Opinion
CRIMINAL CASE NUMBER: 1:14-CR-453-ODE-JSA
10-19-2015
UNITED STATES OF AMERICA, v. THOMAS MCLEAN HENDLEY
FINAL REPORT AND RECOMMENDATION
Law enforcement agents secured a warrant to search Defendant's house for child pornography and other contraband, including computers. The agents found Defendant's smart phone within the house. Defendant argues that the warrant did not expressly authorize the agents to turn on and search the smart phone itself. But the agents did so, under the perceived authority of the warrant authorizing a search of the house. After searching the phone both on-site and back at the computer lab, they eventually found substantial volumes of incriminating evidence.
Defendant's Motion to Suppress [15] raises two questions: first, whether this warrant, which authorized the search of a house, implicitly also authorized searches of computer media found within the house; and, second, whether the agents, having undertaken an initial search of the phone on-site that yielded no evidence, were authorized without obtaining a new warrant to take the phone back to their lab for further, more sophisticated searching. As explained below, the undersigned finds for the Government on both of these questions, and RECOMMENDS that the Motion to Suppress [15] be DENIED.
BACKGROUND
A. Procedural History
Plaintiff originally filed his Motion to Suppress, styled as a preliminary motion, on January 16, 2015 [15]. This motion raised two issues. First, Defendant argued that the affidavit submitted in support of the search warrant for his residence lacked probable cause and should not have been issued. Id. at 2-4. Second, Defendant argued that the warrant for the home did not authorize a search of the cellular phone discovered in the home, and that the warrantless search of the phone should be suppressed. Id. at 4-5. The Court held a pretrial conference on January 21, 2015 [16], and set a briefing schedule for the Motion.
Defendant's initial motion identifies two phones that were the subject of his motion to suppress, but he later narrowed the scope of the motion to just a single phone (the Samsung S4). See Suppl. Br. [21] n. 1.
The theories presented by this Motion evolved somewhat over the course of the briefing. In his opening brief in support of the Motion, Defendant indicated that he would no longer pursue the first argument asserted, that is, the lack of probable cause on the face of the affidavit. Suppl. Br. [21] at n. 1. Then, in his Reply Brief for that Motion [32], Defendant raised an entirely new issue. Defendant asserted that he had only recently learned new facts supporting a challenge not just to the issuance of the warrant, but also to its execution. Specifically, Defendant alleged that he discovered for the first time that the agents had conducted multiple electronic searches of his cellular phone on the day of the search, including an initial review at the scene of the search that revealed no evidence, and then a subsequent more complete forensic analysis. Reply [32] at 2-3. Defendant - who had previously acknowledged that his original legal challenges to the search required no evidentiary hearing - requested a hearing to explore the facts regarding the execution of the search warrant on Defendant's cellular phone. Id.
The Court thereafter convened an evidentiary hearing on this topic on July 13, 2015 [36], and a transcript was prepared several weeks later [38]. The parties submitted supplemental briefs based on the evidence obtained at the hearing [40][43]. The following facts are adduced from the testimony at the hearing and the exhibits introduced into evidence.
B. Facts
On August 22, 2014, based on an application from Special Agent Michael L. Ashley with Homeland Security Investigations, Immigration and Customs Enforcement ("HSI"), U.S. Magistrate Judge E. Clayton Scofield III issued a warrant authorizing the search of a particular residential premises on Chickasaw Trial, in Douglasville, GA. See Gov't Hearing Ex. 3. The warrant authorized the agents to search the premises for and seize "computer storage media and other items as particularly described in Attachment B." Id. Attachment B specifically listed nearly three pages worth of items and categories of items relating to the possession, receipt and transmission of child pornography, including:
• "And and all tapes, cassettes, cartridges . . . computer disks, disk drives . . . hard drives, terminals . . .and other computer related operation equipment, in addition to computer photographs, digital graphic file formats,"
• "Any and all computer software . . . ."
• "Any and all records and materials, in any format and media (including, but not limited to, envelopes, letters, papers, e-mail, chat logs and electronic messages) pertaining to the possession, receipt, or distribution of visual depictions of minors engaged in sexually explicity conduct,"
• "In any format and media, all orignals, copies, and negatives of visual depictions of minors engaged in sexually explicit conduct," or "bearing on the receipt, shipment, or possession" of such visual depictions,
• "Records of communication (as might be found, for example, in digital data files) between individuals concerning the topic of child pornography,"
• "Evidence of association, by use, subscription, or free membership, with online clubs, services, or other internet sites . . ."See Gov't Hearing Ex. 3.
• "The contents of any computer files located on any computer hard drive or any other form of computer storage media, depicting any child engaged in sexually explicit conduct,"
Agent Ashley testified at the evidentiary hearing that the search was conducted on September 3, 2014 at approximately 6:30 am. Transcript of July 13, 2015 evidentiary hearing ("Tr.") [38] at 4-5. During the search, the agents found the smart phone at issue in this motion, a Samsung S4 cellphone, attached to a cord and apparently being charged, in the room that the Defendant stated was his. Id. at 5-6. The agents were particularly looking for smart phones, because defendants in child pornography cases can keep contraband on such devices, and because the investigation revealed that Defendant or someone using a smart phone assigned to him had previously received child pornography via a phone. Id. at 6-7. Agent Ashley believed he was authorized to take the phone under the authority of the warrant. Id. at 7-8.
Also present at the search was HSI computer forensics specialist, Special Agent Cory Brant. Tr. at 6, 11-13, 15-16. Upon seeing the phone, Agent Ashley contacted Agent Brant for him to take charge of the device. Id. Agent Brant has received extensive training on the subject of computer forensics, and had experience on 25-30 prior occasions in searching the electronic contents of cellular phones. Id. at 13-14.
Agent Brant explained the different types of "extractions" that he engages in to search the electronic contents of a storage device such as a cellular phone. Id. at 14-15. The easiest and most limited methodology is referred to as a "logical" extraction, in which the investigator is limited to reviewing only the data that the casual user himself would be able to access, and which specifically would not include access to any deleted data. Id. at 14. Because of those limitations, particularly in child pornography investigations, the agents also engage in more robust methodologies, such as a "file system" extraction and "physical" extraction. Id. at 14-15. The most thorough technique is the "physical" extraction, which provides investigators much more access not just what is currently on the phone, but also "what has been on that phone." Id. In other words, as Agent Brant explained, the physical extraction gives "us access to deleted data that we may not see with the logical or file system." Id. The forensic agents are trained to do all of the extractions as part of a thorough search, because the different methods can recognize and understand different data and therefore can yield different results. Id. at 35.
As Agent Brant explained, "[a]t that time most of my forensic software for mobile devices was still back at my office. It's not routine for us to try to do these extractions on site unless we have a case in which the case agent is asking for it. So most of my tools were back at the office . . . ." Id. at 17-18. Nevertheless, Agent Ashley requested that Agent Brant "go ahead and attempt an on-scene extraction . . . ." Id. at 17. Agent Brant had at least sufficient equipment with him to do the logical search, which he did. Id. at 17-18. Specifically, he was able to use the standard cable that was with the phone, and his laptop, to engage in the logical extraction while sitting in his car at the search scene. Id. at 30-31. The logical search at the scene yielded no evidence. Id. at 17-18.
Agent Brant then brought the device to his office to engage in the more robust file system and/or physical extractions. Id. As he explained, "[i]n this case I would have selected physical extraction because it was supported for physical extractions." Id. He determined and found the correct cable for physical extraction on the Samsung S4 device - the "Yellow tip 133" cable - which he did not have with him at the search scene. Id. at 18, 36. Upon arriving at his office, he connected the device with the appropriate cable to his computer and, using the forensic software, "would have just let it extract while I continued other forensic duties in the lab." Id. at 18. According to Agent Brant the physical extraction on a Samsung device typically takes between four and five hours. Id. By contrast, the typical logical extraction takes on the order of ten to fifteen minutes. Id. at 38. The physical extraction revealed over 8,000 images of child pornography on the device. Id. at 19. Agent Brant did the physical extraction on the same day as the search. Id. at 22.
Agent Brant acknowledged that he could have brought some of the tips and cables that might have enabled a physical extraction with him to the scene of the search but he stated that "typically we do not because cellphones they do take time to work on, and with the understanding that cellphone, a physical extraction is going to usually take between four and five hours, that's something that we're not going to typically do on scene because of the timeframe." Id. at 38.
ANALYSIS
A. The Warrant Authorized The Search Of Defendant's Phone
The parties do not dispute that, before searching the electronic contents of Defendant's phone, the agents were required to have a valid warrant authorizing them to do so. The Government identifies no exception to the warrant rule justifying the search. Indeed, while there is no claim that the phone was seized incident to arrest, the Supreme Court has recently clarified that a cellular phone seized incident to arrest cannot generally be searched without a warrant. See Riley v. California, 134 S.Ct. 2473, 2495 (2014) ("Our answer to the question of what police must do before searching a cell phone seized incident to an arrest is accordingly simple—get a warrant.")
Instead, the Government argues that the warrant to search the residence for specific categories of contraband necessarily authorized search of the electronic contents of Defendant's cellular telephone, found within the residence, for that contraband. Defendant, on the other hand, argues that a warrant allowing a search only of the house, and for seizure of computer media found within, should not be read as permitting electronic searches within such computer media. The Defendant further argues that the language of this particular warrant suggests the Magistrate Judge's intention to not permit electronic searches of computer media.
As the Government points out, the general rule has long been established that "[a] lawful search of fixed premises generally extends to the entire area in which the object of the search may be found and is not limited by the possibility that separate acts of entry or opening may be required to complete the search." United States v. Ross, 456 U.S. 798, 821 (1982). The Supreme Court in Ross went on to explain the scope and broad application of this rule:
Thus, a warrant that authorizes an officer to search a home for illegal weapons also provides authority to open closets, chests, drawers, and containers in which the weapon might be found. A warrant to open a footlocker to search for marijuana would also authorize the opening of packages found inside. A warrant to search a vehicle would support a search of every part of the vehicle that might contain the object of the search. When a legitimate search is under way, and when its purpose and its limits have been precisely defined, nice distinctions between closets, drawers, and containers, in the case of a home, or between glove compartments, upholstered seats, trunks, and wrapped packages, in the case of a vehicle, must give way to the interest in the prompt and
efficient completion of the task at hand.Ross, 456 U.S. at 821. The issue in Ross was whether the police, in conducting a lawful search of a vehicle for drugs under the automobile exception, could also search a closed paper bag that was found in the trunk of the car. The Court answered that question in the affirmative, because "[i]f probable cause justifies the search of a lawfully stopped vehicle, it justifies the search of every part of the vehicle and its contents that may conceal the object of the search." Id. at 825. The Court further explained that this rule was not limited to paper bags or any other particular categories of storage containers but rather broadly applies without fine distinctions:
This rule applies equally to all containers, as indeed we believe it must. One point on which the Court was in virtually unanimous agreement in Robbins was that a constitutional distinction between "worthy" and "unworthy" containers would be improper. Even though such a distinction perhaps could evolve in a series of cases in which paper bags, locked trunks, lunch buckets, and orange crates were placed on one side of the line or the other, the central purpose of the Fourth Amendment forecloses such a distinction. For just as the most frail cottage in the kingdom is absolutely entitled to the same guarantees of privacy as the most majestic mansion, so also may a traveler who carries a toothbrush and a few articles of clothing in a paper bag or knotted scarf claim an equal right to conceal his possessions from official inspection as the sophisticated executive with the locked attaché case.Id. 822 (internal citations omitted); see also United States v. Gonzales, 940 F.2d 1413, 1420 (11th Cir. 1991) (warrant authorizing a search of a premises for currency and documents necessarily included authorized search of a locked briefcase found at the premises, which "could easily contain such items."); United States v. Morris, 647 F.2d 568, 572-73 (5th Cir. Unit B 1981) (search warrant for a premises justified search of a locked jewelry box found within the premises, though the result might be different if "the objects sought in the warrant were of a size that would not fit in the box.").
This is not to say that the law imposes no bounds on the scope of a search effectuated within a premises. The point is simply that, as Ross explained, the scope "is not defined by the nature of the container in which the contraband is secreted." 456 U.S. at 824. Rather, it is defined by the reasonableness of the search itself. Using the example Ross suggested in the context of an automobile search, "probable cause to believe that undocumented aliens are being transported in a van will not justify a warrantless search of a suitcase." Id. As Morris explained, a warrant for a premises would not authorize officers to break open a closed jewelry box found at the premises if the only items to search for were too large to fit within. 647 F.2d at 572-73. To extend this to a hypothetical situation more relevant to the case at hand, investigators might be hard pressed to explain how a warrant authorizing a search of a home for a gun might justify searching the entire electronic contents of every computer and phone found in the house.
But Defendant here does not challenge the reasonableness of the officers' belief that his phone might house images or communications described in Attachment B to the warrant. Rather, Defendant argues that no search of this phone was authorized at all, because the phone was not itself listed as the premises to be searched.
There is not a wealth of case law discussing how the Ross rule - allowing searches of containers found within premises lawfully being searched - applies to computer or other electronic storage containers seized during the execution of a warrant to search a premises. But those cases that have wrestled with this issue have uniformly upheld such electronic searches, and found that no second warrant is required to search electronic media that have been validly seized.
Obviously, a second warrant is required where agents wish to search a computer seized during execution of a warrant for evidence of other crimes not specified in the warrant. See United States v. Carey, 172 F.3d 1268, 1273 (10th Cir. 1999). That is not the case here.
For example, the 1st Circuit in United States v. Rogers, 521 F.3d 5, 9-10 (1st Circuit 2008), discussed whether a warrant authorizing the search of an apartment for a computer and for "photos" of a particular minor child also necessarily authorized agents to search a videotape found within the apartment, because it was reasonable to believe that such images could be stored on the videotape. The court upheld the validity of the electronic videotape search in that case, applying the principle established in Ross and other cases that "any container situated within a residential premises which are the subject of a validly-issued warrant may be searched if it is reasonable to believe that the container would conceal items of the kind portrayed in the warrant." Id. (internal quotations and citations omitted). The court agreed with the Government's position, that the term "photos" reasonably included images captured by videotape or digital camera, and that the warrant therefore authorized the search of the videotape. Id.
Judge Thrash in this District confronted a similar question in United States v. Rhoades, No. 1:08-CR-56-TWT, 2008 WL 3925168,*8-9 (Aug. 26, 2008). In that case, agents executed a search at a residence pursuant to a warrant that authorized them to search for and seize computer equipment and also "images of FBI identification or law enforcement credentials and files containing images of such identification and credentials in any form . . . ." The agents found a digital video disc ("DVD") entitled "teen pics," searched that disc, and found evidence of child pornography (which was not a subject of the initial search warrant) in apparent plain view. The Defendant argued that this review exceeded the scope of the original warrant by searching the contents of the DVD, when all the warrant specifically authorized was a search of the house itself for FBI credentials and other documents, and to seize (but not to search) computer media. Judge Thrash, adopting the recommended ruling of the Magistrate Judge, disagreed, finding that the agents were authorized to review the contents of the DVD to determine whether it contained evidence of the type covered by the search warrant. Id. (Citing United States v. Gilberson, 527 F.3d 882, 886 (9th Cir. 2008) ("We have long held that a search warrant authorizing the seizure of materials also authorizes the search of objects that could contain those materials."); United States v. Gregoire, No. 09-275, 2009 WL 5216844, *14 (D.Minn. 2009) (finding that a warrant authorizing a search for records in a premises authorized the search of a computer found in those premises for those records).
Having seen the apparent child pornography in plain view, the agents then applied for and obtained a second search warrant to permit them to specifically and intentionally examine the disc more completely for evidence of child pornography.
In Giberson, the warrant authorized a search for and seizure of documents, and agents also seized a computer believing it might contain such documents. The Ninth Circuit upheld the seizure of the computer, but the specific holding in that case is limited because the agents did not actually search the computer until they obtained a second warrant (which is what Defendant here argues the agents should have done). Nevertheless, the Ninth Circuit expressly applied the concept that "a search warrant authorizing the seizure of materials also authorizes the search of objects that could contain those materials" to the context of a computer, and also specifically rejected Defendant's argument "that the analogy between a computer and other 'containers' is not appropriate because computers are somehow entitled to heightened protection, and are searchable only when specified in the warrant." 527 F.3d at 887. Although this exact question was not before the Ninth Circuit in Giberson, the logical extension of these rulings would yield the same result as that in Rogers and Rhoades, that is, that electronic storage media can be searched just like any other "container" found during execution of a warrant.
Defendant cites no case finding otherwise, that is, that investigators must obtain a second warrant to search a computer, phone or other electronic medium found in a premises subject to a warrant, where that device could reasonably contain items for which the agents were authorized to search. Defendant asks this Court to reach this proposition by analogizing to the Supreme Court's recent opinion in Riley, 134 S.Ct. at 2473. The issue in that case was different, although somewhat related: Whether law enforcement can search the entire contents of an arrestee's smart phone, without any warrant at all, based only on the search-incident-to-arrest doctrine, simply because the phone was found in the arrestee's pocket during arrest. The Court's answer was "no," as such a search "bears little resemblance to the type of brief physical search" authorized by the search-incident-to-arrest exception to the warrant requirement. Id. at 2485. The Court instead declared that "officers must generally secure a warrant before [searching the contents of a smart phone seized from an arrestee]." Id. at 2485.
The Court acknowledged that it had, forty years earlier, authorized police officers to search a closed cigarette package found in an arrestee's pocket, under the search-incident-to-arrest doctrine. See United States v. Robinson, 414 U.S. 218 (1973). But the Court in Riley rejected the Government's analogy to Robinson, finding that "[c]ell phones differ in both a quantitative and qualitative sense from other objects that might be kept on an arrestee's person." Id. at 2489. Specifically, because of the volume and nature of the data kept on a modern smart phone, the intrusion on privacy associated with a search of such a phone could if anything be greater than the search of a house. Id. at 2490-91. The Court found that "[m]odern cell phones are not just another technological convenience. With all they contain and all they may reveal, they hold for many Americans 'the privacies of life.' The fact that technology now allows an individual to carry such information in his hand does not make the information any less worthy of the protection for which the Founders fought." Id. at 2494-95.
In other words, in Riley, the Court to some degree did what it said it would not do in Ross, which was draw a Fourth Amendment distinction among different sorts of containers. A cigarette container was deemed worthy of a search incident-to-arrest, but a smart phone was not.
The issue before the Court in Riley, however, remained whether a warrantless search of a phone was permissible. The Court noted that two principles underlie the search-incident-to-arrest doctrine, that is, the heightened government interests at stake in a volatile arrest situation, as well as the arrestee's reduced expectation of privacy upon being taken into police custody. Id. at 2488. The Court found that these rationales did not generally justify rummaging through the electronic storage of a smart phone without a warrant.
First, the governmental interest in an immediate search during arrest does not extend to the data within a cell phone, because "[d]igital data stored on a cell phone cannot itself be used as a weapon to harm an arresting officer or to effectuate the arrestee's escape . . . Once an officer has secured a phone . . . data on the phone can endanger no one." Id. at 2485. By contrast, the Court noted, "unknown physical objects," including a cigarette pack, "may always pose risks, no matter how slight, during the tense atmosphere of a custodial arrest." Id.
Second, the Court found that the substantial privacy intrusion implicated by a cell phone search - as distinct from a more limited search of a cigarette pack - offended even the reduced privacy expectation that an arrestee enjoys. Id. at 2488. For these reason, the Supreme Court found that a cell phone generally cannot be searched without a warrant, under the incident-to-arrest doctrine. Thus, the Court ultimately stated that "[o]ur answer to the question of what police must do before searching a cell phone seized incident to an arrest is accordingly simple - get a warrant." Id. 2495.
The Court noted that there might be specific facts, including exigent circumstances, that could justify a warrantless search of a cell phone in individual cases.
The problem with Defendant's reliance on Riley is that the agents here did "get a warrant." The agents provided evidence to a neutral magistrate, who found probable cause that Defendant's residence contained evidence of child pornography, and authorized a search of that residence for particular categories of evidence. This case raises a different question than Riley, therefore, i.e., whether a warrant authorizing agents to search for records within a house continues to authorize agents to search for those records in a computer within the house, even though the warrant does not expressly mention an electronic computer search. The undersigned finds in the Government's favor on this question, at least on the facts of this case.
Notably, the warrant in this case itself expressly authorized the agents to search not just for physical evidence, paper files, letters and printed photographs. The warrant itself - through Attachment B - permitted searches for photographs and communications in "any format or media," including "digital graphic files," "computer photographs," "software," "e-mail," "chat logs," "electronic messages," "digital data files," and even "[t]he contents of any computer files located on any computer hard drive or any other form of computer storage media, depicting any child engaged in sexually explicit conduct." See Gov't Hearing Ex. 3.
To be sure, the warrant may not have stated in so many words that the agents could electronically search computer media found within the house. But it authorized them to search for items that could only be found by doing just that. If a warrant authorized the agents to search a house for frozen pizza, it would be obvious that the agents could search the freezer. This is so, even if the warrant did not expressly authorize search of the house "and any freezer found within the house." The exact same logic applies here, where the warrant went so far as to authorize agents to search for "the contents of computer files," "e-mail," "electronic messages," "computer photographs," "digital data files," and the like. It makes no sense to characterize this warrant as authorizing only a search for but not within electronic media.
Defendant argues that "this Court must presume that Judge Scofield, when he signed the warrant authorizing agents merely to 'search for and seize' various objects, including Mr. Hendley's telephone, meant what he said." Def. Br. [40] at 11. Defendant also points out that, in the affidavit, the agent referred to the application as requesting permission to search the computers and cell phones he expected to find at the house, see Def. Ex. 4 [24-4] at 19, whereas in response Judge Scofield only included the house itself as the premises subject to search. Defendant argues that the Court should infer from these papers a decision by Judge Scofield to disallow a search of computers.
The Court rejects these arguments for all the reasons explained above. While the warrant authorized the agents to search for and seize the phone itself, it also authorized the agents to search for and seize materials "in any format," including digital and computer files that could only be found by searching within electronic storage media. "Plain reading and common sense are the landmarks for the execution and interpretation of the language of a search warrant." United States v. Gorman, 104 F.3d 272, 275 (11th Cir. 1996) (quoting United States v. Brown, 822 F.Supp. 750, 754 (M.D.Ga. 1993)). As explained above, plain reading and common sense does not support reading this warrant as excluding electronic searches, while at the same authorizing agents to search for electronic documents.
Further, given the weight of the case law at the time, it is particularly difficult to draw conclusions from the lack of any express reference in the warrant to allowing computer searches. The warrant's reference to the residence as the premises to be searched could simply have reflected an intention to authorize a search co-extensive with the scope authorized by Ross, et al., that is, a search of the residence along with any containers found within the residence in which items listed in Attachment B might reasonably be found.
In the end, at least on the facts of this case, the warrant authorized the agents to search Defendant's cell phone. This reflects a straightforward application of Ross and the numerous cases that have applied it to searches of electronic media. And nothing about this result offends Riley, as the agents here did exactly what the Supreme Court in Riley demanded: they got a warrant that allowed them to search for the items that they in fact searched for, which specifically included numerous categories of electronic evidence.
B. The Agents Did Not Impermissibly Conduct Multiple Searches
As detailed above, Agent Brant undertook a "logical extraction" from the phone at the scene of the search, which yielded no evidence. Afterwards, Agent Brant took the phone to his forensic lab where he also completed a "physical extraction," which yielded substantial evidence. Defendant argues that the physical extraction reflected an impermissible second search. The Government, on the other hand, contends that the physical extraction was merely a continuation of the original search that was initiated at the scene.
The parties agree on the relevant legal standards. On the one hand, "a warrant authorizes only one search" of any particular premises. United States v. Keszthelyi, 308 F.3d 557, 568-69 (6th Cir. 2002). On the other hand, "a single search warrant may authorize more than one entry into the premises identified in the warrant, as long as the second entry is a reasonable continuation of the original search." Id. The Sixth Circuit in Keszthelyi made two inquiries, first, whether a subsequent search was actually a continuance of an original search, and not a new search, and, second, whether the continuance of the original search was reasonable. Id.
The Eleventh Circuit applied this same approach in United States v. Gerber, 994 F.2d 1556, 1558-60 (11th Cir. 1993). In that case, agents permissibly searched a car pursuant to a warrant, but could not open the hood without the assistance of a mechanic, who was not available until the next business day after the warrant expired. The mechanic came and opened the hood that next business day, and the agents found incriminating evidence as a result. The Eleventh Circuit found that the delayed search of the hood, after securing the mechanic's assistance, was merely a continuation of the original search, and therefore was timely executed. Id. The Court considered that it was reasonable for the agents to search the engine area of the car for the items authorized in the warrant, that they intended to do so at the time of the original search, and that there was no bad faith in the delay. Id.
The Court finds that Agent Brant's "physical extraction" was permissible under these standards. As Agent Brant explained, a thorough computer search requires use of multiple extraction tools, which can recognize and understand different data and therefore can yield different results. Tr. at 35. That multiple extraction methods were used on Defendant's phone, therefore, does not mean that multiple searches were conducted. Agent Brant established, rather, that these methods were used as part of one overall search protocol, and that he intended all along, per his training, to conduct a physical extraction in addition to the logical extraction. Id. at 17-18, 35. After all, Agent Brant understood from the beginning that the logical extraction would not access all areas of the phone's memory, and that to do so he would need to also conduct the physical extraction. Id. This supports the conclusion that these extractions constituted - and were always intended to constiute - a single search.
Agent Brant also established that it was reasonable to continue the search at the forensic lab. First, there was no delay, as Agent Brant began the physical extractions upon his arrival at the lab after having left the search scene. Second, Agent Brant explained that he could not have engaged in the physical extraction in his car on-site, as he lacked the necessary cable equipment in his car, and as the physical extraction process takes four to five hours. Defendant does not establish that Agent Brant could have known precisely what devices would be found in the search such that he could have predicted in advance what cables and other equipment would be needed. In any event, it was not unreasonable for the agents to wait to conduct such a time-intensive exercise in their laboratory, which was less than a 30 minute drive away, Tr. at 20-21, and not in a parked car at the search site. Indeed, conducting such a lengthy forensic extraction in Defendant's driveway or living room if anything would seem to unnecessarily increase the intrusiveness of the search, as well as increase the expenses and security risks to government personnel.
Defendant does not establish that Agent Brant could have, as a practical matter, engaged in a 4-5 hour physical extraction in his car at the search site. Among other questions, there was no indication that Agent Brant would have access to whatever power source would be necessary for his equipment for such a lengthy operation.
That the initial logical extraction yielded no evidence did not mean it was unreasonable to continue to search the remaining memory on the phone. The officers had established probable cause that Defendant possessed photographs, communications, and other records relating to child pornography, and it was reasonable for them to search the entire contents of the phone (including deleted files) for that material.
Defendant analogizes to Keszthelyi, 308 F.3d 557, but the facts at issue in that case were very different. In Keszthelyi, officers conducted a search on a particular day of a suspect's home and found various items of evidence. Id. at 563. The agents conducting the search believed that they had completed an effective search, and collected all available evidence. Id. at 571. The next day, an agent who had not participated in the search called the prosecutor's office about returning to the residence, because he "felt very strongly that there was something there that had not been located." Id. at 563. At this agent's urging, but without any concrete information to believe that the original search had been faulty, he and others re-entered the residence without obtaining a new warrant, and this agent ultimately found a trap door in a kitchen appliance containing drugs. Id. In these circumstances, the Sixth Circuit found that the second entry was improper, and was not a mere continuation of the original search. Id. at 573.
The Sixth Circuit ultimately denied suppression of the fruits of the search, however, under the inevitable discovery doctrine, since the officers obtained a second search warrant based on other facts two days after the faulty re-entry. Id. at 573-74. --------
By contrast, here, the evidence shows that the brief, fifteen-minute "logical" extraction was not - and was not intended to be - a complete and thorough search of the phone. Agent Brant testified that he always intended to include a physical extraction as part of any complete and thorough search, per his training, as the physical extraction was the only way to access certain areas of the phone's memory. In other words, while in Keszthelyi the officers believed after their first search that they had done everything they could and had completed the search, Agent Brant did not consider his forensic search to be complete based simply on the logical extraction. And the testimony shows that the "logical" extraction was not, in fact, a full search of the contents of the phone. Thus, the Court finds the facts of this case more analogous to Gerber, and that the relevant factors all point to finding that Agent Brant engaged in a single overall search.
CONCLUSION
For the reasons explained above, Defendant's Motion to Suppress [15] should be DENIED.
With no other matters before the undersigned, this case is hereby CERTIFIED AS READY FOR TRIAL.
IT IS SO RECOMMENDED this 19th day of October, 2015.
/s/_________
JUSTIN S. ANAND
UNITED STATES MAGISTRATE JUDGE