Agents Seized My Computer: What Happens to It and How Long They Keep It.

The Fourth Amendment imposes a reasonableness standard, not a fixed, nationwide deadline, for the length of time a federal law enforcement agency may hold onto a computer it has seized. Under the Fourth Amendment, seizure is allowable “as long as reasonable.”

Seizure of a computer and other device is a multi-step process involving four separate legal events:

• Seizure, which occurs when federal agents obtain control of the device;
• Search of the content of the computer or other seized device;
• Retention of the original computer or other seized device; and,
• Retention of any copies created by federal agents (such as “mirror image” copies).

The Fourth Amendment also imposes certain restrictions regarding the timing of these events. For example, it does not give federal agents unlimited time to complete their forensic searches, and it also limits the government’s right to hold original computers and device copies indefinitely. The longer the government continues to hold onto a seized device, the harder it should be for the government to justify that continued retention.

Computer warrants have special characteristics as well, and warrants that are overbroad under the Fourth Amendment’s “particularity” requirement can be challenged. Computer warrants must restrict the items to be seized, and they must also restrict the locations to be searched. If the computer warrant authorizes the seizure of items that are too broad in scope, then the computer warrant may be challengeable.

Federal Rule of Criminal Procedure 41 also contains several provisions that are important for federal computer cases. For example, Rule 41(f)(1)(C) requires the officer executing the warrant to give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or to leave a copy of the warrant and receipt at the place where the officer took the property. Rule 41(e)(2)(A)(ii) requires federal warrants to be executed during the daytime, unless the judge for good cause expressly authorizes execution at another time.

How long can federal agents keep my computer before returning it?

Under the Fourth Amendment, even if seizing a device is “reasonable,” the government may not be entitled to retain control over the device or the data it contains indefinitely. As noted above, the Fourth Amendment allows the government to seize computers and other property “as long as reasonable,” but, as the Supreme Court has stated in the context of the government’s ability to hold property and other evidence after a criminal seizure, “the law has long recognized the importance of promptly completing searches and seizures.”

Under the balancing test, “the reasonableness of the seizure is to be measured by the government’s interest in continued retention of the seized device or data against the owner’s right to get back the original equipment or data.” As the court noted, while there may be reasons to justify the government’s continued retention of a seized device or other property, this means “that the federal government will need to have compelling evidence that it has an ongoing need for the evidence in order to support the government’s continued possession and control over it.”

In fact, the court had just this opportunity to apply the Fourth Amendment in the case before it. As the court explained, “the fact that federal agents seized a laptop from de-identified devices can only justify the government’s continued retention to the extent that the government can establish a continued evidentiary need.” This is because, “the same reason that makes de-identified devices and data subject to seizure may not necessarily be a justification for continued government possession and control.” In other words, “the same reason that makes de-identified devices and data subject to seizure will only justify the government’s continued retention of de-identified devices and data as long as de-identified devices and data are evidence for which the federal government is pursuing an ongoing and justifiable investigation.” The Eighth Circuit also noted that any hypothetical future usefulness would be “wholly insufficient to justify the government’s continued and indefinite retention of de-identified devices and data.”

As the Eighth Circuit noted in Lindell v. United States, “even if the government is entitled to seize de-identified devices and data under the Fourth Amendment, the government will need to do more to justify the continued possession and control of the de-identified devices and data.” The Eighth Circuit emphasized that this requires “case-by-case balancing of the government’s interest in retaining de-identified devices and data against the device owner’s interest in getting rid of the devices and data.” In other words, “nothing in the law implies the rule that lawfully seizing de-identified devices and data allows for the continued retention of the same devices and data.”

In other words, the Eighth Circuit in Lindell v. United States adopted the position that “the fact that federal agents seized a cell phone from Lindell may justify the continued retention of that phone in order to allow the government to make its case.” The Eighth Circuit rejected the position that the government could “indefinitely retain digital devices as evidence” based on the “generalized assertion of potential evidentiary value.”

Lindell, however, was decided by the Eighth Circuit Court of Appeals and has not been adopted as the law in other circuits. While the case of Lindell v. United States is important, it is not nationwide law. And it does not mean that the federal government must charge you within a certain timeframe. The fact that the government is not going to charge you (or you are no longer under a federal investigation) does not necessarily establish an immediate obligation for the federal government to return your computer.

Why are agents still searching my computer months after seizing it?

Federal Rule of Criminal Procedure 41(e)(2)(A)(i) requires the warrant to command the officer to “execute the warrant within a specified time no longer than 14 days.” Rule 41's deadline limits only how long agents have to execute the warrant; it places no limit on how long the government may keep property it has already seized, and Rule 41(e)(2)(B) expressly permits later review of seized electronic storage media. If agents seized your computer, your email, and other digital data, then they must execute the warrant within 14 days of its issuance unless a judge determined that a longer period of time was warranted.

But the rule is not an end date for the review process itself. While it establishes a deadline for the execution of the computer warrant (for example, by authorizing seizure of the device), the execution of the warrant does not end the government’s right to investigate you. As the rule explicitly states, federal agents are entitled to execute federal warrants and “later review the content of the computer or electronic storage medium seized under Rule 41(e)。”

As a result, federal agents can hold on to devices like computers and phones for months or even years while they wait for their computer forensics laboratories to image and process their data. The length of time it takes to complete a federal forensic analysis can vary. Generally speaking, forensic analysts try to process devices in the order they are received. However, agents can request expedited processing of certain devices and data, and this request is generally granted.

Unfortunately, the federal forensic laboratories have large backlogs. There is no published standard for the federal computer forensics laboratories for handling computers or other electronic storage media. In the past, this means that the turnaround time for federal forensic reports is typically several months.

How long should it take a federal computer forensics laboratory to finish its analysis? This question is difficult to answer because the turnaround time varies among agencies, offices, districts, devices, data encryption, the amount of data on a device, and the complexity of the case at hand. The Eighth Circuit Court of Appeals has noted that “federal agents frequently face a backlog of several months to a year for computer forensics laboratory results.”

Even though a federal warrant must be executed within a specified period no longer than 14 days, nothing in Rule 41 sets an end date for the government's retention of seized property, some might assume a criminal statute of limitations creates an equivalent end date for the government’s right to hold evidence. While this is not the case, federal laws impose limitations periods for both civil and criminal offenses. Most federal offenses that are not capital offenses are subject to a general five-year limitation period under 18 U.S.C. § 3282. If the government doesn’t file charges within the statutory period, then the case is time-barred. However, the criminal statute of limitations is not a bar on the federal government’s right to retain evidence.

Todd Spodek is the managing partner of Spodek Law Group, a second generation criminal defense firm that has been practicing since 1976.

How do I file a motion to get my seized computer back?

The federal law permitting a request for the return of seized property is Federal Rule of Criminal Procedure 41(g). Rule 41(g) governs both cases where an “unlawful seizure” occurred and cases where “the government’s continued deprivation of the property” is “unreasonable.” If you are seeking the return of property that was seized based on a search warrant issued under Rule 41, then “a person aggrieved” may move for “the property to be returned in the district where the property was seized.” When courts grant Rule 41(g) motions, they may also “impose any reasonable conditions on the person’s access to the property.”

While Rule 41(g) provides a mechanism to request the return of property seized in federal cases, the fact that a warrant was issued does not mean that the property is entitled to be seized, and the fact that agents have executed a warrant does not mean that agents are entitled to hold property. Therefore, Rule 41(g) motions can present issues such as challenging the validity of a warrant, challenging the government’s continued retention of property, and both of these issues.

When can a Rule 41(g) Motion be Filed?

A Rule 41(g) motion can be filed before an indictment has been returned, or even if no indictment is pending. If it is filed before any criminal case, then Rule 41(g) provides for a civil equitable action, with procedural requirements and remedies that are similar to those in other civil cases.

However, if a Rule 41(g) motion is filed after an indictment, it will generally be filed and decided within the scope of the pending criminal case. Because the case has entered the criminal stage, then Rule 41(g) will typically be filed along with a Rule 16 motion to compel the production of evidence to the defense for purposes of trial preparation. Again, the federal government is permitted to hold onto property while the criminal case is ongoing.

Are the Procedures for Requesting the Return of Property the Same in State and Federal Cases?

While the procedures for requesting the return of seized computers and other property are similar at the state and federal levels, the specific requirements are codified under separate laws. The requirements for state cases will vary on a state-by-state basis. Federal computer forensics investigations are governed by the Federal Rules of Criminal Procedure (specifically, Rule 41(g)), which is separate from the state laws that govern the return of seized computers in state cases.

Can Someone Other than a Targeted Defendant or Suspect File a Rule 41(g) Motion?

Rule 41(g) provides that “a person aggrieved” may move for the return of the seized property. This includes a person who never suspected they were part of a federal investigation, yet an executing officer seized property that they own or to which they have a right of possession. For example, if federal agents seize computers and other electronic storage media at a home, the occupants of the home can file a Rule 41(g) motion to contest the seizure.

If they return my computer, do they still keep my data?

In a recent case involving an unsuccessful federal prosecution, the court stated that “return of the hardware does not, in itself, dictate return of the data.” The court found that “while the hardware had been returned, the FBI still held data imaged from the hardware.” This is because “the storage, analysis, and dissemination of digital evidence are three separate activities, each implicating a continuous privacy interest.” As a result, courts have been open to treating a request for the return of a computer as distinct from a request for the return of the images the government has created. In this case, this means that the government can return the original device and still hold onto any digital images and copies it had made.

At present, there is no uniform federal rule that requires deletion of nonresponsive data after it has been copied from a seized computer.” The court noted that, “the only reason the data was copied is that a search warrant authorizing the capture of an image of the computer was issued, but it was not a search warrant authorizing the permanent storage of nonresponsive data.” However, the court found that “there is no federal rule requiring the deletion of nonresponsive data after it has been imaged. There is no federal rule requiring the federal government to return a computer image of the data on a computer.” In effect, these findings means that, in federal cases, a search warrant only prohibits the government from returning the computer if the warrant remains in effect.

What happens to the hardware?

Once a federal computer forensics examination is complete, there is no continuing evidentiary reason to maintain control of the hardware. While a criminal case can have a continuing evidentiary need for the computer for trial purposes, these needs can be satisfied by a mirror image of the hardware. As the result, completing the forensic examination may, by itself, create a demand for the hardware’s return.

What happens to the images of the data on the hardware?

The Fourth Amendment, the Computer Fraud and Abuse Act, and the Stored Communications Act protect you from the government accessing the data stored on your devices and other devices. Again, the storage, analysis, and dissemination of these digital items are three separate activities, each of which continues to implicate the Fourth Amendment (and the other laws mentioned). As a result, completing the computer forensics laboratory analysis may not, by itself, create a demand for the copies of the digital evidence to be deleted.

Are cloud backups and connected backups seized along with the computer?

While a federal agent may seize any computer, phone, and other device found at a house that are, in fact, computers, phones, and other devices, the device is not the same as the account or data it contains. Cloud account records and cloud backup data are not part of the physical computer, phone, or storage device, so they are not seized along with it. Instead, accessing cloud storage requires an additional legal process under 18 U.S.C. § 2703.

Are external drives, routers, and home network storage also considered computers?

A warrant may authorize the seizure of the computers, phones, and other devices that are, in fact, the subjects of the investigation. When a warrant authorizes a search for specific files or folders, the warrants may separately authorize federal agents to seize any additional equipment from the home or office as well, including external drives, routers, and other devices that might be part of the owner’s home network storage.

Can I get copies of files I need from the computer?

As the Eighth Circuit noted in United States v. Computer Data, “there is no requirement that the computer that is to be imaged be kept in its current location.” The court also noted that the government may remove computers in order to conduct a more thorough examination “offsite.” While this means that you cannot necessarily expect to have immediate access to your computer once a warrant has been executed, it does not mean that you are not entitled to have access to any business, medical, or school files you need.

When the government conducts search and seizure by warrant, it is the warrant that specifies what agents are entitled to seize. The search methods agents use to execute search warrants must also comply with the law. This includes taking appropriate precautions not only to preserve privileged information but also to prevent agents from accessing files that are not subject to seizure under a search warrant.

For example, when prosecutors are aware that a search warrant may result in agents having to review material that is attorney-client privileged, the government will designate a “filter team” to separate attorney-client privileged information and search warrant files that are not responsive.

In certain cases, it may be necessary to appoint a “special master” to conduct an independent review of the seized files. Courts typically appoint special masters in cases where there is a risk of unauthorized access to a massive amount of data that is not subject to seizure under the search warrant and where the volume of the data requires the attention of a neutral third party.

What happens after federal agents have reviewed the data?

The final stage of a Rule 41 computer search is the dissemination of information to a jury. When a grand jury convenes, the federal prosecutor may present all of the relevant evidence to the grand jury. In a grand jury proceeding, however, defendants who are a part of the federal investigation may not have an attorney present. As a result, it is necessary for the federal prosecutor to turn over all of the discoverable digital evidence that you need to prepare your defense. The government may provide an image of the seized computer or specific data extracted from a seized computer. A forensic expert can independently examine these computer images and extracted data to ascertain all relevant facts. The discovered data may corroborate your alibi, contradict the prosecution’s alleged timeline, or cast doubt on the prosecution’s investigation. If you can show a real need to recover specific computer files for use in a pending criminal case, you can present an appropriate motion to the court for access and duplication, and you may be able to use them at trial.

Get Advice on Your Situation

If you want someone to look at the specifics of your case, Spodek Law Group handles federal criminal defense nationwide from New York and Los Angeles. The firm has been practicing since 1976 and its motto is simple: we owe loyalty to only you. Call 212-300-5196.