Every computer border search requires case-by-case reasonableness, DC court holds

Imagine you're flying from the United States to a foreign country and you're carrying a laptop. Federal agents stop you on the jetway as you're about to board your flight. They want to take your computer and search it. Can they? And if they can do that, what are the limits on how much they can search, for how long, and where?

Lower courts have divided on the question. Some courts have concluded that the "border search exception" that the Supreme Court has applied for searches of physical objects should also apply equally to computers. Under that approach, agents can seize and search computers at the border (or at its "functional equivalent," such as at international airports where passengers are boarding international flights) apparently without limit. The Ninth Circuit has adopted a different approach, ruling that agents need "reasonable suspicion" to seize and search a computer at the border if the search is a "forensic" search but not if it is a "manual" search.

Last Friday, Judge Amy Berman Jackson of the D.C. District Court adopted a third approach in a new case called United States v. Kim. The opinion holds that that every computer search at the border must be justified as reasonable under the totality of the circumstances. After concluding that the search in this case was not reasonable under that test, she suppressed the evidence.

I think Judge Jackson's decision is highly problematic. I won't be surprised if DOJ appeals it, as it raises a really important set of questions and answers them in some unusual ways. Will the Court of Appeals agree with Judge Jackson? Time will tell. But we'll probably hear more about this case either way, so here's a detailed rundown of the new decision together with my thoughts.

I. The Facts of the Case

First, the facts. The Department of Homeland Security was investigating illegal shipments of missile parts that had been funneled to Iran. The parts had been purchased in the United States, sent to China, and then routed to Iran in violation of export control laws. The government had indicted a man named Yang for related crimes, and Yang then confessed to having obtained the missile parts from a Mr. Kim three or four years earlier. Kim is a Korean businessman who does business in the United States and Korea.

The government learned that Kim was in the U.S. and that he would be flying soon from Los Angeles to South Korea. Agents decided to conduct a border search at LAX to seize his computer and search it for evidence of export control violations. Agents stopped Kim on the jetway between the gate and the airplane as Kim was boarding his flight. They seized Kim's laptop computer and then allowed Kim to board the flight.

The next day, the case officer turned over the laptop to Department of Homeland Security computer forensics specialists in San Diego. The forensics team made an "image" of the computer—a perfect copy—and returned the laptop to the case agent. The seized laptop was returned to Kim in South Korea about a week after it was seized, although agents kept the image.

The forensics team in San Diego used software to extract from the image the text of e-mails, word processing files, powerpoint files, spreadsheets, and pdf files. The forensics team then asked the case agent for a list of keywords to use to narrow down the search. The case agent gave the forensics team 22 keywords: "QA-2000, QA-3000, G-2000, 7270A, accelerometers, gyroscope, angular, sensor, Honeywell, Endevco, Northrop, Grumman, ITAR, sensitive, export, shipment, military, aircraft, missile, satellite, ballistic, and nuclear." The forensics team ran the keywords through the extracted documents and found 5,900 files on the laptop that included at least one of these words. The forensics team burned a DVD with the 5,900 files and gave them to the case agent.

The case agent then spent several days combing through the 5,900 files. The combing proved a success, as the agent found e-mails on Kim's laptop confirming Kim's purchase of the missile parts. The case agent completed the search through the 5,900 files twelve days after the computer had been seized. The then sought a search warrant to conduct an a further search of the image, in government custody, for violations of the export control laws. A judge signed the warrant, but the agent never executed it. The case instead was charged based primarily on the warrantless analysis of the DVD that had the 5,900 files that had included the incriminating e-mails.

II. The Law: Totality-of-the-Circumstances Reasonableness Balancing

In her opinion, Judge Jackson grants Kim's motion to suppress the recovered e-mails. Here's the holding:

[T]he Court finds, under the totality of the unique circumstances of this case, that the imaging and search of the entire contents of Kim's laptop, aided by specialized forensic software, for a period of unlimited duration and an examination of unlimited scope, for the purpose of gathering evidence in a pre-existing investigation, was supported by so little suspicion of ongoing or imminent criminal activity, and was so invasive of Kim's privacy and so disconnected from not only the considerations underlying the breadth of the government's authority to search at the border, but also the border itself, that it was unreasonable. Therefore, the motion to suppress the evidence . . . will be granted.

How does Judge Jackson arrive at that holding? First, she reasons that under Riley v. California, the cell-phone search case, computer searches raise new issues. Courts are not compelled to follow old rules: "the analysis of whether the search of Kim's laptop was reasonable under the Fourth Amendment does not simply end with . . . the well-recognized border exception[.]" According to Judge Jackson, Riley requires a first-principles analysis of whether a computer search is reasonable based on a totality of the circumstances. That requires assessing the government's interest in a search, weighing how much the search advanced those interests, and then comparing that to the degree of privacy invasion.

Judge Jackson starts off by concluding that in the case of computer searches, the government has little special interest in searching computers leaving the United States:

The government's power at the border arises out of the sovereign's right and need to protect its territorial integrity and national security. "[S]earches made at the border, pursuant to the longstanding right of the sovereign to protect itself by stopping and examining persons crossing into this country, are reasonable simply by virtue of the fact that they occur at the border . . . . " Ramsey at 616. While there is authority that states that the government's broad authority at the border extends to those exiting the country as well as to those coming in, United States v. Seljan, 547 F.3d 993, 999 (9th Cir. 2008), quoting Ramsey, 431 U.S. at 616, the justifications for the exception to the warrant requirement are generally framed in terms of threats posed at the point of entry. [Internal citations omitted] . . . None of those significant governmental interests in monitoring what comes in to the country apply in this case.

It is true that there is case law that extends the search authority at the border to departures as well, and in particular, to potential violations of the export control laws. See, e.g., United States v. Boumelhem, 339 F.3d 414, 423 (6th Cir. 2003) (finding that the government properly searched a large cargo container before it left the United States because "the United States's interest in preventing the export of weapons to other countries also implicates the sovereign's interest in protecting itself"). But Riley indicates that the Fourth Amendment is not necessarily satisfied by a simplistic likening of a computer to a searchable "container." See 134 S. Ct. at 2491.

Further, even if there were a significant government interest, it was not advanced in this case because the forensic team was in San Diego and Kim was allowed to go to South Korea:

[T]he Court cannot help but ask itself whether the examination in this case can accurately be characterized as a border search at all. And if not, it surely cannot be justified by the concerns underlying the border search doctrine.

It is true that Kim's laptop was seized at the border—in this case, LAX—but it was not even opened, much less searched, there. It was transported approximately 150 miles to San Diego, it was retained for a limited period of time, and eventually, the laptop was returned. Meanwhile, there was so little of note found in Kim's luggage, and he posed so little of an ongoing threat to national security, that he was permitted to board his flight.

On the other hand, the degree of privacy invasion was great:

[W]hile the immediate national security concerns were somewhat attenuated, the invasion of privacy was substantial: the agents created an identical image of Kim's entire computer hard drive and gave themselves unlimited time to search the tens of thousands of documents, images, and emails it contained, using an extensive list of search terms, and with the assistance of two forensic software programs that organized, expedited, and facilitated the task. Based upon the testimony of both Special Agent Hamako and Special Agent Marshall, the Court concludes that wherever the Supreme Court or the Court of Appeals eventually draws the precise boundary of a routine border search, or however either Court ultimately defines a forensic—as opposed to a conventional—computer search, this search was qualitatively and quantitatively different from a routine border examination, and therefore, it was unreasonable given the paucity of grounds to suspect that criminal activity was in progress.

Judge Jackson draws confirmation of her conclusion in the government's failure to execute the warrant it had obtained. The fact that the government didn't execute the warrant implicitly shows that the warrantless search was extremely invasive. If the warrantless search had not been complete, the agents presumably would have carried out the warrant they had obtained in order to conduct a more complete search. The fact that they didn't do that only emphasizes the invasiveness (and thus unreasonableness) of the preceding warrantless search.

III. My Criticism of the Court's Reasoning

I find the court's approach very problematic. Here's why:

a) Judge Jackson takes the lesson of Riley to be that courts should engage in case-by-case reasonableness balancing when it comes to computer searches. But the fact that Riley looked to reasonableness to enact a bright-line rule for computer searches incident to arrest doesn't seem to empower every single judge to conduct a murky "totality of the circumstances" test for every computer border search. For one thing, trial judges don't have the power of the Supreme Court to enact new rules in the face of contrary precedent. For another thing, Riley emphasized the need for clear categorical rules instead of case-by-case balancing:

Each of the [government's] proposals is flawed and contravenes our general preference to provide clear guidance to law enforcement through categorical rules. "[I]f police are to have workable rules, the balancing of the competing interests . . . 'must in large part be done on a categorical basis-not in an ad hoc, case-by-case fashion by individual police officers.'" Michigan v. Summers, 452 U. S. 692, 705, n. 19 (1981) (quoting Dunaway v. New York, 442 U. S. 200, 219-220 (1979) (White, J.,
concurring)).

Judge Jackson's totality-of-the-circumstances test seems like the kind of "ad hoc, case-by-case" approach that the Supreme Court warned against in Riley.

b) Judge Jackson's conclusion that the government has no legitimate interest in searching computers leaving the country strikes me as also problematic. There's lots of uniform circuit caselaw concluding that the border search exception applies both to entrance and exit (although none, as far as I can tell, from the DC Circuit). It's not surprising that the lower courts have so held, as the interests seem quite similar. Judge Jackson disagrees by pointing to language that has focused more on the government's interest in searching and stopping property entering the country, paired with a blanket statement that "the Fourth Amendment is not necessarily satisfied by a simplistic likening of a computer to a searchable 'container.'" But it's hard to see how the citations and this generic statement establish her conclusion.

c) I was also unconvinced that the location of the forensic search is relevant. This is an old debate. Regular readers may recall that I argued here back in 2009 that it was irrelevant:

[T]he location of the search has no obvious relevance to the intrusion experienced by the defendant, who doesn't know where the computer is searched or in all likelihood even care. Indeed, it often happens that agents in one district will ship off a computer to another district for analysis: It would be quite odd if the courts based the legality of the search on where the forensic analysis just happened to be done. Why does it matter that the computer went to the analyst instead of the analyst to the computer given that the owner of the computer was elsewhere?

The en banc Ninth Circuit agreed with that irrelevance in Cotterman: "A border search of a computer is not transformed into an extended border search simply because the device is transported and examined beyond the border."

d) Next, it seems troubling to hold it against the government that agents applied for a warrant but then didn't execute it. Judge Jackson sees that fact as implicitly signaling that the warrantless search was highly invasive. But whether or not the warrantless search was invasive, it seems problematic to deduce that from the likely invasiveness of a different search that the government didn't conduct. There are lots of reasons, unrelated to invasiveness, that might explain the non-execution of the warrant. Maybe the forensic team didn't execute the warrant because there was a big backlog of other more pressing cases. Maybe the case agent's boss intervened and told him to stop spending so much time on that one case after he had already spent several days searching the DVD of copied files. Maybe the prosecutor expected the case to plead out based on the evidence they found the first time. Who knows.

e) Holding the non-execution of the warrant against the government is also problematic because it only discourages agents from obtaining a warrant in future cases. Importantly, it's not at all clear that a warrant was needed for a subsequent forensic search. This brings up an area of major uncertainty with great practical importance: Once the computer is seized at the border and an image is made, what are the temporal limits on searching the image? Do the agents have to do a warrantless search quickly, but then get a warrant after a certain period of time passes? Or can they keep searching for as long as they want? If there's a time limit, what framework governs what that time limit is?

Right now, we have no idea. There's just no caselaw on the question. In her opinion, Judge Jackson faults the agents for using the border search exception to search the computer "for a period of unlimited duration." But the agents here actually acted cautiously by getting a warrant after a window of time passed. The initial warrantless search had occurred within 12 days of the laptop's seizure, and they obtained a warrant for searches after that. This opinion sends an unfortunate signal to case agents: Next time, don't get a warrant.

f) Although I'm no fan of the broad good-faith exception to the exclusionary rule, doesn't it deserve consideration here? Judge Jackson never discusses the scope of the exclusionary rule, instead going straight from the conclusion that the Fourth Amendment was violated to granting the motion to suppress. Perhaps the prosecutors didn't argue it, which would be a prosecutorial mistake. But its absence is notable.

IV. Ongoing Versus Past Crimes and the Cotterman Question

Careful readers will recall that Judge Jackson noted, in her totality of the circumstances holding, that the government was only investigating a past crime and that there was no criminal activity "in progress." Why is that relevant, you wonder? To understand that, you need to understand an earlier part of Judge Jackson's opinion. In that section, she considers whether the search would be lawful under the Ninth Circuit's standard in United States v. Cotterman. Recall that Cotterman held that "forensic" searches require reasonable suspicion while "manual" searches do not. Judge Jackson ends up concluding that how Cotterman applies isn't directly relevant. But the Cotterman discussion explains where the ongoing-vs-past-crime point originated—and also why it, too, is problematic.

According to Judge Jackson, the search in this case fails Cotterman because there was insufficient evidence that Kim was committing an ongoing crime at the moment that he crossed the border. The government seized his computer to search for evidence of a past crime—specifically, Kim's purchase of missile parts three or four years earlier. But even if Kim had committed that crime in the past, and there may be evidence of it on his laptop, there was insufficient evidence that Kim was committing a crime at the moment he was departing LAX:

Looking at all of the circumstances presented, then, while it is a close case, it seems clear to the Court that the search of the laptop was predicated upon the agent's expectation that the computer would contain evidence of past criminal activity, but there was no objective manifestation that Kim was or was "about to be, engaged in criminal activity" at that time.

Here's the problem. Even assuming Cotterman applies, I would think the relevant question is whether there is reasonable suspicion that evidence or contraband is presently on the laptop, not whether there is reasonable suspicion to believe the laptop's owner is currently engaged in criminal activity. Granted, the standard of reasonable suspicion as to the person's criminal activity comes up in the caselaw on Terry stops, where the government temporarily seizes a person for questioning. The idea is that the government can only seize the person when there is evidence of the person engaged in committing a crime or about to commit a crime—and in some cases, United States v. Hensley teaches, there is evidence that the person committed a past serious crime.

But why should it matter whether the laptop's owner is presently engaged in a crime in this case? This case doesn't involve a Terry stop. It involves a border search of property, not the seizure of a person. I would think the relevant form of reasonable suspicion is reasonable suspicion of evidence existing on the computer, not reasonable suspicion that the person is presently engaged in criminal activity that would support a Terry stop. Otherwise anyone could insulate a computer from a border search by just giving it to an innocent third party to carry on the flight. Or just paying to ship it.

Admittedly, the Cotterman case that introduced the reasonable suspicion requirement is itself vague on this point. But that's understandable. Cotterman was a child pornography case. In that context, the two inquiries are usually identical. When the crime is possession, reasonable suspicion that there is contraband on the machine ordinarily is the same as reasonable suspicion that the possessor of the machine is committing an ongoing crime. So Cotterman just speaks of "reasonable suspicion" in the abstract.

But I would think it's evidence on the machine that matters in a case where there is a difference between the two standards. That's the approach the Ninth Circuit has taken in its caselaw on "extended" border searches, which the Ninth Circuit has held require reasonable suspicion. See, e.g., United States v. Abbouchi, 502 F.3d 850, 855 (9th Cir. 2007) ("Because the delayed nature of an extended border search … necessarily entails a greater level of intrusion on legitimate expectations of privacy than an ordinary border search, the government must justify an extended border search with reasonable suspicion that the search may uncover contraband or evidence of criminal activity") (emphasis added).

Perhaps Judge Jackson was misled by United States v. Hassanshahi, 2014 WL 6735479 (D.D.C. 2014) (Contreras, J.), which applied Cotterman and also appeared to focus on whether the defendant was engaged in a crime. I would guess that decision explains the focus on the ongoing crime issue in Kim. But if so, Hassanshahi's analysis seems equally misplaced. If you assume Cotterman is the law, I think the issue should be reasonable suspicion about evidence on the machine.

V. Conclusion

In a recent talk, I spoke about how defense attorneys should press judges to find "Riley moments"—situations in which a court concludes that the old rules don't apply because computer searches are fundamentally different from physical searches. While defense attorneys should be making those arguments, I don't think Judge Jackson's "Riley moment" in the Kim case was ultimately a success. Maybe border searches require a Riley moment in some way. Maybe a new test is needed by which the government's search in this case was unconstitutional. But if a new test is needed, I don't think that a case-by-case inquiry based on the kind of factors considered in Kim is the right way to go.

Watch for a possible appeal to the DC Circuit. And if an appeal is filed, stay tuned for how the DC Circuit approaches this very interesting case.

UPDATE: Some commenters argue that Judge Jackson's rethinking of the border search exception is proper because the agent in this case was subjectively not trying to stop evidence from leaving the country. The agent was looking for evidence, not subjectively trying to stop the computer from leaving, making the search seem like using the border search exception as a way to get evidence. The problem is that the Supreme Court has repeatedly and consistently held that the subjective intent of the searching officer is irrelevant—a holding that Judge Jackson acknowledged. It's certainly possible to read Kim as Judge Jackson's way to try to rely on subjective intent while purporting to remain loyal to the Supreme Court's repeated instructions not to do so. For example, her decision quotes at great length from the transcript of the agent's testimony, seemingly using it for its subjective beliefs. But if that's true, then I'm not sure if it's meant as a defense of Judge Jackson's opinion or as another criticism of it. Replacing the current border search doctrine with a subjective test would be another kind of "Riley moment," but it's an approach in considerable tension with a lot of Supreme Court caselaw.