Defendant sought discovery under Fed. R. Crim. P. 16(a)(1)(E) for the government’s computer search protocols, just to see if there was a basis for a suppression motion. The court finds it irrelevant to application of the exclusionary rule because some deviations from the protocols are permitted. Also, when the evidence is offered, there may be some other basis for excluding, but not the search. United States v. Fumo, 2007 U.S. Dist. LEXIS 80543 (E.D. Pa. October 30, 2007). Because of the ubiquity of computer searches in everyday practice of computer searches, I quote a lot from this case:
When a defendant’s Fourth Amendment rights have been violated by a search or seizure of his property, “the principal means today for effectuating the rights secured by the Fourth Amendment is through the judicially created exclusionary rule.” United States v. Christine, 687 F.2d 749, 757 (3d Cir. 1982). If a seizure pursuant to a warrant is overbroad, the appropriate remedy is exclusion from use at trial of evidence outside the scope of the warrant. Id. This suppression remedy is available under Rule 12(b)(3)(C), which lists “motion to suppress” as one of five types of pretrial motions. To facilitate the making of this motion, Rule 12(b)(4) allows the government, “[a]t the arraignment or as soon afterward as practicable” to “notify the defendant of its intent to use specified evidence at trial.” Thus, if Fumo later discovers that evidence offered by the government is beyond the scope of the items described in the warrants, he should file a motion to suppress individual exhibits.
The search protocols and keywords used by the government are irrelevant to the decision whether the warrants were overbroad or the seizures exceeded the scope of the warrants. In both cases, the constitutionality of the warrants and of the seizures of particular documents can be determined by examining only the warrants and the evidence.FN5
5. Fumo does not argue that the warrants permitting the searches and seizures were in any way deficient, so I assume, when necessary, that they were not.
Individual documents offered into evidence might be subject to suppression because (1) the warrants allowing the seizures were overbroad, or (2) the seizure exceeded the scope of the warrants. First, if evidence offered by the government for admission at trial is the result of seizure pursuant to an overbroad warrant, overbreadth can be determined from the face of the warrant, and no further discovery is necessary. See, e.g., Klitzman, Klitzman & Gallagher v. Krut, 744 F.2d 955, 960 (3d Cir. 1984) (referring only to the inclusive language in a warrant authorizing a search of a law office to determine that the warrant was overbroad). The warrant can be evaluated and, if necessary, redacted; evidence seized pursuant to the offending portions of the warrant can be excluded. Christine, 687 F.2d at 758 (“Materials seized under the authority of those parts of the warrant struck for invalidity must be suppressed, but the court need not suppress materials seized pursuant to the valid portions of the warrant.”). No information about search protocols or keywords is necessary or relevant to the analysis.
Second, if the seizure exceeded the scope of the warrant, this will be apparent when the evidence offered is compared to the description on the face of the warrant of items to be seized and when defense counsel questions the proponent of the evidence about the circumstances of its seizure. Cf. United States v. Coleman, 805 F.2d 474, 483 (3d Cir. 1986) (noting that “[t]o the extent material outside the list [contained in the warrant] was seized, the district court properly determined that that material could be suppressed”). Again, information about search protocols or keywords is unnecessary and immaterial to the determination. Therefore, I will deny Fumo’s motion to compel.
Regardless of the search protocols or keywords used by the government, the government may open and briefly examine each computer file to determine whether it is within the description recited in the warrant. The Supreme Court has been clear that a search need not be conducted in the least intrusive manner. Vernonia Sch. Dist. 47J v. Acton, 515 U.S. 646, 663, 115 S. Ct. 2386, 132 L. Ed. 2d 564 (1995). For example, in a search of a file cabinet, the government may examine briefly many documents in the course of looking for a particular document: “In searches for papers, it is certain that some innocuous documents will be examined, at least cursorily, in order to determine whether they are, in fact, among those papers authorized to be seized.” Andresen v. Maryland, 427 U.S. 463, 482 n.11, 96 S. Ct. 2737, 49 L. Ed. 2d 627 (1976). The Third Circuit expanded on this observation, adding that “no tenet of the Fourth Amendment prohibits a search merely because it cannot be performed with surgical precision.” Christine, 687 F.2d at 761. Instead, “flexibility is especially appropriate in cases involving complex schemes spanning many years that can be uncovered only by exacting scrutiny of intricate financial records.” Id. These rules are particularly applicable in the case of documents on computers, where files may be disguised, relevant documents may be intermingled with irrelevant ones, and “there is no way to know what is in a file without examining its contents.” United States v. Hill, 459 F.3d 966, 978 & n.14 (9th Cir. 2006); see also United States v. Vilar, No. S305CR621KMK, 2007 U.S. Dist. LEXIS 26993, 2007 WL 1075041, at *35-38 (S.D.N.Y. Apr. 4, 2007). For these reasons, search protocols and keywords do not mark the outer bounds of a lawful search; to the contrary, because of the nature of computer files, the government may legally open and briefly examine each file when searching a computer pursuant to a valid warrant.
In support of his argument that “forensic investigators are not permitted to randomly peruse computer data simply because they have lawfully seized digital media” (Def.’s Mem. 5), Fumo cites United States v. Carey, 172 F.3d 1268 (10th Cir. 1999). In Carey, a computer technician and detective searching computer files for evidence of drug sales happened upon one image of child pornography in the course of their search. Id. at 1270-71. The Tenth Circuit held that they exceeded the scope of the warrant when they abandoned the original search and began looking for other pornographic images, id. at 1276, noting that the file cabinet analogy was “inadequate” and “inapposite,” id. at 1275. The court, however, limited its holding to the facts of the case. See id. at 1276 (“[W]e are quick to note these results are predicated only upon the particular facts of this case, and a search of computer files based on different facts might produce a different result.”). Additionally, the Tenth Circuit has narrowly construed the holding of Carey to be the truism that “law enforcement may not expand the scope of a search beyond its original justification.” United States v. Grimmett, 439 F.3d 1263, 1268 (10th Cir. 2006). Evidence seized must simply be “consistent with the probable cause originally articulated by the … judge.” Id. at 1268-69. As noted above, this comparison may be performed without reference to search protocols and keywords.
For the reasons set out above, there is no requirement that the government, in executing a warrant, limit itself to its search protocols or keywords, so long as the search and seizure actually conducted are supported by the probable cause and within the scope of the particular descriptions recited in the warrants. Because deviations from search protocols and keywords are permissible, knowledge of those protocols and keywords will not allow Fumo or a court to draw conclusions about the reasonableness of the search actually conducted. If the evidence is within the scope of the warrant, it will be admissible. If it is not, it will be suppressed unless an exception to the warrant requirement applies.
