An intensive search of defendant's hard drive seized at the border was not reasonable under the border search doctrine. United States v. Cotterman, 709 F.3d 952 (9th Cir. 2013) (en banc).

The introduction:

[More:]

Every day more than a million people cross American borders, from the physical borders with Mexico and Canada to functional borders at airports such as Los Angeles (LAX), Honolulu (HNL), New York (JFK, LGA), and Chicago (ORD, MDW). As denizens of a digital world, they carry with them laptop computers, iPhones, iPads, iPods, Kindles, Nooks, Surfaces, tablets, Blackberries, cell phones, digital cameras, and more. These devices often contain private and sensitive information ranging from personal, financial, and medical data to corporate trade secrets. And, in the case of Howard Cotterman, child pornography.

Agents seized Cotterman's laptop at the U.S.-Mexico border in response to an alert based in part on a fifteen-year-old conviction for child molestation. The initial search at the border turned up no incriminating material. Only after Cotterman's laptop was shipped almost 170 miles away and subjected to a comprehensive forensic examination were images of child pornography discovered.

This watershed case implicates both the scope of the narrow border search exception to the Fourth Amendment's warrant requirement and privacy rights in commonly used electronic devices. The question we confront "is what limits there are upon this power of technology to shrink the realm of guaranteed privacy." Kyllo v. United States, 533 U.S. 27, 34 (2001). More specifically, we consider the reasonableness of a computer search that began as a cursory review at the border but transformed into a forensic examination of Cotterman's hard drive.

Computer forensic examination is a powerful tool capable of unlocking password-protected files, restoring deleted material, and retrieving images viewed on web sites. But while technology may have changed the expectation of privacy to some degree, it has not eviscerated it, and certainly not with respect to the gigabytes of data regularly maintained as private and confidential on digital devices. Our Founders were indeed prescient in specifically incorporating "papers" within the Fourth Amendment's guarantee of "[t]he right of the people to be secure in their persons, houses, papers, and effects." U.S. Const. amend. IV. The papers we create and maintain not only in physical but also in digital form reflect our most private thoughts and activities.

Although courts have long recognized that border searches constitute a "historically recognized exception to the Fourth Amendment's general principle that a warrant be obtained," United States v. Ramsey, 431 U.S. 606, 621 (1977), reasonableness remains the touchstone for a warrantless search. Even at the border, we have rejected an "anything goes" approach. See United States v. Seljan, 547 F.3d 993, 1000 (9th Cir. 2008) (en banc).

Mindful of the heavy burden on law enforcement to protect our borders juxtaposed with individual privacy interests in data on portable digital devices, we conclude that, under the circumstances here, reasonable suspicion was required for the forensic examination of Cotterman's laptop. Because border agents had such a reasonable suspicion, we reverse the district court's order granting Cotterman's motion to suppress the evidence of child pornography obtained from his laptop.

A. The Forensic Examination Was Not An Extended Border Search:

Cotterman urges us to treat the examination as an extended border search that requires particularized suspicion. Although the semantic moniker "extended border search" may at first blush seem applicable here, our jurisprudence does not support such a claim. We have "define[d] an extended border search as any search away from the border where entry is not apparent, but where the dual requirements of reasonable certainty of a recent border crossing and reasonable suspicion of criminal activity are satisfied." United States v. Guzman-Padilla, 573 F.3d 865, 878-79 (9th Cir. 2009) (internal quotation marks and citations omitted). The key feature of an extended border search is that an individual can be assumed to have cleared the border and thus regained an expectation of privacy in accompanying belongings. See United States v. Abbouchi, 502 F.3d 850, 855 (9th Cir. 2007) ("Because the delayed nature of an extended border search ... necessarily entails a greater level of intrusion on legitimate expectations of privacy than an ordinary border search, the government must justify an extended border search with reasonable suspicion that the search may uncover contraband or evidence of criminal activity.") (internal quotation marks omitted) (emphasis added).

Cotterman's case is different. Cotterman was stopped and searched at the border. Although he was allowed to depart the border inspection station after the initial search, some of his belongings, including his laptop, were not. The follow-on forensic examination was not an "extended border search." A border search of a computer is not transformed into an extended border search simply because the device is transported and examined beyond the border.

B. Forensic Examination At The Border Requires Reasonable Suspicion:

It is the comprehensive and intrusive nature of a forensic examination—not the location of the examination—that is the key factor triggering the requirement of reasonable suspicion here. See Cotterman, 637 F.3d at 1086-87 n.6 (B. Fletcher, J., dissenting) (recognizing that "[a] computer search in a forensic lab will always be equivalent to an identical search at the border. The duration of a computer search is not controlled by where the search is conducted. The duration of a computer search is controlled by what one is looking for and how one goes about searching for it.") (emphasis in original). The search would have been every bit as intrusive had Agent Owen traveled to the border with his forensic equipment. Indeed, Agent Owen had a laptop with forensic software that he could have used to conduct an examination at the port of entry itself, although he testified it would have been a more time-consuming effort. To carry out the examination of Cotterman's laptop, Agent Owen used computer forensic software to copy the hard drive and then analyze it in its entirety, including data that ostensibly had been deleted. This painstaking analysis is akin to reading a diary line by line looking for mention of criminal activity—plus looking at everything the writer may have erased.

Notwithstanding a traveler's diminished expectation of privacy at the border, the search is still measured against the Fourth Amendment's reasonableness requirement, which considers the nature and scope of the search. Significantly, the Supreme Court has recognized that the "dignity and privacy interests of the person being searched" at the border will on occasion demand "some level of suspicion in the case of highly intrusive searches of the person." Flores-Montano, 541 U.S. at 152. Likewise, the Court has explained that "some searches of property are so destructive," "particularly offensive," or overly intrusive in the manner in which they are carried out as to require particularized suspicion. Id. at 152, 154 n.2, 155-56; Montoya de Hernandez, 473 U.S. at 541. The Court has never defined the precise dimensions of a reasonable border search, instead pointing to the necessity of a case-by-case analysis. As we have emphasized, "[r]easonableness, when used in the context of a border search, is incapable of comprehensive definition or of mechanical application." Duncan, 693 F.2d at 977 (internal quotation marks and citation omitted).