Opinion
Case No. 2:12-CR-645-TC
03-11-2014
UNITED STATES OF AMERICA, Plaintiff, v. ROBERT G. LUSTYIK, JR., and JOHANNES W. THALER, Defendants.
ORDER
and
MEMORANDUM DECISION
Co-Defendants Robert G. Lustyik, Jr. (a former FBI agent) and Johannes W. Thaler have been indicted on counts of criminal conspiracy, fraud, and obstruction of justice. They have filed motions seeking the extreme remedy of blanket suppression of all evidence obtained by federal law enforcement agents through the execution of search warrants dated May 23, 2012, to January 15, 2013. The relevant searches involved review of data retrieved from electronic devices, such as mobile telephones and computers. The Defendants contend that each warrant is invalid on its face because it sanctions an unconstitutional general search (that is, each warrant is overbroad) and, alternatively, the officers' search resulted in an unconstitutional "general rummaging" in flagrant disregard for the scope of the warrants. Mr. Thaler also contends that the warrants for his email account lack probable cause.
Defendants argue that the evidence is fruit of the poisonous tree because the warrants were based on earlier evidence that was unconstitutionally obtained. But, as the court has already held, they have no standing to raise that argument. (See Dec. 17, 2013 Order & Mem. Dec. (Doc. 564).)
For the reasons set forth below, the court holds that (1) the warrants are not overbroad, but even if they were, the good faith doctrine applies; (2) the searches were not carried out in flagrant disregard of the warrants; and (3) the warrants for Mr. Thaler's email account were supported by probable cause. The remedy the Defendants seek—blanket suppression—is not proper here. Accordingly, Mr. Lustyik's and Mr. Thaler's joint motion to suppress is DENIED.
PROCEDURAL BACKGROUND
On October 18, 2013, a grand jury indicted Defendants Robert G. Lustyik, Jr., and Johannes Thaler, along with former Co-Defendant Michael Taylor, for conspiracy, wire fraud, and obstruction of justice. On July 1, 2013, Mr. Taylor filed a Motion to Suppress all Electronic Documents Obtained Through Unconstitutional General Searches and Seizures. (Docs. 306, 387.) On August 9, 2013, Mr. Lustyik and Mr. Thaler joined Mr. Taylor's motion (Docs. 389, 397) and filed their own Joint Memorandum in Support of Motion to Suppress all Electronic Documents Obtained Through Unconstitutional General Searches and Seizures ("Joint Memorandum") (Doc. 389). The court will treat the Defendants' Joint Memorandum as a joint motion to suppress.
Mr. Taylor has since pleaded guilty and withdrawn his motion.
To provide context, the court notes that this case is an offshoot of another case before this court: United States v. Young, 2:12-cr-502-TC (D. Utah). The defendants in Young were indicted in August 2012. Michael Taylor, a Co-Defendant in this case, was also one of the three Young defendants. Here, the Defendants are charged with, among other things, obstruction of proceedings in the Young case. Accordingly, there is some overlap between evidence obtained in the companion case of Young and the evidence obtained in this case, and both sets of evidence arose, in some fashion, out of a series of related warrants. Defendants Lustyik and Thaler have jointly moved to suppress evidence seized through execution of that series of warrants.
On October 15-16, 2013, the court held an evidentiary hearing on motions to suppress in both the Young case and this case. (See Tr. of October 15-16, 2013 Evid. Hr'gs (Docs. 490-91) [hereinafter "Tr."].) In November and December 2013, the parties submitted their proposed findings of fact and conclusions of law. On January 31, 2014, the court heard oral argument on Mr. Lustyik's and Mr. Thaler's joint motion to suppress. During oral argument, the court asked the Government to submit supplemental information concerning the Government's processing and search of electronic documents obtained through the search warrants. On February 12, 2014, the Government submitted the requested supplemental information. Now, having reviewed the parties' pleadings, information obtained during the evidentiary hearing, the parties' proposed findings of fact and conclusions of law, and the Government's supplemental filing, and having heard oral argument, the court issues its Findings of Fact and Conclusions of Law.
(See Docs. 520, 521, 552.) The Government, in its proposed findings of fact and conclusions of law, attached five exhibits that were not presented during the evidentiary hearing. (See Doc. 552 Exs. 3-7.) Accordingly the court disregards those exhibits.
(See Doc. 601.) Mr. Lustyik and Mr. Thaler filed an objection to the Government's filing. (See Doc. 602.) The Defendants contend that the court may not consider the supplemental information, or, in the alternative, the court must justify re-opening of the evidentiary hearing only after receiving a motion from the Government to do so. The court disagrees. At the final argument hearing, the court requested the supplemental information in an attempt to determine whether partial suppression was warranted. The court did not re-open the evidentiary hearing. Moreover, the Government has already done what the court would have done: suppress the evidence that the Government says in its Supplemental Notice will not be used against the Defendants. In short, there is no prejudice to the Defendants, and their objection is overruled.
FINDINGS OF FACT
INITIATION OF THE INVESTIGATION
In December 2011, the Government obtained three search warrants in connection with an investigation of various offenses related to the procurement and award of a 2007 government contract for logistics and weapons maintenance support in Afghanistan. That investigation ultimately led to the August 22, 2012 indictment in United States v. David Young et al., Case No. 2:12-cr-502 (D. Utah). The three warrants were directed at an email account associated with Michael Taylor, a defendant in the Young case, as well as various electronic devices (including computers and mobile telephones) belonging to Mr. Taylor and his company, AISC (another defendant in the Young case).
During searches of the electronic data obtained through the Young warrants, an investigator in the Young case, Special Agent Keith Darnell of the Defense Contract Investigative Services (DCIS), came across some emails that he believed suggested improper conduct of Robert Lustyik, a Special Agent with the FBI at the time. Mr. Lustyik was not a target of the Young investigation and was not a defendant in the Young case. Agent Darnell, upon reading the emails (which were contained in evidence obtained through searches of Mr. Taylor's and AISC's email accounts and electronic devices), became concerned "that there was potentially an inappropriate relationship" between Mr. Taylor and Mr. Lustyik and "decided that this was something that [he] needed to report to somebody else for it to be handled" because he "was afraid it was evidence of a different crime, and if it were, then it potentially needed to be investigated by a different agency and new warrants would need to be obtained." (Tr. 35-36, 124.)
Agent Darnell forwarded the emails to the U.S. Attorney's Office. The emails were then sent to the Department of Justice Office of the Inspector General (DOJ-OIG), and a new and separate investigation into the conduct of FBI Special Agent Robert Lustyik was opened. Thomas M. Hopkins, an Assistant Special Agent in Charge at the DOJ-OIG, was assigned to be the Government's case agent.
Special Agent Hopkins, upon review of the Young emails, noticed that "in some of the messages there was conversation between Mr. Taylor and Special Agent Lustyik regarding the Salt Lake City based Contract Procurement Fraud Investigation" (the Young case investigation) and "[t]here [were] also messages containing [information on] other things like business ventures" leading Special Agent Hopkins to believe "that there was some sort of business relationship between Mr. Taylor and Special Agent Lustyik and Hannes Thaler during a time in which Special Agent Lustyik [was] representing to investigators and prosecutors in Salt Lake that he was opening Mr. Taylor as an FBI CHS [Confidential Human Source]." (Tr. 326-27.) According to Special Agent Hopkins, "we had a little bit of a window into what appeared to us to be . . . this kind of strange business venture . . . coinciding with what we believed to be obstructive behavior [directed at the Young case] . . . by Special Agent Lustyik . . . [s]o we were interested in finding out more about what was going on between Special Agent Lustyik and Mr. Taylor and Mr. Thaler." (Tr. 329.)
The Government alleges in this case that Mr. Lustyik attempted to stop the indictment of Mr. Taylor in the procurement fraud case by getting Mr. Taylor listed as a confidential source who would be too useful to prosecute. The Government further alleges that Mr. Lustyik did so in exchange for Mr. Taylor's promise of financial gain. The Government alleges that Mr. Thaler conspired with Mr. Taylor and Mr. Lustyik.
Special Agent Hopkins began an investigation into that relationship and the Government applied for search warrants to obtain "additional contents [of communications among the three individuals] so that [the DOJ-OIG] could have a better idea of what these conversations entailed." (Tr. 329.) A series of search warrants were issued between May 23, 2012, and January 15, 2013. The evidence obtained through Special Agent Hopkins' investigation, including evidence arising from execution of the searches authorized by the warrants, ultimately led to the indictment of Defendants Robert Lustyik, Michael Taylor, and Johannes Thaler. The three men were charged with criminal counts of conspiracy, wire fraud, and obstruction of justice. Mr. Taylor has since pled guilty. Mr. Lustyik and Mr. Thaler, however, remain in the case and jointly challenge the warrants, contending that the warrants are invalid on their face, that the Government agents' search methodology violated their constitutional right to be free from unreasonable searches and seizures, and that certain warrants were not supported by probable cause. They contend that the Government's actions warrant blanket suppression of all evidence in the case.
THE SEARCH WARRANTS
Between this case and Young, a total of twenty search warrants were executed and challenged by various defendants, including Michael Taylor. Here, Mr. Lustyik and Mr. Thaler challenge fourteen of those twenty warrants, three of which they challenge solely on the basis of the fruit of the poisonous tree doctrine. Because those three warrants authorized searches of areas and items in which only Mr. Taylor had a privacy interest, neither Mr. Lustyik nor Mr. Thaler has standing to challenge the warrants aimed solely at Mr. Taylor or evidence derived from those searches. (See Dec. 13, 2013 Order & Mem. Decision (Doc. 564).) That leaves eleven warrants for the court to examine in this order.
The parties' pleadings and exhibits provide a confusing picture of the universe of warrants and evidence at issue in this case. After a careful review of the record, the court has determined that three warrants were at issue in the Young case, and that seventeen warrants were at issue in this case. Of those seventeen, six are no longer challenged (the party with standing to challenge those six warrants—Michael Taylor—has since pled guilty and withdrawn his motion to suppress). Accordingly, eleven remain at issue.
Of those eleven warrants, Mr. Lustyik challenges seven warrants that targeted areas in which he has a privacy interest: his personal e-mail account, mobile telephone, home, and office. Specifically, Mr. Lustyik challenges the: (1) May 23, 2012 warrant for blustyik16@hotmail.com; (2) August 2, 2012 warrant for blustyik16@hotmail.com, (3) September 17, 2012 warrant for Mr. Lustyik's Blackberry handheld device; (4) September 17, 2012 warrant for Mr. Lustyik's private residence; (5) October 2, 2012 warrant for Mr. Lustyik's office space at the FBI White Plains, New York office; (6) December 5, 2012 warrant for information (essentially text messages) on Mr. Lustyik's mobile telephone; and (7) January 15, 2013 warrant for blustyik16@hotmail.com.
Mr. Thaler challenges the remaining four of the eleven warrants, which targeted areas in which he has a privacy interest: his personal e-mail account, mobile telephone, and home. Specifically, Mr. Thaler challenges the: (1) June 13, 2012 warrant for hannestee@yahoo.com; (2) September 7, 2012 warrant for hannestee@yahoo.com; (3) September 14, 2012 warrant directed at Mr. Thaler's private residence; and (4) September 14, 2012 warrant for Mr. Thaler's mobile telephone.
There is no overlap between Mr. Lustyik's and Mr. Thaler's interests and so no overlap between the two sets of warrants.
THE SEARCHES
During the eleven searches at issue here, the Government obtained both electronic and non-electronic evidence. The non-electronic evidence was obtained primarily through searches of Mr. Lustyik's house and office. The Defendants do not contest the manner in which those physical searches were carried out, but they do challenge the validity of the warrants issued to search not only Mr. Lustyik's home and office, but also Mr. Thaler's home, and, consequently, they seek suppression of the non-electronic evidence that was seized during execution of those purportedly invalid warrants. The Defendants, do, however, challenge the methodology of searches yielding electronic data.
When the warrants for electronic information were first executed (that is, the initial process of gathering the data in electronic form), the Government's technical staff made a mirror image of (or otherwise extracted data from) the seized computers and other electronic devices. In the case of email accounts and text messages, the service providers pulled responsive data and sent it to the Government on disks for review.
Because the search warrants were executed at different times between May 2012 and January 2013, the electronic data arrived in batches. As soon as the data was received, it was sent to an independent "taint team" for review. Any information that contained potentially privileged communications was segregated, and the remainder of the information was forwarded to the Lustyik investigative team, including Special Agent Hopkins.
The central issue in this case focuses on the search method used by Government investigators to review the voluminous electronic data received after the data was culled down by the "taint team." The universe of electronic data seized (in addition to the emails pulled out by the Young investigators and forwarded to the US Attorney's office for independent investigation) included electronic data from warrants seeking emails from blustyik16@hotmail.com (three searches total), emails from hannestee@yahoo.com (two searches total), computer data from Mr. Thaler's laptop, text messages from Mr. Lustyik's mobile telephone (obtained from Verizon), and electronic data extracted from Mr. Thaler's mobile telephone and Mr. Lustyik's Blackberry hand-held device.
The format in which the electronic evidence was reviewed by the investigative team varied, but the main tool the Government used for the data grouping and review is a software database program called "Relativity." The vast majority of the non-privileged electronic data (the Defendants' emails and the contents of Mr. Thaler's laptop computer) was loaded into Relativity. No search terms were used to narrow or segregate the data once it was loaded into Relativity. According to Special Agent Hopkins, Relativity is "a depository for the evidence that's accumulated, that's easy to manipulate and go back and retrieve the evidence accumulated." (Tr. 400.) Everyone working on the case had, and continues to have, access to the Relativity database and is able to review the data at any time.
The evidence extracted from the mobile telephones (including the text messages) was not added to the Relativity database. Instead, it was provided in a report created by Special Agent Harry Lidsky. (Tr. 351-54.)
A. Execution of search warrants for blustyik16@hotmail.com and hannestee@yahoo.com email accounts
For the three blustyik16@hotmail.com and two hannestee@yahoo.com search warrants, a team of DOJ-OIG agents assigned to the case and DOJ prosecutors reviewed each file supplied by the email provider. Members of the email review team were provided with copies of the warrants and affidavits. Each file was marked as "relevant" if it was responsive to the warrant in question and "not relevant" if it was not responsive to the warrant. Documents that were coded as "not relevant" nevertheless remain in the Relativity database. If a reviewer had a question about whether a document was relevant, the reviewer was to consult with Special Agent Hopkins or one of the prosecutors. Special Agent Hopkins (and, as far as he is aware, others executing the warrants) believed they had authorization to search for evidence of specific crimes detailed in the warrants, and that they did not have free rein to search for everything. (Tr. 339-40.)
They did not cull the information down using key word searches because, in Special Agent Hopkins's experience, people sometimes use coded language to hide illegal activities, and it is difficult at the beginning of an investigation to know about any coded language persons might be using. Without knowledge of the coded language being used, it is often not feasible to use search terms to capture all files responsive to the warrants. The Defendants in this case used a variety of coded language. For example, when a Defendant wanted to direct other Defendants to view materials in a drop box, he would send a message stating "go Giants." (Tr. 362.)
The Government's knowledge of the activity being investigated developed over time. As the Government learned new details, the Government would go back and conduct targeted searches in the Relativity database using search terms for additional documents responsive to the warrants. From time to time, and based on developing knowledge of the investigation, documents that were previously marked as irrelevant were re-reviewed and marked as relevant. Members of the investigation team (that is, anyone with an access code) still have access to the entire Relativity database.
B. Execution of Search Warrants for Mobile Telephones and Text Messages
Mr. Lustyik's Blackberry device was seized from him during the search of his residence on September 18, 2012. When data is extracted from a mobile telephone, it is not possible to select a particular message or a particular phone call. Instead, the entire content must be extracted in the process. As a result, a report for data on the phone will contain both relevant and irrelevant data.
Mr. Thaler's iPhone was seized during the search of his home on September 18, 2012. As with Mr. Lustyik's Blackberry, for technical reasons the entire content had to be extracted and the resultant report contained both relevant and irrelevant data.
The Government sought and obtained Mr. Lustyik's text messages through a search warrant to Verizon Wireless (the service provider), because of a concern that Mr. Lustyik may have deleted relevant text messages from his Blackberry device immediately before the seizure. Verizon Wireless provided PDF files with text message content. These PDF files contained both relevant and irrelevant information.
C. Execution of search warrant for Mr. Thaler's hard drives
The Government seized two hard drives during the search of Mr. Thaler's residence on September 18, 2012. After the Lustyik investigators sent the hard drives to a Government contractor to render the data on the hard drives readable, the data was loaded into Relativity.
The Lustyik agents and prosecutors created a list of search terms to narrow the universe of documents to be reviewed (that is, those documents possibly within the scope of the warrant). (See U.S. Resp. to Mot. to Suppress, Aff. of ASAC T. Hopkins, Doc. 412, Ex. 3.) Where documents had valid "last modified" dates, only those documents last modified within the time range of the warrant were reviewed. (Id.) The reviewers received a copy of the warrant and were instructed as to what they should look for when reviewing files.
CONCLUSIONS OF LAW
THE SEARCH WARRANTS
A. The Warrants Are Not Facially Unconstitutional.
The Fourth Amendment requires that all warrants must "particularly describ[e] . . . the persons or things to be seized." "The requirement that warrants shall particularly describe the things to be seized makes general searches under them impossible and prevents the seizure of one thing under a warrant describing another." Marron v. United States, 275 U.S. 192, 196 (1927). "Here, the specific evil is the 'general warrant' abhorred by the colonists, and the problem is not that of intrusion per se, but of a general, exploratory rummaging in a person's belongings." Coolidge v. New Hampshire, 403 U.S. 443, 467 (1971). The Fourth Amendment limits searches, and thus avoids the exploratory rummaging "by requiring a 'particular description' of the things to be seized." Id. "[A] search conducted pursuant to a warrant that fails to conform to the particularity requirement of the Fourth Amendment is unconstitutional." Massachusetts v. Sheppard, 468 U.S. 981, 988 n.5 (1984). Evidence seized in violation of the particularity requirement is subject to suppression. See, e.g., Mapp v. Ohio, 367 U.S. 643, 655 (1961); United States v. Leary, 846 F.2d 592, 600-01 (10th Cir. 1988).
Here, Mr. Lustyik and Mr. Thaler have made two arguments as to why they allege the warrants did not meet the particularity requirement: (1) the warrants were overly broad because they did not limit the Lustyik investigators in what they could seize, and (2) the warrants were required to include a search protocol. The Court disagrees with both contentions.
The warrants satisfy the Fourth Amendment's particularity requirement because the warrants adequately limited the Lustyik investigators in what they could seize. The warrants at issue vary as to their description of what may be seized. They all, however, contain an important limitation—that the documents seized must relate to the specific crime(s) being investigated, or for which the Defendants had been indicted. This language was more than sufficient to limit the scope of the warrants, and prevents the warrants from being generalized warrants. See, e.g., United States v. Christie, 717 F.3d 1156, 1165 (10th Cir. 2013) ("we have said warrants may pass the particularity test if they limit their scope either to evidence of specific federal crimes or to specific types of material") (internal quotations omitted); United States v. Burgess, 576 F.3d 1078, 1091 (10th Cir. 2009); United States v. Brooks, 427 F.3d 1246, 1252-53 (10th Cir. 2005) (finding warrant valid where it authorized search of computers and disks "for evidence of child pornography"); Davis v. Gracey, 111 F.3d 1472, 1479-80 (10th Cir. 1997) (finding warrant met particularity requirement where it directed officers to seize equipment pertaining to the distribution or display of pornographic materials in violation of a specific state law). Moreover, all of the warrants at issue except the May 23, 2012, and August 2, 2012, blustyik16@hotmail.com warrants include additional specifications, such as the relevant time period and persons involved. Because the warrants are all limited in scope at least as to evidence of specific federal crimes, the Court concludes that the warrants meet the Fourth Amendment's particularity requirement. Christie, 717 F.3d at 1165.
Mr. Lustyik and Mr. Thaler rely on United States v. Leary, 846 F.2d 592 (10th Cir. 1988), to support their "overbroad" argument. In Leary, the Tenth Circuit found a warrant was not sufficiently particularized where it only referred to a general import/export statute and the business to be searched was an import/export business. See id. at 600-01. Because in the circumstances of that case, the subject of the warrant was coextensive with the legitimate activities of the business, the warrant in effect called for all records of the business. "In this context — these limitations [the reference to the federal statute] provide no limitation at all." Id. at 600-01 (emphasis added). In contrast, the warrants here contain references to crimes (e.g., obstruction of justice under 18 U.S.C. § 1503, honest services fraud under 18 U.S.C. §§ 1341, 1343 and 1346, acts affecting a personal financial interest under 18 U.S.C. § 208) that, under the circumstances of this case, do not present the same concerns raised in Leary. An investigation into these crimes does not remotely implicate all the activities Defendants were conducting on their email accounts, on their mobile telephones, or on Mr. Thaler's hard drives. In short, Leary was decided on its facts, and its facts are distinguishable from those at issue here.
In addition, to support their "overbroad" argument, Defendants focus on the phrase "including, without limitation, information relating to" (which was included in some, but not all, of the warrants) that comes after the language limiting the warrants to evidence of specific crimes. The existence of this phrase does not mean that the warrants lack particularity. Tenth Circuit precedent is clear that where a warrant contains limiting language, such as a statute, and also, as here, gives examples of the forms in which the material may be found, those examples are restrained by the limiting language. In Burgess, the Tenth Circuit found a warrant to be sufficiently particularized where it stated that the search was for "certain property and evidence to show the transportation and delivery of controlled substances, which may include but [is] not limit[ed] to" and then went on to provide a list of examples of the types of property that might be found, including a computer. Burgess, 576 F.3d at 1083 (emphasis added). In considering whether including the term "computer" in the illustrative list rendered the warrant overly broad, the Tenth Circuit found that the illustrative list was restricted by the limiting language. Namely, any search of the computer was limited to a search for evidence of drugs and drug trafficking because, as described by the Tenth Circuit, "a word is known by the company it keeps." Id. at 1091 (internal quotations omitted).
Defendants have erroneously asserted that all of the warrants include the phrase "including, without limitation, information relating to." (Doc. 389 at 12; Doc. 520 at 18.) In fact, only the May 23 and August 2, 2012 warrants for blustyik16@hotmail.com, the June 13 and September 7, 2012, warrants for hannestee@yahoo.com, and the August 2, 2012, warrant for aisc04@aol.com and bme2012@aol.com contain such language.
Similarly, the warrants here are restricted by the limiting list. The limiting language in the warrants is quite different from the warrants in cases Mr. Lustyik and Mr. Thaler cite, in which there was no limiting language. See, e.g., United States v. Otero, 563 F.3d 1127, 1132-33 (10th Cir. 2009) (invalidating portions of the warrant that lacked explicit or implicit limitations and noting that subject headings and paragraph formation are useful tools in reading warrants in context); United States v. Riccardi, 405 F.3d 852, 862-63 (10th Cir. 2005) (invalidating warrant where it was not limited to any particular federal crime or particular files).
Defendants also claim that the warrants are overly broad because they do not include a search protocol. The Tenth Circuit has unequivocally rejected the same argument. See, e.g., Brooks, 427 F.3d at 1251 ("[t]his Court has never required warrants to contain a particularized computer search strategy"); Burgess, 576 F.3d at 1093 ("It is unrealistic to expect a warrant to prospectively restrict the scope of a search by directory, file-name or extension or to attempt to structure search methods—that process must remain dynamic."). Instead, the search is to be limited by the content called for in the warrant itself, and the Government may look in all files where such content might be found. Burgess, 576 F.3d at 1092-94.
As the Supreme Court has noted, "[n]othing in the language of the Constitution or in this Court's decisions . . . suggests that, in addition to the [requirements set forth in the text of the Fourth Amendment], search warrants also must include a specification of the precise manner in which they are to be executed." United States v. Grubbs, 547 U.S. 90, 98 (2006) (quoting Dalia v. United States, 441 U.S. 238, 255 (1979)). Search protocols are, at their core, directions to the officer about how he may execute the warrant, and then subsequently analyze the seized evidence. Grubbs and Dalia make clear, however, that the Fourth Amendment's particularity clause does not require a warrant to say anything about how a warrant is executed, even if there is the potential to affect Fourth Amendment rights in unexpected ways. "It would extend the Warrant Clause to the extreme to require that, whenever it is reasonably likely that Fourth Amendment rights may be affected in more than one way, the court must set forth precisely the procedures to be followed by the executing officers." Dalia, 441 U.S. at 258.
The search warrants were not facially deficient. Defendants' motions to suppress on that basis are denied.
B. The Good Faith Doctrine Applies.
Even if the warrants lacked the requisite particularity, the evidence here was seized in objectively reasonable reliance on them. See United States v. Leon, 468 U.S. 897, 920-22 (1984) (establishing good faith exception to the exclusionary rule); Massachusetts v. Sheppard, 468 U.S. 981, 983-84 (applying Leon's good faith exception to particularity requirement under Fourth Amendment). The Lustyik investigators reasonably could have concluded that the warrants, with their limitations as to specific crimes and, in some instances, specific persons and time periods, were not overly broad.
Some of the warrants did not contain a date limitation, but for those, Special Agent Hopkins, who was in charge of the Lustyik search team, treated the warrants as limited by statute. (Tr. 351.)
An officer relying on a search warrant presumptively acts in good faith. See United States v. Cardall, 773 F.2d 1128, 1133 (10th Cir. 1985). Because a magistrate judge's determination of the legal sufficiency of the underlying affidavit is entitled to credence, this presumption is overcome only where the underlying affidavit is "devoid of factual support" such that the officer's "reliance [on the warrant] was wholly unwarranted." Id. (emphasis added); see also United States v. Harrison, 566 F.3d 1254, 1257 (10th Cir. 2009) (noting a reasonable officer would have assumed a search was valid "[g]iven the strong presumption in favor of warrant searches, the great deference accorded to a magistrate's probable cause determination" and "the fact that the warrant affidavit was not devoid of factual support") (internal quotations and citations omitted). As noted by the Supreme Court, "[t]he fact that a Fourth Amendment violation occurred—i.e., that a search or arrest was unreasonable—does not necessarily mean that the exclusionary rule applies. Indeed, exclusion has always been our last resort, not our first impulse, and our precedents establish important principles that constrain application of the exclusionary rule." Herring v. United States, 555 U.S. 135, 140 (2009) (internal quotation marks and citations omitted).
The Tenth Circuit has recently explained that among the things a court may consider in assessing the reasonableness with which agents might presume a warrant to be valid are not only the warrant, but also the affidavit supporting it. See United States v. De La Torre, ___ Fed. App'x ___, No. 12-7084, 2013 WL 5861487, at *2 (10th Cir. Nov. 1, 2013) (justifying application of good faith doctrine in part because "both the warrant and affidavit provide guidance in that they limit the myriad items listed to those constitut[ing] evidence of [a specified] crime.") (internal quotations omitted). The affidavits supporting the warrant applications were quite detailed and provided ample cause to allow the searches.
Following Tenth Circuit precedent, this court has held that "a warrant that authorized the agents to seize the 'fruits and instrumentalities' of the violation of a federal car jacking statute was not so obviously overbroad that agents could not rely on it in objective good faith." United States v. Evanson, No. 2:05-cr-805-TC, 2007 WL 4299191, at *14 (D. Utah Dec. 5, 2007) (describing United States v. Robertson, 21 F.3d 1030 (10th Cir. 1994)). Here, as in Christie, Burgess, Brooks, Davis, Robertson, and Evanson, a reasonable officer acting in good faith could have read the warrant as restricting the scope of the search to the enumerated crimes. Because of the similarity between the warrants here and those approved by the Tenth Circuit in Christie, Burgess, Brooks, Davis, and Robertson, the Tenth Circuit's explanation in Christie is equally applicable: "In light of our past approval of a similar warrant, it seems more than a little difficult for us to say now that a reasonably well trained officer would have known that the search in this case was illegal despite the magistrate's authorization." Christie, 717 F.3d at 1166. This is especially true where the two warrants that contained the fewest limitations, the May 23 and August 2 blustyik16@hotmail.com warrants, were approved by not one, but two magistrate judges.
Moreover, under Tenth Circuit precedent, even if a warrant is overly broad, the good faith exception should apply and the evidence should not be suppressed when the officers executing the warrants thought and acted as if the reach of the search warrant was limited. See, e.g., Otero, 563 F.3d at 133-36; United States v. Potts, 586 F.3d 823, 835 (10th Cir. 2009) (finding good faith exception applied where "reasonable officers could have read the warrant as restricting the search to materials connected to child pornography, even under our assumption that the warrant was not actually so restricted"); Riccardi, 405 F.3d at 864 (finding good faith exception applied where "the investigating officers carefully limited their search to files relevant to the investigation, and within the scope of the search as described by the affidavit"). The record is clear that those executing the warrants believed they were limited and could only search for evidence of specific crimes. For example, when Special Agent Hopkins was asked whether he "had free rein to search for anything [he] wanted pursuant to [the May 23, 2012, blustyik16@hotmail.com] warrant" he replied, "Well, no. My understanding, based on this warrant, is that I had authorization to search for evidence of this violation that is stated in the warrant 18 U.S.C. 1503, obstruction, not free rein." (Tr. 339-40.) He further testified, "My understanding was that I was limited by the probable cause contained in the affidavit . . . and the statute." (Tr. 340.)
In light of the strong presumption in favor of search warrants, the great deference accorded to the magistrates' findings of probable cause, the fact that the affidavits contained ample factual support for probable cause, the prior case law relating to overbreadth, and the approval by two different magistrate judges of similar warrants, the court concludes that a reasonable officer would have reasonably believed the search warrants were valid. See United States v. McKneely, 6 F.3d 1447, 1455 (10th Cir. 1993); De La Torre, 2013 WL 5861487, at *2—*3
C. Probable Cause Existed For the Search of Thaler's Email Account.
Mr. Thaler also challenges the sufficiency of probable cause for the warrants directed at his email address, hannestee@yahoo.com. He raised this argument for the first time in the Joint Proposed Findings of Fact and Conclusions of Law. (Doc. 520 at 26-27.) This claim is one for which no evidentiary hearing is needed because the analysis is based only on the affidavit and warrant, see United States v. Beck, 139 Fed. App'x 950, 954 (10th Cir. 2005) (citing Whiteley v. Warden, Wyo. State Penitentiary, 401 U.S. 560 (1971)), and it should have been advanced in their joint motion, but was not. But the Government had the opportunity to respond in its subsequent proposed findings of fact and conclusions of law, so the court will address the argument.
Mr. Lustyik makes the same argument, but he does not have standing to challenge searches of Mr. Thaler's email account.
A magistrate judge's determination of probable cause is entitled to substantial deference. "Once a magistrate judge determines probable cause exists, the role of a reviewing court is merely to ensure the Government's affidavit provided a 'substantial basis' for reaching that conclusion." United States v. Biglow, 562 F.3d 1272, 1281 (10th Cir. 2009) (citing Illinois v. Gates, 462 U.S. 213, 238-39 (1983)). "'[A]fter-the-fact, de novo scrutiny' of a magistrate's probable-cause determination is forbidden." Biglow, 562 F.3d at 1272 (citing Massachusetts v. Upton, 466 U.S. 727, 733 (1984)).
In assessing the magistrate's probable cause determination, the court is mindful of the Supreme Court's guidance that probable cause is a "practical, nontechnical conception," that functions in the light of the "commonsense," "practical considerations of everyday life," Gates, 462 U.S. at 230-31, and that probable cause "requires only a probability or substantial chance of criminal activity," rather than "an actual showing of such activity." New York v. P.J. Video, Inc., 475 U.S. 868, 877-78 (1986); see also Upton, 466 U.S. at 734 ("probable cause does not demand the certainty we associate with formal trials."). And as the Tenth Circuit has observed, "The Fourth Amendment's strong preference for warrants compels us to resolve 'doubtful or marginal cases' by deferring to a magistrate judge's determination of probable cause." Biglow, 562 F.3d at 1282 (citing Upton, 466 U.S. at 734).
With these standards in mind, the court turns to the probable cause determinations for the two hannestee@yahoo.com warrants.
1. The June 13, 2012 Warrant Affidavit Contained Sufficient Probable Cause.
Mr. Thaler argues that (1) although the affidavit in support of the warrant describes the communications between Mr. Lustyik and Mr. Thaler at length, it fails to include "any mention about Mr. Thaler being involved in these alleged communications," and (2) the affidavit relies exclusively on allegations of Mr. Thaler's friendship with Mr. Lustyik and Mr. Taylor and fails to include any allegations of criminal conduct. (Doc. 520 at 27.)
He is incorrect. For example, paragraph 25 of the affidavit details a May 14, 2012 email exchange among the three men, clearly discussing the existence of the Utah investigation into Mr. Taylor, the fact that the investigation was a problem, and that Mr. Lustyik was undertaking efforts to derail the investigation. (Doc. 389, Ex. L, at ¶ 25.) The court finds that this email exchange, coupled with the other information in the affidavit, including that well before May 2012, Mr. Lustyik had taken interest in a business venture involving both Mr. Taylor and Mr. Thaler (id. at ¶¶ 11, 52), and that Mr. Taylor, Mr. Lustyik, and Mr. Thaler regularly communicated through email (id. at ¶¶ 10, 13), adequately supports a common sense conclusion that Mr. Thaler was part of the scheme to undermine the Utah investigation, and, more to the point, that evidence of that scheme would be found in Mr. Thaler's email account.
Of course, the Government need not necessarily show that Mr. Thaler was himself involved in criminal activity in order to justify a search of his email account—the Government need only show that evidence, instrumentalities, or fruits of crime might be found there. See Zurcher v. Stanford Daily, 436 U.S. 547, 555-56 (1978); United States v. Rodrigue, 560 F.3d 29, 34 (1st Cir. 2009).
2. The September 7, 2012 Warrant Affidavit Contained Sufficient Probable Cause.
The September 7th warrant similarly satisfies the probable cause standard. It contains not only the information from the June 13 warrant application, described above, that itself suffices to establish probable cause, but also additional information obtained as a result of executing that warrant, further clarifying the closeness with which Mr. Lustyik, Mr. Taylor, and Mr. Thaler were working (Doc. 389, Ex. N at ¶ 53), as well as information obtained from execution of a search warrant on a Taylor email account that leaves little doubt of the connection between the Utah investigation fizzling and the three men becoming rich. (Id. at ¶ 54.) The September 7, 2012 warrant was amply supported by information substantiating probable cause.
THE SEARCHES
A. The Warrants Were Executed in Accordance with the Constitution.
Mr. Lustyik and Mr. Thaler make several arguments in support of their claim that the Government's execution of the searches amounted to an unconstitutional general search. They argue the Lustyik investigators went beyond the scope of the warrants because, they allege that the search methodology was unreasonable. They claim, for example, that search terms were not used to limit the review of emails on Relativity; documents marked "not relevant" remained accessible and searchable in the Relativity database; later reviews resulted in some documents being changed from "not relevant" to "relevant"; and the Government reviewed materials outside the date ranges prescribed by some of the warrants. They also point to the fact that, in discovery, the Government gave Defendants copies of all documents it received in response to the warrants. (Doc. 389 at 15-16, Doc. 520 at 20-22.) And they argue that a government contractor carried out an illegal search on behalf of the Lustyik team.
Overall, they contend that the Government's conduct went so far as to constitute flagrant disregard of the terms of the warrants. (Doc. 520 at 22.) As will be described in more detail below, the court finds that the searches conducted by the Government were reasonable and fell within the limits of the search warrants that were issued.
1. The Search Methodology Was Proper.
In the Tenth Circuit, "a computer search may be as extensive as reasonably required to locate the items described in the warrant." United States v. Grimmett, 439 F.3d 1263, 1270 (10th Cir. 2006) (internal quotation and citation omitted). Mr. Lustyik and Mr. Thaler argue that the search methodology used by the agents to review the emails was improper because rather than conducting a keyword search, they opened every file provided by the email service providers. The defendant in Evanson made the same argument to this Court, and the Court rejects it today for the same reason as in Evanson: "the relevant inquiry is whether the search warrant limited the objects of the search, not whether the methodology limited the way in which the computer could be searched." Evanson, 2007 WL 4299191, at *13; see also Brooks, 427 F.3d at 1251. A search in which agents open every file rather than relying on a keyword search is "justified and reasonable" if the "objects of the search were properly limited and those limits were observed." Evanson, 2007 WL 4299191, at *13.
The Tenth Circuit has acknowledged the difficulty inherent in tailoring searches of electronic data to discover evidence of particular criminal conduct. In United States v. Welch, 291 Fed. App'x 193, 203-04 (10th Cir. 2008), the Tenth Circuit evaluated the constitutional validity of searches of computers for evidence relating to the manufacture of ecstasy and methamphetamine. The Court noted in that case that "[i]t would not be possible ... to restrict the search by folder name or file extension" because "folders are unlikely to be conveniently labeled 'Meth Manufacturing Files'" and evidence relating to drug manufacturing could be embedded in many different types of files. Id.; see also Christie, 717 F.3d at 1166 ("Computer files can be misnamed by accident, disguised by intention, or hidden altogether, leaving investigators at a loss to know ex ante what sort of search will prove sufficient to ferret out the evidence they legitimately seek."); Brooks, 247 F.3d at 1251 ("[t]his court has never required warrants to contain a particularized computer search strategy.").
The same is true in this case. The Government's methodology takes this reality into account while at the same time tailoring the search "to meet allowable ends." Burgess, 576 F.3d at 1094. As discussed above, the warrants limited what could be seized and those executing the warrants used reasonable efforts to locate materials related to obstructive conduct. Special Agent Hopkins testified that those executing the warrants were restrained by the limits contained within the warrants (Tr. 339-40, 351, 402), and Defendants present no evidence to the contrary. The search method used here—reviewing every email and making a document by document determination as to responsiveness—was appropriate to the situation given the likelihood that Defendants were using coded language. Special Agent Hopkins testified that in his experience as an agent, defendants, including the Defendants in this case, often use coded language to discuss their illegal activities. (Tr. 361, 364.) As the material from the email warrants was reviewed early in the investigation, the coded language would not have been immediately known to those executing the warrants. At that time it would not have been feasible to use search terms to capture all files responsive to the email warrants. (Tr. 357, 364.) Under the circumstances, it was justified and reasonable for those executing the warrants to review every email for responsiveness. In comparison, during the hard drive review that occurred almost a year later, agents had more information and were able to use that information to formulate search terms that limited their search through the documents.
Moreover, the Government's additional targeted searches were not outside the scope of the email and hard drive warrants. As discussed earlier in this order, the Government may conduct extensive searches as long as they are reasonably required to locate items called for by a warrant. Grimmett, 439 F.3d at 1270. Here, as the document review progressed, those executing the warrants gained a better understanding of the illegal conduct at issue in the warrants. (Tr. 397.) The additional targeted searches were a reasonable method for locating additional documents responsive to the warrants. See Burgess, 576 F.3d at 1093 (observing that the process of developing search methods is "dynamic").
This case is different from those cited by Defendants where agents searched for documents outside the scope of the warrant. Mr. Lustyik and Mr. Thaler rely heavily on the Tenth Circuit's decision in United States v. Carey, 172 F.3d 1268 (10th Cir. 1999), for the proposition that the Government exceeded the scope of the warrants. In Carey, the Government obtained a warrant to search a defendant's computers for evidence of the sale and distribution of controlled substances. Id. at 1270. During the course of the search, the detective opened a file containing child pornography. At that point, the detective, by his own admission, "temporarily abandoned" the search for evidence of drug crimes "to look for more child pornography." Id. at 1273. In doing so, he expanded the scope of the search beyond what was permitted by the original warrant, without obtaining an additional warrant to search for pornographic materials. See id.
Defendants' focus on Carey is misplaced. Unlike in Carey, the Lustyik investigators' searches of Mr. Lustyik's and Mr. Thaler's email accounts and Mr. Thaler's hard drive were focused on discovering information related to the enumerated crimes at issue in this case. Special Agent Hopkins testified that the review and subsequent targeted searches were conducted for the purpose of finding documents responsive to the warrants, and Defendants have presented no evidence to the contrary. (Tr. 339-40, 351, 397-400, 402.) "Carey . . . simply stands for the proposition that law enforcement may not expand the scope of a search beyond its original justification." Grimmett, 439 F.3d at 1268. Further, the Tenth Circuit in Carey explicitly limited its holding to the particular facts of that case. See Carey, 172 F.3d at 1276 ("[T]hese results are predicated only upon the particular facts of this case, and a search of computer files based on different facts might produce a different result"); Welch, 291 Fed. App'x at 204 ("In Carey, we were careful to limit the decision to the particular facts of that case.").
2. The Government's Discovery Production Did Not Violate the Warrants.
Defendants point to emails appearing in the Government's discovery production that are not responsive to the search warrants as evidence that the Government failed to execute the search warrants properly. (Doc. 389 at 15-16.) Defendants allege that because the Government produced in discovery a complete copy of the electronic files it obtained from search warrants, used the word "seized" in its production log, and, in response to Defendants' Rule 12(b)(4)(B) motion, designated the entire production as evidence, the Government must have unconstitutionally seized all of those materials. (Joint Reply Mem. to Gov. Resp. to Defs.' Mot. to Suppress, Doc. 421, at 12.) In response, the Government argues that this conflates the Government's compliance with its discovery obligations with how it executed the search warrants. (U.S. Resp. to Mot. to Suppress, Doc. 412, at 18.)
Both the warrants and Federal Rule of Criminal Procedure 41(e)(2)(B) describe a two-part process whereby the electronic data is initially "seized," or copied, and is then later reviewed for information responsive to the warrant. (See, e.g., May 23, 2012 Warrant; June 13, 2001 Warrant; August 2, 2012 Warrant; and December 5, 2012 Warrant.) This is consistent with what Special Agent Hopkins testified occurred here. At the evidentiary hearing, Special Agent Hopkins testified that he initially received a set of data provided by the email service provider. (Tr. 320, 335-37.) Thereafter, the Government made a document-by-document determination of which documents were responsive to the warrant and did not consider all documents to be responsive to the warrants. (Tr. 355, 401-02.) This two-step process was in accord with the warrants in this case. The Government properly took an expansive view of what to produce in discovery, and provided all materials obtained during execution of the warrants. The Court declines Defendants' invitation to effectively treat this production as eviscerating the controls the Government undertook to respect the scope of the warrants.
This rule provides that a warrant seeking electronically stored information "authorizes a later review of the media or information consistent with the warrant. The time for executing the warrant . . . refers to the seizure or on-site copying of the media or information, and not to any later off-site copying or review."
3. The Government Contractor Did Not Exceed the Scope of the Warrants At Issue.
The Defendants argue that a Government contractor (Jessica Gray of NTI), conducted unauthorized searches of the electronic data seized from the warrants here. (Ms. Gray was conducting searches on data received through warrants in the Young case.)
The Lustyik team did provide to the Young prosecutors a hard drive containing approximately 93,000 pages of material from certain Lustyik warrants. But they did so to fulfill the discovery and disclosure obligations of the Government. That is, the materials potentially implicated the Young prosecutors' obligations under Federal Rule of Criminal Procedure 16, Brady v. Maryland, 373 U.S. 83 (1963), Giglio v. United States, 405 U.S. 150 (1972), and Title 18, United States Code, Section 3500.
It is not clear from the record whether Ms. Gray's searches exceeded the limits of the Lustyik warrants or that her searches actually yielded any materials seized from Mr. Lustyik or Mr. Thaler. But even if her searches did yield such materials, the only conclusion the record supports is that the searches were responsive to the warrants here. The Defendants do not present evidence to the contrary.
4. The Government Did Not Flagrantly Disregard the Warrants.
For this Court to find flagrant disregard, it must find that the executing agents "grossly exceeded" the limitations of the warrant. See, e.g., United States v. Blunt, 187 Fed. App'x 821, 828 (10th Cir. 2006); United States v. Hargus, 128 F.3d 1358, 1363 (10th Cir. 1997); United States v. Foster, 100 F.3d 846, 849 (10th Cir. 1996). Courts have found that executing officers flagrantly disregarded a warrant only in extreme cases. For instance, in United States v. Foster, officers obtained a warrant to search Foster's residence for marijuana and four guns identified by serial number. See 100 F.3d at 848. Not only did they take ammunition, videotapes, and weapons not identified in the warrant, but they also seized over sixty items of value outside the scope of the warrant, including:
[S]everal VCR machines, miscellaneous video equipment, a socket set, two bows and a sheath containing six arrows, a pair of green coveralls, a riding lawn mower, three garden tillers, a brown leather pouch containing miscellaneous gun shells, a holster, several stereo systems, a CB radio base station, two soft tip microphones, several televisions with remote controls, a Dewalt heavy duty drill, a Vivitar camera tripod, a Red Rider BB-gun Daisy Model, a Corona Machete in brown leather case, an ASAHI Pentex SpotMatic Camera, a Bowie type knife in black sheath, a Yashica camera MAT-124, a black leather bag with tapes, a metal rod, a Westinghouse clock radio, five hunting knives, a box of pellets, a screw driver set, three vehicles, and a small box containing old coins, knives, watch, and jewelry.Id. at 848 n.1. In finding that the officers acted with flagrant disregard for the warrant, the district court noted that "no attempt was made to substantiate a connection between the seizure of the majority of the seized items and the terms of the warrant." Id. at 855. In fact, one of the officers admitted in his testimony that he and his colleagues "simply 'took anything of value' and did not adhere to the specific terms of the warrant." Id. Under these circumstances, the court determined that the search amounted to an improper "fishing expedition" and suppressed all evidence obtained pursuant to that search. Id. at 852. The Tenth Circuit affirmed. Id. at 853.
Courts have declined to find flagrant disregard in other cases where items outside the scope of the warrant were seized. See, e.g., United States v. Hargus, 128 F.3d 1358 (10th Cir. 1997); United States v. Le, 173 F.3d 1258 (10th Cir. 1999); United States v. Johnson, 168 Fed. App'x 294 (10th Cir. 2006); United States v. Sanger, 44 Fed. App'x 937 (10th Cir. 2002). In United States v. Washington, 162 F.3d 1175 (10th Cir. 1998), (table opinion), 1998 WL 777072, the Drug Enforcement Administration obtained a warrant to search the defendant's residence. Id. at *4. In addition to taking evidence of drug offenses (i.e. marijuana, paraphernalia, currency, documentation and scales), DEA agents seized a number of items seemingly unrelated to the warrant, including "a washer, dryer, television, lawn mowers, three-wheel vehicle, two video cameras and two tripods." Id. at *5. Although these items were not listed in the search warrant, the district court held that the items were properly seized under the civil forfeiture statute "because they were discovered incident to the execution of a valid search warrant and because the officers had a good faith belief the items represented proceeds of criminal activity." Id. Even though the seized items were "not obvious evidence of drug activity," the Tenth Circuit held that the Motion to Suppress was properly denied. Id.
Mr. Lustyik and Mr. Thaler have failed to meet their burden of showing that the Government seized anything improperly, much less that they did so in gross or flagrant disregard of the warrants at issue. The facts here are not remotely analogous to those in Foster. The testimony of Special Agent Hopkins was clear that those executing the warrants took steps to ensure that their searches were tailored to retrieve information of the type specified in the warrants, and at no point did they search for items other than what was called for by the warrants. The classification of flagrant disregard is reserved for those who grossly exceed the authority granted by the warrant. The record demonstrates that there has been no gross violation of the warrants at issue.
ORDER
For the reasons set forth above, the extreme remedy of blanket suppression sought by the Defendants is not appropriate in this case. Accordingly,
1. Mr. Lustyik's and Mr. Thaler's joint motion to suppress all the evidence in the case (Doc. 306) is DENIED.
2. However, the court suppresses the evidence the Government has volunteered to withhold (as set forth in the Government's Supplemental Notice (Doc. 601)) and orders the Government to immediately remove all documents from the Relativity database that were not marked "Relevant" within twenty-four hours of the first review (as listed in the exhibits to the United States' Second Supplemental Notice Regarding Defendants' Motions to Suppress (Doc. 601)). The court also orders that the Government cease further searches of the Relativity database unless it obtains a new search warrant.
BY THE COURT:
TENA CAMPBELL
U.S. District Court Judge