CA6: PC permited seizure of an entire server in a server center for child porn sites

The government narrowed a child pornography website to a particular server in a server center in Los Angeles housing 2000 computer servers. Under the showing of probable cause of what was known to them at the time, the seizure of the entire server was justified by the warrant. Search of the entire server was also permitted because it was believed there was more than one child porn site on it. The court recognizes that virtually every folder can be checked for intentional mislabeling. United States v. Richards, 659 F.3d 527 (6th Cir. 2011):

Courts that have addressed the permissible breadth of computer-related searches have grappled with how to balance two interests that are in tension with each other:

On one hand, it is clear that because criminals can — and often do — hide, mislabel, or manipulate files to conceal criminal activity, a broad, expansive search of the hard drive may be required. … On the other hand, … granting the Government a carte blanche to search every file on the hard drive impermissibly transforms a limited search into a general one.

United States v. Stabile, 633 F.3d 219, 237 (3d Cir. 2011) (citation and internal quotation marks omitted).

Our court has not yet had occasion to confront this issue in depth. Ultimately, however, given the unique problem encountered in computer searches, and the practical difficulties inherent in implementing universal search methodologies, the majority of federal courts have eschewed the use of a specific search protocol and, instead, have employed the Fourth Amendment’s bedrock principle of reasonableness on a case-by-case basis: “While officers must be clear as to what it is they are seeking on the computer and conduct the search in a way that avoids searching files of types not identified in the warrant, … a computer search may be as extensive as reasonably required to locate the items described in the warrant based on probable cause.” United States v. Burgess, 576 F.3d 1078, 1092 (10th Cir.), cert. denied, 130 S. Ct. 1028, 175 L. Ed. 2d 629 (2009) (citations and internal quotation marks omitted). We agree with the Tenth Circuit’s succinct assessment in Burgess that

it is folly for a search warrant to attempt to structure the mechanics of the search and a warrant imposing such limits would unduly restrict legitimate search objectives. One would not ordinarily expect a warrant to search filing cabinets for evidence of drug activity to prospectively restrict the search to “file cabinets in the basement” or to file folders labeled “Meth Lab” or “Customers.” And there is no reason to so limit computer searches. But that is not to say methodology is irrelevant.

A warrant may permit only the search of particularly described places and only particularly described things may be seized. As the description of such places and things becomes more general, the method by which the search is executed become[s] more important — the search method must be tailored to meet allowed ends. And those limits must be functional. For instance, unless specifically authorized by the warrant there would be little reason for officers searching for evidence of drug trafficking to look at tax returns (beyond verifying the folder labeled “2002 Tax Return” actually contains tax returns and not drug files or trophy pictures).

Respect for legitimate rights to privacy in papers and effects requires an officer executing a search warrant to first look in the most obvious places and as it becomes necessary to progressively move from the obvious to the obscure. That is the purpose of a search protocol which structures the search by requiring an analysis of the file structure, next looking for suspicious file folders, then looking for files and types of files most likely to contain the objects of the search by doing keyword searches.

But in the end, there may be no practical substitute for actually looking in many (perhaps all) folders and sometimes at the documents contained within those folders, and that is true whether the search is of computer files or physical files. It is particularly true with image files.

Id. at 1094 (footnote omitted).