The Sealed Search Warrant, “Particularity” and a Search Protocol

This post examines an opinion recently issued by a U.S. District Court Judge who sits in the District Court for the District Court of Utah:  U.S. v. Vafeades, 2015 WL 5675279 (2015).  According to the court’s docket, Timothy Jay Vafeades was indicted on federal charges on March 26 of 2014.  U.S. v. Vafeades, supra. I cannot find the indictment online, but a Huffington Post story on the case says the charges “against him include kidnapping, transportation for illegal sexual activity and possession of child pornography, and they could bring a life sentence if he is convicted.”  

If you would like to read more about the facts in this very bizarre case, you can check out the news stories you can find here, here, and here. You might want to check them out -- they put the charges into context. 

The District Court Judge begins his opinion by explaining that Vafeades moved to

suppress evidence obtained from a search warrant executed on electronic devices seized from him following his arrest on November 26, 2013. The United States filed its opposition on June 5, 2015. As directed, both parties submitted their positions in the form of draft orders. Vafeades contends that the search warrant lacks particularity, and therefore, authorized an overly broad search of his electronic devices. Vafeades also argues that the search warrant failed to sufficiently specify or restrict the search of his electronic devices. But Vafeades provides no briefed challenge to the affidavit, application or the actual search procedure used.

U.S. v. Vafeades, supra. Vafeades’ motion was made under the Fourth Amendment, which outlaws “unreasonable” searches and seizures. U.S. v. Vafeades, supra.

The judge went on to explain that

Minnesota State Patrol troopers arrested Vafeades on November 26, 2013, at the Red River Weigh Station in Moorehead, Minnesota. After his arrest, an Apple iPhone, an Apple Mac Book Pro, and five external hard drives were seized from Vafeades. On February 24, 2014, FBI Special Agent Daniel P. Horan submitted a sealed and sworn application and affidavit for a search warrant, and a search warrant and two attachments to Magistrate Judge Dustin Pead. Magistrate Judge Pead issued the sealed search warrant and its attachments the same day.

Based on the facts set forth in his affidavit, SA Horan stated that there was probable cause to believe evidence of five federal crimes—transportation, possession, receipt or distribution of child pornography; kidnapping; and transportation for illegal sexual activity—would be found on Vafeades's electronic devices. Attachment A to the search warrant lists the electronic devices referenced above as the items to be searched, along with the devices' serial numbers, and notes that the electronic devices were in the possession of the Clay County Sheriff's Office in Moorehead, Minnesota. Attachment B lists the items to be seized and in most paragraphs includes references to definitions related to child pornography; references to the federal statutes for kidnapping and for transportation for illegal sexual activity are found in paragraph 2 of Attachment B.

U.S. v. Vafeades, supra.  If you would like to see an application for a federal search warrant with Attachments, you can find one here.  

The judge goes on to explain what happened next:

SA Horan submitted the electronic devices to the Intermountain West Regional Computer Forensics Laboratory (IWRCFL) on March 5, 2014, along with the IWRCFL's service request form. SA Horan attached the search warrant and his affidavit to the IWRCFL service request form. In the explanation portion of the service request form, SA Horan wrote: `Please image and search for child porn and evidence of kidnapping. I will help review to find evidence.’ The search warrant was executed on March 5, 2014, at the IWRCFL. A search of Vafeades's cell phone revealed text messages between Vafeades and Victim A, and photographs of Victim A and Victim B. A search of Vafeades's computer and hard drives revealed hundreds of images and videos of possible child pornography, as well as additional photos of the victims in this case.

U.S. v. Vafeades, supra. 

The judge then began his analysis of Vafeades’ motion to suppress, explaining that the

Fourth Amendment ensures `[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures’ and that `no [w]arrants shall issue but upon probable cause . . . and particularly describing the place to be searched, and the persons or things to be seized.’ Warrants that contain no limitation, for example, warrants authorizing the search of all information and data, or all electronic devices, have been held invalid. However, `warrants may pass the particularity test if they limit their scope either ‘to evidence of specific federal crimes or [to] specific types of material.’

As the Tenth Circuit has noted, `efforts to apply the Fourth Amendment's particularity requirement to computer searches are still relatively new.’ Thus, the vast array of items that can be stored on personal computers `makes the particularity requirement that much more important.’  While the particularity requirement applies equally to searches of electronic devices such as computers and cell phones, the requirement has never `been understood to demand a warrant of technical precision or elaborate detail, but only practical limitations affording reasonable specificity.’

`While officers must be clear as to what it is they are seeking on the computer and conduct the search in a way that avoids searching files of types not identified in the warrant, a computer search may be as extensive as reasonably required to locate the items described in the warrant based on probable cause.’  Because of the vast array of one's personal information stored in computers, `warrants for computer searches must affirmatively limit the search to evidence of specific federal crimes or specific types of material.’

U.S. v. Vafeades, supra. 

The District Court Judge then began his analysis of Vafeades’ first argument, which was that “the search warrant is invalid because it authorized a limitless search of his electronic devices.” U.S. v. Vafeades, supra.  He found that argument to be “without merit”. U.S. v. Vafeades, supra.  The judge went on to explain that Vafeades contends

the warrant is not valid because it does not identify the statutory provisions he violated. While the warrant itself does not list the statutes, the warrant refers to the application for the warrant, which on its face lists three violations of the United States Code: 18 U.S. Code § 1201(a)(1), Kidnapping; 18U.S. Code § 2421, Transportation for Unlawful Sexual Activity; and 18 U.S.Code § 2252, Child Pornography. The Application incorporates by reference the Affidavit which contains the statutory provisions for which evidence is sought. The Warrant refers to Attachment B, which lists evidence to be seized and includes several references to the specific crimes under investigation and definitions under the child pornography statutes. Investigators had ample information as to what the search warrant permitted them to seize.

U.S. v. Vafeades, supra. 

The judge then explains that, in order to

support his argument, Vafeades cites U.S. v. Cassady, 567 F.3d 628 (U.S. Court of Appeals for the 10^th Circuit 2009), and Mink v. Knox, 613 F.3d 995 (U.S. Courtof Appeals for the 10th Circuit 2010), alleging that the warrant here endorses a `general search for evidence of crimes not specifically listed in the warrant.’ The facts in Cassady and Mink, however, differ significantly from this case.

In Cassady, a local sheriff challenged the district court's denial of qualified immunity from liability for his and his department's search for marijuana in a local farmer's home and his entire property. In affirming the district court's denial of qualified immunity, the Tenth Circuit examined the search warrant and accompanying affidavit for Cassady's property and held that the search warrant was invalid because, among other things, it authorized the search of his entire farm, including his home, the seizure of `[a]ny and all illegal contraband,’ and `all other evidence of criminal activity.’ In Mink, another case involving qualified immunity, the Tenth Circuit held the search warrant for the plaintiff's computer was overly broad because `there was no reference anywhere in the warrant to any particular crime.’

Unlike the search warrants in Cassady and Mink, the warrant in this case specifically listed particular crimes. The search warrant here does not authorize the `general rummaging’ the court criticized in Cassady. Instead, the attachments to the search warrant specify the electronic devices to be searched, along with their serial numbers if available. The search warrant and its attachments also specify the types of evidence to be seized, specifically, evidence related to child pornography and kidnapping. In twelve of the fifteen paragraphs listed in Attachment B `List of Items to Be Seized’ there is a specific reference to either child pornography or to kidnapping.

U.S. v. Vafeades, supra.  If you would like to read more about drafting search warrants, check out this site.

The judge then explained that Vafeades also took issue with

specific paragraphs in Attachment B to the search warrant, which lists the items to be seized. Vafeades argues that the statutory definitions referred to in paragraphs 3, 5, 8 through 10, and 12 through 14 are not a substitute for the actual statutory provisions he is alleged to have violated. His argument is incorrect. `[O]ur case law requires that “warrants for computer searches must affirmatively limit the search to evidence of specific federal crimes or specific types of material.”’ The references to the specific statutory violations and the related definitions in paragraphs 3, 5, 8 through 10, and 12 through 14 provided sufficient guidance as to exactly what evidence the forensic examiner was permitted to seize. Similarly, although paragraphs 4, 7 and 11 do not cite a statutory violation and do not refer to a statutory definition, those paragraphs directed the forensic examiner to seize only evidence of minors engaged in sexually explicit conduct.

Vafeades contends that written depictions of child pornography referred to in paragraphs 12 through 14 cannot be criminalized, and therefore, render the search warrant invalid. It is correct that certain writings about child pornography, such as the advocacy of child pornography, cannot be criminalized. However, writings may be admissible to show a defendant knowingly possessed child pornography or to link a defendant to the computer on which child pornography was found.

U.S. v. Vafeades, supra. 

And he noted that Vafeades claimed

paragraphs 1 and 6 lack any particularity at all. As an initial matter, Vafeades's argument regarding paragraph 6 is moot because the United States did not find any evidence that falls under paragraph 6; that is, any records, documents, invoices or materials related to any accounts with an internet service provider or social networking website. Even if the United States found evidence responsive to paragraph 6, the lack of particularity in paragraph 6 does not render the entire search warrant invalid. Read in context, the structure of Attachment B suggests that paragraph 6 is subject to the same limitations as the paragraphs that reference either specific statutory violations or specific statutory definitions.

Paragraph 1 lists eleven items to be seized `[f]or any computer or storage medium whose seizure is otherwise authorized by this warrant and any computer or storage medium that contains or in which is stored records or information that is otherwise called for by this warrant.’ Thus, paragraph 1 directs the person seizing items from the electronic devices to only seize those items that the warrant explicitly authorizes in paragraphs 2 through 14.

U.S. v. Vafeades, supra. 

The  judge went on to note that Vafeades

acknowledges that paragraph 2 of Attachment B meets the Fourth Amendment's particularity requirement, but contends that paragraph 2 cannot be severed because paragraph 1, and paragraphs 3 through 14 lack sufficient particularity. It is not necessary to decide whether paragraph 2 can be severed from the warrant because Attachment B does not lack sufficient particularity. One paragraph refers specifically to statutory violations, seven paragraphs refer to statutory definitions relating to the child pornography statute, and three paragraphs refer to evidence of minors engaging in sexually explicit conduct. Even assuming for argument's sake that the warrant lacked sufficient particularity, it was not so overbroad that a reasonable officer would have known that the search warrant was illegal.

U.S. v. Vafeades, supra. 

Finally, the District Court Judge took up Vafeades’ argument that the search warrant was

invalid because the search warrant did not identify a valid search protocol. To support his request, Vafeades relies on two memoranda and orders from magistrate judges outside of this district who have required search protocols for electronic devices such as computers and cell phones. The U.S. Court of Appeals for the 10^th] Circuit, however, does not and `has never required warrants to contain a particularized computer search strategy.’  Simply because a warrant does not contain a search protocol does not mean the `warrant is per se overbroad.’ While the 10th Circuit's `efforts to apply the Fourth Amendment's particularity requirement to computer searches are relatively new and [the court's] existing treatment is far from comprehensive,’ the court has suggested `that it is “unrealistic to expect a warrant to prospectively restrict the scope of a search by directory, filename or extension or to attempt to structure search methods—that process must remain dynamic,”’  as file or directory names may or may not alert one to illegal activity.

Vafeades has not made a sufficient argument that the search protocol here was deficient. Paragraph 15 of Attachment B to the search warrant explains various search procedures that SA Horan anticipated might be used.  Additionally, when SA Horan submitted Vafeades's electronic devices with the IWRCFL Service Request form, he also submitted the search warrant and his affidavit, and wrote in the explanation section that the forensic examiner was to look for evidence of child pornography and kidnapping.

U.S. v. Vafeades, supra. 

The judge concluded by explaining that

[o]ther than suggesting that the government should have returned to a magistrate judge with a `sophisticated technical explanation’ of the search, Vafeades fails to explain exactly what search protocol should have been used or `how protocols the government followed in this case were unreasonable or insufficiently particular.’ Without more guidance, it is not possible to `assess rationally [Vafeades's] challenge to the government's search procedures in this case.’ If the actual search procedures had been challenged, the IWRCFL Service Request form would likely be dispositive.

U.S. v. Vafeades, supra. 

He therefore denied Vafeades’ motion to suppress.  U.S. v. Vafeades, supra.  If you would like to read more about drafting search warrants, check out this article.