EFTA01207766

U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) of the sovereign to protect itself by stopping and ' KeyCite Yellow Flag • Negative Treatment examining persons and property crossing into Declined to Extend by United States v. Hassanshahi, D.D.C., the country, are reasonable, within meaning of December 1, 2014 the Fourth Amendment, simply by virtue of the 990 F.Supp.2d 536 fact that they occur at the border. U.S.C.A. United States District Court, Const.Amend. 4. D. Maryland, Southern Division. Cases that cite this headnote UNITED STATES of America v. Ali SABOONCHI, et al. Criminal Case No. PWG-13—too. J Signed April 7, 121 Customs Duties 2014. aaGrounds or cause for stop, search, or seizure Routine searches of the persons and effects of entrants at a border are not subject to any Synopsis requirement of reasonable suspicion, probable Background: Defendant, indicted for multiple counts of cause, or warrant. U.S.C.A. Const.Amend. 4. unlawful export to an embargoed country and one count of conspiracy to export to an embargoed country, in violation of the International Emergency Economic Cases that cite this headnote Powers Act (IEEPA) and the Iranian Transactions and Sanctions Regulations (ITSR), moved to suppress evidence obtained during warrantless forensic searches of his smartphones and flash drive. PI Customs Duties i• Searches and Seizures Holdings: The District Court, Paul W. Grimm, J., held Even at the border, Fourth Amendment that: continues to protect against unreasonable searches and seizures. U.S.C.A. Const.Amend. (I) reasonable suspicion was required for performance of 4. forensic searches of digital devices taken from defendant at border, and Cases that cite this headnote (2) reasonable suspicion existed to support such search. Motion denied. Customs Duties ii Searches and Seizures At the border, routine searches become West Headnotes (19) reasonable within meaning of the Fourth Amendment because the interest of the Government is far stronger and the reasonable Ill Customs Duties expectation of privacy of an individual seeking oiSearches and Seizures entry is considerably weaker. U.S.C.A. Const.Amend. 4. Government's interest in preventing the entry of unwanted persons and effects is at its zenith at the international border, and thus searches made Cases that cite this headnote at the border, pursuant to the long-standing right WestlawNext" © 2015 Thomson Reuters. No claim to original U.S. Government Works. 1 EFTA01207766 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) equivalents as well; the functional equivalent of a border may include an established station near the border, at a point marking the confluence of two or more roads that extend from the border, PI Customs Duties or the search of passengers and cargo arriving at p-Grounds or cause for stop, search, or seizure an airport within the United States after a nonstop flight from abroad. U.S.C.A. When a border search stretches beyond the Const.Amend. 4. routine, it must rest on reasonable, particularized suspicion, which is significantly less demanding than the showing of probable cause required to Cases that cite this headnote secure a warrant for a domestic search. U.S.C.A. Const.Amend. 4. Cases that cite this headnote Pi Customs Duties 411'ime and distance factors; checkpoints Extended border search doctrine has been applied to entry border searches conducted some Searches and Seizures time after the border was crossed. 6Scope, Conduct, and Duration of Warrantless Search Cases that cite this headnote Under the Fourth Amendment, mere fact that a search includes computer files does not transform it from routine to nonroutine. U.S.C.A. Const.Amend. 4. Customs Duties faTime and distance factors; checkpoints Cases that cite this headnote Unlike searches that actually occur at a border or the functional equivalent thereof, an extended border search requires reasonable suspicion with respect to the criminal nature of the person or Customs Duties thing searched as well as reasonable suspicion Jaime and distance factors; checkpoints that the subject of the search has crossed a border within a reasonably recent time. U.S.C.A. Under the Fourth Amendment, a border search Const.Amend. 4. need not take place at the border. U.S.C.A. Const.Amend. 4. I Cases that cite this headnote Cases that cite this headnote Irrt Customs Duties f'-Time and distance factors; checkpoints lel Customs Duties p-rime and distance factors; checkpoints Government agents' search of defendant's Customs Duties electronic devices was not an extended border 4, Airports and airplanes search within meaning of the Fourth Amendment; the devices did not enter the Under the Fourth Amendment, border searches country with defendant, but were returned to may in certain circumstances take place not only him at a later date. U.S.C.A. Const.Amend. 4. at the border itself, but at its functional WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 2 EFTA01207767 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) searches. U.S.C.A. Const.Amend. 4. Cases that cite this headnote Cases that cite this headnote 1121 Customs Duties v-Time and distance factors; checkpoints 116) Searches and Seizures A border search of a computer is not 4-Scope, Conduct, and Duration of Warrantless transformed into an extended border search Search under the Fourth Amendment simply because the device is transported and examined beyond Even if a search is not destructive or damaging, the border. U.S.C.A. Const.Amend. 4. if it is sufficiently invasive or intrusive, or butts up against other Fourth Amendment values, it may be nonroutine. U.S.C.A. Const.Amend. 4. 2 Cases that cite this headnote Cases that cite this headnote Customs Duties -4Grounds or cause for stop, search, or seizure Customs Duties A forensic border search of a computer or oilScope and Nature; Successive or Secondary electronic device should be considered a Searches nonroutine search for which reasonable suspicion is required under the Fourth Under the Fourth Amendment, a routine border Amendment. U.S.C.A. Const.Amend. 4. search may include a conventional inspection of electronic media and a review of the files on them just as it may include physical papers. 3 Cases that cite this headnote U.S.C.A. Const.Amend. 4. 2 Cases that cite this headnote Customs Duties iaPersonal, skin, or strip searches; pat•down Even the border search power cannot justify a filet Customs Duties strip search without any particularized 0-Time and distance factors; checkpoints suspicion. U.S.C.A. Const.Amend. 4. Reasonable suspicion was required for forensic search of imaged hard drives of digital devices Cases that cite this headnote taken from defendant at the border and subjected to forensic examination at later time; search would result in exposure of intimate details and abrogate defendant's reasonable expectations of privacy in his most personal and confidential I151 Customs Duties affairs. U.S.C.A. Const.Amend. 4. Ii0Grounds or cause for stop, search, or seizure A border search that goes beyond the routine is 1 Cases that cite this headnote justified merely by reasonable suspicion, a lesser standard than required for analogous non-border WestlawNexi © 2015 Thomson Reuters. No claim to original U.S. Government Works. 3 EFTA01207768 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) reasoning. Supplemental briefing was requested and Customs Duties permitted. I now hold that, under the facts presented by e'-Grounds or cause for stop, search, or seizure this case, a forensic computer search cannot be performed under the border search doctrine in the absence of Reasonable suspicion supported forensic search reasonable suspicion. Because the officials here of smartphone and flash drive taken from reasonably suspected that Saboonchi was violating export defendant as he crossed border; defendant's restrictions, Defendant's Motion to Suppress is denied. name had come up in connection with two different investigations of export violations, information received in response to previously-issued subpoenas showed that he had I. BACKGROUND purchased two cyclone separators after Defendant Ali Saboonchi is a dual citizen of the United representing that they would be used States and the Islamic Republic of Iran. Gov't Opp'n 3, domestically, and then shipped them overseas, ECF No. 65. On March 4, 2013, Saboonchi was indicted understating their value in a manner consistent by a grand jury on four counts of unlawful export to an with an attempt to avoid scrutiny, and embargoed country and one count of conspiracy to export investigation had determined that the recipient to an embargoed country, in violation of the International of the separators was linked to a company in Emergency Economic Powers Act ("IEEPA"), 50 U.S.C. Iran. U.S.C.A. Const.Amend. 4. §§ 1702 & 1705, and the Iranian Transactions and Sanctions Regulations ("ITSR"), 31 C.F.R. § 560.203-204. See Indictment, ECF No. 1. On August 22, Cases that cite this headnote 2013, the grand jury returned a superseding indictment that added more alleged co-conspirators, an additional count, and additional acts in furtherance of the alleged conspiracy, and revised the alleged start of the conspiracy from November 2009 to September 2009. Superseding Indictment, ECF No. 66.E Attorneys and Law Firms On July IS, 2013, Saboonchi filed several motions *538 Christine Manueliart, Rod J. Rosenstein, Office of including a Motion to Suppress Evidence, ECF No. 58. the United States Attorney, Baltimore, MD, for United States of America. Most of the basic facts are undisputed. Saboonchi and his *539 Elizabeth Genevieve Oyer, Office of the Federal wife were stopped by United States Customs and Border Public Defender, Baltimore, MD, for Ali Saboonchi, et al. Protection ("CBP") agents on March 31, 2012 at the Rainbow Bridge outside of Buffalo, New York when returning from a daytrip to the Canadian side of Niagara Falls. Def.'s Mot. 2. Saboonchi and his wife were questioned separately, and Saboonchi was questioned in a locked room where he was "required to remain in the MEMORANDUM OPINION room and directed to answer questions by a federal agent." Id. "Without Defendant's knowledge and consent, all electronics were seized with intent to search." Id. at 3. PAUL W. GRIMM, District Judge. Eventually, Saboonchi and his wife were allowed to reenter the United States, but an Apple iPhone, a Sony Defendant Ali Saboonchi is alleged to have violated U.S. Xperia phone, and a Kingston DT101 G2 USB flash drive export restrictions on trade with the Islamic Republic of (the "Devices") were seized; Saboonchi claims that "no Iran. On July I 8, 2013, Saboonchi moved to suppress the clear justification was given for" keeping the Devices. Id. fruits of warrantless forensic searches of his smartphones Saboonchi was given a "Detention Notice and Custody and flash drive performed under the authority of the Receipt for Detained Property," CBP Form 605ID, listing border search doctrine after they were seized at the the devices. CBP Form 6051D, Defs Mot. Ex. B, ECF U.S.—Canadian border. At a hearing on September 23, No. 58-2. 2013, I issued an oral opinion denying the motion but stated that, in light of the difficult issues raised by a *540 On April 4, 2012, a Homeland Security forensic search of digital devices seized at the border, I Investigations ("HSI") special agent imaged each of the would be issuing a written opinion further explaining my Devices, see ICE Report of Investigation Continuation WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 4 EFTA01207769 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) (the "ICE Reports"), Def.'s Mot. Ex. A, ECF No. 58-1.2 Falls, New York on March 31, 2013, Burkhardt Tr. 6:4-9, Thereafter, the image of each device was forensically and his testimony primarily relied on his recollection as searched using specialized software. Id. refreshed by his report of the events of March 31, 2012, as well as his knowledge of standard practices at the On April 13, 2012, Saboonchi met with two HSI agents in Rainbow Bridge facility. According to Burkhardt, people Baltimore who returned the Devices to him. Def.'s Mot. traveling by car go through primary screening in one of 6; Gov't Opp'n 25. At that time, a conversation occurred about seventeen lanes. Id. at 6:17-21. Although Burkhardt that Saboonchi characterized as an "interrogat[ion]," lacked firsthand knowledge of Saboonchi's primary Def.'s Mot. 6, and that, at the very least, confirmed that inspection, it was his understanding that Saboonchi Saboonchi owned two of the Devices and included arrived at *541 the Rainbow Bridge facility at 9:47 p.m., questioning about an internship Saboonchi once had with id. at 22:11, and was referred to secondary inspection an Iranian company and his knowledge of restrictions on because his name had produced a "hit" in the TECS doing business with Iran, Gov't Opp'n 25. database during primary screening, id. at 38:11-17.2 Saboonchi moved to suppress any evidence obtained from In general, once a car is diverted to secondary inspection, the Devices, any statements that he made to CBP on it is approached by one or more officers, with weapons March 31, 2012, and any statements that he made to HSI holstered, to escort the car to secondary inspection. Id. at on April 13, 2012. See Def.'s Mot. Saboonchi's motion 7:13-8:15. When the car reaches the main CBP building, relied on his argument that the warrantless search of the a "stop stick" tire deflation device is placed between the Devices at the border—and their later forensic front and back tires of the car to prevent flight. Id. at search—violated the Fourth Amendment's prohibition of 17:20-23. The passengers are escorted inside and a unreasonable searches and seizures, hi. at 7—8, that any secondary inspection typically is conducted in a room off statements made on March 31 were obtained in violation of the building's lobby called the "medium secondary." of the Fifth Amendment's Self—Incrimination Clause, id. Id. at 9:11-16. The medium secondary is reached through at 6-7, and that any statements made on April 13 resulted a locked door, which is operated remotely to buzz people from the improper search of Saboonchi's Devices, id., and in or out. Id. at 15:17-16:5. The room contains several therefore are the "fruit of the poisonous tree," Nardone v. chairs and a metal table, id. at 15:7-16:5; Hr'g Ex. United States, 308 U.S. 338, 341, 60 S.Ct. 266, 84 L.Ed. 1F-1H, and has windows that are tinted on their bottom 307 (1939). The Government responded, taking the portion. See Hr'g Ex. 1F-1H. Saboonchi and his wife position that the search of the Devices was a routine were taken into the secondary inspection area and Officer border search that required neither a warrant nor Burkhardt took their passports and Saboonchi's wife's particularized suspicion and that Saboonchi's statements visa. Burkhardt Tr. 18:8-19:24. did not result from custodial interrogation. Gov't Opp'n 28-29. Shortly before the hearing on the motion to Burkhardt ran his own query of TECS and discovered two suppress, I sent a letter to the parties seeking additional flags on Saboonchi, one out of Washington, D.C. and one briefing as to certain matters, Letter to Counsel (Sept. 13, out of Baltimore. Id. at 20:5-7. Because of those flags, at 2013), ECF No. 73, and the parties responded shortly 9:52 p.m., Burkhardt contacted HSI Special Agent Kelly thereafter, see Gov't Supp. Mots. Resp., ECF No. 75; Baird about Saboonchi; Baird told him to detain Def.'s Supp. Briefing Submission, ECF No. 76. Saboonchi's Devices. Id. at 20:8-23; 22:11-12. A hearing was held before me on September 23, 2013, at At 10:00 p.m., Burkhardt interviewed Saboonchi and his which the Government presented testimony from two wife. Id. at 22:15. The interview consisted of routine witnesses: CBP Officer Kenneth Burkhardt, see Hr'g Tr., questions regarding their citizenship, their reason for Testimony of Kenneth Burkhardt ("Burkhardt Tr."), ECF traveling to Canada, and other information relevant to No. 85, and HSI Special Agent Kelly Baird, see Hr'g Tr., their readmission to the United States. Id. at 23:21-24:10. Testimony of Kelly Baird ("Baird Tr."), ECF No. 84. The interview did not last more than thirty minutes, and may have been as short as ten to fifteen minutes. Id. at 29:3-20. Burkhardt did not give Miranda warnings to Saboonchi or his wife, id. at 31:7-9, and testified that they A. Testimony of Kenneth Burkhardt are allowed to refuse to answer Officer Burkhardt was one of the officers who performed questions, but until we determine a secondary screening on Saboonchi when he re-entered their admissibility, I mean, a the United States via the Rainbow Bridge in Niagara WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 5 EFTA01207770 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) thorough search of the car, a Special Agent Kelly Baird testified on three main issues: thorough search of them, I mean, the factual basis underlying the flags on Saboonchi in the we arc going to, so to speak, get to TECS database, the forensic searches of the Devices, and the bottom of what we want to—I her April 13, 2012 meeting with Saboonchi to return the mean, 99.9 percent of people Devices. answer questions. Baird testified that Saboonchi first came to the attention Id. at 68:2-6. Although Burkhardt did not recall the of federal authorities in the Fall of 2010, when "the FBI details of questioning Saboonchi and his wife, he stated received information that there had been an inquiry to a that his standard practice would be to separate a car's company in Vermont regarding specialized technology passengers and question them separately. Id. at 33:11-14. that has applications with industrial medical or military At this time they also would have been asked to empty applications" by "a person named Ali," whose telephone their pockets, known as a "pocket dump," id. at 21:14-18, number eventually led to Saboonchi. Baird Tr. 65:16-21, but they probably were not subjected to a 10:21-11:2. Around December 2011, another HSI agent pat-down or other more invasive search of their persons, contacted Baird to inform her that Saboonchi's name had id. at 30:16-22. At approximately 10:30 p.m., a come up again in the context of another investigation into "seven-point exam," which is a detailed examination of export violations. Id. at 11:19-23. This led HSI to issue a Saboonchi's car, was performed. Id. at 22:18-23:2. number of subpoenas seeking credit card and shipping Saboonchi and his wife were not free to leave during this records that were returned in early March 2012. Id. at process. Id. at 46:17-47:14. 11:24-12:2.4 *542 The HSI duty agent at the Rainbow Bridge, In response to HSI's subpoenas, Baird received a Federal Cornelius O'Rourke, was contacted at 10:55 p.m. and Express ("FedEx") airbill that showed that Ali Saboonchi, responded at 11:20 p.m. Id. at 23:9-12. At 11:55 p.m., through a business called Ace Electric, had shipped a HSI Special Agent Kelly Baird requested that all of the cyclone separator to an Arash Rashti at a company called Saboonchis' information be turned over to the local Joint General DSAZ in the United Arab Emirates. Id. at 12:2-7, Terrorism Task Force ("JTTF") agent, Jeff Alrich. Id. at 29:1-4, 30:22-24.s An investigation into General DSAZ, 23:12-15. The local chief was informed of all that had using the contact information gleaned from the airbill, transpired at 12:15 a.m. on April I, 2013, and Saboonchi revealed that *543 it was linked to another company in and his wife were released at 12:25 a.m. on April I. Id. at Iran dealing with "industrial parts and things of that 23:16-17. From when they were stopped until they were nature." Id. at 12:8-12. cleared to enter the United States, over two and one-half hours had elapsed. Shortly thereafter on March 29, 2012, Baird conducted interviews with individuals at a company called Geiger Although Saboonchi and his wife were allowed to re-enter Pumps, which confirmed that it had sold two cyclone the country, the Devices were not returned to them at that separators to Saboonchi based on his representation that time and Saboonchi was given a CBP 605 ID receipt for "the end user was domestic use only." Id. at 12:13-22. the detention of the Devices. CBP Form 605ID. Baird also noted that the airbill had listed the value of the Burkhardt said that it was not normal practice to look at cyclone separators as $100 but that their actual value was the contents of electronic media found on a person during over $2,100. Id. at 15:21-16:2. Although reporting inspection, id. at 41:4-43:25, and neither he nor any other requirements only apply to items worth at least $2,500, CBP officer attempted even a cursory inspection of the Baird testified, based upon her training and experience, contents of the Devices at the Rainbow Bridge, id. at that "when people tend to undervalue stuff, it's to keep 59:13-60:1. "Duty Agent O'Rourke departed the station things below the radar." Id. at 16:6—8. On March 30, with the two cell phones and the thumb drive." Id. at 2012, Baird conducted interviews with another supplier, 24:19-20. RG Group, from which Saboonchi also had made purchases. Id. at 12:23-13:4, 31:9-20. Somewhere around In Burkhardt's view, what happened at the screening was this time, Baird caused Saboonchi's information to be "[a]bsolutely routine." Id. at 28:23. entered into TECS as a person of interest. Id. at 4:7-11.6 Also based on her investigation, Baird testified that when she was contacted by Burkhardt, she asked him to detain Saboonchi's electronic media and to search his vehicle to take advantage of the Government's border search B. Testimony of Kelly Baird authority. See id. at 5:6-9; 33:4-14. WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 6 EFTA01207771 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) With respect to the Devices, Baird testified that she of Miranda, relying in part upon United States v. FNU received them in a Fed& package from Agent O'RourIce LNU, 653 F.3d 144, 153-54 (2d Cir.201 I) (noting that the and immediately handed them over to her computer likelihood that those entering the country expect some forensics agent, Agent Mycel. Baird Tr. 7:21-8:1. Baird degree of confinement and questioning reduces the told O'Rourke not to examine the Devices and had not likelihood that such restrictions would be perceived as examined them herself, so that she could give them to a custodial); see also Hr'g Tr., Argument and Rulings (the specialist in the preservation of computer evidence. See "Ruling Tr."), 14:19-19:1.7 id. at 8:22-9:10. Images were made of the hard drives of both phones and of the USB drive, but the image of the With respect to the seizure' and subsequent search of the Sony phone later was deleted after it was determined that Devices, I found that current state of the law provides it was not Saboonchi's. Id. at 24:7-25:6. Among the files considerably less clarity. Although it seemed that the that were searched, Baird found evidence of telephone seizure of Saboonchi and the Devices was supported by contact with an employee of Geiger Pumps and a copy of reasonable suspicion, the Government had taken the Saboonchi's résumé that showed that he had interned with position that its actions constituted a routine border search an Iranian company. Id. at 15:11-20. for which no suspicion was required, Gov't Opp'n 26-29, and I noted that the nature and extent of the authority to On April 13, 2012, after the Devices had been imaged, image and forensically search those devices was unclear. Baird arranged for Saboonchi to come to the U.S. Custom See Ruling Tr. 31:4-20. Because this is an unsettled area House in Baltimore so that she could return the Devices to of the law, and one that increasingly is important as ever him. Id. at 20:20-22. Saboonchi pulled his car up outside greater aspects of our lives involve the use of digital the Custom House, and Baird and another agent came out devices, I stated my intention to issue a written opinion to meet him. Id. at 20:21-23. In addition to turning over setting forth the reasons for my decision. Id. at the devices, Baird asked Saboonchi whether he was aware 36:25-37:14. of the sanctions in place with respect to Iran and Saboonchi responded that he was aware that there were The Government requested, and I granted, the opportunity some restrictions in place, that he knew people who had to provide supplemental briefing in light of the had difficulties receiving money from family in Iran, and importance of the issue and the paucity of other opinions that he believed that United States residents were not addressing it. See id. at 40:11-41:4. That briefing now has permitted to use Iranian airlines. Id. at 21:2-15. Baird been completed, see Gov't Supp. Mem., ECF No. 87; advised Saboonchi that he would need to get permission Def.'s Rap. Mem., ECF No. 90, and I can turn now to from the Office of Foreign Asset Control ("OFAC") if he addressing the issues raised in Defendant's motion. wished to conduct business with entities in Iran. Id. at 21:16-24. Baird also asked questions about Saboonchi's internship with an Iranian company but did not ask if he was *544 exporting products to Iran. Id. at 38:14-40:7. II. THE BORDER SEARCH DOCTRINE Saboonchi asked Baird why his wife had not received her Permanent Resident Card and Baird offered to look into it, taking down Saboonchi's wife's information to aid in A. Types of Border Searches her inquiry. Id. at 22:23-23:1. I I I 121 Any analysis of a border search must begin from the proposition that •545 "[t]he Government's interest in The entire interaction between Baird and Saboonchi took preventing the entry of unwanted persons and effects is at place on the street, at Saboonchi's car. Id. at 20:20-23. its zenith at the international border." United States v. Although Baird was carrying a weapon, it was concealed, Flores—Montano, 541 U.S. 149, 152, 124 S.Ct. 1582, 158 id. at 22:10-12, and Baird testified that Saboonchi was L.Ed.2d 311 (2004). It therefore is well-established "[t]hat free to leave at any time, id. at 22:13-16. searches made at the border, pursuant to the long-standing right of the sovereign to protect itself by stopping and examining persons and property crossing into this country, are reasonable simply by virtue of the fact that C. Supplemental Briefing they occur at the border." United States v. Ramsey, 431 U.S. 606, 616, 97 S.Ct. 1972, 52 L.Ed.2d 617 (1977). At the conclusion of the hearing, I resolved the Fifth "Routine searches of the persons and effects of entrants Amendment issue, finding that neither the initial are not subject to any requirement of reasonable questioning of Saboonchi by CBP nor his conversation suspicion, probable cause, or warrant ...." United States v. with Special Agent Baird were custodial for the purposes Montoya de Hernandez, 473 U.S. 531, 538, 105 S.Ct. WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 7 EFTA01207772 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) 3304, 87 L.Ed.2d 381 (1985). 534-35, 105 S.Ct. 3304. As a result, she "was detained incommunicado *546 for almost 16 hours before PI Hi PI But even at the border, the Fourth Amendment inspectors sought a warrant." Id. at 542, 105 S.Ct. 3304. continues to protect against unreasonable searches and In holding that the detention required, and in that seizures; the only difference is that, at the border, routine particular case was justified by, reasonable suspicion, id. searches become reasonable because the interest of the at 541, 105 S.Ct. 3304, the Court expressly refrained from Government is far stronger and the reasonable expectation defining "what level of suspicion, if any, is required for of privacy of an individual seeking entry is considerably nonroutine border searches such as strip, body cavity, or weaker. See Carroll it United States, 267 U.S. 132, 154, involuntary x-ray searches," id. at 541 n. 4, 105 S.Ct. 45 S.Ct. 280, 69 L.Ed. 543 (1925) ("Travelers may be [ ] 3304. stopped in crossing an international boundary because of national self-protection reasonably requiring one entering 161 The principal case on border searches in the Fourth the country to identify himself as entitled to come in, and Circuit is United States v. Ickes, 393 F.3d 501 (4th his belongings as effects which may lawfully be brought Cir.2005), which, like this case, dealt with a computer in."). But cf. United States v. Verdugo-Urquidez, 494 search—although not a forensic examination of an U.S. 259, 274-75, 110 S.Ct. 1056, 108 L.Ed.2d 222 identical image of the entire contents of the computer's (1990) (holding that the Fourth Amendment does not hardware. In Ickes, the defendant was selected for apply to non-citizens searched or seized outside of the secondary inspection at the U.S.—Canadian border United States). When a search stretches beyond the because the large amount of property he had in his van routine, it must rest on reasonable, particularized seemed inconsistent with his claim that he was returning suspicion, Montoya de Hernandez, 473 U.S. at 541, 105 from a vacation. Id. at 502. In a routine secondary S.Ct. 3304, which is significantly less demanding than the inspection, the inspector found a video camera with "a showing of probable cause required to secure a warrant tape of a tennis match which focused excessively on a for a domestic search, see U.S. Const. amend. IV. It is not young ball boy." Id. The agents searched the van more so easy to divine precisely where a border search falls thoroughly and turned up marijuana seeds and pipes, a along the continuum from reasonable to unreasonable, copy of a Virginia warrant for Ickes's arrest, and "several particularly when the search involves imaging the entire albums containing photographs of provocatively-posed contents of two smartphones and a flash drive. prepubescent boys, most nude or semi-nude." Id. at 503. The Customs agents placed Ickes under arrest but The Supreme Court has not addressed the issue often, but continued to search the van, discovering a computer and it has laid out the broad strokes of what constitutes a approximately seventy-five disks containing child routine, versus a nonroutine, search. On the one hand, in pornography. Id. The Fourth Circuit concluded that the United States v. Flores—Montano, the Court held that "the search was a routine border search that did not require a Government's authority to conduct suspicionless showing of reasonable suspicion, id. at 505-06, even inspections at the border includes the authority to remove, though the officers likely had reasonable suspicion before disassemble, and reassemble a vehicle's fuel tank." 541 they viewed the contents of the disks. Thus under Ickes, U.S. at 155, 124 S.Ct. 1582. In so holding, the Court the mere fact that a search includes computer files does found that the privacy interest in the contents of a not transform it from routine to nonroutine. person's gas tank was less than that in the contents of a passenger compartment, that such searches were relatively brief, and that the possibility of permanent damage to a car was so remote that it did not implicate a legitimate property interest, particularly because an owner B. Location of Border Searches of a damaged car might be entitled to recover damages. 171 PI A border search need not take place at the Id. at 154-55, 124 S.Ct. 1582 (citing Carroll, 267 U.S. at 154, 45 S.Ct. 280). border—indeed, here it appears that Saboonchi's Devices were seized at a border but actually were searched in On the other hand, United States v. Montoya de Baltimore, well within the territory of the United States. Hernandez presents an extreme factual situation that Courts have recognized two different ways that a search clearly exceeded a mere routine search or seizure, in may fall within the border search doctrine even though it which a defendant suspected of smuggling drugs in her does not occur at a physical border. First, border searches alimentary canal was told that she would not be released "may in certain circumstances take place not only at the into the United States until she submitted to an x-ray or border itself, but at its functional equivalents as well." "produced a monitored bowel movement that would Almeida-Sanchez v. United States, 413 U.S. 266, 272, 93 confirm or rebut the inspectors' suspicions." 473 U.S. at S.Ct. 2535, 37 L.Ed.2d 596 (1973). The "functional WestlawNext" © 2015 Thomson Reuters. No claim to original U.S Government Works. 8 EFTA01207773 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) equivalent" of a border may include "an established methodology, where the computer searches vast amounts station near the border, at a point marking the confluence of data that would exceed the capacity of a human of two or more roads that extend from the border," or the reviewer to examine in any reasonable amount of time. search of passengers and cargo arriving at an airport The techniques used during a forensic search can be within the United States after a nonstop flight from distinguished from a conventional computer search, in abroad. Id. at 273, 93 S.Ct. 2535. As these locations are which a Customs officer may operate or search an the functional equivalent of a border, the analysis is no electronic device in much the same way that a typical user different from a search at an actual, physical border and would use it. no additional suspicion is required. See id. As I will explain, a conventional computer search can be Isl " Second, courts have permitted " `extended border deeply probing and, much like any search of personal searches,' under which `border' is given a geographically effects at the border, has the potential to be invasive. Yet flexible reading within limits of reason related to the these concerns do not bring a conventional computer underlying constitutional concerns to protect against search outside of the broad authority granted under the unreasonable searches." United States v. Bilir, 592 F.2d border search doctrine any more than a suitcase is 735, 740 (4th Cir.1979). "[T]he `extended border search' immunized from search because it may contain a personal doctrine has been applied to entry border searches diary. Despite the vast amounts of data available in an conducted some time after the border was crossed." electronic device, a conventional search is limited by the United States v. Cardona, 769 F.2d 625, 628 (9th amount of time one Customs officer has to devote to Cir.I985) (citing United States v. Caicerlo-Guarnizo, 723 reviewing the contents of digital evidence at the border F.2d 1420, 1422 (9th Cir.1984)). An extended border while its owner awaits the outcome of the search. Even if search may be necessary *547 because the first contact that review may take a matter of hours, the amount of data with a customs official occurs away from the border, or searched will be a mere fraction of what is on the device, because officers have elected to allow a suspect to pass given the storage capacity of modem electronic devices. through the border in order to perform a search at a later And in any event, though such a search may last hours, it time. Bilir. 592 F.2d at 740. Unlike searches that actually will not last days. There is only so much time that a occur at a border or the functional equivalent thereof, an Customs officer has to devote to the border search of a extended border search requires reasonable suspicion with computer. No matter how thorough or highly motivated respect to the criminal nature of the person or thing the agent is, a manual search of a computer or digital searched as well as reasonable suspicion that the subject device will never result in the human visualization of of the search has crossed a border "within a reasonably more than a fraction of the content of the device. recent time." Id. In contrast, a forensic examination of a computer or other electronic device using sophisticated technology-assisted search methodologies can exceed vastly the capacity of a III. DISCUSSION human searching and viewing files. Moreover, this type of At the outset, it is important to understand what takes search exposes a class of data that raises novel privacy place during a forensic computer search, and what concerns, including files that a user had *548 marked as distinguishes it from what may usefully be regarded as a "deleted"' and location data that may provide information "conventional" search of a computer or digital device. about activities in the home and away from the border. Though every search is different, a forensic search has For this reason, a forensic search of an electronic device certain hallmarks by which it can be identified. First, "the differs significantly from a conventional search not computer forensics process always begins with the merely in degree, but in kind. Accordingly, as explained creation of a perfect 'bitstream' copy or `image' of the below, a forensic search of an electronic device seized at original storage device saved as a 'read only' file." Orin the border cannot be performed absent reasonable, S. Kerr, Searches and Seizures in a Digital World, 119 articulable suspicion. Harv. L.Rev. 531, 540 (2005). Then, a computer forensics expert will use specialized software to comb through the data, often over the course of days, weeks, or even months, id. at 537-38, searching the full contents of the imaged hard drive, examining the properties of individual A. Analytical Framework files, and probing the drive's unallocated "slack space" to reveal deleted files, id. at 542-43. Although directed by a I") The framework established by the Supreme Court and forensic examiner, an integral part of a forensic the Fourth Circuit allows for three possible ways to examination is the use of technology-assisted search analyze the seizure and search of Saboonchi's Devices. WestlawNext" © 2015 Thomson Reuters. No claim to original U.S. Government Works. 9 EFTA01207774 U.S. v. Saboonchl, 990 F.Supp.2d 536 (2014) The Government has taken the position that the detention, transformed into an extended border search simply seizure, imaging, and forensic search of the Devices because the device is transported and examined beyond should be viewed as a routine border search, so that no the border." United States v. Cotterman, 709 F.3d 952, suspicion was required and the search clearly was 961 (9th Cir.2013). Thus, I find that this was not an permissible under any facts. Gov't Opp'n 26. Saboonchi extended border search; to the contrary, Saboonchi's has argued that, because the actual search of the Devices Devices were not permitted to enter into the United States took place at a field office in Baltimore, several hundred until they were returned to him in Baltimore, and any miles from where Saboonchi crossed the border, it is best searches of those devices were pursuant to the general viewed as an extended border search for which reasonable border search doctrine. suspicion was required. Def.'s Reply 2. In the alternative, Saboonchi argues that, unlike a conventional search of a " 31 Therefore, the level of suspicion required depends on digital device such as viewing a video or booting up a whether the forensic search of the Devices was a routine computer at the border, the act of seizing and imaging an search or a nonroutine search. Although I hold that a electronic device and thereafter—perhaps days or weeks forensic search of a computer or electronic device should later—performing a forensic search crosses the line from be considered a nonroutine search for which reasonable a routine search to a nonroutine search, and therefore suspicion is required, I do so only after thorough analysis requires reasonable suspicion irrespective of where it is of the relevant law and factual considerations. performed. Id. at 2, 5-6. The facts here are distinct from cases that found an extended border search had occurred. In United States v. Bilir, for example, DEA agents declined to act B. Routine Venus Nonroutine Searches Generally immediately on information that heroin was concealed on a Turkish ship that would be entering several American Unsurprisingly, the overwhelming majority of searches ports, and instead followed the ship from port to port in that one would expect to encounter at the border fall into hopes of apprehending the suspects. 592 F.2d 735, 737 the category of conventional, routine border searches. (4th Cir.1979). The agents allowed the suspects to debark This includes pat-downs, pocket-dumps, and even the ship in Baltimore in order to follow them, and the searches that require moving or adjusting clothing without suspects eventually were stopped and searched at disrobing, and also may include scanning, opening, and Baltimore Penn Station. Id. at 738. The Fourth Circuit rifling through the contents of bags or other closed upheld the search as an extended border search. Id. at 739. containers. But a routine search also may go beyond what Similarly, in United States v. Guzman-Padilla, 573 F.3d a traveler othenvise may consider routine. For example, a 865 (9th Cir.2009), a Border Patrol agent used a routine search may extend to the inside of an automobile controlled tire deflation device to stop a vehicle that gas tank, United States v. Flores-Montano, 541 U.S. 149, already was in the United States but that the agent 155, 124 S.O. 1582, 158 L.Ed.2d 311 (2004), to the reasonably believed had entered the United States contents of photograph albums or information encoded on recently from Mexico. Id. at 875. Although it did not need video tapes, United States v. Ickes, 393 F.3d 501, 502-03 to decide the issue, the Ninth Circuit noted that this might (4th Cir.2005), or to password protected or locked items, qualify as an extended border search. Id. at 877-78. In United States V. McAuley, 563 F.Supp.2d 672, 678 both of these cases, no search or seizure took place until (W.D.Tex.2008). Insofar as the "touchstone of the Fourth after the suspects had cleared the border and were within Amendment is reasonableness," Florida v. Jimeno, 500 the United States. U.S. 248, 250, III S.Ct. 1801, 114 L.Ed.2d 297 (1991) (citing Katz v. United States, 389 U.S. 347, 360, 88 S.Ct. " 21 The searches of the Devices in this case cannot be an 507, 19 L.Ed.2d 576 (1967)), it does not require extended border search because Saboonchi was not Napoleonic insight to see how the power to conduct allowed to bring them across the border. See United States searches of this kind on a routine basis, without suspicion, v. Stewart, 729 F.3d 517, 525 (6th Cir.2013) (finding no is the sine qua non of customs and border enforcement; extended border search under similar circumstances otherwise there would be nothing to stop travelers or "because [defendant's] laptop computers never cleared commercial shippers from dodging our customs laws with the border"). The seizure of the Devices occurred at the impunity so long as they avoid drawing attention. See, border itself. •549 They then were shipped to Baltimore e.g., United States v. Johnson, 991 F.2d 1287, 1292 (7th and were transferred from CBP to HSI, both of which Cir.1993) ("A customs official might have to rummage play a role in securing the border. And once the devices through any border entrant's luggage to ascertain whether were cleared for entry, they were returned, in Baltimore, all items have been declared properly."). to Saboonchi. "A border search of a computer is not WestlawNexi © 2015 Thomson Reuters. No claim to original U.S Government Works. 10 EFTA01207775 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) A wide range of searches of persons also have been (i) whether the search results in the exposure of upheld as routine even if they involve some level of intimate body parts or requires the suspect to disrobe; indignity or intrusiveness, so long as they fall short of a strip search and do not expose the cavities of the body. (ii) whether physical contact between Customs officials See, e.g., Bradley v. United States, 299 F.3d 197, 203 (3d and the suspect occurs during the search; Cir.2002) (holding that patdowns are routine searches that do not require reasonable suspicion); United States it (iii) whether force is used to effect the search; Kelly 302 F.3d 291, 294-95 (5th Cir.2002) (dog sniff was a routine border search even where dog made brief (iv) whether the type of search exposes the suspect to contact with suspect's groin); United States v. Charleus, pain or danger; 871 F.2d 265, 266-67 (2d Cir.1989) (touching (v) the overall manner in which the search is defendant's back and, upon discovering a bump, lifting conducted; and the back of his shirt was a routine search); United States v. Brown, 499 F.2d 829, 833 (7th Cir.1974) (lifting an (vi) whether the suspect's reasonable expectations of *550 ankle-length skirt to just above a female suspect's privacy, if any, are abrogated by the search. knees in a room with only women constituted a routine search). 842 F.2d at 512 (footnotes omitted). These factors did not represent "an exhaustive list of equally-weighted lul 1151 On the other hand, United States v. Ramsey left concerns," and each search was a fact-specific inquiry in open the possibility that "a border search might be which those factors were among the relevant deemed 'unreasonable' because of the particularly considerations. Id. at 513. offensive manner in which it is carried out." 431 U.S. 606, 618 n. 13, 97 S.Ct. 1972, 52 L.Ed.2d 617 (1977). For Other courts have focused specifically on familiar example, there is a general consensus that even the border touchstones such as the exposure of intimate body parts search power cannot justify a strip search without any and details, as well as a suspect's reasonable expectations particularized suspicion. See, e.g., Montoya de of privacy. In United States v. Vega—Barvo, 729 F.2d Hernandez, 473 U.S. at 541 n. 4, 105 S.Ct. 3304 (listing a 1341 (11th Cir.1984), the Eleventh Circuit, considering category of "nonroutine border searches" including a strip the permissibility of an x-ray search of a person, or body cavity search); United States v. Rodriguez, 592 observed: F.2d 553, 556 (9th Cir. 1979) ("While anyone at a border may be stopped for questioning and subject to an To determine the "intrusiveness" inspection of luggage, handbags, pockets, wallets, without level of the internal body searches any suspicion at all on the part of customs officials, 'real involved in today's cases, it is suspicion' is required before a strip search may be necessary to decide whether conducted ...." (citations omitted)); United States v. intrusiveness is to be defined in Asbury, 586 F.2d 973, 975-76 (2d Cir.1978) (a strip terms of whether one search will search is "such an extensive invasion of privacy, [a border reveal more than another, or official] should have a suspicion of illegal concealment whether intrusiveness is to be that is based upon something more than the border interpreted in terms of the indignity crossing, and the suspicion should be substantial enough that will be suffered by the person to make the search a reasonable exercise of authority"); being searched. For example, is an United States v. Himmelviright, 551 F.2d 991, 994-95 x-ray more intrusive than a cavity (5th Cir.I977) (holding that reasonable suspicion, but search because it will reveal more nothing more, is required to justify a strip search at the than *551 the cavity search, or less border). "[A] border search that goes beyond the routine intrusive because it does not is nevertheless justified merely by reasonable suspicion, a infringe upon human dignity to the lesser standard than required for analogous non-border same extent as a search of private searches." United States v. Oriakhi, 57 F.3d 1290, 1297 parts? A person can retain some (4th Cir.I995) (citing Montoya de Hernandez, 473 U.S. at degree of dignity during an x-ray, 541, 105 S.Ct. 3304). but it is virtually impossible during a rectal probe, despite the more Courts have struggled to define a clear dividing line limited scope of such a search. between routine and nonroutine searches. In United States v. Burks, 842 F.2d 509 ( 1st Cir.I 988), the First Circuit Id. at 1345. Although the Eleventh Circuit held that the listed the following relevant factors: WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 11 EFTA01207776 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) true touchstone is "personal indignity," id. at 1346, the those entering the country, and the heightened protection distinction did not seem to make much difference, as the the Fourth Amendment provides for one's home. Id. at Eleventh Circuit held that an x-ray search is "more 488. The court held that reasonable suspicion—but no intrusive than a frisk, [though] no more intrusive than a more—was required for such a search because the "high strip search," and therefore required reasonable suspicion, expectation of privacy and level of intrusiveness" brought but not more, id. at 1349. The Supreme Court and the it beyond the routine. Id. at 489; see also id. at 486-87 (" Fourth Circuit also have assumed, but not decided, that an `something more than naked suspicion' " required to x-ray search is nonroutine. See Montoya de Hernandez, search a ship's cabin (quoting United States v. Alfonso, 473 U.S. at 541 n. 4, 105 S.Ct. 3304; United States v. 759 F.2d 728, 738 (9th Cir.1985)); United States v. Aguebor, 166 F.3d 1210, 1999 WL 5110, at •3 (4th Cir. Cunningham, •552 No. 96-265, 1996 WL 665747, at Jan. 4, 1999). Courts also have found searches to be •3 (E.D.La. Nov. 15, 1996) (reasonable suspicion nonroutine where they required the removal of an required to search private areas of a ship); State v. Logo, artificial limb, United States v. Sanders, 663 F.2d I, 3-4 798 So.2d 1182, 1183 (La.Ct.App.2001) (reasonable (2d Cir.1981), or required a woman partially to disrobe to suspicion required to search passenger's cabin on ship). display her girdle, United States v. Palmer, 575 F.2d 721, Accordingly, even if a search is not destructive or 723 (9th Cir.1978). But in each of these cases, the search damaging, if it is sufficiently invasive or intrusive, or was upheld as supported by reasonable suspicion. butts up against other Fourth Amendment values, it may Aguebor, 1999 WL 5110, at *3; Sanders, 663 F.2d at 3-4; be nonroutine in any event. Palmer, 575 F.2d at 723. Though most of these cases deal with searches of persons, some searches of property also have been found to be nonroutine. In Flores-Montano, the Supreme Court C. Prior Case Law on Searches of Electronic Media noted—and declined to comment on—a series of cases finding that "exploratory drilling searches" required in Ickes makes it clear that a routine border search may reasonable suspicion. See Flores—Montano, 541 U.S. at include a conventional inspection of electronic media and 154 n. 2, 124 S.Ct. 1582; see also United States v. Rivas, a review of the files on them just as it may include 157 F.3d 364, 366-67 (5th Cir.1998) (reasonable physical papers. See Ickes, 393 F.3d at 505-06. suspicion required to drill into frame of truck trailer); Furthermore, Ickes comports with the clear weight of United States v. Robles, 45 F.3d I, 5 (1st Cir.1995) precedent from other courts. See, e.g., United States v. (reasonable suspicion was required to drill into a "closed, Arnold, 533 F.3d 1003, 1008 (9th Cir.2008) ("reasonable metal cylinder"); United States v. Carreon, 872 F.2d suspicion is not needed for customs officials to search a 1436, 1440-41 (10th Cir.I989) (reasonable suspicion laptop or other personal electronic storage devices at the required to drill hole into wall of camper). The Supreme border"); United States v. Linarez—Delgado, 259 Court noted that such searches are "potentially Fed.Appx. 506, 508 (3d Cir.2007) (viewing a videotape in destructive" and could be considered " 'particularly defendant's possession was permissible as part of a offensive' " and therefore nonroutine. See routine border search); United States v. Bunty, 617 Flores-Montano, 541 U.S. at 154 n. 2, 124 S.Ct. 1582 F.Supp.2d 359, 365 (E.D.Pa.2008) (viewing files on (quoting Ramsey, 431 U.S. at 618 n. 13, 97 S.Ct. 1972). It defendant's floppy disk permissible as part of is not difficult to see how these searches, involving both suspicionless border search). In these cases, courts have physical damage to property and the invasion of a space analogized a laptop to a closed container that may be that may contain private material, can be analogized to opened and its contents searched at the border. See body cavity searches. Arnold, 533 F.3d at 1007. 1161 There also is a line of cases that has held that searches But courts have disagreed on whether the same principles of private quarters on ships arriving at U.S. ports from apply to forensic searches of electronic devices. There abroad resemble the search of a home too closely to be have been two recent opinions addressing the issue in the permitted absent reasonable suspicion. In United States v. past year, United States v. Cotterman, 709 F.3d 952 (9th Wafted, customs officials entered the defendant's cabin Cir.2013) (en banc), and Abidor v. Napolitano, 990 after a query on a ship's manifest against TECS returned a F.Supp.2d 260, 2013 WL 6912654 (E.D.N.Y. Dec. 31, "one-day lookout" for the defendant. 541 F.3d 480, 483 2013), that reached opposite conclusions. Moreover, (3d Cir.2008). When the defendant challenged the search, neither Cotterman nor Abidor is, by itself, sufficiently the Third Circuit found that the cabin of a ship presents persuasive to resolve the issue under Fourth Circuit law. the intersection of two opposed but important values: the broad authority of the sovereign to perform searches on United States V. Cotterman is the first (and as far as I have WestlawNeff © 2015 Thomson Reuters. No claim to original U.S. Government Works. 12 EFTA01207777 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) found, the only) circuit court case to address the issue, capable of storing warehouses full of information.... and it held that a forensic search of electronic media could not be a routine search. 709 F.3d 952. Cotterman was The nature of the contents of electronic devices differs returning to the country from a vacation in Mexico when, from that of luggage as well. Laptop computers, iPads during primary inspection at the border, a search of TECS and the like are simultaneously offices and personal returned a hit for Cotterman indicating that he was a sex diaries. They contain the most intimate details of our offender. Id. at 957. The border agents called the contact lives: financial records, confidential business person listed in the TECS entry and, as a result, came to documents, medical records and private emails. This believe that Cotterman was involved " `in some type of type of material implicates the Fourth Amendment's child pornography.' " Id. On secondary inspection, specific guarantee of the people's right to be secure in Cotterman was found to have two laptop computers and their "papers." ... three digital cameras, which contained personal photographs and several password-protected files. Id. at Electronic devices often retain sensitive and 957-58. confidential information far beyond the perceived point of erasure, notably in the form of browsing histories Immigration and Customs Enforcement ("ICE") agents and records of deleted files. This quality makes it arrived at the border crossing, Mirandized Cotterman and impractical, if not impossible, for individuals to make his wife, and interrogated them. Id. at 958. Cotterman meaningful decisions regarding what digital content to offered to help them access the files on his computer, but expose to the scrutiny that accompanies international the ICE agents declined out of concerns that he would travel. A person's digital life ought not be hijacked delete the files or that his laptop was "'booby trapped.' " simply by crossing a border. When packing traditional Id. Eventually the Cottermans were allowed to leave but luggage, one is accustomed to deciding what papers to the ICE agents retained the laptop computers and a digital take and what to leave behind. When carrying a laptop, camera, which they transported 170 miles to an ICE tablet or other device, however, removing files Computer Forensic Examiner. Id. The examiner imaged unnecessary to an impending trip is an impractical and performed forensic searches of the hard drives of the solution given the volume and often intermingled electronic devices and found seventy-five images of child nature of the files. It is also a time-consuming task that pornography hidden in the unallocated space on may not even effectively erase the files. Cotterman's laptop. Id. He contacted the Cottermans shortly thereafter and informed *553 Cotterman that he would need assistance to access certain ... Such a thorough and detailed search of the most password-protected files; Cotterman responded that he intimate details of one's life is a substantial intrusion would need to track down the passwords but instead he upon personal privacy and dignity. [The Ninth Circuit fled the country without meeting with ICE officials. Id. at therefore held] that the forensic examination of 958-59. Cotterman's computer required a showing of reasonable suspicion, a modest requirement in light of The Ninth Circuit found no problem with the initial the Fourth Amendment. search of Cotterman's devices at the border itself, id. at 960, but held that "the comprehensive and intrusive Id. at 964-65, 968 (internal citations omitted). But the nature of a forensic examination ... trigger[s] the court took pains to note that suspicionless conventional requirement of reasonable suspicion here," id. at 962, (that is to say, nonforensic) searches of electronics still because the material that can be gleaned from a forensic would continue, and that "[r]easonable suspicion leaves search of an electronic device differed not only in ample room for agents to draw on their expertise and quantity, but in kind, from that which previously had been experience to pick up on subtle cues that criminal activity upheld. The Ninth Circuit explained: may be afoot." Id. at 967 (citing United States v. Tiong, 224 F.3d 1136, 1140 (9th Cir.2000)). Finding that there The private information individuals store on digital was reasonable suspicion with respect to Cotterman, the devices—their personal "papers" in the words of the Ninth Circuit majority upheld the forensic search of Constitution—stands in stark contrast to the generic Cotterman's electronic devices. Id. at 970. and impersonal contents of a gas tank.... The amount of private information carried by It is difficult to rely on Cotterman as setting forth a rule of international travelers was traditionally circumscribed general applicability. *554 First, the Ninth Circuit begins by the size of the traveler's luggage or automobile. with the proposition that the border search doctrine is " 'a That is no longer the case. Electronic devices are narrow exception to the Fourth Amendment prohibition WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 13 EFTA01207778 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) against warrantless searches without probable cause.' " constitutionality of the searches after having determined Id. at 960 (quoting United States v. Se!fan, 547 F.3d 993, that none of the plaintiffs had standing to challenge them, 999 (9th Cir.2008) (en bane)). But the Fourth Circuit and because certain aspects of its reasoning are cases, which are binding on this Court, have stated in unpersuasive. Abidor was a civil suit brought by an clear terms that even if the border search doctrine is individual plaintiff named Pascal Abidor, the National narrow in its geographical scope (that is, confined to the Association of Criminal Defense Lawyers, and the border or its functional equivalents), it provides "broad National Press Photographers Association. Abidor v. authority to conduct border searches." Ickes, 393 F.3d at Napolitano, 990 F.Supp.2d 260, 2013 WL 6912654 506. Accordingly, even were I to adopt Cottennan 's (E.D.N.Y. Dec. 31, 2013). Abidor was an academic reasoning in toto, I would be required independently to whose laptop computer and external hard drive were assess whether its conclusion comported with Fourth searched and detained on an Amtrak train from Canada to Circuit law. the United States when CBP agents found photographs of Hezbollah and Hamas on his laptop; he alleged that his Further, it is difficult to figure out the precise basis on laptop and external drive had been searched and which the Ninth Circuit distinguished forensic searches physically opened. *555 Id. at 267-68, at •5. The from conventional ones. The court's main rationale association plaintiffs argued only that the possibility that seemed to be that "the uniquely sensitive nature of data on their electronic devices could be searched in the absence electronic devices carries with it a significant expectation of suspicion made it difficult for them to protect of privacy and thus renders an exhaustive exploratory important, confidential information. Id. at 268-69, at *6. search more intrusive than with other forms of property." Importantly, the plaintiffs in Abidor sought only Cottennan, 709 F.3d at 966. But Cotterman seemed to declaratory and injunctive relief. Id. at 263-64, at * I. avoid laying down a distinction between forensic searches and intrusive but conventional ones, instead deferring to In Abidor, the court held that all plaintiffs lacked standing "the ability of law enforcement to distinguish a review of for the relief that they sought. Id. at 276-78, at *13-14.io computer files from a forensic examination." Id. at 967. But, in what appears to have been an exercise of Judge Callahan, concurring in the result but disputing the "hypothetical jurisdiction," it opined that forensic en bane majority's reasoning, suggests that the holding searches may be performed without reasonable suspicion "relies primarily on the notion that electronic devices are in any event), Abidor's reasoning contains at least three special," and therefore the reasoning in Cottennan cannot analytical shortcomings: first, by designating the be squared with the Fourth Circuit's holding that alternative to a "comprehensive forensic examination" to "electronic devices are like any other container that the be a mere "quick look," id. at 269-70, at •7 (quoting Supreme Court has held may be searched at the border Cotterman, 709 F.3d at 956, 960), Abidor obscures, rather without reasonable suspicion." Id. at 973, 975 (Callahan, than illuminates, the actual nature of the searches J., concurring in part, dissenting in part, and concurring in involved; second, Abidor fails to recognize the reality of the judgment) (discussing Ickes, 393 F.3d 501). And the nature and role of digital devices in the contemporary Judge Smith, writing in dissent, goes even further in world; and third, Abidor actually does not address suggesting that "[m]apping our privacy rights by the forensic searches at all. amount of information we carry with us leads to unreasonable and absurd results," such as rendering "a At the outset of its discussion of computer searches, Mini Cooper filled with documents [ ] entitled to less Abidor defines the relevant distinction as between a privacy protection at the border than a stretch "quick look," which is "only a cursory search that an Rolls—Royce filled with documents." Id. at 987 (Smith, J., officer may perform manually," and a "comprehensive dissenting). At the very least, Ickes forecloses the forensic evaluation," which is "an exhaustive search of a possibility that the mere fact that an electronic device may computer's entire hard drive." Id. at 269-70, at •7 contain massive amounts of personal data, by itself, can (citations omitted). This distinction purports to come out change the legal analysis at the border, see Ickes, 393 of Cotterman, but that is questionable. The phrase "quick F.3d at 505-06, and were I to accept Cottennan's look" appears only a single time in Cotterman, where the conclusion, I must do so on a basis other than that used by Ninth Circuit noted that it "ha[s] approved a quick look the Ninth Circuit. and unintrusive search of laptops," Cottennan, 709 F.3d at 960 (citing United States v. Arnold, 533 F.3d 1003, If Cottennan raises complex and difficult questions as to 1009 (9th Cir.2008)), and does not appear elsewhere in its rationale and its consistency with Fourth Circuit law, the border search case law. Moreover, in United States v. Abidor v. Napolitano appears to lack precedential Arnold, the case that Cotterman described as involving a value—both because there are questions about the court's "quick look," the defendant was detained for several jurisdiction where it stated legal conclusions regarding the hours while his computer was searched thoroughly. 533 WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 14 EFTA01207779 U.S. v. Saboonchl, 990 F.Supp.2d 536 (2014) F.3d at 1009. This hardly is "quick" in the conventional economy, professionals, businessmen, academics, and sense and, to the contrary, actually shows how lengthy ordinary folk travel and maintain contact with family, and comprehensive a conventional search can be. But by friends, and colleagues at home while doing so. See, e.g., unnecessarily labeling a *556 conventional computer Compl. ¶¶ 79-82, Abidor v. Napolitano, No. 10-4059 search—which, under established law, may be quite (E.D.N.Y. Sept. 7, 2010), 2010 WL 3477769 (attorneys extensive—as a "quick look," Abidor sets up a "quick allege they cannot work overseas without bringing look" as a straw man, creating a false dichotomy between electronic devices). And for travelers—whether for a comprehensive forensic search and a cursory one that business or pleasure—who may leave behind children, obviously will be insufficient in many instances to obtain sick or pregnant family members, or businesses and the information justifiably needed to secure our borders. professions that depend upon them keeping current, the choice to travel without a reliable means of contact, in Further, Abidor's reasoning seems to proceed from the reality, is no choice at all. view that, "it would be foolish, if not irresponsible, for plaintiffs to store truly private or confidential information Smartphones, in particular, have become so deeply on electronic devices that are carried and used overseas." embedded in day-to-day activities that travelers cannot Abidor, 990 F.Supp.2d at 277, 2013 WL 6912654, at *14. reasonably be expected to travel without them, even if this The court reasons that, because "'the individual crossing were the only way to preserve their Fourth Amendment a border is on notice that certain types of searches are rights. For many users, smartphones completely have likely to be made, ... he thus has ample opportunity to replaced alarm clocks and watches, cameras (both still diminish the impact of that search by limiting the nature and video), GPS devices, personal planners or datebooks, and character of the effects which he brings with him.' " music players, newspapers, radios, and even books. See Id. at 280, at *16 (quoting 5 Wayne LaFave, Search And *557 Brooke Crothers, How Many Devices Can a Seizure: A Treatise of the Fourth Amendment § 5(a) (4th Smartphone, Tablet Replace? CNET (July 10, 2011 3:59 ed.2011-12)). PM), http://news.cnet.com/8301-13924_3-20078244-64/how- While this reasoning may make sense with respect to many-devices-can-a-smartphone-tablet-replacet And as non-digital "effects" carried by international travelers, it of 2012, eighteen percent of those who take digital misperceives the reality of the capacity and use of digital photographs were using a smartphone as their primary devices in today's world: Portable electronic devices are camera, and that percentage has been growing as the ubiquitous. It neither is realistic nor reasonable to expect percentage of people who use a dedicated camera for the average traveler to leave his digital devices at home most of their photography has been falling. See Janice when traveling. Over ninety percent of American adults Chen, CEA Says Phones Replacing Point—and—Shoot as own some kind of cellular phone and more than half of Primary, Photo Device, ZDNet (Feb. 21, 2012 1:33 PM), those own a smartphone—a category that includes, but is http://www.zdnet.comiblogidigitalcameraskea-says-phon not limited to, iPhones, Android-based phones, and es-replacing-point-and-shoot-as-primary-photo-device/56 Blackberry devices. Aaron Smith, Smartphone Ownership 16. 2013, PewResearch Internet Project (June 5, 2013), httplAvww. Encouraging Americans to travel without their electronic pewinternetorg/2013/06/05/smartphone—ownership-2013 devices also is imprudent and leaves them exposed in the . The public increasingly is attached to its phones: In 2010 event of disaster abroad. In one recent incident, skiers the Pew Research Center found that sixty-five percent of caught in an avalanche were able to call for help using adults—and seventy-two percent of parents—have slept their cell phones and were rescued with help from a GPS with or near their phones. Amanda Lenhart, Cell Phones unit. Mike Clarke, 3 Skiers Rescuedfrom Avalanche near and American Adults, PewResearch Internet Project (Sept. Hope, B.C.; Two Skiers Were Caught in the Avalanche, 2, 2010), http://www.pewinternet. One Was Injured, CBC News (Feb. 16, 2014 7:20 PM) org/2010/09/02/cel1-phones-and-american-adults/. (last updated Feb. 16, 2014 9:10 PM), Although many undoubtedly carry their phones as a httplAvww.cbc.ca/news/british—columbia-3—skiers—rescu convenience or a luxury, for others it is a necessity. Last ed—from—avalanche—near—hope—b—c-1.2539773. In year's ABA Legal Technology Resource Center's another, an American family was able to use their cell Technology Survey "reveals that 91% of all attorneys use phones to re-book hotels and flights (undoubtedly with a smartphone, and that percentage increases with the size substantial roaming fees) when they encountered of the law firm." 2013 ABA Tech Survey Once Again problems with their reservations in the Dominican Shows Surge in Attorneys Using iPhone, iPad, Republic. Douglass Dowty, Forced Home After First Day www.iphonejd.com/iphonejd/2013/07/2013—aba—tech—s of $4,600 Caribbean Vacation, Family Sues Travel Site urvey.html (July 30, 2013). In an increasingly global Hotwire.com, Syracuse.com (N.Y.) (Feb. 7, 2014 9:12 WestlawNext' © 2015 Thomson Reuters. No claim to original U.S. Government Works. 15 EFTA01207780 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) AM) (updated Feb. 7, 2014 1:06 PM), why a forensic search differs from a conventional one, httplAvww.syracuse.cominews/index.ssf/2014/02/clay_fa Abidor did not appear to recognize any meaningful mily_forced_home_afler_ distinction between the two at all.I2 But as explained first_day_of 4600_caribbean_vacation_sues_booking.ht below, there is a substantial difference between a ml. The Department of State expressly has recommended conventional computer search and a forensic search. that travelers to certain regions enroll in the Smart Traveler Enrollment Program to receive "safety and There are a handful of additional cases that, though security updates" and to ensure that those travelers can be decided in the shadow of forensic searches, did not contacted in case of emergency—a goal that could not be directly address their permissibility. One notable circuit accomplished if the travelers in question did not have court case is United States v. Stewart, in which defendant electronic devices on which to receive updates and Stewart was selected for secondary screening after being " communications. See, e.g., Bureau of Consular Affairs, `standoffish' and `confrontational' " towards CBP Russian Federation Travel Alert, Dep't of State (updated officers. 729 F.3d 517, 520 (6th Cir.2013). An officer March 14, 2014), http://travel.state. booted up one of Stewart's two laptop computers and govicontent/passports/english/alertswamings/russia-travel found "about a dozen thumbnail images ... that he -alert-events-in-ulcraine.html ("strongly recommend[ing] believed to be child pornography." Id. at 521. At that that U.S. citizens traveling to or residing in Russia enroll time, an ICE agent was called in to assist; the agent in the Department of State's Smart Traveler Enrollment detained the laptops but allowed Stewart to enter the Program"). And in the context of unrest in Ukraine, "the country and board a flight to Maryland. Id. Later that day, American Citizen Services Unit of the U.S. Embassy in an ICE forensic analyst searched the other computer Kyiv has implemented a text messaging network, (which had a dead battery and could not be booted up at whereby registered American citizens in Ukraine can the airport) by scrolling through it and located additional receive short text messages ... providing important suspected child pornography. Id. At that time, ICE information in case of an emergency." Travel Information obtained a search warrant and a forensic examination of by SMS Alerts, Embassy of the United States, Kyiv, both computers was performed. Id. Ukraine, http://ukraine.usembassy.gov/announcements.html (last Like the Fourth Circuit, the Sixth Circuit characterized visited Apr. 4, 2014). It is likely that smartphones will the border search doctrine as "a broad exception to the become even more useful while traveling, as the Fourth Amendment's requirement of probable cause." Id. ownership and use of smartphones abroad has been at 524. But because a warrant was obtained prior to any expanding rapidly. See, e.g., Josh Heggestuen, One in forensic search, the only question that was raised on Every 5 People in the World Own a Smartphone, One in appeal was whether the initial detention and conventional Every 17 Own a Tablet, Businesslnsider.com (Dec. 15, searches of Stewart's computers prior to obtaining the 2013 3:23 PM), search warrant constituted an extended border search, httplAvww.businessinsider.corn/smartphone—and—tablet requiring reasonable suspicion, or a routine border search, penetration-2013-10 (between 2009 and 2013, global for which suspicion is not required. See id. The Sixth smartphone ownership has expanded from 5% of the Circuit held that this was a routine search, noting that the world's population to 22%, an increase of 1.3 billion second conventional search, though performed without a smartphones). warrant, was "the same search that they could have done the previous day had the proper equipment [i.e., a Indeed, mobile devices now serve as digital umbilical computer charger] been present at the airport," and that cords to what travelers *558 leave behind at home or at the search occurred only one day later and twenty miles work, indispensable travel accessories in their own right, away. Id. at 525-26. and safety nets to protect against the risks of traveling abroad and, particularly, of traveling to unstable or In House v. Napolitano, No. 11-10852-DJC, 2012 WL dangerous regions of the world. It therefore strikes me as 1038816 (D.Mass. March 28, 2012), plaintiff House was unrealistic, if not unreasonable, to expect Americans an organizer of the Bradley Manning Support Network traveling abroad to choose between leaving their devices who alleged that he was targeted by various government at home or exposing them to the possibility of being agencies as a result of his *559 support for Bradley imaged and forensically searched on reentry to this Manning. Id. at *2.1) When returning from a vacation in country without requiring Customs officers to articulate a Mexico, House initially was cleared through customs at justification even as modest as reasonable, articulable Chicago O'Hare International Airport, but was then suspicion. approached in the terminal by DHS officials who detained him and demanded all of his electronics, including a Finally, whereas Cotterman did not adequately explain laptop computer, a USB drive, a video camera, and a WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 16 EFTA01207781 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) cellular phone. Id. at *3. House was questioned by the *560 There are other cases dealing with computer agents, during which time he informed them that the searches, but none directly resolves the question before computer was password protected and refused to disclose me. In United States v. McAuley, 563 F.Supp.2d 672 the password because it would allow unauthorized access (W.D.Tex.2008), the Western District of Texas held that to his employer's server. Id. When House was allowed to the conventional search of a "personal computer at a port leave, his phone was returned to him but the other items of entry is a routine search and thus, does not necessitate a were not. Id. at *4. Forty-eight days later, when the finding of reasonable suspicion in order to search a electronic devices still had not been returned, House's computer, disks, hard drives, or any other technical attorney sent a letter to DHS, CBP, and ICE requesting devices." Id. at 679. The court's holding rested on its the return of House's electronics, as well as information refusal to create a special rule for computers, because "[a] on the chain of custody of any copies made of the search of items like a computer, unlike a strip search of a information in his electronic devices. Id. The next day, the person, is not per se embarrassing," particularly where, as devices were returned, but no information was given as to in McAuley's case, that search was done in a private what information, if any, was copied and what was done location where others would not see that he possessed with any such copies. Id. After his devices were returned pornographic material. Id. at 678-79. The court also to him, House filed suit seeking declaratory and found that the existence of a password on the computer injunctive relief, alleging violations of his First and was no more relevant than the existence of a lock on a Fourth Amendment rights. Id. suitcase, neither of which automatically can convert a search from routine to nonroutine. Id. at 678. And in Relying on United States v. Brake, 842 F.2d 509, 512-13 United States v. Romm, the Ninth Circuit upheld a (1st Cir.1988), the district court found that the search of forensic search of a laptop computer at the border without an electronic device lacked the physical contact and force probable cause, 455 F.3d 990, 1006 (9th Cir.2006), but that made searches of the person so invasive and harmful the only issue raised on that appeal was whether the to dignitary interests. House, 2012 WL 1038816, at *6-7. search in question was a border search; the defendant had Accordingly, the court held that "the search of House's waived any argument that the forensic search exceeded laptop and electronic devices is more akin to the search of the valid scope of a border search. Id. at 996-97. a suitcase and other closed containers holding personal information travelers carry with them when they cross the Counsel also have cited several cases in which courts border which may be routinely inspected by customs and upheld searches of computers or other media as supported require no particularized suspicion." Id. at *7. by reasonable suspicion, thereby obviating the need to determine whether the search was routine or nonroutine. Crucial to the court's reasoning was the notion that "[i]t is See, e.g., United States v. Irving, 452 F.3d 110, 124 (2d the level of intrusiveness of the search that determines Cir.2006) (upholding border search of floppy disks and whether the search is routine, not the nature of the device undeveloped film without analyzing what type of search or container to be searched." Id. at *8. Thus the district had occurred because officers had reasonable suspicion); court declined to recognize an exception to the border United States v. Roberts, 274 F.3d 1007, 1012 (5th search doctrine that would give greater protection to Cir.2001) (assuming that search of diskettes was electronically stored information than it would to nonroutine and finding it was supported by reasonable information carried in other formats. Id. But the House suspicion); United States v. Furukawa, No. court relied heavily on Arnold and Ickes and did not 06-145(DSD/AJB), 2006 WL 3330726, at *1-2 (D.Minn. address whether forensic searches inherently may be more Nov. 16, 2006) (finding that search of computer was intrusive than other types of searches of an electronic supported by reasonable suspicion and therefore it did not device. Id. at *7. In any event, the district court found that matter whether it was routine or nonroutine). the chance that House was targeted because of his political views created a sufficient possibility that the motivation underlying the search was unreasonable even if the search itself was not impermissible. Id. at *8. The court also found that there are some limits on how long D. An Analytical Framework for Searches of the government may detain property, even if it Electronic Media legitimately was seized. See id. at *9. The possibility that a forty-nine-day detention was not reasonably related to PI "There is no question that computers are capable of the reasons for detaining the electronic devices also was storing immense amounts of information and often sufficiently strong to defeat a motion to dismiss. Id. at contain a great deal of private information. Searches of *9-10. computers therefore often involve a degree of intrusiveness much greater in quantity, if not different in WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 17 EFTA01207782 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) kind, from searches of other containers." United States v. glass of water to an Olympic swimming pool because Payton, 573 F.3d 859, 862-63 (9th Cir.2009). But the both involve water located in a physical container. Fourth Circuit has stated that a conventional search of a "Judges and lawyers live on the slippery slope of computer is not legally distinct from a conventional analogies; they are not supposed to ski it to the bottom." search of a closed container. See Ickes, 393 F.3d at 503, Robert H. Bork, The Tempting of America: The Political 507; see also Arnold, 533 F.3d at 1010. Seduction ofthe Law 169 (1990). A conventional search at the border of a computer or The courts that have confronted forensic searches have device may include a Customs officer booting it up and struggled to differentiate between general characteristics operating it to review its contents, and seemingly, also of searches of electronic devices and characteristics would allow (but is not necessarily limited to) reviewing a unique to forensic searches as such. See supra (explaining computer's directory tree or using its search functions to that neither Cotterman nor A bidor drew a clear distinction seek out and view the contents of specific files or file between a forensic search and a conventional one). This types. Because electronic storage is logical, not spatial or distinction seems absolutely necessary for analyzing the physical, even a cursory search can be tremendously constitutional requirements for forensic searches. powerful because it can target very specific files or file types. See Orin S. Kerr, Searches and Seizures in a Digital World, 119 Harv. L.Rev. 531, 540, 544-47 (2005). And, just as a luggage lock does not render the contents of a suitcase immune from search, a password I. Issues Raised by Electronic Devices Generally protected file is not unsearchable *561 on that basis alone. See McAuley 563 F.Supp.2d at 678. The proliferation of electronic devices has allowed travelers to carry a tremendous amount of information But seizing a digital device, imaging the entirety of its with them, much of which is likely to be highly personal. contents, and keeping the imaged file in the possession of The sheer quantity of data strains analogies between the government after the device has been returned for the computers and other closed containers. For example, the purpose of subjecting the imaged file to a forensic search, standard size of a checked bag on an international flight is is another matter entirely. In a forensic search of sixty-two linear inches (that is, the total of length plus electronic storage, a bitstream copy is created and then is width plus height) and fifty pounds. See, e.g., American searched by an expert using highly specialized analytical Airlines Baggage Allowance Information, American software—often over the course of several days, weeks, Airlines, httplAvww.aa.corn/i or months—to locate specific files or file types, recover 18n/travelInformation/baggage/ baggageAllowance.jsp# hidden, deleted, or encrypted data, and analyze the !basic-info/ (last visited Apr. 4, 2014) (checked bags may structure of files and of a drive. See Kerr, supra, at be up to 62 linear inches and fifty pounds); Checked Bags 544-47. It is the potentially limitless duration and scope Fees, Delta, of a forensic search of the imaged contents of a digital httplAvww.delta.com/content/www/en_US/traveling-with device that distinguishes it from a conventional computer -us/baggage/before-your-trip/checked.html?icid=Policy_ search. The latter may take hours and delve deeply into Ck_Baggage_Ongoing/ (last visited Apr. 4, 2014) (same); the contents of the device, but it is difficult to conceive of Baggage Policies, U.S. Ainvays, httpJ/ a conventional search of a computer or similar device at a www.usairways.com/enUS/traveltoolsibaggageibaggagep border lasting days or weeks. A forensic examination of olicies.html (last visited Apr. 4, *562 2014) (same); see the imaged content, possibly at a location far from the also Checked Baggage, United, httplAvww. border and using sophisticated electronic search methods united.com/CMS/en-US/travel/Pages/BaggageChecked.as designed to recover even deleted information, is of an px (last visited Apr. 4, 2014) (checked bags may be up to altogether different scope and magnitude. And while 62 linear inches and fifty pounds or up to seventy pounds courts may reach different conclusions about whether for certain passengers). In contrast, LexisNexis estimates forensic searches of digital devices seized at the border that a single gigabyte of data can comprise nearly require reasonable suspicion, they nevertheless should sixty-five thousand pages of Microsoft Word documents, acknowledge the true character of the devices at issue, the over one hundred thousand pages of e-mails, or nearly six amount of data they contain, the mix of personal and hundred seventy-eight thousand pages of text files. business information they store, and the magnitude of LexisNexis, How Many Pages in a Gigabyte, what their contents may reveal about the lives of their httplAvww.lexisnexis.com/applied users. Facile analogies of forensic examination of a discovery/lawlibrary/whitepapers/adi_fs_pagesinagigabyt computer or smartphone to the search of a briefcase, e.pdf (last visited Apr. 4, 2013). If one gigabyte of Word suitcase, or trunk are no more helpful than analogizing a documents was printed on standard, 8.5"x II", twenty WestlawNexi O 2015 Thomson Reuters. No claim to original U.S. Government Works. 18 EFTA01207783 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) pound paper, the paper would occupy enough space to fill time that can be devoted to this while the owner waits at at least four suitcases (each measuring 30" x 20" x the border for the search to conclude and, even if "[t]he 12"—that is, sixty-two linear inches) and would weigh private information individuals store on digital 650 pounds, which would require thirteen checked bags.• devices—their personal 'papers' in the words of the Using this math, the eight-gigabyte USB drive that Constitution—stands in stark contrast to the generic and Saboonchi was carrying could hold the equivalent of impersonal contents of a gas tank," Cottennan, 709 F.3d thirty-two suitcases based on its size and, at 5,200 pounds, at 964 (citing United States v. Jones, — U.S. —, 132 would exceed the weight limit for one hundred checked S.Ct. 945, 957, 181 L.Ed.2d 911 (2012) (Sotomayor, J., suitcases.1S concurring)), a conventional search of a digital device—though by no means limited to Abidor's "quick There also is no question that a conventional search search"—necessarily must focus on turning up evidence allows Customs officers to examine a wealth of of contraband or illegal activity within a reasonably information that limited amount of time. The mere fact that this information may be located more readily on a computer is, by and large, of a highly does not change the nature of the search. See United personal nature: photographs, States v. Knolls, 460 U.S. 276, 285, 103 S.Ct. 1081, 75 videos, written and audio messages L.Ed.2d 55 (1983) (using a beeper to augment visual (text, email, and voicemail), surveillance of a suspect on public roadways was contacts, calendar appointments, permissible because "scientific enhancement of this sort web search and browsing history, raises no constitutional issues which visual surveillance purchases, and financial and would not also raise"). medical records. It is the kind of information one previously would Nor do the privacy concerns raised by such a search differ have stored in one's home that from where a traveler brings a suitcase full of personal would have been off limits to items, files, or a diary. Although it surely is a officers performing [a border discomforting concept, there is no principle beyond the search]. shortness of life and the acknowledgement that there is only so much time available to conduct any particular United States v. Mine, 728 F.3d I, 8 ( I st Cir.2013), cert. border search that prevents a CBP officer from "reading a granted, — U.S. —, 134 S.Ct. 999, 187 L.Ed.2d 848 diary line by line looking for mention of criminal (2014) (internal citations omitted). But this type of search activity." Cf Cotterman, 709 F.3d at 962-63. But in has been indispensable in allowing Customs officers to practice, CBP officers are expected to use their discretion uncover concealed child pornography, see, e.g., Arnold, to focus on more likely evidence of contraband or 533 F.3d at 1005; pictures of terrorist groups, see Abidor, criminality—to ensure that what appears to be a diary is 990 F.Supp.2d at 267-68, 2013 WL 6912654, at *5; and not actually The Anarchist Cookbook, and to move on. evidence of drug activities, *563 see United States v. Rodridiguez, No. C—I 1-344, 2011 WL 3924958, at *2 All of this is not to say that there are not new issues on the (S.D.Tex. Sept. 6, 2011) (CBP agents found pictures of horizon that may not fit into existing frameworks. Cloud marijuana on a cell phone), even when they were computing allows users to store data on a remote server protected by a password, see, e.g., United States v. for easy access from a computer or cell phone, "giv[ing] McAuley, 563 F.Supp.2d at 674. Officers also have found users 'anywhere access' to applications and data stored on evidence of criminal activities in conventional searches of the Internet." David A. Couillard, Note, Defogging the text messages, e-mails, internet histories, and call logs. Cloud: Applying Fourth Amendment Principles to See, e.g., United States v. Finley, 477 F.3d 250, 254 (5th Evolving Privacy Expectations in Cloud Computing, 93 Cir.2007) (scrolling through text messages revealed Minn. L.Rev. 2205, 2216 (2009). These files do not messages related to narcotics use and trafficking); United "cross the border, [but they] may appear as a seamless States v. Kyle, No. CR 10-00245-1 JSW, 2011 WL part of the digital device when presented at the border." 176038, at *2 (N.D.Cal. Jan. 19, 2011) (officers searched Cottennan, 709 F.3d at 965. It is not clear how these files cell phone for e-mails, text messages, and call logs). should be treated in a border search. But even though travelers routinely walk around carrying Even more concerning, Judge Posner has noted that "[a]n digital truckloads worth of data, a conventional search of iPhone application called iCam allows you to access your an electronic device does not differ significantly in scope home computer's webcam so that you can survey the from the search of a suitcase. There is a limited amount of inside of your home while *564 you're a thousand miles away. At the touch of a button a cell phone search WestlawNext' © 2015 Thomson Reuters. No claim to original U.S. Government Works. 19 EFTA01207784 U.S. v. Saboonchl, 990 F.Supp.2d 536 (2014) becomes a house search, and that is not a search of a 'container' in any normal sense of that word, though a house contains data." United States v. Flores—Lopez, 670 F.3d 803, 806 (7th Cir.2012) (internal citations omitted). L The Role ofImaging Software This technology raises the possibility that some conventional searches may run afoul of Kyllo v. United The subject of a forensic search always is a bitstream States, 533 U.S. 27, 38, 121 S.Ct. 2038, 150 L.Ed.2d 94 copy of the data on a device—and copies of the (2001) (holding that advances in technology cannot copy—not the device itself. See Kerr, supra, at 540 ("The "erode the privacy guaranteed by the Fourth actual search occurs on the government's computer, not Amendment"), but these questions are for another court to the defendant's."); see also ICE Report I (noting that consider on another day, and are not before me now. each device was "connected to an XRY imaging machine and a logical image ... was obtained," following which the In sum, the reason why a conventional search of a "device was then returned to evidence storage"). The computer can be analogized to a conventional search of a primary purpose of working from an image is to suitcase is less because a computer is analogous to a "duplicate[ ] every bit and byte on the target drive suitcase than it is because a conventional search has the including all files, the slack space, Master File Table, and same inherent limitations—and the same inherent risk of metadata in exactly the order they appear on the original." invasiveness—irrespective of what is being searched. Kerr, supra, at 541. It also prevents the alteration or loss There is only a finite amount of time available for a CBP of data as a result of the operation of a computer itself. CI agent to detain a traveler at the border to search the Corey J. Mantei, Note, Pornography and Privacy in Plain contents of his suitcase or laptop. If the collected works of View: Applying the Plain View Doctrine to Computer Shakespeare comprise a mere five megabytes of text, see Searches, 53 Ariz. L.Rev. 985, 1007 (2011) ("[A] manual Data Powers of Ten, in How Much Information (2000), search of an operating system may lead to evidentiary httplAvww2.sims.berIceley.edu/research/projects/how-mu issues because *565 of compromised or damaged ch-info/datapowers.html, a conventional search of a hard hardware, data loss, or poor forensic analysis."). drive containing several gigabytes of data cannot possibly encompass every bit of data on the device to be searched But creating an image of a drive has an added benefit to any more than a search of an English major's bags would law enforcement: "Instead of detaining the electronic include a full reading of Hamlet. There simply is not device, CBP or ICE may instead copy the contents of the enough time to do so while both traveler and Customs electronic device for a more in-depth border search at a agent wait at the border. later time." U.S. Dep't of Homeland Sec., Privacy Impact Assessment for the Border Searches ofElectronic Devices 8 (Aug. 25, 2009), http://www.dhs. gov/xlibrary/assets/privacy/privacy_pia_cbp_laptop.pdf [hereinafter Privacy Impact Assessment]. This allows for 2. Issues Unique to Forensic Searches searches to extend far beyond the time that an actual physical search at the border would have been performed. In contrast, a forensic search is a different search—not Whereas the sixteen hour detention of Montoya de merely a search of a different object—and it Hernandez "undoubtedly exceed [ed] any other detention fundamentally alters the playing field for all involved. A ... approved under reasonable suspicion," Montoya de forensic search requires the creation of a bitstream copy Hernandez, 473 U.S. at 543, 105 S.Ct. 3304, "[c]omputer and its thorough analysis with specialized software over searches tend to require fewer people but more time," an extended period of time. See Kerr, supra, at 540, Kerr, supra, at 544, and the forensic review of imaged 544-47. This type of search raises issues that do not arise files routinely lasts days if not weeks, see, e.g., United in conventional searches. First, because the item searched States v. Mutschelknaus, 592 F.3d 826, 828 (8th Cir.2010) is a bitstream copy of a device, it may take place long (search warrant provided for search of home within ten after the device itself has been returned to its owner and days, but allowed an additional sixty days for the forensic therefore a forensic search is unbounded in time. Second, review of computers). Indeed, the Federal Rules of a forensic search allows officers to recover a wealth of Criminal Procedure acknowledge this by expressly information even after it has been deleted. And third, a providing that the fourteen-day time limit to execute a forensic search provides information about a person's warrant applies only to "the seizure or on-site copying of domestic activities away from the border that is not the media or information, and not to any later off-site otherwise available even in a conventional search taking copying or review." Fed.R.Crim.P. 41(c)(2)(8). To the place at the border. extent that the ability exists to execute a search long after a physical device has been returned to its owner, this WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 20 EFTA01207785 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) allows Customs officers to search a computer days or [M]arlcing a file as "deleted" normally does not actually even weeks after it physically has entered the country. In delete the file; operating systems do not "zero out" the such circumstances, it no longer can be said that the zeroes and ones associated with that file when it is purpose of the search is to prevent contraband from marked for deletion. Rather, most operating systems entering the country, and the search has become merely go to the Master File Table and mark that uncoupled from the rationale for its justification. See particular file's clusters available for future use by Flores—Montano, 541 U.S. at 153, 124 S.Ct. 1582. Also, other files. If the operating system does not reuse that forensic "[c]omputer searches lower the cost and cluster for another file by the time the computer is inconvenience of invasive searches, making such searches analyzed, the file marked for deletion will remain the norm rather than the exception." Kerr, supra, at undisturbed. Even if another file is assigned to that 569-70. If unchecked by even the need to show cluster, a tremendous amount of data often can be something as minimal as articulable suspicion, a forensic recovered from the hard drive's "slack space," space search of a hard drive containing vast amounts of digital within a cluster left temporarily unused. It can be information, unbounded by limits of time, space, or accessed by an analyst just like any other file. human stamina, bears little resemblance to the type of search that historically has been justified in the name of Computer operating systems and programs also securing the borders of the country. generate and store a wealth of information about how the computer and its contents have been used. As And "even if the initial seizure of a laptop and other more programs are used, that information, called electronic devices at the border requires no reasonable metadata, becomes broader and more suspicion, the '[g]overnment cannot simply seize property comprehensive. For example, the popular Windows under its border search power and hold it for weeks, operating system generates a great deal of important months, or years on a whim.' " House v. Napolitano, No. metadata about exactly how and when a computer 11-10852-DX, 2012 WL 1038816, at •9 (D.Mass. has been used. Common word processing programs March 28, 2012) (quoting U.S. v. Cotterman, 637 F.3d such as WordPerfect and Microsoft Word generate 1068, 1070, 1082-83 (9th Cir.2011) (alteration in temporary files that permit analysts to reconstruct the original)). Even when acting under the border search development of a file. Word processing documents doctrine, a particularly lengthy seizure raises concerns can also store data about who created the file, as well where "the detention [is not] reasonably related in scope as the history of the file. Similarly, browsers used to to the circumstances which justified it initially." Montoya surf the World Wide Web can store a great deal of de Hernandez, 473 U.S. at 542, 105 S.Ct. 3304. detailed information about the user's interests, Assuming, without deciding, that the creation and habits, identity, and online whereabouts, often retention of a bitstream copy implicates at least some of unbeknownst to the user. Browsers typically are the same concerns as a traditional seizure of physical programmed to automatically retain information evidence," there is a fundamental difference between about the websites users have visited in recent allowing a Customs •566 officer to review a computer as weeks; users may use this history to retrace their it crosses the border and allowing CBP, HSI, and related steps or find webpages they previously visited. Some agencies to use a border crossing as a license to obtain a of this information may be very specific; for full copy of any electronic device to be perused at a later example, the address produced by an Internet search date. engine query generally includes the actual search terms the user entered. Id. at 542-43 (footnotes omitted). Indeed, even reformatting a hard drive—which long has ii. Access to Deleted Data been described as •567 the only truly final way to delete sensitive information from a drive—often "erases less A forensic search also exposes an entirely different body than 1/10th of one percent of the data on the disk, such of data from any conventional search: It is the only means that anyone with rudimentary computer forensic skills can by which deleted data can be recovered." See Kerr, supra, recover your private, privileged and confidential data. If at 542-43. Indeed, one of the specific purposes of the it's not overwritten or physically destroyed, it's not forensic search in this case was to "allow[ ] the gone." Craig Ball, Computer Forensics for Lauyers Who unallocated sectors of the disk to be searched and Can't Set a Digital Clock 3, 25, in Five on Forensics examined" to recover deleted files. ICE Reports 2. As (2008), http://www. craigball.com/_OFFLINEJcipdf. Kerr explained: This means that Abidor's injunction that users should " '[t]hink twice about the information [they] carry on [their] WestlawNexr © 2015 Thomson Reuters. No claim to original U.S. Government Works. 21 EFTA01207786 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) laptop,' " Ahidor, 990 F.Supp.2d at 277, 2013 WL Chris Foresman, Android Phones Keep Location Cache, 6912654, at •14 (quoting Airport Insecurity: The Case of Too, But It's Harder to Access, Ars Technica (Apr. 22, the Lost & Missing Laptops, Ponemon Institute LLC, 3 2011 2:37 PM), http://arstechnica. (July 29, 2008), httpifwww.dell.com/ corn/gadgets/20I I /04/android-phones-keep-location-each downloads/global/services/dell_ etoo-but-its-harder-to-access/. In Saboonchi's case, the lost_laptop_study_emea.pdf), misses the point. No matter search also recovered WiFi connection information, ICE how many times a user tries to protect herself by Reports 2, that can be used to determine a user's location, removing private or extraneous data from her computer, see Foresman, supra. That means that a Customs officer her efforts will be fruitless in the event of a forensic performing a forensic search can recreate the most search capable of uncovering anything that may have intimate details of a person's life over the course of the been on the computer at any point in time. And these files last several months—even if the data includes highly can remain in a computer's slack space for "months, even personal details of what transpired before leaving the years," Philip N. Yannella, How the Latest Advances in country or while in one's own home. See In re Computer Forensic Analysis Are Impacting Litigation Application of United States, 849 F.Supp.2d 526, 540 Matters, Aspatore, Aug. 2013, 2013 WL 3759816, at •1, (D.Md.20II) ("Location data from a cell phone is meaning that a user who wishes to be protected against distinguishable from traditional physical surveillance forensic border searches would be well advised never to because it enables law enforcement to locate a person put private or personal data on her computer or entirely divorced from all visual observation."). smartphone; by the time a foreign trip is on the horizon it "Indiscriminate monitoring of property that has been will be far too late to delete any such data." withdrawn from public view would present far too serious a threat to privacy interests in the home to escape entirely And even if a user never saves any data, there still is no some sort of Fourth Amendment oversight." United States guarantee of protection because a forensic search can v. Karo, 468 U.S. 705, 716, 104 S.Ct. 3296, 82 L.Ed.2d recover even some unsaved data. This goes beyond a 530 (1984). mere search of one's "papers" to a review of their thoughts and ideas left unspoken.'° It may include deeply And this is to say nothing about the reams of data that, personal thoughts that no sooner were typed than deleted, though readily available on a smartphone or computer, months—or years-old Internet search history and nevertheless are unlikely to be reviewed and analyzed at communications, and pictures or documents long-since length in a conventional search. The forensic searches of discarded. Rather than a search of a suitcase, this would Saboonchi's Devices recovered contacts, call logs, be as if, by opening a suitcase, a Customs officer could calendar entries, text messages, email, chat logs, web determine everywhere the suitcase had been taken, browser information, photos, documents, and video files. everything that had been packed within it, when and how ICE Reports 2; see also supra (explaining that forensic it was acquired, and when each item last had been worn. searches essentially are unbounded in time). The prospect stretches the computer-to-closed-container analogy beyond its breaking point. iv. A Forensic Search Is Sui Generis lit Access to ProtectedInformation Taking all of this into account, I cannot help but find that even if a computer or cell phone is analogized to a closed A forensic search of a mobile device also can reveal a container, a forensic search cannot be analogized to a wealth of data about a user's thy-to-thy life. "Security conventional search of luggage or even of a person. A researchers have discovered that Apple's iPhone keeps forensic search is far more invasive than any other track of where you go—and saves every detail of it to a property search that I have come across and, although it secret file on the device," including latitude and longitude lacks the discomfort or embarrassment that accompanies a data and timestamps, for up to a year. Charles Arthur, body-cavity search, it has the potential to be even more iPhone Keeps Record of Everywhere You Go, The revealing. Guardian (U.K.) (Apr. •568 20. 2011 9:06 AM), httplAvww.theguardian. A conventional computer search allows Customs officers corn/technology/201I /apr/20/iphone-tracking-prompts-pri to choose, within the finite amount of time available to vacyfears. Devices using the Android operating system them while they detain the traveler, to decide where, also store similar data, gleaned from cell tower within a veritable mountain of personal data, to focus triangulation and from WiFi networks that they encounter. their attention while searching for contraband, threats, or WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 22 EFTA01207787 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) criminality. And at the end of a conventional search, as forensic computer search—it essentially is a body cavity with the conventional search of a suitcase, a traveler search of a computer. If any property search can be regains custody of his possessions and information and considered nonroutine, a forensic search of an electronic proceeds about his business with a minimum of lingering device must fall into that category. Its ability to plumb the inconvenience. A forensic search, on the other hand, depths of a traveler's data differs not only in degree, but allows a Customs officer to give uniquely probing review in kind, from conventional searches. Accordingly, under not only to the files on one's computer, but also any files the facts presented to me in this case, I find that a search that ever may have been on that computer. And even after of imaged hard drives of digital devices taken from the a traveler is cleared to enter the country, the search may Defendant at the border and subjected to forensic continue for months or even years afterwards. examination days or weeks later cannot be performed in the absence of reasonable suspicion. Applying the Brakc factors, there is no doubt that such a search results in the exposure of intimate details and abrogates a traveler's reasonable expectations of privacy in his or her most personal and confidential affairs—including in information that, from the user's v. The Scope of this Ruling perspective, no longer even exists. United States v. Brakc, 842, *569 F.2d 509, 512 (1st Cir.1988). And although I also must clarify what I do not hold today. First, nothing such a search may not always involve physical contact or in this opinion departs from the Fourth Circuit's holding force, id., a Customs officer at least must make contact in Ickes. It would be unworkable to develop a different set with a device to operate it, and it is not unheard of for of rules for conventional border searches of computers, officers to apply some measure of additional force to the not to mention for anything capable of containing item searched, see Abidor, 990 F.Supp.2d at 268, 2013 expressive material. See Ickes, 393 F.3d at 506. WL 6912654, at *5 (noting that it looked like the plaintiff's devices "had been physically opened"), and in I also do not define a forensic search in terms of the any event it frequently deprives the person whose devices amount of data that is recovered, thereby leaving the are searched of his or her possessions for several days, if status of a given search to be resolved later by Customs not weeks, see, e.g., Def.'s Mot. 3, 6 (noting that the officers. CI Cotterinan, 709 F.3d at 967. A forensic Devices were confiscated on March 31, 2012 and returned search is a different procedure, fundamentally, from a to Defendant two weeks later on April 13, 2012); Abidor, conventional search. It occurs when a computer expert 990 F.Supp.2d at 268, 2013 WL 6912654, at •5 creates a bitstream copy and it analyzes it by means of ("Abidor's laptop and external drive were returned to him specialized software. Because the distinction between a eleven days later by mail."); House, 2012 WL 1038816, at conventional computer search at the border that requires *4 (plaintiffs devices were in government custody for no showing of suspicion and a forensic examination of the forty-nine days). imaged hard drive of a computer or digital device is easy to distinguish, the narrow holding of this decision does My conclusion becomes even more clear if I focus on the not hamper the ability of Customs officers to perform potential for personal indignity and intrusiveness—as did their duties when *570 conventionally searching digital the Eleventh Circuit in Vega—Barvo—because a computer devices at the border. forensic search is at least as invasive as an x-ray, takes longer, and reveals considerably more information. See Moreover, as explained, forensic searches are not United States v. Vega-Ban'o, 729 F.2d 1341, 1345 (1 1 th prohibited—or even subject to a difficult or exacting level Cir.1984). And, particularly because it may contain of constitutional scrutiny. All that is required is that a location data, a forensic search of a mobile device also Customs officer has reasonable suspicion—that is, a " may reveal information about what goes on within the 'particularized and objective basis for suspecting the privacy of one's home, which even at the border is subject particular' " device to be searched contains contraband or to heightened protection. See United States v. Whined, evidence of criminal activity. See Montoya de Hernandez, 541 F.3d 480, 488 (3d Cir.2008). 473 U.S. at 541-42, 105 S.Ct. 3304 (quoting United States v. Cortez, 449 U.S. 411, 417, 101 S.Ct. 690, 66 It is true that there are not many existing cases in which L.Ed.2d 621 (1981)). This standard is far from onerous property searches were found to be nonroutine, but the and still leaves officers with considerable freedom to Supreme Court has not foreclosed the possibility that such search suspicious persons and respond to unexpected a category of search may exist. See Flores—Montano, 541 factual developments. See, e.g., United States v. U.S. at 154 n. 2, 124 S.Ct. 1582. It is difficult to conceive Brignoni—Ponce, 422 U.S. 873, 884-85, 95 S.Ct. 2574, 45 of a property search more invasive or intrusive than a L.Ed.2d 607 (1975) ("Any number of factors may be WestlawNexts © 2015 Thomson Reuters. No claim to original U.S Government Works. 23 EFTA01207788 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) taken into account in deciding whether there is reasonable United States v. Stewart, 729 F.3d 517, 520 (6th suspicion to stop a car in the border area.... In all Cir.2013); Abidor, 990 F.Supp.2d at 282-83, 2013 WL situations the officer is entitled to assess the facts in light 6912654, at •18-19; see also *571 United States v. of his experience in detecting illegal entry and Irving 452 F.3d 110, 124 (2d Cir.2006); United States v. smuggling." (citations omitted)). Roberts, 274 F.3d 1007, 1012 (5th Cir.2001); United States v. Furukawa, No. 06-145(DSD/AJB), 2006 WL Nor is my ruling likely meaningfully to change anything 3330726, at *1-2 (D.Minn. Nov. 16, 2006). that actually happens at the border. The Department of Homeland Security has advised CBP officers that "[l]n the course of a border search, with or without individualized suspicion, an Officer may examine electronic devices and may review and analyze the E. The Search of Saboonchi's Devices Was Supported information encountered at the border." CBP Directive § by Reasonable Suspicion 5.1.2, Privacy Impact Assessment Attachment I. This has not changed. CBP Officers also might detain an electronic PI When Saboonchi arrived at the Rainbow Bridge on device "to perform a thorough border search." CBP March 31, 2012, he already was the subject of an Directive § 5.3.1. So long as that search is conventional, investigation. His name had come up in connection with and not forensic—and so long as the time for which the two different investigations of export violations. Baird Tr. device is detained is reasonably related in scope to the 10:21-11:23. Several subpoenas seeking evidence about circumstances requiring the search, see House, 2012 WL Saboonchi's dealings already had been issued and were 1038816, at •9—this also remains permissible. Insofar as returned in early March 2012. Id. at 11:24-12:2. The CBP only will retain information beyond the length of the information that was received in response to those initial search with probable cause, CBP Directive § subpoenas showed that Saboonchi had purchased two 5.4.1.1, that requirement goes beyond anything required cyclone separators after representing that they would be by this opinion. And although there is some lack of clarity used domestically, id. at 12:13-22, and then shipped them as to precisely when and how DHS allows data to be overseas, id. at 12:2-7, understating the value of the analyzed, it has noted that data typically will be cyclone separators in a manner consistent with an attempt retained—that is, "store[d] ... in any of their to avoid scrutiny, id. at 16:6—8. Special Agent Baird also recordkeeping systems"—if "the border search reveals had determined that the recipient of the cyclone information relevant to immigration, customs, or other separators, General DSAZ, was linked to an industrial laws enforced by DHS." Privacy Impact Assessment 5. parts company in Iran. Id. at 12:8-12. Again, this remains permitted because it presupposes a reasonable suspicion. All of this is more than sufficient to give rise to reasonable, particularized suspicion—if not probable Finally, I am not aware of a single case that would have cause—that Saboonchi was involved in violations of reached a different outcome on the basis of the reasoning export restrictions on Iran. Accordingly, CBP and HSI in my ruling here. Put simply, Customs officials do not officers did not violate the Fourth Amendment when they have the time or resources—or, most likely, the seized Saboonchi's Devices and subjected them to a inclination—to perform random or suspicionless forensic forensic search. searches. See, e.g., United States v. Chaudlny, 424 F.3d 1051, 1054 (9th Cir.2005) (Fletcher, l., specially concurring) ("As a practical matter, border agents are too IV. CONCLUSION busy to do extensive searches (removing gas tanks and In sum, for the reasons stated above, Defendant's Motion door panels, boring holes in truck beds) unless they have to Suppress, ECF No. 58, is DENIED, as was ordered on suspicion."); Abidor, 990 F.Supp.2d at 282, 2013 WL the record in open Court. 6912654, at •18 ("I would agree with the Ninth Circuit that, if suspicionless forensic searches at the border threaten to become the norm, then some threshold showing of reasonable suspicion should be required."). All Citations Indeed, neither I nor the parties have found any case where a forensic search was performed in the absence of 990 F.Supp.2d 536 reasonable suspicion, see Cotterman, 709 F.3d at 970; Footnotes WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 24 EFTA01207789 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) On December 12, 2013, subsequent to the hearing on this motion, a second superseding indictment was returned that added an additional count against Saboonchi. See Second Superseding Indictment, ECF No. 95. 2 Imaging a hard drive is the first step of a forensic search and involves making a copy of a storage device that is known as an "image," "bitstreant" copy, or "forensic" copy. See Orin S. Kerr, Searches and Seizures in a Digital World. 119 Harv. L.Rev. 531, 540-41 (2005). "A Bit Stream Backup is an exact copy of a hard drive, preserving all latent data in addition to the files and directory structures." The Sedona Conference Glossary: E-Discovery & Digital Information Management 6 (3d ed.2010). 3 TECS (not an acronym) is the updated and modified version of the former Treasury Enforcement Communications System. TECS is owned and managed by the U.S. Department of Homeland Security's (DHS) component U.S. Customs and Border Protection (CBP). TECS is the principal system used by officers at the border to assist with screening and determinations regarding admissibility of arriving persons. U.S. Dep't of Homeland Sec., Privacy Impact Assessment Update for the TECS System: CBP Primary and Secondary Processing (TECS) National SAR Initiative 2 (Aug. 5, 2011), available at littps:/Avww.dhs. gov/xlibrary/assets/privacy/privacy-pia-cbp-tecs-sar-update.pdf. 4 Saboonchi does not appear to have challenged the investigation up to this point; nor is it clear that he would have standing to challenge subpoenas issued to unrelated third parties in any event. See United States v. Payner, 447 U.S. 727, 732, 100 S.Ct. 2439, 65 L.Ed.2d 468 (1980) ("[A] court may not exclude evidence under the Fourth Amendment unless it finds that an unlawful search or seizure violated the defendant's own constitutional rights." (emphasis added) (citation omitted)). 5 Rashti has been indicted as a coconspirator in this case under the name Arash Rashti Mohammad, see Second Superseding Indictment, ECF No. 95, but because Rashti is an Iranian national currently located in Iran, id. ¶ 5, the United States has not been able to acquire jurisdiction over him or to bring him before a judicial officer of this Court. 6 Although it is not entirely clear that the reason why Saboonchi was flagged in the TECS database is relevant to determining whether CBP agents acted permissibly in relying on the database, see Herring v. United States, 555 U.S. 135, 129 S.Ct. 695, 172 L.Ed.2d 496 (2009) (recognizing good-faith exception to exclusionary rule even where search resulted front police negligence), to the extent that Baird's entry in TECS was based on reasonable, articulable suspicion, it obviates the need to analyze the good faith of the officials involved. 7 Saboonchi now has changed counsel and his new attorney has filed a Motion to Suppress Statements, ECF No. 110, asserting, inter alia. Fifth Amendment violations arising out of the April 13, 2013 encounter. Id. 12(b). Though similar issues were addressed at the motions hearing, nothing herein is intended to relate to the resolution of the merits of Saboonchi's new motion to suppress. 8 CBP and HSI attempt to distinguish between a "detention" and a "seizure." See Burkhardt Tr. 57:16-17 ("I don't mean to get technical, but CBP does not seize, we detain."); see also U.S. Dep't of Homeland Sec., Privacy Impact Assessment for the Border Searches of Electronic Devices 5 (Aug. 25, 2009), available at http:/Avww.dhs. gov/xlibrary/assets/privacy/privacy_pia_cbp_laptop.pdf (defining a "detention" as "a temporary detention of the device during an ongoing border search" and "seizure" as occurring only "when CBP or ICE determines there is probable cause to believe a violation of law ... has occurred"). As explained on the record, however CBP and HSI may choose to characterize their actions, it was a constitutional seizure "the minute [the Devices were] taken," so that this distinction is not relevant for purposes of the Fourth Amendment. See Ruling Tr. 30:10-19. 9 The mere act of marking a file as "deleted" does not actually delete it from a computer; rather, it merely removes references to the file from the computer's Master File Table, which marks the data clusters where the file is located as available for future use. The file itself will remain until those clusters actually are overwritten or are "zeroed out" so as to remove the file itself from the computer. Kerr, supra, at 542-43. IO The court in Abidor held that "declaratory relief is not appropriate because it is unlikely that a member of the association plaintiffs will have his electronic device searched at the border, and it is far less likely that a comprehensive forensic search would occur without reasonable suspicion." 990 F.Supp.2d at 274, 2013 WL 6912654, at •II. With respect to Abidor himself, it also found that DHS already had deleted the inmges taken from his electronic devices. Id. "More significantly, however, [the court found it] difficult to understand how a threshold requirement of reasonable suspicion significantly alleviates the alleged harm that plaintiffs fear." Id. at 276, at •13. Noting that there was no claim for damages, the court held that the plaintiffs lacked standing for the declaratory relief they sought. Id. at 275-77, at *12-13. The Supreme Court expressly has rejected the practice of" 'assuming' jurisdiction for the purpose of deciding the merits—the doctrine of 'hypothetical jurisdiction.' "Steel Co. v. Citizensfor a Better DIV .:, 523 U.S. 83, 94, 118 S.Ct. 1003, 140 L.Ed.2d 210 WestlawNeff © 2015 Thomson Reuters. No claim to original U.S. Government Works. 25 EFTA01207790 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) (1998) (citation omitted). "Hypothetical jurisdiction produces nothing more than a hypothetical judgment—which comes to the same thing as an advisory opinion, disapproved by this Court from the beginning." Id. at 101, 118 S.Ct. 1003 (citing Muskrat v. United Suites. 219 U.S. 346, 362, 31 S.Ct. 250, 55 L.Ed. 246 (1911); Hayburn's Case. 2 U.S. (2 Dall.) 409, I L.Ed. 436 (1792)). Although Abidor's statements on forensic searches may amount to an advisory opinion, because of the paucity Mother case law on the issue—and because of the sweeping statements made in Abidor—I consider its reasoning nevertheless even if it is not clear that it is precedential. 12 It is worth noting that Abidor relied heavily on Camara V. Municipal Court. 387 U.S. 523, 87 S.Ct. 1727, 18 L.Ed.2d 930 (1967), which upheld a warrantless building inspection to enforce municipal codes, weighing the public interest served by such searches against the fact that the "inspections are neither personal in nature nor aimed at the discovery of evidence of crime." Camara, 387 U.S. at 537, 87 S.Ct. 1727. There is little question that border searches frequently are personal in nature; nor is there a genuine dispute that Saboonchi was searched in an attempt to disclose evidence of prior crimes, and not because his entry was believed to be a security threat in and of itself. 13 In June 2010, House and others organized political support for the defense of Bradley Manning, a United States serviceman deployed in Iraq who was arrested in May 2010 on suspicion of having disclosed restricted material to WikiLeaks.... The Bradley Manning Support Network J, formed by [louse and others, is an unincorporated association of individuals and organizations. The Support Network is an "international grassroots effort to help accused whistle blower Pfc. Bradley Manning." House, 2012 WL 1038816, at •2 (internal citations omitted). 14 One ream of twenty pound paper weighs five pounds and contains five hundred pages; one case of paper contains ten reams and, according to Amazon.com, has the approximate dimensions of 17.6" x 115" x 10.8". Xerox 4200 Business Multipurpose White Paper, 92 Bright. 8-1/2 x 11, 10 Reams/Carton (XER3R2047), Amazon.com, http://wvAv.amazon.com/Xerox-Business Multipurpose-Bright-XER3R2047/dp/B0000931O4/ref-sr_1_7?ie-UTF 8&gid•.1392922161&sr-8-7 (last visited Apr. 4, 2014). IS The USB drive likely is only the tip of the iceberg. The iPhone 4s that Saboonchi was carrying, see ICE Report I, is available with a storage capacity ranging from eight to sixty-four gigabytes. ldentifring iPhone Models. Apple.com, lutp://support.apple.comflcbtht3939 (scroll to iPhone 4s) (last visited Apr. 4, 2014). The Sony Ericsson Xperia phone that Saboonchi was carrying contained a microSD card with a sixteen gigabyte capacity. See Ice Report 1. A microSD card provides removable storage for up to 128 gigabytes, see, e.g.. Sandisk microSD Cards, SanDisk, lutp://www.sandisk.comiproducts/memory-cards/microsd/ (last visited Apr. 4, 2014), and is about the size of a thumbnail, see, e.g., SanDisk Ultra 128 GB microSDXC UHS-1 Card with Adapter (SDSDQUA 128G-G464). Amazon.com, lutp://www.amazon.corn/SanDisk-Ultra-microSDXC-Adapter-SDSDQUA-128G-G46 A/dp/BOOILI6W4S/ref-isr_l281?sic&i&UTF8&qid1393515338&s 1-28&keyworis•micro+sd+128gb (listing the dimensions of a microSD card as 0.6" x 0.4") (last visited Apr. 4, All of this pales in comparison to laptop computers currently being sold with a hard drive capacity of up to one terabyte (1,024 gigabytes). See, e.g., Compare Mac Models, Apple.com, littp://vAvw.apple.comimackompare/ notebooks.html (listing standard hard drive size for a MacBook Pro as up to one terabyte) (last visited Apr. 4, 2014). 16 It is not entirely clear whether retaining an image of electronic data constitutes a "seizure." In the physical world, it has been established that so long as an action does not "'meaningfully interfere' with [the owner's] possessory interest," a seizure has not occurred even if information related to an item is recorded. See Arizona v. Hicks. 480 U.S. 321, 324, 107 S.Ct. 1149, 94 L.Ed.2d 347 (1987). But electronic information is "nonrivalrous. It simply cannot be 'used up.' Indeed, copying information actually multiplies the available resources," so that both the original owner and the copier may have equally good copies of the same data. Mark A. Lemley, Er Ante Versus Er Post Justifications for Intellectual Property. 71 U. Chi. L.Rev. 129, 143 (2004). At the very least, it has been suggested that generating a bitstreani copy at least could be considered "a search or seizure based on its interference with the owner's property rights." See, e.g., Kerr, supra, at 535. 17 And unlike when physical trash is discarded, information deleted from an electronic device is not othenvise exposed to the public. C.1 California V. Greennvod, 486 U.S. 35, 40, 108 S.Ct. 1625, 100 L.Ed.2d 30 (1988). 18 Though there are tools, such as Apple's "Secure Empty Trash" feature, see OS XMountain Lion: Prevent Deleted Filesfrom Being Read, Apple.com, littp://support.apple.com/kb/PH 11124 (last visited Apr. 4, 2014), that may enable a user permanently to erase data from a computer, these are special features or applications that a typical user may not even be aware of, and their existence does not affect the reality that the overwhelming majority of users of electronic devices operate under the reasonable belief that once they have deleted an item permanently, it is gone. 19 This problem was even more prevalent under older file systems, in which unfilled clusters would be "padded" with whatever happened to be in the computer's Random Access Memory at that moment—which would include whatever the user had done recently irrespective of whether it ever was saved to disk. See Ball, supra, at 27. WestlawNext' © 2015 Thomson Reuters. No claim to original U.S. Government Works. 26 EFTA01207791 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) End of Document C 2015 Thomson Reuters. No claim to original U.S. Government Works. WestlawNexi © 2015 Thomson Reuters. No claim to original U.S. Government Works. 27 EFTA01207792