to be searched. Despite the poor drafting, the court upheld the warrant based on the manner in which it was executed; while executing the search, the police relied upon the search warrant affidavit that sufficiently described the items to be seized, checking off each item as they progressed.

In Iowa v. Gogg, 561 N.W.2d 360 (Iowa 1997), a confidential informant has said that a computer, modem, and telephone similar to those stolen from a local business were located at the defendant's residence. The warrant for these items was held invalid (due to lack of probable cause) because there was no showing in the affidavit that the items observed by the informant were unique or unusual. Besides, telephones and computer equipment are often found in homes. "Where items to be seized are not unique, mere similarity to property involved in a crime will not support probable cause." Id. at 366 (citing Iowa v. Seager, 341 N.W.2d 420, 427 (Iowa 1983)).

In Schalk v. Texas, 767 S.W.2d 441 (Ct. App. Tex. 1988), the appellant was found guilty of theft of trade secrets for knowingly copying five separate computer programs that belonged to his former employer. The district attorney obtained a search warrant for the premises of the appellant's new employer. The warrant allowed the search and seizure of all magnetic media tapes, including those bearing a certain brand name and all documents labeled as the first company's trade secrets. Additionally, the warrant specified the access codes and passwords necessary to access the trade secrets. The appellant contended that the search warrant failed to describe the items to be seized with sufficient particularity. The court upheld the validity of the warrant noting that "[t]o describe the 'trade secret' itself in sufficient detail to meet the argument of appellant would be to reveal the precise secret information that was not intended to be revealed." Id. at 453.

B. DRAFTING A WARRANT TO SEIZE INFORMATION

1. Describing the Place to Be Searched

c. Handling Multiple Sites in Different Districts

(Insert at page 95)

In United States v. Denman, 100 F.3d 399, 402 (5th Cir. 1996), cert. denied, 117 S. Ct. 1256 (1997), the Fifth Circuit upheld the legality of a wiretap order issued in one district on phone lines located in another district. The defendant contended that the wiretap evidence should be suppressed because the wiretap order was jurisdictionally defective. Relying on United States v. Rodriguez, 968 F.2d 130 (2d Cir.), cert.denied, 506 U.S. 847 (1992), the court held that for the purposes of Title III, the interception "includes both the location of a tapped telephone and the original listening post, and that judges in either jurisdiction have authority under Title III to issue wiretap orders." The Denman court noted that this interpretation "aids an important goal of Title III, to protect privacy interests, by enabling one judge to supervise an investigation that spans more than one judicial district."

In United States v. Ramirez, 112 F.3d 849, 852 (7th Cir. 1997), the government had obtained, in the Western District of Wisconsin, an order authorizing the wiretapping of a cellular phone line primarily used by a defendant in a drug conspiracy who commuted between his home in Wisconsin and St. Paul, Minnesota where he sold drugs. The listening post was set up in Minnesota. Shortly after setting up the listening post, the government learned that the cellular phone was not being used by the defendant, but was being used by another person who was discussing the drug conspiracy the government was investigating. The defendants challenged the admissibility of the wiretap evidence.

According to Judge Posner, a literal interpretation of 18 U.S.C. § 2518(3):(6) would not allow a judge in the Western District of Wisconsin to authorize the interception by a stationary listening post in Minnesota of calls from a cellular phone located in Minnesota, but it would authorize the judge to authorize the interception by a stationary listening post in Minnesota of calls from a cellular phone in the Western District of Wisconsin, by a stationary listening post in that district of calls from anywhere, and by a mobile listening post (or other mobile interception device) authorized in the western district but located anywhere in the United States of calls from anywhere. The literal reading makes very little sense. It would mean that if as in this case the listening post is stationary and is for practical reasons located outside the district in which the crime is being investigated and the cellular phone is believed to be located, the government, to be sure of being able to tap the phone if it is carried outside the district (as is it is quite likely to be, given its mobility), must obtain the wiretap order from the district court in which the listening post is located, even though that location is entirely fortuitous from the standpoint of the criminal investigation. Id. at 852.

Relying on Denman and Rodriguez, the Ramirez court held that it would make far more sense that the term "mobile interception device," for the purposes of 18 U.S.C. § 2518(3), "means a device for intercepting mobile communications." The court, therefore, found that the district court in the Western District of Wisconsin could authorize a wiretap on a cellular phone "regardless of where the phone or listening post was." The court reasoned that to limit the scope of a court order would serve no interest in protecting privacy because "the government can always seek an order from the district of the listening post for nationwide surveillance of cellular phone calls." Id. at 853.

2. Describing the Items to be Seized

(Insert at page 99)

In Davis v. Gracey, 111 F.3d 1472 (10th Cir. 1997), as described above (see "Liability Under the PPA," supra, at p. 21), the police obtained a warrant to search the business premises of the defendant for pornographic CD-ROMs and "equipment, order materials, papers, membership lists and other paraphernalia pertaining to the distribution or display of pornographic material in violation of state obscenity laws." The warrant did not describe a BBS, which the officers seized after determining that it contained obscene material. The defendant challenged the search and seizure of the BBS, claiming that because the warrant did not define the term "equipment," it was not sufficiently particular. The Tenth Circuit held that because the warrant limited the officers' discretion by authorizing them to search only for "equipment . . . pertaining to the distribution of or display of pornographic materials in violation of state obscenity laws," the computer equipment was legally seized. Id. at 1479. Finally, the court held that although the officers failed to inform the magistrate of the existence of the BBS, the warrant was sufficiently supported by probable cause.

In United States v. Falon, 959 F.2d 1143, 1148-49 (1st Cir. 1992), the First Circuit affirmed an order suppressing the defendant's checkbooks, canceled checks, telephone records, address indexes, message slips, mail, telex and facsimile records, calendars and diaries, memory typewriters, word processors, computer disks, both hard and floppy, and other electronic storage media and unrelated software on the ground that the warrant failed to distinguish between the defendant's personal papers and business documents. The court stated that "when an individual's allegedly fraudulent business activities are centered in his home, the 'all records' doctrine must be applied with caution. . . . [I]t would require extraordinary proof to demonstrate that an individual's entire life is consumed by fraud and that all records found in the home were subject to seizure. Because the warrant failed explicitly to limit these . . . categories of items to the subset directly linked to the alleged fraud, the warrant was to that extent insufficiently particular to meet the requirements of the Fourth Amendment."

The Sixth Circuit upheld an "all records" warrant for the search of a residence in a fraud investigation in United States v. Humphrey, 104 F.3d 65, 69 (5th Cir.), cert. denied, 117

S. Ct 1833 (1997). The warrant included a list of four generic categories of property, all related to financial records, and was supported by a three-page affidavit from the agent. The court held that the search warrant was valid in light of the pervasive nature of the fraud, the considerable overlap of the defendant's business and personal life, and the limitation of the warrant to records of financial transactions.

In United States v. Lyons, 992 F.2d 1029 (10th Cir. 1993), during the course of seizing stolen computer equipment, the FBI also searched and seized the contents of stolen computer disks which were not described in the search warrant. The court held that because the defendant made no attempt to show that he had any rightful claim to the disks, he failed to meet the threshold requirement of demonstrating an expectation of privacy in the property searched. Consequently, the court affirmed the district court's denial of the motion to suppress.

In United States v. Maxwell, 45 M.J. 406 (Ct. App. Armed Forces 1996), agents secured a warrant for a search of America Online's computers to determine the identity of a user suspected of trafficking in child pornography and to secure copies of his e-mail. Before receiving the warrant, AOL programmed its computers to provide the requested information. When the warrant was obtained, however, the defendant's screen name was misspelled as "REDDEL"; however, the search was run using the correct name "REDDE1." Notwithstanding the defendant's contention that a search for the name in the warrant would not have revealed his identity, the court held that the typographical error did not invalidate the warrant.

The defendant also challenged the warrant on the ground that it was overly broad, resulting in a general search prohibited by the Fourth Amendment, because it: (1) included the names of those merely receiving obscenity and child pornography, which is not illegal; and (2) lacked an identifiable "e-mail chain" to conclusively link the copies of the electronic child pornography presented to the magistrate with the separate typed list of screen names provided as an attachment to the warrant application. The court held that it was not a general warrant, because "any attempt to further narrow the field of names to be searched in order to weed out those who might have unknowingly received the illegal materials would have resulted in an advance search of those recipients' mailboxes." Id, at 420.

Finally, the defendant challenged the scope of the search because AOL provided information on his second screen name "ZIRLOC," which was not specified in the warrant. The appellate court held the evidence from that screen name inadmissible, because AOL did not rely on the precise language of the warrant while executing the search. Instead, they provided the information pursuant to their understanding of what the warrant would direct. When AOL learned about the screen name "REDDE1" they determined it belonged to defendant and prepared to produce all e-mail associated with his account, including e-mail sent or received under the account's other screen name, "ZIRLOC." But AOL accounts are often used by more than one member of the same family. The identities within one account are differentiated by using a different screen name for each user. The court thus held that because it was not possible for AOL to determine who actually used the unspecified screen name, the court was "unpersuaded . . . to declare other's expectations of privacy to be forfeited based upon some undefined 'good faith' exception." Id, at 421. The appellate court also rejected arguments that the evidence found under the "ZIRLOC" screen name was admissible under the plain view exception or by the inevitable discovery rule. Id. at 422.

In United States v. Kow, 58 F.3d 423 (9th Cir. 1995), the Ninth Circuit held that a warrant that authorized the seizure of inter alia, "[c]omputers, magnetic floppy disks or diskettes, including 3 ½ inch, 5 1/4 inch, or 8 inch sizes, compact disks, magnetic tapes, including cassettes, cartridges, streaming tape, video tape, hard disk units (with attached control card), magnetic cards, and any other electronic data processing storage medium," was overbroad because it did not specify with particularity which records related to the charged offense. The court ruled that such a general warrant might be appropriate if the government establishes probable cause to believe that the entire business is merely a scheme to defraud or that all the business records are likely to evidence criminal activity. In this case, however, the warrant was not supported by such probable cause. See also United States v. Thomas, 746 F. Supp. 65, 68 (D. Utah 1990) (discussing search that included computer disks in corporate office, holding that warrant must limit search to "particular entity or transaction" in order to be reasonably particular).

In United States v. Hersch, Crim. A. No. 93-10339-Z, 1994 WL 568728 (D. Mass. 1994) (unpublished decision), the court considered whether a warrant for the search and seizure of computer hardware, software, and related equipment amounted to a general search warrant. The defendant filed a motion requesting an evidentiary hearing under Franks v. Delaware, 438 U.S. 154 (1978), to challenge the affidavits that supported a warrant to search his offices. The defendant claimed that the initial warrant and affidavit lacked the requisite particularity under the Fourth Amendment. The court held that because of the "nature" of computer equipment and data, the scope of seizure necessarily must be broad. Furthermore, in this particular case, the complex scheme under investigation required the seizure of the entire computer system in order to piece the scheme together. (citing Andresen v. Maryland, 427 U.S. 463, 481 n.10 (1976)).

The court in United States v. Stewart, Crim A. No. 96-383, 1997 WL 189381 (E.D. Pa. 1997) (unpublished decision), addressed whether the description of the items set forth in the warrant was so broad that it constituted a general exploratory warrant in violation of the Fourth Amendment. The warrant at issue allowed the search and seizure of "[a]ll computer hardware and software containing any [evidence of racketeering, mail and wire fraud, and money laundering], including, any computer hardware and/or software necessary to access this data and any operating manuals and software guides necessary to access this data." The court upheld this warrant, holding that this restriction acted as a sufficient limitation on the scope of the warrant.

In United States v. Lacy, -- F.3d --, 1997 WL 378104 (9th Cir. 1997), the Ninth Circuit further addressed the specificity requirement for warrants. On appeal from a conviction for possession of child pornography, the defendant argued that the warrant was too general because it authorized the seizure of his entire computer system. The Ninth Circuit distinguished the Kow decision, stating that, unlike the Kow case, the affidavit in the present case established probable cause to believe that the entire system would contain evidence of criminal activity. Although both the warrant in Lacy and the warrant in Kow described the computer equipment in generic terms and subjected it to a blanket seizure, the court held that, in the instant case, no more specific description of the computer equipment sought was possible.

STATE CASES

In New York v. Loorie, 165 Misc.2d 877, 630 N.Y.S.2d 483 (Monroe Cty. Ct. 1995), police seized a computer, a backup drive, and several dozen floppy disks, pursuant to a valid warrant that authorized the police to search for and seize "any and all computers, keyboards, Central Processing Units, external drives and/or internal drives, external and internal storage devices such as magnetic tapes and/or disks or diskettes." After seizing the computer equipment, the police examined the contents of the computer's internal drive and the floppy disks. The court rejected appellant's contention that the police exceeded the scope of the warrant by examining the contents of the computer's internal drive and the floppy disks. The court stated that United States v. Ross, 456 U.S. 798, 829-22 (1982), and its progeny established the principle that where a search warrant authorizes the seizure of records, the police can search whatever type of container might reasonably contain such records.

In Washington v. Riley, 121 Wash.2d 22, 846 P.2d 1365 (1993), a long distance telephone company observed that the company's general phone card access number was being repeatedly dialed at 40-second intervals. After connection, a different 6-digit code was entered, followed by the same long distance number. The company recognized this activity as characteristic of a "hacker" attempting to obtain customer's 6-digit access codes which could then be used to make long-distance calls. The long distance company contacted the local phone company which traced the repeated calls to the defendant.

Based on this information, the police secured a warrant which authorized the seizure of "any fruits, instrumentalities and/or evidence of a crime, to-wit: . . . information stored on hard or floppy disks, personal computers, modems, monitors, speed dialers, touchtone telephones, electronic calculators, electronic notebooks, or any electronic recording device."

The defendant claimed that the warrant was overbroad because it did not specify what crimes were being investigated or otherwise limit the scope of the search by reference to particular items to be seized. The Washington State Supreme Court held that the warrant was facially overbroad and therefore invalid because the warrant failed to sufficiently limit the scope of the search, nor did it state the crime under investigation. When the nature of the underlying offense precludes a descriptive itemization of the items to be seized, generic classifications, like the ones used for this warrant, are acceptable. In such an instance, however, the search must be circumscribed by reference to the crime under investigation. In this instance, the warrant authorized broad categories of material to be seized and was not limited by reference to any specific criminal activity. The court thus held the warrant to be invalid.

In Florida v. Wade, 14 Fla. L. Weekly 1071, 544 So.2d 1028 (Fla. Dist. Ct. App. 1989), the appellants challenged a warrant authorizing the search and seizure of "computer equipment and business records which is [sic] being kept and used in violation of the Laws of the State of Florida" as overbroad. The court upheld the warrant, stating that such a description accompanied by a lengthy affidavit of probable cause sufficiently limited the scope of the search.

In Louisiana v. Tanner, 534 So.2d 535 (Ct. App. La. 1988), police obtained a warrant that authorized officers to search an office and seize "a copy of the 'Cosmos Revelation' software disc, . . . on a floppy disc, and other computer related software and copies of computer printouts bearing the name 'First Page Beepers.'" While executing the warrant, officers found manuals, but not the specified disk. The program bearing the proper serial number was found on a computer's hard drive. The officer made a copy of the program from the hard drive, and seized the manuals, computer keyboard, terminal, and numerous related documents.

The defendant claimed that the warrant was overbroad. The warrant authorized the officers to seize a copy of the disk identified by serial number and other computer related software and copies of computer printouts bearing the name of the business. The court found that the warrant was not overbroad because it limited the officers' discretion by authorizing only the search and seizure of related software bearing the name "First Page Beepers."

In Pennsylvania v. McEnamy, 667 A.2d 1143 1149 (Pa. Super. Ct. 1995), the court held that a second warrant to search the memory chip of a validly seized cellular telephone was unnecessary. The court reasoned that "the memory chip in a cellular phone is analogous to the memory chip of a personal computer in that both simply store information," and it has long been held that a warrant authorizing the seizure of a personal computer authorizes reproduction of the documents stored within.








VII. POST-SEARCH PROCEDURES

B. PROCEDURES FOR PRESERVING EVIDENCE

4. Returning Seized Computers and Materials

a. Federal Rules of Criminal Procedure: Rule 41(e)

(Insert at page 106)

The defendant invoked Fed. R. Evid. 41(e) for the return of seized computer equipment in United States v. Stowe, No. 96 C 2702, 1996 WL 467238 (N.D. Ill. 1996) (unpublished decision). The defendant operated a bulletin board system that allegedly trafficked in copyrighted software. While executing a valid search warrant, police seized two networked computers, a mini-tower containing two hard drives, a tower containing three hard drives, a Digital Audio Tape ("DAT") drive, and two CD-ROM drives containing discs. Eighteen months after the seizure of the computer equipment, the defendant filed a Fed. R. Evid. 41(e) motion requesting the return of the computer equipment. The court denied the defendant's motion, holding that the government's asserted interests in retaining the computer equipment outweighed the defendant's interest in having it returned. The retention of the equipment was held to be justified because of several factors: (1) the investigation appeared to be leading to a criminal charges, (2) the volume of work in determining whether particular files were copyrighted, and their retail value, was time consuming, (3) the age and poor condition of the computer equipment was impeding timely progress in the investigation, and (4) by returning the equipment, the government would have been returning stolen goods.

1. This text is not intended to create or confer any rights, privileges or benefits to anyone. It is also not intended to have the force of law or a United States Department of Justice directive. See United States v. Caceres, 440 U.S. 741 (1979).

2. Note: Page references to the Guidelines are for the printed version formatted in Times Roman. The page numbers of other versions may vary, but section references are accurate throughout.

3. Plaintiff's motion to suppress these items was granted in the plaintiff's criminal trial. The reasons for the suppression, however, were not discussed in the civil case.

4. The plaintiff also alleged that the defendants had violated the Electronic Communications Privacy Act (because the seized system also contained subscriber e-mail) and the Fourth Amendment. See infra at 25.

5. The reason for this dismissal was not provided.

6. This subsection authorizes a district judge to approve a wiretap "within the territorial jurisdiction of the court in which the judge is sitting (and outside that jurisdiction but within the United States in the case of a mobile interception device authorized by a Federal Court within such jurisdiction)."