M.D.Pa.: Search warrant for computer intrusion justified seizure and search of all computer media for evidence

Defendant was fired from his job, and the company found by a stumbled-upon email he was still remotely accessing the company computer to take information from them. They traced his accesses to a particular IP address and reported it to the police. A search warrant was obtained for all his computer equipment for evidence of computer trespass, and that was the scope of search. In the course of the search, two potential pictures of child pornography were stumbled upon. The search stopped and another warrant was sought for child pornography. The warrant was valid for seizure of the computers for evidence of computer trespass at his house via the IP address in use by him at the time of the intrusion, and then the search. The warrant was not overbroad. United States v. Getgen, 2011 U.S. Dist. LEXIS 133239 (M.D. Pa. November 18, 2011):

Getgen argues that SW-61-09 should only have permitted the executing officers to search for evidence relating to Getgen’s use of his computer to access the internet, and, therefore, it was unnecessary to search any of his computer files on either his computer or other electronic media. (Doc. 28, at 13). As Getgen noted, however, remotely accessing another computer without authorization does not constitute computer trespass under § 7615. Instead, the key evidence of computer trespass related to the intercepted and forwarded email, which would likely leave evidence in the form of a file or other type of data in the computer of the intruder. Furthermore, the search could not be limited to certain dates or file extensions because computer files can be easily disguised. See, e.g., United States v. Highbarger, 380 Fed. App’x 127, 130 (3d Cir. 2010); United States v. Crespo-Rios, 645 F.3d 37, 43 (1st Cir. 2011) (citing cases); United States v. Hill, 322 F. Supp. 2d 1081, 1091 (C.D. Cal. 2004) aff’d, 459 F.3d 966 (“Criminals will do all they can to conceal contraband, including the simple expedient of changing the names and extensions of files to disguise their content from the casual observer …. There is no way to know what is in a file without examining its contents, just as there is no sure way of separating talcum from cocaine except by testing it.”). The risk of disguised files was especially cogent in the instant case when Getgen worked with computers professionally. (See Gov’t Ex. A). Accordingly, the court rejects Getgen’s argument that SW-61-09 was overbroad.