Monday, June 07, 2010

Time Period for Seizing Computers

As I noted in an earlier post, the Federal Rules of Criminal Procedure (and comparable provisions of state law) specify a period within which a search warrant must be “executed.” “Executing” a search warrant means that the officers do what it authorizes them to do which, in a cybercrime case, is usually finding, seizing and then searching one or more computers.

The cases I’ve seen usually involve an argument that officers didn’t search a computer within the time allowed by the applicable federal/state rule or state statute. This post is about a case in which the defendant argued that the officers didn’t seize the computer within the time allowed by the applicable Federal Rule of Criminal Procedure.


The case is U.S. v. Stanton, 2010 WL 2179892 (U.S. District Court for the Middle District of Alabama 2010), and this is how it arose:


On August 9, 2008, Sergeant Schreiber, a detective with the Troy Police Department, received [a report] . . . regarding possible child-abuse. He was requested by the victim, T.C., a minor approximately sixteen years old, and her mother, Deidra Stanton, to come to the Stanton house. . . .


Schreiber arrived at the Stanton home and. . . . was informed that Deidra was Stanton's wife. . . . T.C. told the Sergeant that her step-father, Stanton ,. . . had been touching her in an inappropriate manner. . . since she was . . . seven or eight years of age. . . .


Schreiber asked the[m] to come to the police station. . . . Stanton was placed in an interview room while Schreiber interview[ed] Deidra and T.C. . . . T.C. detailed a history of sexual abuse . . . by Stanton. . . .

[S]everal hours [later], Stanton was interviewed by Schreiber. . . . [who] informed [him] of the allegations. . . . Stanton stated he believed the allegations were made to divert attention from T.C.'s pregnancy. . . . Schreiber asked if [he] would consent to the search of his car and home. . . . [A]round 9:00 p.m., . . . Stanton executed a written consent to search his residence for . . . computers and an array of associated media. . . .


[O]fficers conducted a search of the home immediately. . . . [They seized] computers, computer storage devices, and associated media. . . . From Stanton's vehicle the[y]. . . . removed a box of compact disks (CDs). . . . later viewed by Sergeant Everage. . . . [She] showed some of the images to Schreiber because she believed [they] were child pornography. Schreiber . . . called Agent Faulkner with the FBI, knowing she was involved in a task force specializing in child pornography cases.


On. . . August 21, 2008, Faulkner arrived at the Troy Police Department and viewed some of the images. . . .. She identified . . . child pornography on the CDs. . . . [She] took the evidence . . . and continued her investigation, finding numerous images of child pornography. Based on her findings, she applied for a federal search warrant, which was signed . . . on September 18, 2008.


Faulkner shipped the items to Mobile . . . and they were forwarded to a laboratory. The search and investigation of the contents of the computer and associated media was completed in April of 2009. . . . [M]ultiple images and videos of child pornography were found on the seized items.


U.S. Stanton, supra. As a result of all this, Stanton was federally charged with . . . something. The opinion doesn’t tell me what he was charged with (or when), but I’m assuming it was possession of child pornography. (He was charged with child abuse in a state proceeding). I’m also assuming he was charged in 2009, as the case seems to have a 2009 docket number. (I can’t find a docket entry, either.)


In the federal case, Stanton moved to suppress the evidence against him, arguing that (i) his consent wasn’t valid and (ii) the search warrant wasn’t valid. U.S. Stanton, supra. I’m going to skip the consent argument because I’ve done several posts on consent lately, and I don’t think the issues here contribute to what I covered there. I should also note that Stanton’s motion to suppress was referred to a U.S. Magistrate Judge, who wrote the opinion (a recommendation to the U.S. District Court Judge who has the case) we’re concerned with.


Stanton raised several arguments as to why the warrant wasn’t valid, e.g., wasn’t based on probable cause, didn’t “particularly” describe the items to be seized. U.S. Stanton, supra. We’re interested in what seems to have been his final challenge to the warrant: Stanton claimed the evidence was “seized in excess of the ten-day time limitation of Rule 41 of the Federal Rules of Criminal Procedure.” U.S. Stanton, supra. (It was ten days when this seizure occurred; it was later expanded to 14 days, as we see below.)


Rule 41 sets out the procedures federal agents are to follow in searching for and seizing evidence pursuant to a warrant. Rule 41(e)(2) establishes the time period for executing a search (and seizure) warrant. Rule 41(e)(2)(A) says warrants “to search for and seize a person or property” must be executed “within a specified time no longer than 14 days.” (It was 10 days until the rule was changed last year.) Rule 41(e)(2)(B), which sets special time limits for executing search warrants directed at electronic evidence, was added to the rule recently and revised last year. This is what the rule currently provides:


A warrant under Rule 41(e)(2)(A) may authorize the seizure of electronic storage media or the seizure or copying of electronically stored information. Unless otherwise specified, the warrant authorizes a later review of the media or information consistent with the warrant. The time for executing the warrant . . . refers to the seizure or on-site copying of the media or information, and not to any later off-site copying or review.


The Committee that was responsible for the current version of the rule explained its structure and purpose as follows:


Computers and other electronic storage media commonly contain such large amounts of information that it is often impractical for law enforcement to review all of the information during execution of the warrant at the search location. This rule acknowledges the need for a two-step process: officers may seize or copy the entire storage medium and review it later to determine what electronically stored information falls within the scope of the warrant. . . .


2009 Amendments, Advisory Committee Note. That brings us back to Stanton. Stanton, remember, claimed the seizure of the evidence was untimely because it occurred more than 10 days after the warrant was issued. The government argued in response that “the ten-day limitation applied to the seizure of the computer[s], or the imaging of their contents.” U.S. v. Stanton, supra. I don’t have Stanton’s motion to suppress or the government’s response to that motion, so all I know of either is what’s in this opinion.


After outlining the arguments made by both sides, the Magistrate Judge said the


court is concerned that there was a violation of the Rule in this case. This does not appear to be a case where the contents of the computers and other media were `imaged’ within ten days. Although the government's brief mentions court decisions relating to imaging, it does not assert that the contents of the seized items were imaged. Further, the court has reviewed the testimony presented at the hearing and neither the officers nor the agents testified that the items were imaged prior to being sent to the laboratory.


U.S. v. Stanton, supra. He then explained that the 4th Amendment “`does not specify that search warrants contain expiration dates’”, i.e., nothing in the text of the amendment says warrants have to be executed within a set time period. U.S. v. Stanton, supra (quoting U.S. v. Gerber, 994 F.2d 1556 (U.S. Court of Appeals for the 11th Circuit 1993)).


Since no constitutional issue was involved, the issue was, as the Magistrate Judge noted, “whether suppression is appropriate if a violation of Rule 41 has occurred.” U.S. v. Stanton, supra. He found that suppression was not appropriate in this case:


`[N]oncompliance with Rule 41 requires suppression of evidence only where (1) there was `prejudice’ in the sense that the search might not have occurred or would not have been so abrasive if the rule had been followed, or (2) there is evidence of intentional and deliberate disregard of . . . the Rule.’ U.S. v. Loyd, 721 F.2d 331 (U.S. Court of Appeals for the 11th Circuit 1983). . . . Stanton is unable to show prejudice. At the time the ten days had passed, child pornography had been found on the CDs taken from his car. Thus, the search would have occurred. . . . [H]e is unable to show that the search would have been less abrasive, because once the search of the computers and other media had occurred the images would have been found.

Finally, there is no evidence the officers acted with intentional and deliberate disregard of the Rule. . . .


U.S. v. Stanton, supra. The Magistrate Judge also noted that the “better course of action by the agents would have been to image the computers and associated media within the ten-day time period.” U.S. v. Stanton, supra. He found, then, that “the court need not determine whether a violation of Rule 41 occurred because, even assuming such a violation, suppression would not be appropriate.” U.S. v. Stanton, supra.


Notwithstanding that, he recommended that the motion to suppress be denied and about a month later the U.S. District Court Judge ordered that it was denied. U.S. v. Stanton, 2010 WL 2179890 (U.S. District Court for the Middle District of Alabama 2010).

Did a violation of Rule 41 occur? The reason rules set a time limit for executing a search (and seizure) warrant is to ensure that the probable cause they’re based on hasn’t become “stale.” Assume an officer has probable cause to believe a large quantity of drugs are in a house at 234 Brown Street because an informant told him they’d be delivered 10 days ago and when the officer watched the house he saw what he, based on his expertise in drug cases, concluded was a delivery of drugs. The officer got a warrant to search the house the next day but, for various reasons, didn’t search until today . . . 10 days after the presumptive drug delivery. If he seized drugs, the person who owned them can move to suppress arguing that the probable cause was stale, i.e., just because you have probable cause to believe drugs are in a given place at one point in time, doesn’t mean you have probable cause to believe they’ll be there later.


Here, the computers and CDs had been seized by state law enforcement agents pursuant to a state warrant. Then a federal agent gets a federal warrant to seize (and search) them but apparently doesn’t execute the seizure until more than 10 days after she got the warrant. The computers and CDs were seized in a timely fashion pursuant to the state warrant, and were in state custody until the federal agent took custody of them pursuant to the federal warrant. What I’m wondering is if the state seizure of the evidence can be considered in deciding whether there was a violation of Rule 41.

No comments: