Exigent Search of a Computer

This post is about the rule that lets officers seize -- but not search -- evidence, such as a computer, because they believe it would be risky or even dangerous to delay and follow usual procedure.

As I’ve explained before, under the 4th Amendment officers must have either (i) a search warrant or (ii) an applicable exception to the warrant requirement in order to conduct a lawful search of someone or of their property or to seize their property.

As Wikipedia explains, one of the exceptions that can justify a search is the “exigent circumstances” exception. This exception is based on the premise that sometimes police simply cannot take the time to get a search warrant because if they do, the evidence they’re after will either be destroyed or will have been moved, maybe out of their jurisdiction or maybe to some place where they may not be able to find it. So it’s essentially an emergency exception.

A U.S. District Court judge’s opinion from last fall, in a case out of Texas, illustrates how the exigent circumstances exception can apply to a computer search or seizure. Here are the facts in the case:

On January 24, 2007, FBI . . .Agents Lynd and Sabol. . . . were . . . investigating a conspiracy involving [Guadalupe] Martinez, [Jason] Trowbridge, Chad Ward, and Stuart Rosoff in which [they] . . .`exceeded authorized . . . access to a . . . database to obtain personal identification information on individuals . . . so the conspirators could harass them by making threatening phone calls, disrupting telephone service and making false 911 calls to elicit response by police, fire and ambulance. . . [T]his is known as `swatting. . . . [A]round noon, the agents proceeded to Ward's home and interviewed him. Ward stated . . . that Trowbridge had a girlfriend who lived with him, Trowbridge had instructed him to destroy evidence on one occasion, had seven computers in his home and was anti-government and could take care of himself if law enforcement arrived. . . .

The agents proceeded to Trowbridge's town home at about 3:00 p.m to . . . talk.. . . When the[y] knocked on Trowbridge's door . . and called out Trowbridge's name, the music inside the home stopped playing. . . . Angela Roberson, Trowbridge's girlfriend . . . answered the door and [said] Trowbridge was not home. She agreed to talk . . . about Martinez and allowed them to come inside. The agents remained on the first floor of the three level town house. . . . Roberson [said] she had exchanged instant messages with Martinez regarding his swatting activities on . . .computers in the home, that spoof cards had been purchased using computers in the home, and that Trowbridge had computer access to a commercial database at the home. . . .Lynd observed a wireless router that would allow a person within a few hundred yards to access the computers and erase or change them. . . . [T]he officers noticed three computers downstairs, and Roberson said that there were three upstairs. . . . Roberson called Trowbridge's cell phone, and the agents heard [it] ring upstairs. Roberson hung up . . . stating that Trowbridge did not answer. At this point, the agents believed that Trowbridge was hiding upstairs but did not know how many people were upstairs [or] if there were any weapons. . . . Lynd called and spoke with Trowbridge who said he was not home and Lynd could make an appointment to speak with him and his attorney. . . .

At some point during the conversation with Roberson, the agents developed probable cause to search the computer hard drives because she identified [them] as being used to have conversations with Martinez and to purchase spoof cards. The agents then spoke with the U.S. Attorney's Office [which] advised them that it would be difficult to get a search warrant in the late afternoon because of Houston traffic. [In] Lynd’s experience individuals involved in computer crimes had attempted to destroy computer evidence. [He knew] computer evidence is more fragile than drug evidence. It can be destroyed by turning off the computer, smashing it with a hammer, using a magnet, or throwing it into a fire. Lynd was sure the evidence would be gone in a few minutes if the agents left. Both agents did not believe it would be safe to leave one at the residence while the other secured a search warrant. Lynd based this fear on the fact Roberson and Trowbridge were concealing Trowbridge's presence upstairs, people had fled the residence, the residence smelled like marijuana, and they could not see what was occurring upstairs. Sabol also knew Trowbridge had been affiliated with an anarchist group. Lynd . . . was concerned that Ward had called Trowbridge to warn him that the agents were coming.

The agents asked Roberson for a copy of the computers and when she refused informed her that they would seize the computers to prevent the destruction of evidence. [She] . . . asked the agents to leave. . . . When Houston police . . . officers arrived to perform a safety sweep, Roberson told them that Trowbridge was upstairs. The police officers escorted him downstairs. . . . [A]dditional agents arrived and seized the computers. . . . The agents . . . did not search anything else in the home.

U.S. v. Trowbridge, 2007 WL 4226385 (N.D. Tex. 2007).

After seizing the computers, the agents checked them into an evidence control room in Houston, got a warrant to search the computers, and then shipped the computers to a forensic lab, where they were analyzed. U.S. v. Trowbridge, supra. On June 19, 2007, a federal grand jury charged Trowbridge with conspiring to violate 18 U.S. Code § 1029, which criminalizes what is called access device fraud. You can read about the crime in the U.S. Department of Justice Manual you can find here.

Trowbridge moved to suppress the evidence recovered from the seized computers, arguing that seizing the computers violated his rights under the 4th Amendment because the agents did not have a warrant authorizing the seizure. In ruling on his motion, the district court first noted that an intrusion into someone’s home – like the intrusion and seizure here – is presumptively unreasonable unless the person consents (which Trowbridge did not) or unless “probable cause and exigent circumstances justify the encroachment.” U.S. v. Trowbridge, supra. The court then cited a federal appellate court for the proposition that exigent circumstances exist when

(1) the degree of urgency involved and amount of time necessary to obtain a warrant; (2) the reasonable belief that contraband is about to be removed; (3) the possibility of danger to the police officers guarding the site . . . while a search warrant is sought; (4) information indicating that the possessors of the contraband are aware that the police are on their trail; and (5) the ready destructibility of the contraband and the knowledge that efforts to dispose of [evidence] are characteristic behavior of [the suspect].

U.S. v. Trowbridge, supra. The district court then considered whether, under this standard, the agents had exigent circumstances that justified seizing the computers:

[T]he situation was urgent because the officers believed Trowbridge was upstairs and could quickly destroy the evidence. Lynd was sure that the evidence would be gone in a few minutes. The agents . . . feared for their safety. [T]he U.S. Attorney's Office told the[m] . . . it would be difficult to obtain a search warrant that day. . . . [T]he officers believed that Trowbridge was hiding upstairs and had access to the computers. They had also been told that Trowbridge had instructed Ward to destroy evidence in the past. . . . Both did not believe it would be safe to leave one agent at the residence while the other secured a warrant. Roberson and Trowbridge were deceiving them by concealing Trowbridge's presence in the home. Sabol had seen two individuals fleeing the house and was unaware whether they might return. The[ fact] Trowbridge was allegedly affiliated with an anarchist group also alarmed the agents. These facts support a finding that it would have been dangerous for one of the officers to guard the residence.

Considering the fourth factor, . . . Martinez had recently been arrested and news of this arrest may have been available to party line members. . . . [T]he agents had spoken with Ward. They were concerned that he would call Trowbridge to warn him that they were coming. When Roberson called Trowbridge's cell phone, the officers heard the phone ring upstairs. This indicated to the officers that Trowbridge was upstairs and was aware of their presence. . . . [T]he agents had spoken with Trowbridge on the phone confirming that he knew of their presence. Finally, . . . Lynd testified that computer evidence is easier to destroy than drug evidence. . . . [T]here was reason to believe that Trowbridge would destroy the evidence. Ward informed the officers that Trowbridge had instructed him to destroy evidence in the past; therefore, the destruction of computer evidence may be characteristic of his behavior. . . . Lynd testified that individuals accused of computer crimes had attempted to destroy evidence in his experience and that Martinez had disposed of computer evidence.

U.S. v. Trowbridge, supra.

So the district court judge found that the agents reasonably relied on the exigent circumstances exception in seizing the computers to prevent the destruction of the evidence they contained. It denied Trowbridge’s motion to suppress the evidence, but he can always appeal that decision, either after the case has gone to trial or after he enters a guilty plea that lets him reserve the right to appeal this issue.

I think the federal judge was right in finding that there was an exigency here. It looks to me like the agents did everything they could to get a search warrant and, finding that it was simply not possible to get one, they acted as they should, to preserve evidence. And you’ll note that no one searched the seized computers until after the government had gotten a search warrant authorizing the search of each one. The scope of the exigency here only justified seizing the computers; it didn’t authorize searching them.

This, by the way, is the only reported case I can find, so far, anyway, on swatting, which somewhat surprises me.