D.C. Circuit forbids seizing all electronic storage devices in computer warrant cases

The U.S. Court of Appeals for the D.C. Circuit handed down an important computer search case Friday, United States v. Griffith. The case is about computer search warrants, and specifically whether they can authorize a seizure of all devices that investigators discover that might contain the evidence sought. The frustrating part of the opinion is that there are a few different ways to interpret it, and I'm not sure which way is right. I thought I would explain why the case is important, why I'm not sure how to interpret it, and how it is in tension with other decisions.

I. The Facts

The facts of the case are simple. The police obtained a search warrant to search the home of a gang member suspected of involvement in a homicide. The warrant permitted the government to seize electronic storage devices in the home. The thinking was that gang members share a lot of information about their crimes, and that information was likely to be on their electronic devices such as their cellphones. When the agents went to the house to execute the warrant, the defendant saw the police coming and tossed a gun out the window.

The agents executed the warrant and seized six cellphones and a tablet computer in addition to the tossed gun. At that point, the case turned into a gun case instead of a homicide or computer search case. The government charged Griffith with being a felon in possession of a firearm. It has not brought any charges relating to the cellphones or tablet computer, which were not introduced into evidence in the case.

In the new decision, authored by Judge Srinivasan and joined by Judge Pillard, the court suppresses the gun because the warrant for electronic storage devices lacked probable cause and was overbroad. Discovery of the gun was the fruit of the unconstitutional warrant search, the court reasons, so the gun is suppressed. Judge Brown dissented, reasoning that the good faith exception to the exclusionary rule should apply.

Srinivasan's opinion identifies two fundamental flaws with the warrant. First, the warrant lacked probable cause because the affidavit did not provide sufficient basis to conclude that evidence of the crime would be in the home. In particular, there wasn't specific reason to think the defendant had a phone or computer; there wasn't specific reason the person's cellphones or computer would be in the home; and there wasn't sufficient reason to think any phones or computers in the home had evidence of that crime. I find the first point quite unpersuasive but the latter two points plausible. I have some quibbles with this part of the opinion, but it seems pretty fact-specific.

II. The Important Reasoning in the Alternative Holding

It's the alternative holding that strikes me as really important. In the next part of the opinion, the court rules that the warrant was also defective because it allowed the government to seize all devices found in the place to be searched. According to Srinivasan, the police could seize only specific devices, not all of them. Here's the analysis:

The warrant in this case authorized police to search for and seize "all electronic devices to include but not limited to cellular telephone(s), computer(s), electronic tablet(s), devices capable of storing digital images (to include, but not limited to, PDAs, CDs, DVD's [and] jump/zip drives)." A. 36. . . . [T]he warrant did not stop with any devices owned by Griffith, which already would have gone too far. It broadly authorized seizure of all cell phones and electronic devices, without regard to ownership. That expansive sweep far outstripped the police's proffered justification for entering the home-viz., to recover any devices owned by Griffith.

Indeed, the terms of the warrant allowed officers unfettered access to any electronic device in the apartment even if police knew the device belonged to someone other than Griffith. He shared the apartment with Lewis, his girlfriend, and the warrant authorized police to search for and seize all of her electronic devices. For instance, if officers executing the warrant had seen Lewis using her cell phone in her apartment, the warrant would have authorized them to seize that phone. Yet the police unsurprisingly offered no explanation of why Lewis's devices could have been appropriately seized.

The warrant's overbreadth is particularly notable because police sought to seize otherwise lawful objects: electronic devices. Courts have allowed more latitude in connection with searches for contraband items like "weapons [or] narcotics." Stanford, 379 U.S. at 486 (internal quotation marks omitted). But the understanding is different when police seize "innocuous" objects. See Andresen v. Maryland, 427 U.S. 463,
482 n.11 (1976). Those circumstances call for special "care to assure [the search is] conducted in a manner that minimizes unwarranted intrusions upon privacy." Id.; see also 2 LaFave, Search & Seizure § 4.6(d).

Of course, even with searches of lawful objects, we may allow a broader sweep when a reasonable investigation cannot produce a more particular description. See Andresen, 427 U.S. at 480 n.10. There may be circumstances in which police have probable cause to seize a phone, yet still lack specific information about the phone's make or model. For example, police might learn a suspect uses a phone through an informant, and thus have no ability to describe the specific characteristics of any phone belonging to him. In that sort of situation, we recognize that some innocuous devices would need to "be examined, at least cursorily," to determine their relevance to the investigation. Id. at 482 n.11.

But even then, it is no answer to confer a blanket authorization to search for and seize all electronic devices. The warrant must be tailored to the justifications for entering the home. In this case, the warrant should have limited the scope of permissible seizure to devices owned by Griffith, or devices linked to the shooting. The Department of Justice in fact encourages use of that sort of approach in certain situations. See Office of Legal Educ., Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations, Crim. Div., Dep't of Justice 69-72 (2015), https://www.justice.gov/sites/default/files/criminal-ccips/legacy/2015/01/14/ssmanual2009.pdf.

Such a warrant would have enabled police to sweep more broadly when executing the search, but would have disabled them from seizing devices plainly unrelated to the crime. Officers, for example, could have examined a device they initially thought might belong to Griffith, but they could not have seized the device if they became aware it belonged to Lewis. That sort of approach would "minimize[] unwarranted
intrusions upon privacy." Andresen, 427 U.S. at 482 n.11.

The government does not deny that the warrant in this case would be invalid insofar as it authorized the seizure of all devices found in the apartment without regard to ownership. The government instead argues that, for various reasons, the warrant should be read more narrowly. We find those arguments unpersuasive. . . .

Nor does the government allay our concerns by suggesting it would have attempted to determine which of the seized devices in fact belonged to Griffith and would have sought a separate warrant to search the contents of those - and only those - devices. As an initial matter, the warrant, according to its terms, seemingly would have authorized police to search any electronic devices in the residence. At the federal level, Federal Rule of Criminal Procedure 41 provides that, "[u]nless otherwise specified," a warrant authorizing seizure of electronic storage media also "authorizes a later review of the media or information consistent with the warrant." Fed. R. Crim. P. 41(e)(2)(B). The warrant here included no express limitations on agents' authority to examine any electronic devices seized. To the extent the officers showed restraint when executing the search, "this restraint was imposed by the
agents themselves, not by a judicial officer." Groh, 540 U.S. at 561 (internal quotation marks omitted).

In any event, our holding does not turn on whether the police had the power to search the devices' digital contents. The police lacked probable cause to seize all electronic devices in the home in the first place. The warrant was invalidly overbroad in enabling officers to do so.

III. Some background on computer search and seizure

To understand the significance of Griffith, it helps to know some background principles of computer search and seizure law. Computer searches are generally executed in two steps. The idea is that when the government establishes probable cause to believe that there is evidence of a crime in the place to be searched that might be stored in a computer, there is no practical way to search the computers found on site to figure out which ones contain the evidence sought. It just takes too long. Given that, courts have allowed the government to seize all the electronic storage devices found onsite and to take them back to the government's lab for analysis. It's an overseizure, the thinking runs, but there's no practical way to avoid that. It's the least bad way to make sure the government can search for the evidence under the warrant, so it is reasonable under the Fourth Amendment.

As I wrote in a 2005 article, "Search Warrants in an Era of Digital Evidence," this creates a puzzle for how to draft computer warrants. The question is, should the particular description of the thing to be seized refer to what is seized at the physical search stage (when all computers will have to be seized), or should it refer to what is seized at the electronic search stage (when the seized computers are searched for the specific information to be seized)?

Each answer has problems. If the warrant uses the particular description at the physical search stage, then the warrant doesn't seem to offer any guidance about what the police will look for at the electronic search stage and can be overbroad because it's not guiding the electronic search stage. If the warrant uses the particular description at the electronic search stage, then the government isn't saying what it is seizing at the physical search stage and its execution will be broader than the warrant permits on its face. To avoid these problems, I recommended that computer warrants should particularly describe the item to be seized at both the physical and electronic search stages. That way, the warrant explicitly covers what is happening at both steps.

The caselaw has so far been too deferential to the government to require my approach, however. Courts have approved warrants that just describe the evidence to be seized at the electronic search stage, reasoning that the overseizure at the physical search stage is implicit in the two-step warrant method and is reasonable. Courts have also approved warrants that just describe the evidence to be seized at the physical search stage, reasoning that the warrant should be read as implicitly only allowing the physical computers to be searched for the specific evidence sought at the electronic search stage.

IV. Three views of the Griffith case

Okay, enough background. Let's go back to the Griffith case. I'm not sure what to make of the critical alternative holding because different parts of the opinion seem to be hinting at three different rationales. I'll cover each in turn.

First, parts of the alternative holding seem to be saying that the government erred by describing the things to be seized only at the physical search stage. The warrant said that the government could seize all electronic storage devices. But the warrant didn't say what it could search the computers for at the electronic search stage, suggesting that they could be searched for anything without limitation - which would be too broad. See Slip Op. at 20 ("The warrant here included no express limitations on agents' authority to examine any electronic devices seized.") Most courts have gone out of their way to read such warrants as implicitly being limited to searching devices for specific evidence. See, e.g., United States v. Burgess, 576 F.3d 1078 (10th Cir. 2009) (construing warrant that authorized seizure of "all computer records" as implicitly limiting a search of computer records to drug trafficking records).

From that perspective, maybe Griffith is just being less forgiving in terms of the two-stage warrant process than cases such as Burgess. If that's the right reading of the case, it makes Griffith important but also something that is easy to draft around. For example, maybe the solution is something like the explicit two-stage particularity description I recommended in 2005. I tend to think that's the most plausible reading of the opinion. But I'm not sure.

Second, parts of the alternative holding seem to be imposing a limit on overseizure at the physical search stage. That is, parts of the opinion seem to be saying that overseizure itself isn't permitted: The government can't take phones that aren't likely to have the sought-after evidence on them. If any phone has the evidence, it's likely to be Griffith's phone. Maybe the court is saying that the government can't plan to seize all devices when some devices are more likely to have evidence on them than others.

From that perspective, Griffith may be a bigger deal. Maybe it is pushing back against the established caselaw allowing the overseizure at the physical search stage. If the court is taking that view, I should add, I think it is wrong: I happen to think that overseizure is necessary and that courts should allow it, because you never know where the electronic evidence might be. See the details in this recent article. But I'm not sure the court is making that argument.

Finally, a third reading of Griffith's alternative holding is that the case reflects an odd way to tie probable cause and particularity. The ordinary way that warrants work is that the affidavit offers reason to think evidence might be in the place to be searched. Warrants then allow a search of that place for the evidence. Parts of Griffith suggest a narrower view, that maybe the government has to focus its search based on the most plausible theory for where the evidence might be. In particular, the idea that the government could seize only a phone that belonged to Griffith seems peculiar to me. If the government established probable cause to believe there were records of the crime in the apartment, who cares if those records are on a phone that "belongs" to Griffith or stored in some other device?

In particular, it's not clear to me why the court thinks only a phone that belongs to Griffith could be seized. The court writes: "Officers, for example, could have examined a device they initially thought might belong to Griffith, but they could not have seized the device if they became aware it belonged to Lewis." But that makes no sense to me. Griffith might have used Lewis's phone. He may have used a bunch of different phones. Or there may be messages about the crime on someone else's phone, such as messages Griffith sent to Lewis that are stored on her phone.

It's true that the affidavit doesn't give specific reason to think those are the case. But I don't see how that is relevant. The point of an affidavit is to establish probable cause that evidence is in the place to be searched, not to establish probable cause about specifically where in the place to be searched the evidence will be. The government ordinarily can search anywhere in the place to be searched for the evidence sought regardless of what containers it must open: "A lawful search of fixed premises generally extends to the entire area in which the object of the search may be found, and is not limited by the possibility that separate acts of entry or opening may be required to complete the search." United States v. Ross, 456 U.S. 798, 820-21 (1982). Under that traditional principle, it just doesn't matter who owns the property searched so long as it is found in the place to be searched. See Wyoming v. Houghton, 526 U.S. 295, 303 (1999) ("[N]either Ross itself nor the historical evidence it relied upon admits of a distinction among packages or containers based on ownership.").

V. Concluding thoughts

I'm curious to know whether readers who made it through the opinion have a good sense of which of the three rationales named above is driving the court's alternative holding. It's totally possible that is clear to others, so a sense of where the crowd of readers is on this question would be very helpful.

Two additional thoughts. First, the good faith analysis for the exclusionary rule part of the opinion doesn't seem like a particularly strong match for the claimed overbreadth defect in the warrant. The probable cause defect is at least a causal link to the warrant: Without probable cause, the government couldn't get a warrant. And without a warrant, the government wouldn't have approached the house and wouldn't have seen Griffith toss the gun. I'm not sure the lack of probable cause makes suppression appropriate under the good faith exception, but it's a debatable issue.

With the overbreadth defect, however, the claimed defect is completely unrelated to the discovery of the evidence. When Griffith saw the police coming and tossed the gun out the window, he had no idea how the warrant was drafted. Given that exclusionary rule caselaw generally requires a causal link between the constitutional defect and suppression of evidence, see Hudson v. Michigan, 547 U.S. 586, 592 (2006), I don't quite see how suppression is appropriate for that particular defect.

Finally, the briefing and opinion suggest in some places that the government planned on getting a second warrant to search the devices. I have heard secondhand that some magistrate judges prefer to execute the two-stage computer warrant process using two different warrants. First, the magistrate judges sign a warrant for the physical seizure of the devices that doesn't authorize an electronic search of them. Next, the magistrate judge signs a second warrant, for specific devices, that authorize an electronic search. Using two warrants to do the work of one warrant makes no sense to me. To the extent Griffith may reflect the D.C. Circuit's rejection of the two-warrant approach some magistrate judges apparently favor, that seems like an unobjectionable development.