Reading Your Search Warrant: Scope, Attachment B, and Overreach.

Warrant scope is the term used to define agents’ legal search authority. This authority is limited, and often Attachment B lists the categories of property agents are permitted to seize. Searching outside the scope of Attachment B can support suppression. Here, suppression focuses on evidence obtained through unconstitutional overreach, whether by searching outside the scope of the warrant or exceeding authority by continuing the search beyond a reasonable time.

A federal search warrant is a court order authorizing a defined search and seizure. The order allows federal agents to search and seize if they have probable cause: “probable cause, when used in the context of a Fourth Amendment search or seizure, means the existence of facts and circumstances sufficient to warrant a reasonable person to believe, in the presence of the facts and circumstances that exist, that there is a fair probability that specific items are or were at the place being searched, that the place being searched is or was used in a crime, or that the individual to be arrested is at the location.”

The Fourth Amendment requires a search warrant to describe “the place to be searched, and the persons or things to be seized.” This description creates separate limits on the search (the place to be searched) and the seizure (the items to be seized). Warrant applications, such as those used by the FBI, require both a description of the place to be searched and a description of the items to be seized. Both a place description and item description must meet the Fourth Amendment probable cause requirement on its own.

Prior to issuing a search warrant, a neutral magistrate judge ordinarily reviews federal agents’ warrant applications.

Which papers in the warrant packet control scope?

Attachment A usually identifies the specific location, device, or individual to be searched. In some instances, the warrant’s cover page may describe a much narrower area of search than agents assume. Affidavits, however, do not expand search authority by their nature. Instead, they only expand scope if they are incorporated into the warrant itself. Thus, a reviewing attorney’s first step is to thoroughly examine the warrant, the affidavit, and the attachments.

A warrant packet can include incorporated exhibits, search protocols, and supporting attachments. However, not every attachment will limit the scope of a search. An attachment limits the scope of a search warrant only when included in the warrant or incorporated by reference. Often, warrants that refer to particular attachments do not actually include them, creating particularity problems. This is true both of the search location and the scope of items to be seized.

A sworn affidavit, also referred to as a probable cause affidavit, supplies the facts federal agents believe support their search warrant request. However, if an affidavit is not incorporated by reference, it does not define the scope of federal agents’ search and seizure authority. Instead, it provides evidence to a magistrate judge to establish probable cause to support the particularized search and seizure described in the warrant.

What should Attachment B actually allow agents to seize?

The Fourth Amendment prohibits searches and seizures that are not “particular.” This particularity requirement applies to both “the place to be searched” and “the persons or things to be seized.” The requirement serves to limit agents’ searches to specific evidence that a neutral magistrate judge has found is supported by probable cause and relates to the criminal offense alleged. Thus, a federal warrant must identify the evidence to be seized precisely enough so that “the officers executing the warrant, and in the absence of clear instruction, will not be given unreasonable discretion to make the decision of which items should be seized.”

Attachment B may limit the scope of agents’ seizures by offense, date range, account number, device, person, statute, file type, business entity, premises, or other evidence category. For example, “ all emails to and from specific parties between certain dates,” or “ all documents that contain references to specific entities, accounts, or individuals.”

Rather than sweeping all records, which may lead to the search warrant becoming an unconstitutional general warrant, a list of broad categories of evidence in Attachment B must still be tied to the facts that establish probable cause for the offenses suspected. As the Supreme Court explained in Stanford v. Texas, 379 U.S. 476 (1965), the general warrant is the very evil that the Fourth Amendment was designed to forbid. With that in mind, it is up to the reviewing magistrate judge to determine whether the warrant meets the Fourth Amendment’s particularity requirement. If, after seeing the warrant, seizing unlisted items requires agents to rely on another doctrine (like the “plain view” doctrine), then agents lack authorization from the warrant, and an overreach suppression is warranted.

How do I compare agents’ conduct with Attachment B?

The first question you should ask is, “What was in the place searched that could be reasonably thought to be covered by Attachment B?” The next question is, “What did agents take?” Compare the inventory receipt with the warrant’s Attachment B. If there is any item on the inventory receipt that is not covered by a category in Attachment B, then you have evidence to challenge that seizure in your case. Also, if you have a copy of the warrant and if agents search anywhere beyond the scope allowed by Attachment B, you have a potential suppression claim on any evidence seized beyond Attachment B’s scope.

Federal agents are permitted to search anywhere that the described evidence could possibly be found. For example, if the search warrant authorizes the seizure of records and boxes of documents, this would allow agents to search everywhere but for areas they have no reasonable basis to believe evidence is located. If the search warrant describes agents’ search of “books, documents, and records,” a warranted search of a home or office should not include opening a small jewelry case because a jewelry case is unlikely to contain books, documents, and records. Also, if a warrant describes an office search for bank records or other records, this doesn’t necessarily authorize search and seizure of unlisted apps or other records that are not bank records or other records.

Another major issue in search warrant cases is whether an inventory is generic, which makes it difficult to determine whether the seized items match Attachment B. The most effective way for counsel to review this is to mark each Attachment B category against each seized item. The goal is to get an idea of what was taken, and whether there are any items the warrant didn’t cover.

Finally, if agents search outside the place to be searched, this can also support a suppression of any evidence found. For example, if the warrant says “the detached garage,” then agents cannot search in the house. If agents think they have permission under the “plain view” doctrine, they must first have legal access to the place they find the item, and the item must be “plainly” in their sight.

Can agents seize devices and search them later?

Under Federal Rule of Criminal Procedure 41(e)(2)(B), “if the search warrant authorizes the seizure of electronic storage media, and if the warrant’s executing officer determines that a later review is more practical, the officer may execute the warrant, take the media into custody, and then review the media at a more convenient time.” When federal agents execute a search warrant for electronically stored information (ESI), they will likely use this rule to seek a seizure.

Agents’ search warrants expire (usually) after 14 days. However, this time limit applies to the execution of the warrant, meaning the seizure or copying of the ESI. This time limit does not apply to the subsequent forensic examination of the stored data.

When on-site sorting of files is impractical, federal agents may be authorized to perform a bulk seizure, which then enables later review. Once agents take the device or computer off-site, they are still bounded by the Fourth Amendment, and the limitations that applied on-site apply off-site. As a result, federal agents must use the warrant’s search authority to separate and sequester responsive and nonresponsive material. This raises a number of issues, such as the retention and return of nonresponsive materials.

Another major issue when agents seize devices is the distinction between the authority to seize and the authority to search. With that in mind, a search warrant can authorize federal agents to seize (i.e., take) an electronic device but not necessarily permit agents to review its contents in their entirety. A search warrant can also authorize imaging of a device but may not necessarily allow for unconstrained forensic review.

An example of this distinction is in United States v. Ray, 141 F.4th 129 (4th Cir. 2025). In that case, the defendant faced child pornography charges arising from a Naval Criminal Investigative Service investigation. While the warrant authorized federal agents to seize the defendant’s telephone, “the warrant did not authorize the search of the phone, and thus the defendants’ objection to the search based on the Fourth Amendment had merit.”

Spodek Law Group, led by managing partner Todd Spodek, defends clients in federal criminal and white collar matters.

What digital overreach should I look for after review?

Along with the place and item descriptions, digital warrant limits can include date ranges, applications, accounts, file types, and more. With this in mind, after obtaining the search terms used by the agents to execute the warrant, you can determine if they stayed within the scope of Attachment B. Later, if you obtain a file forensic extraction report, compare these files with the categories authorized by the warrant.

In many federal digital warrant cases, federal agents also want to review cloud accounts. In this scenario, you will want to ensure that federal agents’ review of cloud accounts is limited to those that fall under the warrant’s scope. Another issue when seizing devices is the issue of deleted data. If the warrant authorizes agents to search for deleted data, then this search must still stay within the limits of Attachment B’s subject matter, date ranges, and more. This includes location history. If agents extract cell phone location history beyond the dates and times authorized by the warrant, agents have an unconstitutional overreach suppression issue as well.

Privileged communication is a topic that comes up in both device and cloud account search warrants. During a device or cloud account search, agents will have to navigate privileged communication with a filtered approach. During the review of such communication, this gives the reviewing party an opportunity to preserve the privileged communication.

Finally, while phone location history and cell site location information (CSLI) are closely related, CSLI is data that must be requested from the telephone provider. As noted in Carpenter v. United States, 138 S. Ct. 2206, 2217 (2018), “A government request for seven days of historical CSLI would be a Fourth Amendment search that requires a warrant.”

If you need to speak with an attorney, feel free to reach out to our firm. At Spodek Law Group, we provide free, confidential initial case evaluations. We can promptly determine the scope of any search warrants executed during a search and advise you on whether any federal suppression laws apply.

What should I request and preserve after agents leave?

When executing search warrants, federal agents should serve the warrant or leave it at the premises to be searched. Additionally, the executing agent or the team leader should leave an inventory receipt listing the property seized. If a recipient is under investigation, they should take the following steps as soon as possible.

1. Immediate Requests

After agents leave, request the signed warrant and all attachments. Keep an eye out for all attachments and request any that are missing. Also, you should request the application, any search protocols agents are following, and anything else in the warrant packet.

2. Agent Contact Information

Ask for the name and phone number of the lead agent on the search team (also called the case agent). This helps ensure communication with the relevant individual if needed.

3. Documentation of Agent Activity

Write down the details of the search as soon as possible. Note the room entries, items removed, agents’ specific queries, and the length of time the search took. These contemporaneous notes can be invaluable for building a scope challenge in later criminal proceedings.

4. Video Surveillance Recording

If available, check security video for any signs of overreach. Security video can also help establish the timeline of agents’ entries and exits. The time they took to search can be important if agents took much longer than necessary, supporting a Fourth Amendment violation challenge.

5. Inventory Checklist

Under Federal Rule of Criminal Procedure 41(f)(1)(C), “The officer executing the warrant must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken or leave a copy of the warrant and receipt at the place where the officer took the property.” While federal agents must provide this receipt, it may only provide a general overview of the property seized. An attorney will need to seek the actual list of seized property for use in your case.

6. Motion for Protective Order

When executing a search warrant, agents are often permitted to seize potentially confidential files and information. Seizing this information is separate from using it. If you have concerns about the potential use and disclosure of your confidential information, then a motion for a protective order may be necessary.

What Rule 41 deadlines and remedies matter after overreach?

Federal Rule of Criminal Procedure 41 governs several important procedures, and this rule applies to federal search warrants as well as subpoenas. Generally, federal search warrants must be executed within 14 days of being issued.

1. Suppression

Motions to suppress evidence are not governed by Rule 41, but by Federal Rule of Criminal Procedure 12. In particular, Rule 12(b)(3)(C) requires that any suppression motions be filed before the trial. Defendants must be extremely careful to avoid missing the deadline for filing these motions. Missing the deadline for filing suppression motions can result in waiving a party’s ability to challenge the search warrants and other federal search and seizure procedures used by the government.

2. Return of Property

Under Rule 41(g), owners of seized property can file motions for the return of their property. “The court must return property that is seized and does not come within the scope of the warrant if it also does not belong to the United States or a third party and is not subject to a lien or forfeiture under federal law.” If an attorney can demonstrate that the government has no legal right to keep the seized property, the court should order its return. However, it is possible that the government may retain copies of any records that it is lawfully in possession of. This provides additional protections for the return of items that were not permitted to be seized under the search warrant.

3. Narrowing Agreement and Privilege Clawbacks

Narrowing agreements and privilege clawbacks can be additional ways to assert protection. A narrowing agreement may limit the scope of a later forensic review of seized ESI. If agents seize a device, this can be critical as the agreement can limit a forensic review to the specific categories of data and files that align with the warrant’s scope.

Privilege clawbacks are another tool used when federal agents’ searches result in the seizure of materials subject to the attorney-client privilege or other privileges. A privilege clawback requires that the materials protected by legal privileges are identified, returned, and either deleted or protected from further review.

Is Overreach Different from a Franks Challenge?

The scenario where a search exceeds the scope of a valid warrant is distinct from a challenge to a warrant’s validity because it was issued based on a defective warrant. The latter is referred to as a “Franks challenge” after the Supreme Court decision in Franks v. Delaware, 438 U.S. 154 (1978), which allows defendants to challenge a search warrant if they have evidence of a material, false, and intentional statement in support of the warrant’s probable cause finding. A defendant who wishes to challenge a search based on a defect in the warrant affidavit will typically need to establish three things to receive a Franks hearing:

• Substantial Preliminary Showing of the Falsehood or Omission: The defendant must present the court with enough evidence to establish a “substantial preliminary showing” of a false statement and/or material omission in the warrant affidavit. Conclusory accusations do not satisfy this threshold; instead, defendants generally need to produce affidavits, sworn statements, or reliable documents (such as email records, bank account records, or public records) to support their claims.
• Intentional or Reckless Conduct: The defendant must establish that federal agents made the false statement or omitted the relevant material “intentionally, or with reckless disregard for the truth.”
• Materiality: The false statement must be “material” to the probable cause finding. In other words, if the false statement had not been made, or if the omission had not been made, the magistrate judge or other issuing official would not have found probable cause.

While the underlying legal theories are different, both overreach and Franks challenges aim for the suppression of evidence. If federal agents searched and seized evidence based on an invalid warrant, you may have multiple legal claims. Our lawyers will focus on all potential options, and our primary objective will be suppression in your case.

Speak With a Federal Defense Lawyer

If you are dealing with any part of what this article describes, the next step is a conversation with a lawyer who handles these cases. Spodek Law Group is a second generation criminal defense firm practicing since 1976, representing clients nationwide from offices in New York, Brooklyn, Queens and Los Angeles. Call 212-300-5196 to speak with our team.