Suppressing Evidence From an Overbroad Digital Search Warrant.

A warrant may not be invalid even though it’s overbroad. If a warrant is supported by probable cause but authorizes a search of items not supported by probable cause, that warrant might not be void, but it would be invalid. But the warrant’s invalidity doesn’t necessarily lead to suppression in all cases. Courts have authority to suppress “only that data and information which they determine was obtained through constitutionally unsupported authorization.This raises an interesting question regarding federal evidence obtained under warrants that, while having some probable cause support, are not limited to only items supported by probable cause. Does Leon apply here?

• Probable cause support
• Leon (good faith reliance)
• Overbreadth
• Particularity

Is the reliance on the authority granted by the judge as a whole, even where that authority is overbroad, reasonable, or is the reliance only reasonable insofar as the authority sought and the authority granted were not overbroad? The answer depends on a variety of factors and requires a case-by-case analysis focused on whether the agents involved were aware or should have been aware that the warrant was overbroad.

The Fourth Amendment of the United States Constitution states: “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.”

This is the baseline for determining whether search warrants and their enforcement are reasonable or unreasonable. While the courts have tried to provide some uniformity through the Leon analysis, this is still an area that requires scrutiny in every case.

What makes a digital search warrant unconstitutionally overbroad?

Even though a digital search warrant must be supported by probable cause, having probable cause is not the only requirement for a constitutionally compliant warrant. A digital search warrant must also be limited to the scope for which there is probable cause, and it must also be “particular.”

Probable Cause and Nexus

Probable cause requires a nexus, a specific connection, between the crime and the digital data to be seized. Even when probable cause for a particular crime exists, a search warrant can be overbroad if it allows the seizure of information not supported by that probable cause. In other words, the search warrant must not only be supported by probable cause, but it must also be limited to the scope for which there is probable cause. A statement such as “In a world where cell phone use is common, drug dealers and other criminals commonly use cell phones to facilitate their criminal activity” is simply not a nexus, it is just a generalization.

Overbreadth vs. Particularity

What is the difference between overbreadth and particularity? While these two concepts are similar, they are different and require different scrutiny of the warrant and the circumstances under which it was issued. When the court examines the issue of particularity, it is asking: can a federal law enforcement officer identify the scope of the search and seizure authorized by the warrant without guesswork?

Particularity of Digital Search Warrants

As digital search warrants expand the number of items to be searched and the number of crimes for which the search warrants may be issued, agents need to be as clear as possible. However, many warrants are so broad that the officers themselves probably have to guess at what their warrants allow. In order for a warrant to satisfy the particularity requirement it must, at minimum, provide for:

• Specific Offense(s)
• Category of Data
• Specific Account(s)
• Date Range
• Limitations to Avoid a General Warrant

For example, if an agent’s affidavit only alleges that a search for “evidence of any federal offense” is warranted, such authorization is too wide and it can be easily argued that the warrant has become a general warrant, which is exactly what the Fourth Amendment is designed to avoid.

Lack of Date Range

When addressing the issue of dates, federal agents frequently fail to specify an applicable date range in their applications and affidavits. Does this mean that the warrant is automatically invalid? No. But it does support the argument that the warrant is overbroad. It may need to be carved out and severed to preserve the remainder of the warrant.

Which records show whether the digital search exceeded its scope?

When evaluating the authorized scope of a digital search, judges typically rely on the language of the warrant. They also rely on the language of the affidavit, if it was properly incorporated by reference in the warrant. However, if the warrant does not incorporate the affidavit by reference, the particularized facts contained in the affidavit may not save a deficient warrant.

At Spodek Law Group, our review of digital search warrants and the evidence obtained by executing them is extremely thorough. We review the warrant and affidavit in the application for the warrant, as well as any discovery records. We compare these documents against what the forensic examiner actually did to determine if the digital search was performed within its authorized scope. Execution records can show if a digital search was performed outside of the specified date range, for file types not authorized, or for data not constituting evidence of the specific offense authorized by the warrant.

A Cellebrite report is just one example of a forensic report. In such reports, a key indicator of the scope is the “acquisition method.” Even if the acquisition itself was too broad, the digital search may have remained within the authorized scope. Here, the examiner notes are critical. The report lists the parsed data, including messages and call logs, showing what data was obtained. This reveals whether the forensic examiner reviewed data beyond what was authorized by the warrant.

Beyond Cellebrite reports, search logs, keyword lists, and examiner notes can reveal the actual search techniques used. We examine if the examiner performed keyword searches, how those searches were structured and reviewed, and if the examiner avoided data outside the warrant’s scope.

Regarding the warrant itself, an attachment can limit its scope if properly incorporated. If not incorporated, the attachment typically will not limit the warrant’s scope.

In execution-scope analysis, distinguishing between what the examiner “could” do and what the examiner “did” is key. Most forensic tools have the capacity to acquire all data; the central issue is whether the examiner’s review was focused on the data they were legally authorized to seek.

Was the Warrant Invalid or Was the Search Too Broad?

Is a digital search warrant invalid if the authorized scope is not limited to only those items and information about which the issuing judge found probable cause? Or is the warrant invalid because it’s overbroad? And, even if the warrant itself is valid, does that allow agents to review everything they have extracted?

When a federal digital search warrant is “facially overbroad,” the question is about the scope of the search and seizure authorized by the judge. When the search itself is overbroad, the question is about the review of all data and information obtained by the forensic examiner. If the warrant was properly issued and authorized by the judge but the search was performed beyond that authorization, the digital search is overbroad.

The difference between a warrant being overbroad and the search being overbroad is important in some cases, because the remedies will depend on whether the judge has decided whether to carve out and sever specific portions or whether the forensic search itself was invalid. In both cases, a law enforcement officer may extract data from a digital device to which they may have law enforcement access without the need to review all the extracted data. However, just because the forensic extraction is lawful does not automatically make the review of every extracted item lawful.

What If the Search was to Expand the Case?

Just because the search and seizure was authorized for certain information doesn’t mean the investigators can use the information to look into other matters. The review of the extracted data must remain focused on the categories of data authorized by the warrant and should not be used to build a case for another offense. When investigators discover a new lead during their review, they cannot rely on the warrant they already had to seek information outside the authorized scope. They must seek additional authorization.

What If the Device Was Retained for Months or Years?

What if the digital device was seized but not forensically analyzed for months or years? What if investigators relied on that device for multiple offenses, and what if they found a way to recover the device without its image? The Fourth Amendment applies in all cases. When determining if a search or seizure is lawful, the judge must decide:

• Did the agents have the authority to seize the device?
• Did the agents have the authority to image the device?
• Did the agents have the authority to review specific types of data and specific offenses?
• Did the agents have the authority to store the image?
• Did the agents have the authority to utilize the image for multiple offenses?

Each step presents unique constitutional issues that need to be addressed individually.

Todd Spodek and the attorneys at Spodek Law Group handle federal cases of this kind from New York, Brooklyn, Queens and Los Angeles.

Will the Court Suppress Everything Found in the Search?

In a challenge to a digital search, it is not necessary to challenge the warrant itself. The forensic search and its products can still be challenged. If the digital search or its execution is found to be unconstitutional, the courts will then determine whether the direct products of the search are excluded from the trial. Then, the court may examine whether other evidence is excluded as the fruit of illegality.

Inevitable Lawful Discovery

Is it inevitable that the evidence in question would have been discovered lawfully through a valid search warrant or other lawful investigation? If the evidence would have inevitably come to light lawfully, then the earlier unconstitutional act may not prevent admissibility.

Severance

Is severance appropriate? Severance refers to the act of severing an overbroad digital search warrant into several portions, some of which are constitutionally compliant and some of which are not. The stronger the case for severance, the more likely the court will examine whether the authorized and unauthorized portions of the warrant can be separated. This will happen if the categories of data for which there was probable cause can be meaningfully distinguished from the categories of data for which there was no probable cause.

If the warrant is broad, the more likely that the only possible action is wholesale suppression. But in most cases, federal judges, especially district judges, will attempt to sever the warrant if a substantial portion is still valid.

Attenuation

Does the evidence obtained independently present a case for attenuation? When the evidence came to light through a chain of events that occurred after the unconstitutional act, the court should assess whether the misconduct is sufficiently attenuated from the discovered evidence. Brown v. Illinois outlines three key issues for attenuation:

• The amount of time between the alleged misconduct and the discovery of the evidence
• The presence of intervening circumstances and the conduct of the law enforcement officers involved
• The purpose and flagrancy of the official misconduct

Independent Source Doctrine

Is the evidence in question obtained through an independent source? If a warrant is deemed to be unlawful, but there is evidence that the government obtained the same evidence through another lawful method, the other source must be a wholly independent source. The evidence should not have any tie or relationship to the unlawful search warrant or search execution. The independent source doctrine can provide a defense to wholesale suppression in cases involving digital search warrants and the execution of the warrants.

Good Faith Reliance

Is it apparent that the agents relied on the authority granted by the judge on good faith? When a warrant, or its execution, is unlawful, the good faith reliance doctrine allows for the admission of the evidence based on the officers’ reliance on a judge-issued warrant. This doctrine is a powerful tool that the government can use to overcome a constitutional challenge to the search.

Can Prosecutors Save the Evidence through Good-Faith Reliance?

In United States v. Leon, the Supreme Court of the United States created the “warrant good-faith exception” to the exclusionary rule. It allows federal prosecutors to try to keep the products of a search even when a search is found to be unconstitutional. When reviewing good-faith claims, judges must determine if the officers involved reasonably relied on the authority granted by the judge. In other words, judicial approval of the warrant is not enough; the reasonableness of police reliance is what the law requires.

Inadequate Probable Cause

When a judge issues a warrant based on a request that has virtually no probable cause support, this generally will not be sufficient to preserve evidence. This type of flaw of the warrant or the warrant application usually has the judge at fault. The good faith exception does not provide protection to investigators when the affidavit failed to provide the necessary probable cause and the judge apparently did not read it. In fact, most judges do read the affidavit and approve the warrant if the affidavit seems to show probable cause. If the court finds the probable cause not present, the product of the search warrant probably must be suppressed.

Facial Overbreadth

Does a warrant’s facial overbreadth and obvious flaws provide reasonable reliance on a warrant? The Supreme Court has decided that evidence obtained under warrants with “facial defects” should be suppressed. These facial defects make the reliance objectively unreasonable regardless of who drafted the warrant, as they, on their own, violate the Fourth Amendment.

Reliance on Warrant drafted by law enforcement

Does a federal prosecutor have the ability to assert the good faith reliance exception when one of his agents drafted the warrant? The court will look at the facts and circumstances presented. In cases where law enforcement was entirely responsible for drafting, this may undermine a claimed reliance on a warrant that is not valid.

Reckless Disregard of the Fourth Amendment

When deciding what is required to keep the evidence, the Supreme Court clarified the requirements in Herring v. United States. In Herring, the Court decided that the exclusionary rule is designed to discourage misconduct. The Court determined that evidence obtained by law enforcement will be excluded only when the conduct of the law enforcement officer is “deliberate, reckless, or grossly negligent.”

State Constitutional Claims

Does state constitutional law require suppression even though the evidence is admissible under the good-faith exception? Even in a federal prosecution, if the conduct involved violated the laws of the state and if it resulted in a state court proceeding, then the evidence can be suppressed.

Knowing or Reckless Misrepresentation

The good faith exception won’t protect evidence obtained by agents who knowingly or recklessly misled the issuing judge. Those agents and their prosecution must be ready to face the consequences.

How Should the Defense Build and Preserve the Suppression Motion?

To challenge a digital search warrant in federal court, a defendant must establish that he (or she) had a reasonable expectation of privacy in the digital data obtained from the search warrant. Once a reasonable expectation of privacy is established, the defendant then needs to present the legal analysis demonstrating that the digital search warrant is overbroad, and not particularly describing. The suppression motion must identify the challenged evidence and the constitutional defect in the warrant or search execution, and the proper remedy under the Fourth Amendment.

When Should the Motion Be Filed?

A suppression motion in federal court must be filed before the trial. Federal Rule of Criminal Procedure 12, which covers pretrial motions, lists various grounds for requests to suppress evidence, including a Fourth Amendment violation.

How Do We Get the Truth Out of the Affidavit?

What happens if the warrant affidavit is materially dishonest and is the basis for the overbreadth in the digital search warrant? If a law enforcement agent includes false or materially incomplete facts, the proper remedy is to seek a “Franks” hearing. In United States v. Franks, the Supreme Court of the United States decided that a defendant can challenge a search warrant if he (or she) can make a substantial preliminary showing of “either a false statement, knowingly or willfully made, or with reckless disregard for the truth, or material omissions from the affidavit.”

What is a Substantial Preliminary Showing for a Franks Hearing?

The substantial preliminary showing for a “Franks” hearing needs to be backed by more than just unproven allegations or speculation. The movant needs to provide specific facts that show which statements are false or misleading and present evidence of the truth. Evidence for a “Franks” hearing can include depositions of the officer who drafted the affidavit and reports from the digital device in question.

Who Bears the Burden of Proof?

The party requesting the suppression bears the burden of proof unless otherwise noted. The defendant must prove a reasonable expectation of privacy and that the warrant application contains false and misleading information, with any pertinent facts or evidence proving that.

How Does the Defendant Preserve Suppression Challenges on Appeal?

The defendant preserves his (or her) suppression challenge on appeal if the defendant raises the applicable grounds for the motion to suppress at the trial level. Federal appellate courts generally refuse to hear arguments for which a sufficient factual record was not created in the district court. If a defendant wishes to appeal the judge’s decision on a motion to suppress, he must ensure the trial court has an adequate evidentiary record for the appropriate legal review on appeal.

Speak With a Federal Defense Lawyer

If you are dealing with any part of what this article describes, the next step is a conversation with a lawyer who handles these cases. Spodek Law Group is a second generation criminal defense firm practicing since 1976, representing clients nationwide from offices in New York, Brooklyn, Queens and Los Angeles. Call 212-300-5196 to speak with our team.