N.D.Cal.: Visiting defendant in the USM lockup directing him to provide his password for his cell phone seized under a SW exceeded the scope of the warrant

Visiting defendant in the USM lockup directing him to provide his password for his cell phone seized under a search warrant exceeded the scope of the warrant. United States v. Maffei, 2019 U.S. Dist. LEXIS 70314 (N.D. Cal. Apr. 26, 2019):

If the “scope of [a] search exceeds that permitted by the terms of a validly issued warrant … [the search and any] subsequent seizure [are] unconstitutional.” Horton v. California, 496 U.S. 128, 140, 110 S. Ct. 2301, 110 L. Ed. 2d 112 (1990). In deciding whether a search exceeded its lawful scope, a court may consider “both the purpose disclosed in the application for a warrant’s issuance and the manner of its execution.” United States v. Rettig, 589 F.2d 418, 423 (9th Cir. 1978). Whether a search exceeds the scope of the relevant search warrant requires an objective inquiry that looks at the circumstances surrounding the issuance of the warrant, the contents of the search warrant, and the circumstances of the search. United States v. Hitchcock, 286 F.3d 1064, 1071 (9th Cir. 2002), superseded on other grounds by United States v. Hitchcock, 298 F.3d 1021 (9th Cir. 2002).

The text of the application at issue here requested, and therefore the signed warrant provided, only the “authority to compel [defendant] to provide a biometric key (facial recognition or thumbprint) to unlock any” Subject Device “in order to open the phone in a law enforcement controlled setting.” (Aff. in Sup. Fed. Compl. ¶ 90.) Notably, elsewhere in the search warrant application, the agent explained that “Apple iPhones require either a multi-digit passcode or a biometric key” and that “[u]pon successful opening of the phone, law enforcement will adjust the passcode to allow for successful opening of the phone out of the presence of [defendant.]” (Id. ¶¶ 89, 90.) Yet, the agent only sought the authority to compel defendant to provide a biometric key and did not request permission or authority to compel defendant to provide her multidigit passcode. (Id. ¶¶ 3, 90.)

Although neither the Supreme Court nor the Ninth Circuit have spoken directly on the relationship between and the interchangeably of a multidigit passcode and a biometric key in decrypting a device seized pursuant to a warrant, the Court does not consider the two perfect substitutes in evaluating the scope of the warrant. From a practical standpoint, a passcode and a biometric key serve different functions. Apple iPhone software will often not accept the biometric key and will require the multidigit passcode to unlock the device—for example, when one restarts the device or engages in too many failed attempts to unlock the phone via the biometric key, or if more than 48 hours have passed since the device was last unlocked using a biometric key. About Touch ID Advanced Security Technology, (Sept. 11, 2017) https://support.apple.com/en-us/HT204587. More importantly in this context, iPhone software requires the multidigit passcode in order to change or remove the encryption on the device. Id. The government seems to have considered this issue and still did not request the authority to compel defendant’s passcode. (See Aff. in Sup. Fed. Compl. ¶ 90.) Thus, the Court finds that obtaining defendant’s passcode, rather than a biometric key, constituted materially different conduct for the purposes of determining whether law enforcement exceeded the scope of the warrant.

Additionally, in light of recent developments in this area of law in this District, it seems possible that a magistrate would have denied an application for a warrant authorizing officers to compel defendant’s cellphone passcode as violating the Fifth Amendment. See United States v. Spencer, No. 17-cv-00259-CRB-1, 2018 U.S. Dist. LEXIS 70649, 2018 WL 1964588, at *2 (N.D. Cal. Apr. 26, 2018) (“For instance, the government could not compel Spencer to state the [cellphone] password itself, whether orally or in writing.”) (citing Doe v. United States, 487 U.S. 201, 210 n. 9, 108 S. Ct. 2341, 101 L. Ed. 2d 184 (1988)) (alteration supplied); see also supra III.B.1. Moreover, SA Collins, the author of the warrant application, seems to have understood the multidigit passcode and biometric key as distinct methods of opening the device and therefore could have drafted a warrant application requesting authority to compel a multidigit passcode, and yet did not. (See id. ¶ 89 (“I know Apple iPhones require either a multi-digit passcode or a biometric key … in order to open the phone.”).)

For these reasons, the Court finds that by visiting defendant in the U.S. Marshals facility and “inform[ing] [her] that he was there to get the passcodes for the phones” SA Collins exceeded the scope of the warrant in violation of the Fourth Amendment.