EFTA01207793

United States v. Kim, — F.Supp.3d (2015) 2015 WL 2148070 Only the Westlaw citation is currently available. West Headnotes (14) United States District Court, District of Columbia. Arrest United States of America 4 -Reasonableness; reason or founded v. suspicion, etc Jae Shik Kim, Karham Eng. Corp., Defendants. Law enforcement officer has reasonable Crim. Action No. 13—oloo (ABJ) J Signed May 8, suspicion of criminal activity, of kind sufficient 2015 to support investigatory stop, if officer can point to specific and articulable facts which, when considered together with rational inferences that Synopsis can be drawn from those facts, indicate that Background: Defendant charged with violating export criminal activity may be afoot. U.S. Const. control laws moved to suppress evidence discovered Amend. 4. during warrantless search of laptop computer that was seized as he was departing from the United States for his Cases that cite this headnote home country of Korea. Holdings: The District Court, Amy Berman Jackson, J., Arrest held that: oiFReasonableness; reason or founded suspicion, etc In mere fact that alien may have previously participated in unlawful export of controlled articles to Iran in violation Court's determination of whether officer had of export control laws did not provide special agent of the reasonable suspicion of criminal activity, of kind Department of Homeland Security (DHS) with reasonable required to support investigatory stop, must be suspicion of any ongoing or imminent criminal activity, based on totality of the circumstances. U.S. of kind sufficient to support seizure and search of Const. Amend. 4. contents of alien's laptop computer as he was departing for his home country of Korea following his most recent visit to the United States; Cases that cite this headnote (2)in assessing reasonableness of search„ it was not appropriate for court to simply categorize the laptop as "container," of kind which may be subjected to warrantless search at border; and PI Arrest (iReasonableness; reason or founded P) search was supported by so little suspicion of ongoing suspicion, etc or imminent criminal activity, and was so invasive of defendant's privacy and so disconnected from not only Reasonable suspicion of criminal activity, of the considerations underlying the breadth of government's kind required to support investigatory stop, is authority to search at border, but also the actual border reasonable suspicion of ongoing or imminent itself, that it was unreasonable and violative of Fourth crime. U.S. Const. Amend. 4. Amendment. Cases that cite this headnote Motion granted. WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 1 EFTA01207793 United States v. Kim, — F.Supp.3d (2015) Customs Duties international border. U.S. Const. Amend. 4. ii-Particular Objects or Products Mere fact that alien may have previously Cases that cite this headnote participated in unlawful export of controlled articles to Iran in violation of export control laws did not provide special agent of the Department of Homeland Security (DHS) with 171 Customs Duties reasonable suspicion of any ongoing or imminent criminal activity, of kind sufficient to 6-Grounds or cause for stop, search, or seizure support seizure and search of contents of alien's laptop computer as he was departing for his Routine searches of the persons and effects of home country of Korea following his most entrants at international border are not subject to recent visit to the United States, where alien had any requirement of reasonable suspicion, business interests in the United States sufficient probable cause, or warrant. U.S. Const. Amend. to explain his frequent visits, where prior 4. incident in which alien allegedly participated in unlawful export of controlled articles to Iran did Cases that cite this headnote not involve his travel to the United States, and where special agent conducted no surveillance of alien while he was in the United States on his latest trip and uncovered nothing during his encounter with alien in airport to suggest any IBI Searches and Seizures ongoing or imminent violation of export laws. it-Fourth Amendment and reasonableness in U.S. Const. Amend. 4. general Ultimate touchstone of validity of search under Cases that cite this headnote the Fourth Amendment is reasonableness. U.S. Const. Amend. 4. Cases that cite this headnote Arrest -4Reasonableness; mason or founded suspicion, etc Evidence of prior criminal conduct alone is 191 Searches and Seizures insufficient to give rise to reasonable suspicion P-Necessity of and preference for warrant, and of ongoing or imminent criminal activity, of exceptions in general kind required to support investigatory stop. U.S. Const. Amend. 4. When search is undertaken by law enforcement officials to discover evidence of criminal wrongdoing, reasonableness generally requires Cases that cite this headnote the obtaining of judicial warrant. U.S. Const. Amend. 4. Cases that cite this headnote 1'1 Aliens, Immigration, and Citizenship 6.-Border Stops and Inspections Customs Duties -4Searches and Seizures Ira Searches and Seizures Government's interest in preventing the entry of -4Necessity of and preference for warrant, and unwanted persons and effects is at its zenith at exceptions in general WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 2 EFTA01207794 United States v. Kim, — F.Supp.3d (2015) longstanding right of the sovereign to protect In the absence of warrant, search is reasonable itself by stopping and examining persons only if it falls within a specific exception to crossing into the country, are reasonable simply warrant requirement. U.S. Const. Amend. 4. by virtue of fact that they occur at the border. U.S. Const. Amend. 4. Cases that cite this headnote Cases that cite this headnote Ittl Customs Duties ti-Particular Objects or Products Itrl Customs Duties iTime and distance factors; checkpoints In assessing the reasonableness, for Fourth Customs Duties Amendment purposes, of law enforcement ti.Scope and Nature; Successive or Secondary agent's conduct in seizing laptop computer of Searches alien suspected of having violated export laws in the past before alien boarded aircraft to return to Law enforcement agent's imaging and search of his home country of Korea, and in having hard entire contents of alien's laptop computer, aided drive copied so that it could be subjected to by specialized forensic software, over period of search of indefinite duration using specialized unlimited duration and conducting examination computer software, it was not appropriate for of unlimited scope, for the purpose of gathering court to simply categorize the laptop as evidence of pre-existing export violation, was "container," of kind which may be subjected to supported by so little suspicion of ongoing or warrantless search at border, especially given imminent criminal activity, and was so invasive the wealth of personal information that could be of alien's privacy and so disconnected from not stored on laptop and fact that actual examination only the considerations underlying the breadth and analysis of contents of laptop's hard drive of government's authority to search at border, occurred over period of weeks at location far but also the actual border itself, that it was removed from border; rather, to determine unreasonable and violative of alien's Fourth constitutionality of agent's conduct, district Amendment rights. U.S. Const. Amend. 4. court had to proceed by assessing, on the one hand, the degree to which search intruded on alien's privacy and, on the other, the degree to Cases that cite this headnote which it was necessary for promotion of legitimate governmental interests. U.S. Const. Amend. 4. Ildj Aliens, Immigration, and Citizenship Cases that cite this hcadnotc tii heckpoints Customs Duties i•Time and distance factors; checkpoints Concept of "border" search, for Fourth 1121 Aliens, Immigration, and Citizenship Amendment purposes, extends beyond the eBorder Stops and Inspections physical boundary itself to the functional Customs Duties equivalent of border, which may include an ti•Searches and Seizures established station near the border or other nearby convenient locations. U.S. Const. Government's power to conduct warrantless Amend. 4. searches at the border arises out of the sovereign's right and need to protect its territorial integrity and national security; Cases that cite this headnote searches made at the border, pursuant to WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 3 EFTA01207795 United States v. Kim, — F.Supp.3d (2015) border to protect the homeland is the beginning and end of the matter. Attorneys and Law Firms But to apply those principles under the facts of this case would mean that the border search doctrine has no Frederick Walton Yette, U.S. Attorney's Office, borders. The search of the laptop began well after Kim Washington, DC, for United States of America. had already departed, and it was conducted approximately 150 miles away from the airport. The government engaged in an extensive examination of the entire contents of Kim's hard drive after it had already been secured, and it accorded itself unlimited time to do so. MEMORANDUM OPINIONAND ORDER There was little or no reason to suspect that criminal activity was afoot at the time Kim was about to cross the border, and there was little about this search—neither its AMY BERMAN JACKSON, United States District Judge location nor its scope and duration—that resembled a routine search at the border. The fundamental inquiry *I In this case involving the enforcement of export required under the Fourth Amendment is whether the control laws and the trade embargo with Iran, defendant invasion of the defendant's right to privacy in his papers Jae Shik Kim has moved to suppress the evidence the and effects was reasonable under the totality of the United States harvested from a laptop computer it seized circumstances, and the Court finds that it was not. from him when he was departing the country through Los Angeles International Airport. Kim is a Korean businessman with business operations in both Korea and California, and in October of 2012, investigators with the Department of Homeland Security obtained information PROCEDURAL HISTORY that he was involved in a previous shipment of controlled articles to a Chinese businessman in Korea, who then On March 28, 2013, Kim and his company, Karham Eng. forwarded them to customers in Iran. The Special Agent Corp. ("Karham"), were indicted for violations of a handling the investigation decided to search Kim's laptop number of statutes, including the International Emergency computer for evidence the next time Kim came to the Economic Powers Act ("IEEPA"), 50 U.S.0 § 1701 et United States, and in December 2012, he obtained the seq., the Arms Export Control Act ("AECA"), 22 U.S.C. computer from Kim before permitting him to board his § 2778, and the International Traffic in Arms Regulation flight home. The next day, the laptop was shipped to an ("ITAR"), 22 C.F.R. pts. 120-30. Indictment [Dkt. N I]. agency forensic specialist in San Diego, who created an These laws and regulations govern economic sanctions identical copy of the hard drive, which was then searched imposed by the United States against certain countries, using specialized software and a list of keywords. The such as Iran, and the export of certain "defense articles" thousands of files that were extracted from the keyword from the United States. The United States alleges that search were then burned onto a DVD and returned to the from around December 2007 through March 2010, case agent for further review. defendants conspired to export defense articles without the required export licenses for sale to intermediaries in After incriminating emails were uncovered through that China and Korea and ultimate customers in Iran. process, the agent sought and obtained a warrant based Indictment ¶ 17. The defense articles at issue—six upon the content of the emails to conduct the search of the Q—Flex Accelerometers, Models QA-2000-10, hard drive that had already been completed and to seize QA-2000-20, or QA-3000—are aircraft parts the emails that had already been reviewed. Those emails manufactured by Honeywell Aerospace which are used in now form a part of the basis of this prosecution, and Kim aircraft and missile navigation systems. Indictment TT 3, moves to suppress that evidence, arguing that his rights 16(1), 17(3). They appear on the export control list, and under the Fourth Amendment of the Constitution have an export license is required before they may be exported been violated. legally from the United States. 22 U.S.C. § 2778(bX2); 22 C.F.R. pt. 123.1(a). The government points to its plenary authority to conduct warrantless searches at the border. It posits that a laptop *2 On March 2, 2015, defendants filed the instant motion computer is simply a "container" that was examined to suppress. Dots.' Mot to Suppress Evidence [Dkt. # 35] pursuant to this authority, and it submits that the ("Defs.' Mot."). The parties briefed the motion, Gov't's government's unfettered right to search cargo at the Opp. to Defs.' Mot. [Dkt. # 37] ("Gov't Opp."); Defs.' WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 4 EFTA01207796 United States v. Kim, — F.Supp.3d (2015) Reply in Supp. of Defs.' Mot. [Dkt. # 38] ("Defs.' at 3; see also 4/7 Tr. at 17. The emails included several Reply"), and the Court held an evidentiary hearing on communications with "Uncle Kim" atJS®karham.co.kr: April 7 and 8, 2015, at which the following facts were established. • an email dated June 24, 2010 from Yang to Kim that stated, "There is an inquiry from a domestic client for Honeywell products. It is not for military application and I confirm the end user is not Iranian," to which Kim responded on the same day, FACTUAL BACKGROUND "Thanks! Raymond, I will also check the Honeywell parts whether [w]e can buy them." A. The Government's Investigation of Bin Yang • emails between Yang and Kim from July 2010 In 2011, Special Agent Kevin Hamako of the Department relating to the purchase of various items not subject of Homeland Security ("DHS") Homeland Security to export controls Investigations office was investigating a Chinese national, Bin Yang, also known as Raymond Yang, for export • an email from almost a year later, dated March 28, control violations, specifically the unlawful export of 2011, in which Yang asked Kim if he could identify accelerometers to China and Iran. Mots. Hr'g Tr., April 7, a source for other parts that are not subject to 2015 ("4/7 Tr.") at 7. As part of the investigation, Special controls: "Dear Uncle Kim Hi. I have the inquiry for Agent Hamako worked with an undercover agent who Honeywell QAT 185/160 model, about 150pcs for communicated with Yang by email and telephone. 4/7 Tr. each model per year. 3pcs is a completed unit. First at 14. trial order, the client will buy 9pcs for each model as a start. Do you have any good sources to supply On April I, 2011, Yang sent the undercover agent an them." On the same date, Kim responded, "Now, Mr email asking to obtain Honeywell QA-3000-30's from Ji are checking it with ow USA office. And also, him, and he offered: "Because my uncle has a sudden Tomorrow, I will go to USA with Mr. Ji and stopped schedule to USA, he may could meet you and pay you." in USA office. We will check it again and feed back Report of Investigation, No. 107, May 20, 2011, Gov't you soon." Ex. 3 ("May 2011 ROI") at 3. *3 • an email from Yang to Kim dated April I, 2011, On April 4, 2011, Yang sent the undercover agent another stating: "I see that you will go to U.S.A, it is very email stating, "My uncle just has his sudden trip to US, he good. For your reference, I get a message that there may meet you and only see the goods and maybe pay is supplier could supply us some stocks of QA3000. you." May 2011 ROI at 3. But I don't have successful business with him before, but we could buy his goods if his stocks are In an April 5, 2011 telephone conversation between Yang ok. Dear Uncle Kim, can you please have a check if and the undercover agent, Yang again volunteered that he you agree. We could pay you, so you can buy it in had a contact who would be traveling to the United States USA.... QAT 185 and 160 are not sensitive products, who could inspect the QA-3000 accelerometers that Yang and if you can supply, we could buy from you, and hoped to buy. May 2011 ROI at 3; 4/7 Tr. at 15-16. Yang there is no worry to pay the deposit, because I trust proposed to have his "uncle" travel to the United States, my uncle." inspect the accelerometers, and provide payment for them. 4/7 Tr. at 15-16. He also stated he did not want his May 2011 ROI at 4-6. "uncle" to physically carry the items out of the country because he was afraid that U.S. customs officials would On April 5, 2011, Yang had the recorded telephone call discover them. 4/7 Tr. at 16; see also Report of with the undercover agent described above in which he Investigation, No. 114, Jun. 22, 2011, Gov't Ex. 2 ("Jun. proposed that his "uncle" could inspect the parts Yang 2011 ROI") at 3 (detailing information about the April 5, hoped to buy. As of May 2011, though, the agents were 2011 telephone call). At that point, the unidentified aware that Yang's inquiry to Kim had borne no fruit and "uncle" became a further subject of the investigation. 4/7 the undercover operation was over. 4/7 Tr. at 72 (stating Tr. at 16. the agents knew "fairly soon after, within maybe a couple of weeks" that the operation was not going ahead). On April 27, 2011, Special Agent Hamako obtained and executed a warrant to search and seize Yang's emails, and on May 12, 2011, he received the emails. May 2011 ROI WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 5 EFTA01207797 United States v. Kim, — F.Supp.3d (2015) B. The Identification of "Uncle Kim" and his On October IS, 2012, Special Agent Hamako interviewed Companies Yang. 4/7 Tr. at 9; see also Report of Investigation No. On June 21, 2011, Special Agent Hamako was able to 146, Nov. 15, 2012, Gov't Ex. 1 ("Nov. 2012 ROI") at identify "Uncle Kim" as defendant Jae Shik Kim by 3-5 (reporting results of the Yang debrief). Yang told searching a government database for theJS investigators that at some point in 2008 or 2009, he ®karham.co.kr email address. 4/7 Tr. at 21-22; Jun. 2011 purchased six QA-2000 accelerometers from Kim, which ROI at 3-4. The email address appeared in U.S. State were shipped to him in China without an export license. Department records on a non-immigrant visa application 4/7 Tr. at 10. Yang said that once he received the submitted by Kim. 4/7 Tr. at 21-22; Jun. 2011 ROI at 3. accelerometers, two of his Iranian customers traveled The application provided Special Agent Hamako with from Iran to China to receive them directly. Id. Yang told other information about Kim, including his date of birth, Special Agent Hamako that Kim purchased the passport number, and nationality. Jun. 2011 ROI at 3-4; accelerometers through his connections in the United 4/7 Tr. at 22. States, and they were shipped from the United States to China. 4/7 Tr. at 11; Nov. 2012 ROI at 3. While this is not From the visa application, Special Agent Hamako also reflected in the report of the interview, Special Agent determined that Kim was president of corporate defendant Hamako testified that Yang also told him that Kim knew Karham. 4/7 Tr. at 22. Through further research, he the accelerometers were destined for customers in Iran. learned that Karham was located in South Korea and 4/7 Tr. at II. Stevenson Ranch, California, and that Karham shared its Stevenson Ranch, California address with a company *4 As a result of the Yang interview, Special Agent called Apex Components. 4/7 Tr. at 22-23; see also Jun. Hamako decided to conduct what he characterized as a 2011 ROI at 3-5 (providing information about the border search of Kim's electronic devices "as he was identification of Kim). leaving the U.S. on his next travel." 4/7 Tr. at 110. Special Agent Hamako researched Karham and Apex I wanted to know when [Kim] was Components and found that Karham was involved in the returning to further my export and sale of equipment used in the oil industry and investigation in the sense that I petrochemical industries, including types of meters. 4/7 wanted to be ready to conduct more Tr. at 24. On a web-based government database, Special proactive steps if he was in the Agent Hamako found approximately thirty-nine shipper's U.S., specifically, to include a export declarations ("SEDs") from Karham for the export border search, surveillance, or other of meters from the United States to Australia and South activities to determine if he was Korea. 417 Tr. at 24. He found eight shipper's export engaged in any potential criminal declarations from Apex Components, which also showed activity while in the United States. exports of various industrial equipment from the United States to South Korea. 4/7 Tr. at 25. 4/7 Tr. at 33. At that time, it was the agent's understanding that no suspicion was required to conduct a Finally, Special Agent Hamako found travel records border search of any items Kim might be carrying, showing that defendant Kim arrived in Los Angeles including electronic devices. 4/7 Tr. at 32. International Airport ("LAX") on April 2, 2011, and departed LAX for Narita, Japan on April 14, 2011. Jun. Because of the ongoing investigation, Kim's name was in 2011 ROI at 4; see also 4/7 Tr. at 26. DHS's case management system, which meant Special Agent Hamako would receive an automatic email if Kim was booked on a flight to or from the United States. 4/7 Tr. at 32-33. Some time later, the agent received an email C. Yang's Arrest and Debrief notifying him that Kim was going to return to the United Early the following year, in January 2012, Yang was States in November 2012, and that he would be departing arrested and, in May 2012, he was extradited from LAX for South Korea on December 5, 2012. 4/7 Tr. at 33. Bulgaria to the United States. 4/7 Tr. at 9. He agreed to be debriefed by U.S. authorities in an effort to ameliorate his sentence. 4/7 Tr. at 9; see also Search Warrant, Ex. B to Defs.' Mot. [Dkt. # 35-2] ("Search Warrant"); Aff. in D. The December 5, 2012 Search of Kim Supp. of Appl. for Search Warrant, Ex. B to Defs.' Mot. Special Agent Hamako testified that while he understood [Dkt. # 35-2] ("SW Aff."), at 7 n.1. that he had the authority to conduct a border search of WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 6 EFTA01207798 United States v. Kim, — F.Supp.3d (2015) Kim without any level of suspicion that Kim was engaged *5 4/7 Tr. at 34-35. He added that based on Yang's in criminal activity, 4/7 Tr. at 34, he had grounds for that statements and Karham's general business activities, he suspicion in any event. was "concerned that [Kim] could be involved in further activity in the [Spates regarding illegal exports." 4/7 Tr. At that time my suspicion was at 39. But he testified that he did not know at the based on the debriefing of Yang in time—and he does not know now—what Kim did while which Yang stated he had he was in the United States between November 25 and previously successfully procured December 5, 2012, and that he did not conduct any ITAR controlled accelerometers surveillance or take any steps to find out before carrying from Mr. Kim, as well as the fact out his plan to obtain the laptop. 4/7 Tr. at 81. that Mr. Kim's company appeared to be engaging in exports from the On December 5, 2012, working with a LAX duty agent U.S. to South Korea and other and Customs and Border Protection officers, Special foreign locations, as well as the fact Agent Hamako conducted the planned search of Kim as that, more recently, Mr. Yang had he departed the country. 4/7 Tr. at 40. First, he searched asked Mr. Kim to view products in Kim's checked luggage, which was located behind the the U.S., inspect them and pay for check-in counter with Korean Airlines. Id. He found no them. accelerometers or contraband. 4/7 Tr. at 82-83. He did find a small plastic bag containing plastic o-rings, some 4/7 Tr. at 35. Special Agent Hamako stated that although unidentified industrial metal objects, and some product he knew Yang was incarcerated, he "wasn't sure if Mr. brochures. 4/7 Tr. at 40-41, 90. The agent was not able to Kim was in contact with other individuals who might be identify the applications of these particular o-rings seeking to illegally procure U.S. goods," and that his goal because he was not an aircraft parts expert, but said that was to ascertain whether Kim had other customers. 4/7 he knew "in other cases the Iranian Air Force had been Tr. at 35-36. Under questioning by the prosecutor at the seeking o-rings for their aircraft," and so he thought that hearing, the agent agreed that he also thought it was these small plastic ones "could be" on the munitions list, reasonable to believe that records of the 2008 and he kept them to determine their application. 4/7 Tr. at transactions, including emails, could still be saved on the 41-42. He later spoke with the manufacturer, and computer. 4/7 Tr. at 38-39. determined "it was very unlikely that they were export controlled items," and shipped them back to Kim. 4/7 Tr. Special Agent Hamako said he intended to conduct a at 43. Special Agent Hamako also testified that the metal border search of Kim as he departed the country rather objects in the luggage did not appear to have any moving than as he entered the country, parts or sensors or electronics and may have been a tripod, and the product brochures "didn't seem to be because if I believed at that time pertinent at the time." 4/7 Tr. at 87-88, 90. So he did not that he was traveling to the U.S. retain either the metal objects or the brochures and did not and might be conducting criminal photograph or document what they were. 4/7 Tr. at 88-89. activity while he was in the U.S., such as procuring products or Next, Special Agent Hamako stopped Kim on the jetway attempting to set up subsequent between the gate and the airplane as Kim was boarding deals, I would want to capture that his flight. 4/7 Tr. at 40, 43. He identified himself and information after he had done so, asked Kim if he had any electronics, to which Kim rather than before he had conducted responded that he had a laptop. 4/7 Tr. at 44. Special any such activity. So, conducting a Agent Hamako told Kim that he would be detaining the border search on the inbound side laptop pursuant to a border search and that he would could cause him to decide not to return it once the search was complete. Id. He also told conduct whatever activities or Kim that he would be detaining the o-rings until their operations he might have been export control status was determined. Id. Special Agent planning. Whereas, conducting the Hamako testified that he did not have an interpreter border search as he was leaving, in during the encounter with Kim because he did not our view, would be more likely to anticipate that he was likely to say anything obtain evidence of any criminal incriminating. 4/7 Tr. at 94. activity he had conducted during his trip. My goal at that time wasn't to WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 7 EFTA01207799 United States v. Kim, — F.Supp.3d (2015) conduct an in-depth interview or Special Agent Marshall explained as follows: subject interview of Mr. Kim, reading him his rights or anything Allocated space, in general, means like that, since my main goal was to space in your hard drive where ... obtain his electronics and then let files are living, files that you see on him go on his way. your desktop, maybe a photo of a family vacation or Word 4/7 Tr. at 95. This is precisely what took place, and Kim documents. Unallocated space boarded his flight. 4/7 Tr. at 45. refers to space that's not currently being used by—let's say it's Special Agent Hamako did not turn the laptop on or Windows, by Windows for any review its contents in any way during his search of Kim at files. And when you delete a file, it LAX. 4/7 Tr. at 45. He explained that "it would be goes into unallocated space.... inappropriate to search his laptop without—without an [U]nallocated space is space that's individual who's qualified to preserve the contents of the not currently being used by the laptop. Because if I were to turn on the laptop and just computer. begin searching it there, that would be altering the information on the laptop and could render any evidence I 4/8 Tr. at 9. found on it tainted or otherwise questionable, since I would be modifying the contents of the laptop by Special Agent Marshall placed the hard drive back into conducting searches on it. And also, because based on the Kim's laptop and returned the laptop to Special Agent time available, it could have taken who knows how long." Hamako on December 7, 2012. 4/8 Tr. at 8.: 4/7 Tr. at 45; see also 4/7 Tr. at I 15 (stating that "conducting a live search on his computer would have Also on December 7, 2012, Special Agent Marshall necessarily changed and altered the contents of the laptop, employed a software program called EnCase to export so I would not have conducted such a search"). Special files from Kim's computer. 4/8 Tr. at 10; see also Dec. Agent Hamako testified, "[M]y main goal was to obtain 2012 ROI at 4 (stating that he used commercially any electronics that he had on his person at that time." 4/7 available email analysis software to export files). He used Tr. at 94. EnCase to export six Microsoft Outlook email containers,' 8,184 Microsoft Excel spreadsheets, 11,315 Adobe PDF files, 2,062 Microsoft Word files, and 879 Microsoft PowerPoint files from the image. Dec. 2012 ROI at 4; see E. The Search of Kim's Computer also 4/8 Tr. at II. *6 On December 6, 2012, Special Agent Hamako submitted Kim's laptop to Special Agent David Marshall Special Agent Marshall used another program, Intella, to of the Homeland Security Investigation San Diego process the files. 4/8 Tr. at 10; see also Dec. 2012 ROI at Computer Forensics Group. Report of Investigation, No. 4. He testified that Intella is a powerful piece of software 147, Dec. 11, 2012, Gov't Ex. 5 ("Dec. 2012 Ron at 1, with a variety of capabilities, including the ability to 3; Mots. Hr'g Tr., April 8, 2015 ("4/8 Tr.") at 7-8;' see search the text of emails that are not otherwise searchable. also 4/7 Tr. at 99-100. Special Agent Hamako "requested 4/8 Tr. at 31. It also indexes and categorizes emails: a border search of the laptop" from Special Agent Marshall. 4/8 Tr. at 8. [A]n e-mail container can contain thousands of e-mails. So Intella To carry out Special Agent Hamako's request, Special will go through and open up the Agent Marshall removed the hard drive from Kim's e-mail, and what we call index and laptop and created a forensic image, or a duplicate copy, categorize the e-mail. So it looks at of it. 4/8 Tr. at 8. To do this, Special Agent Marshall all the e-mail information, the to connected a piece of hardware "about the size of a and the from, the dates, things like shoebox" to the laptop hard drive: the hardware creates that, the attachments, and it "an exact copy, reading every single bit, as we call it, processes those and categorizes all every single piece of data on the hard drive and making a that information so that the user can copy of that for me to analyze later on." 4/8 Tr. at 8-9. then go in and see all the e-mails from a certain person, you know, or The imaged copy included all files from both the to a certain person or on a date. allocated and unallocated space on the computer, which WestlawNexi © 2015 Thomson Reuters. No claim to original U.S Government Works. 8 EFTA01207800 United States v. Kim, — F.Supp.3d (2015) *7 4/8 Tr. at 31-32. And according to Special Agent the Iranian Transactions Regulations, and other statutes Hamako, it would have been "impractical" to use the would be contained in the files on Kim's laptop. SW Aff. search function in Outlook instead; given the 10. The affidavit states that the laptop was detained investigators' search methodologies, "Intella is more during a border search, that the government had imaged efficient." 4/7 Tr. at 105. the laptop, and that Special Agent Hamako reviewed emails obtained from the laptop for ten days. SW Aff. 11 These files were copied to a "case agent review" laptop 16-17. The affidavit then describes the contents of emails for Special Agent Hamako to review. 4/8 Tr. at II. When between Kim and Yang from December 2007 through Special Agent Marshall saw the number of files on the April 2008, showing that Kim helped Yang purchase six laptop, he asked Special Agent Hamako to give him a accelerometers without the required export control keyword list to use to "filter down the amount of license, and that the items were to be forwarded to Iran. information for him to review." 4/8 Tr. at II. SW Aft ¶¶ 18-40. On December 10, 2012, Special Agent Hamako gave The application stated further that, "[w]ith the approval of Special Agent Marshall a list of twenty-two keywords: the Court in signing this warrant, agents executing this QA-2000, QA-3000, G-2000, 7270A, accelerometers, search warrant will employ the following procedures" to gyroscope, angular, sensor, Honeywell, Endevco, search Kim's computer: forensic imaging, which the Northrop, Grumman, ITAR, sensitive, export, shipment, affidavit acknowledged had already occurred, and military, aircraft, missile, satellite, ballistic, and nuclear. identification and extraction of relevant data. SW Aff. 4/8 Tr. at 12-13. Using these keywords to screen the files 43-50. Special Agent Hamako explained: on Kim's laptop, Special Agent Marshall found approximately 5,900 files that had a keyword match. 4/8 *8 Analysis of the data following the creation of the Tr. at 13. He burned the files to a DVD and gave the forensic image can be a highly technical process DVD to Special Agent Hamako, along with the case agent requiring specific expertise, equipment and software. review laptop. Dec. 2012 ROI at 4; 4/8 Tr. at 13. There are literally thousands of different hardware items and software programs, and different versions of The next day, on December 11, 2012, Special Agent the same program, that can be commercially purchased, Marshall exported all of the picture files, which can installed and custom-configured on a user's computer include images of documents and not simply photographs, system. that were located in the allocated space of the sss computer—approximately 24,900 .jpg files. 4/8 Tr. at 13-14; Dec. 2012 ROI at 4. He copied all of those onto another DVD and gave the DVD to Special Agent Analyzing the contents of a computer or other Hamako. 4/8 Tr. at 13-14; Dec. 2012 ROI at 4. electronic storage device, even without significant technical challenges, can be very challenging. Special Agent Hamako then spent "[s]everal days" Searching by keywords, for example, often yields many reviewing the files obtained from Kim's computer, thousands of hits.... Merely finding a relevant hit does conducting keyword searches of the emails and not end the review process. The computer may have documents. 4/7 Tr. at 47; Search Warrant 1 17 (stating stored information about the data at issue: who created that Special Agent Hamako received the emails on it, when and how it was created or downloaded or December 10, 2012 and reviewed them until December copied, when was it last accessed, when was it last 19, 2012). He found emails consistent with the 2008 modified, when was it last printed and when it was transaction Yang described during the interview, and deleted.... Moreover, certain file formats do not lend those form the basis for the criminal charges in this case. themselves to keyword searches.... Many common 4/7 Tr. at 47-48. electronic mail, database and spreadsheet applications do not store data as searchable text. SW Aft. ¶¶ 45-46. F. The Search Warrant On January 13, 2013, Special Agent Hamako filed an According to the agent's affidavit, the "mind-boggling" application for a search warrant in the U.S. District Court amount of data stored on computers makes analyzing the for the Southern District of California. Search Warrant. data "increasingly time-consuming." SW Aff. ¶ 48. He provided an affidavit with the application, in which he Therefore, Special Agent Hamako predicted that "[t]he stated his belief that there was "probable cause to believe identification and extraction process ... may take weeks or that evidence relating to violations" of the ACEA, IEEPA, months." SW Aff. 1j 49. He also averred that the WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 9 EFTA01207801 United States v. Kim, — F.Supp.3d (2015) government "has not attempted to obtain this data by Neither the Supreme Court nor the D.C. Circuit has other means, except I) through border search authority ... weighed in on this issue, so there is no binding precedent and 2) some email communications between Kim and to be applied by this Court.' In 2014, a District Court in Yang ... previously obtained pursuant to court authorized Maryland also concluded that reasonable suspicion was search warrants of Yang's email accounts." SW Aff. ¶ 52. needed to justify a forensic search of a defendant's electronic data storage devices. United States v. On January 16, 2013, the U.S. District Court for the Sahoonchi, 990 F.Supp.2d 536, 539 (D.Md.2014). And Southern District of California signed the warrant. Search later that year, another court in this District was asked to Warrant. apply the Cotterman rule to a search of a laptop seized from a passenger flying into LAX, but in that case, the But Special Agent Hamako and Special Agent Marshall court determined that it was not necessary to reach the each testified that after the search warrant was obtained, constitutional question of whether reasonable suspicion no further searches or analyses were undertaken. 4/7 Tr. was required because it found that such suspicion was at 51 ("THE COURT: Was there some new, different present in any event. United States v. Hassanshahi, No. program that was applied after you got the warrant that 13—0274(RC), — F.Supp.3d —, 2014 WL did something more to the computer, or is it just a matter 6735479, at *12 (D.D.C.2014). In an effort to follow that that you actually seized the e-mails? [Special Agent sensible approach, this Court took up the reasonable Hamako]: That's correct, Your Honor. We didn't use any suspicion question first. different programs after obtaining the search warrant."); 4/8 Tr. at 23 ("THE COURT: Did you do anything to—either the complete image that you had created or the case agent's laptop, did you do any further searching or I. Was there reasonable suspicion to support the application of any programs after the search warrant was search of Kim's laptop? obtained? [Special Agent Marshall]: No."). In 1~1The Supreme Court has defined reasonable suspicion as "a particularized and objective basis for suspecting the particular person stopped of criminal activity." United States v. Cortez, 449 U.S. 411, 417-18, 101 S.Ct. 690, 66 L.Ed.2d 621 (1981). The standard is met when a law ANALYSIS enforcement officer can point to "specific and articulable facts," which, when considered together with the rational The government argues first and foremost that a laptop is inferences that can be drawn from those facts, indicate nothing more than a sort of container, and that the agents that criminal activity "may be afoot." Terry v. Ohio, 392 had full authority to scour its contents without the need U.S. I, 21, 30, 88 S.Ct. 1868, 20 L.Ed.2d 889 (1968). As for a warrant or a showing of any particular level of the government has pointed out in this case, a court's suspicion simply because the search was initiated at the determination of whether the officer had reasonable border. Gov't Opp. at 6, citing, inter alia, United States v. suspicion must be based upon the totality of the Ramsey, 431 U.S. 606, 97 S.Ct. 1972, 52 L.Ed.2d 617 circumstances. See United States v. Arvizu, 534 U.S. 266, (1977), and 19 U.S.C. § 1581.4 But the government also 273, 122 S.Ct. 744, 151 L.Ed.2d 740 (2002); see also suggests that a search which took place at LAX, involving Cortez, 449 U.S. at 418, 101 S.Ct. 690 (recognizing that a passenger traveling to and from California, should be law enforcement agents will draw upon their training and assessed utilizing the Ninth Circuit precedent set forth in experience to piece together subtle clues that may seem United States v. Cotterman, 709 F.3d 952 (9th Cir.20I3). innocent to others); United States v. Tiong, 224 F.3d 4/8 Tr. at 86; Gov't Opp. at 10, n.9, II n.11. 1136, 1140 (9th Cir.2000). *9 In Cotterman, the Ninth Circuit announced that 13IBut what is it that the officer must reasonably suspect? reasonable suspicion was required before investigators Neither party focused in on that issue, but a review of the could undertake the forensic examination of a computer cases decided in the wake of Terry makes it clear that the hard drive as part of a search that began as a cursory reasonable suspicion standard relates to ongoing or review at the border. 709 F.3d at 957. In this case, the imminent crime. See Cortez, 449 U.S. at 417, 101 S.Ct. government argues both that no suspicion was necessary 690 ("An investigatory stop must be justified by some since this was an ordinary, reasonable border search that objective manifestation that the person stopped is, or is can be distinguished from the forensic examination that about to be, engaged in criminal activity."); United States took place in Cotterman, and also that the necessary v. Edmonds, 240 F.3d 55, 59 (D.C.Cir.2001) r[T]he issue suspicion was present. Gov't Opp. at 10-14. is whether a reasonably prudent man in the circumstances would be warranted in his belief that the suspect is WestlawNexr © 2015 Thomson Reuters. No claim to original U.S. Government Works. 10 EFTA01207802 United States v. Kim, — F.Supp.3d (2015) breaking, or is about to break, the law.") (citation and internal quotation marks omitted). Therefore, if this Court The government points out that the subjective intent of were to determine, after considering the totality of the the agent is irrelevant. Gov't Opp. at 12 (stating that "only circumstances, that a reasonably prudent officer would a 'minimal level of objective justification' " is required), have been justified in his belief that Kim was engaged in quoting Hassanshahi, — F.Supp.3d at —, —, 2014 ongoing criminal activity at the time he was stopped at WL 6735479, at *16. And at the hearing on the motion, it LAX, then the search would have been lawful under the posited that there was reasonable suspicion to support the Cottennan standard. And then, the Court could adopt the search based upon the following circumstances: the approach taken by the District Court in Hassanshahi and preexisting ongoing investigation into Kim's involvement find the constitutional question of whether the search of in Yang's 2008 transaction with Iran; the fact that Kim's the computer required reasonable suspicion to be moot. name came up in connection with the more recent attempt to engage Yang in an undercover transaction; the fact that * 10 1411n this case, though, the Court is troubled by the Kim did travel to the United States at the time Yang said lack of particularized grounds to believe that this he would be traveling; the business relationship between defendant was engaged in criminal activity at the time he Kim and Yang; and the discovery of the o-rings. 4/8 Tr. at was exiting the United States. First of all, there is no 77-78; Gov't Opp. at 12-14. question that the decision to conduct the search was not made on that basis: Special Agent Hamako candidly IsiBut even if one credits Special Agent Hamako's testified that he made the decision to obtain the laptop and testimony that Yang told him Kim knew that the items search it for evidence of the alleged conspiracy with Yang shipped in 2008 were bound for Iran, see 4/7 Tr. at based upon his understanding that such a search required 10-11—despite the agent's failure to mention that key no level of suspicion at all. 4/7 Tr. at 34. He testified that detail in either his contemporaneous report or the affidavit once he had information from Yang that defendant Kim he submitted in support of the search warrant, see Nov. had been his source in 2008, he decided to conduct what 2012 ROI; SW Aff.—and even if one credits Yang's he termed a "border search" the next time Kim came to account of the previous transaction, evidence of prior the United States for the purpose of obtaining the laptop. criminal conduct alone is not sufficient to give rise to 4/7 Tr. at 33-34, 94. And he made that decision before he reasonable suspicion. Hassanshahi, — F.Supp.3d at knew when Kim would be travelling to the United States, , —, 2014 WL 6735479, at *14, citing United whether he would be travelling, or why, and in the States v. Johnson, 482 Fed.Appx. 137, 148 (6th Cir.2012); absence of any information whatsoever about what Kim United States v. Walden, 146 F.3d 487, 490 (7th would or did do while he was in the country. 4/7 Tr. at 81, Cir.1998). This is particularly true under the 33.6 Even after the agent had been notified that Kim was circumstances of this case, where the only evidence of on his way, he took no steps to monitor Kim's activities in more recent activity was Yang's inquiry to Kim on behalf any way while he was in the United States. 4/7 Tr. at 81. of the undercover officer, which did not result in any action on Kim's part. As of December 5, 2012, all that Notwithstanding these undisputed facts, the government Special Agent Hamako knew about ongoing activity was takes the position that the agent had reasonable suspicion that Yang had contacted Kim and the approach had to search the laptop under the Teny standard adopted in quickly come to a dead end, that Yang was under arrest Cottennan based upon the totality of the circumstances. It and no longer conspiring with anyone, and that the search argued in its opposition to the motion to suppress, of Kim's luggage revealed no accelerometers or "Yang's admission that he previously conspired with Kim obviously controlled items. ... created reasonable suspicion that Kim had been, and perhaps still was, involved in illegal activity." Opp. at 12. *11 The government points to Kim's previous travel and And, "SA Hamako had reason to suspect that Kim would the fact that exports to Yang and others were a regular be crossing the border with a laptop that still contained part of his business, but this is the sort of evidence the evidence of his earlier criminal conspiracy with Yang, as Supreme Court has cautioned against according much well as any recent illegal activities." Gov't Opp. at 14. weight in the reasonable suspicion analysis because it "describe[s] a very large category of presumably innocent But the government's use of such language as "perhaps" travelers." Reid v. Georgia, 448 U.S. 438, 441, 100 S.Ct. and "any" was not at all reassuring, as it served to 2752, 65 L.Ed.2d 890 (1980). highlight how thin the showing is in this case. And the agent's testimony confirmed that gathering evidence of a Further, it is difficult to find that the o-rings had anything completed crime was the central motivation here. See 4/7 other than marginal importance. The testimony was that Tr. at 95 ("[M]y main goal was to obtain his electronics they were small and plastic, and it was not obvious to an and then let him go on his way."). agent who was well trained in the contents of the WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 11 EFTA01207803 United States v. Kim, — F.Supp.3d (2015) munitions list that they were listed at all. 417 Tr. at 41, in the affidavit in support of the search warrant, he did not 83-86. Indeed, they were of so little value to his include any facts or allegations related to anything that investigation that the agent did not retain them, was supposedly going on in December of 2012. He photograph them, or even describe them in any report. 4/7 simply averred, "[a]fter his arrest, Yang stated that he had Tr. at 86-87. According to Special Agent Hamako, that previously purchased six Honeywell QA-2000 was because his "main goal was to obtain [Kim's] accelerometers from Kim." See SW Alf. ¶ 15. And electronics and then let him go on his way." 4/7 Tr. at 95. therefore, this case is distinguishable from Cotterman and And the agent testified that that the decision to search the the decision from this District in Hassanshahi. laptop well preceded the discovery of the o-rings in any event. 4/7 Tr. at 110-12. *12 The court in Cotterman noted that the agents at the Mexican border made their initial decision to search the The agent's answers to questions posing obvious defendant's belongings on his way into the country after propositions that do not depend on sophisticated the Treasury Enforcement Communication System investigatory experience, see 4/7 Tr. at 48 ("Q.... Ulf you ("TECS") revealed that the defendant was a known sex knew that Mr. Yang and Mr. Kim had conspired to export offender. 709 F.3d at 957. Based on the TECS alert, the the accelerometers Mr. Yang told you about, did you have border agents believed that the defendant had a prior reason to suspect Mr. Kim could have had other people he conviction for child pornography, that he was possibly was working with? A. That's correct. It's common in ow involved in child sex tourism, and that he was arriving investigations that individuals will have different from a country associated with that activity. Id. at 957, coconspirators and customers for goods, ...."), did little to 968-69.' The agents' review of Cotterman's passport lift the evidence out of the realm of hunch or speculation, confirmed that he travelled frequently out of the country. particularly given the fact that the one known prior Id. at 968. The Immigration and Customs Enforcement alleged conspiracy did not involve entry into or exit from ("ICE") "field office specifically informed [the border the United States at all. 417 Tr. at 10-11; see also id. at 53 agent] that the alert was part of Operation Angel Watch, (agent admitted on cross examination that while it was a which targeted individuals potentially involved in sex "possibility" that Kim had other co-conspirators, he had tourism and alerted officials to be on the lookout for no evidence of any other questionable transactions laptops, cameras and other paraphernalia of child besides the one with Yang). pornography." Id. at 969. A search of the Cottermans' vehicle produced two laptop computers and three digital Looking at all of the circumstances presented, then, while cameras, and an initial inspection of the devices on the it is a close case, it seems clear to the Court that the scene revealed what appeared to be personal photos, as search of the laptop was predicated upon the agent's well as a set of password-protected files on the laptop. Id. expectation that the computer would contain evidence of at 957-58. past criminal activity, but there was no objective manifestation that Kim was or was "about to be, engaged While neither the prior conviction nor the use of in criminal activity" at that time. Cortez, 449 U.S. at 417, password-protected files alone would have sufficed, the 101 S.Ct. 690; see also 417 Tr. at 32-33 (after the Yang court concluded that "Cotterman's TECS alert, prior debriefing, the agent arranged to be notified of any child-related conviction, frequent travels, crossing from a planned travel by Kim so that he could take proactive country known for sex tourism, and collection of steps such as surveillance or a border search "to electronic equipment, plus the parameters of the determine if he was engaged in any potential criminal Operation Angel Watch program, taken collectively, gave activity while in the United States") (emphasis added). rise to reasonable suspicion of criminal activity." Id. at With respect to ongoing activity, the search was nothing 969. The court added that where there are other indicia of more than a fishing expedition to discover what Kim criminal activity, the password protection of individual might have been up to. See also 4/7 Tr. at 35-36 ("Q [by files—as opposed to the commonplace use of a password AUSA]. Now, you knew that Mr. Yang was locked up to protect an entire device—could be considered as part of and could not engage in activity with Mr. Kim, correct? the totality of the circumstances, but only in a situation, A. That's correct. However, based on the fact that I such as a child pornography case, where the encryption or wasn't able to search Mr. Kim's e-mail, I wasn't sure if protection of files would have some relationship to the Mr. Kim was in contact with other individuals.... So, at suspected criminal activity. Id. at 969. Given the that time I wasn't sure if Mr. Yang was Mr. Kim's only combination of the TECS hit and the discovery of the customer. Q. Were you intending to investigate whether inaccessible files, and crediting the agents' observations he had other customers? A. I was. That was a primary and experience, the Ninth Circuit found that "[t]he border goal of our investigation.") Indeed, when Special Agent agents 'certainly had more than an inchoate and Hamako took the time to detail the evidence against Kim unparticularized suspicion or hunch' of criminal activity WestlawNexi © 2015 Thomson Reuters. No claim to original U.S. Government Works. 12 EFTA01207804 United States v. Kim, — F.Supp.3d (2015) to support their decision to more carefully search for F.Supp.3d at —, —, at *14. evidence of child pornography." Id. at 970, quoting United States v. Montoya de Hernandez, 473 U.S. 531, The TECS information about Hassanshahi revealed 542, 105 S.Ct. 3304, 87 L.Ed.2d 381 (1985).6 additional travel involving Iran: in 2006, twice in 2008, once in 2010, in May 2011, and in either late 2011 or Here there was nothing about Kim's particular travel early 2012, all of which supported the notion that his plans that would arouse suspicion; he was returning to his Iranian business dealings were ongoing. Id. In addition, home in Korea and he was known to have business the fact that the defendant's email account was accessed operations within the United States. And, the agent did twenty-four times from an Iranian IP address between not even open the laptop—which did not turn out to December 8, 2011 and December 15, 2011, and the contain password protected files in any event—on the evidence that around the time the defendant traveled to scene. So while in Cotterman, the court characterized the Iran, he made contact with one Iranian telephone number forensic search as one that grew out of observations made and received a missed call from another, reinforced the during the initial cursory examination at the border, the conclusion that Hassanshahi was engaged in business search here was not prompted, even in part, by anything activity during his recent trip. Id. — F.Supp.3d at —, that raised the agent's level of concern upon a first glance —, at *15. Finally, the court took note of the fact that at the device at the border. Compare Cotterman, 709 F.3d Hassanshahi was travelling with multiple electronic at 969-70 (pointing to the password-protected files on devices and data storage accessories, including a laptop Cotterman's computer as a circumstance justifying the computer, multimedia cards, thumb drives, a camcorder, scope of the search). SIM cards, and a cell phone. Id. It observed, "[t]hough it generally is unremarkable nowadays for a person *13 In United States v. Hassanshahi, the court found that traveling abroad to bring a computer, camcorder, or cell there was reasonable suspicion that the defendant was phone with them, Hassanshahi's possession of multiple engaged in efforts to violate the trade embargo with Iran, data storage devices appears to be inconsistent with just which supported the decision to conduct a forensic search personal use while traveling," and it found that the of his laptop upon his return to the United States in volume of equipment supported the inference that the January 2012 after travel to Iran. Hassanshahi, — defendant had traveled to Iran to continue the same sorts F.Supp.3d at —, — —, 2014 WL 6735479, at of business activity in which he had been engaged in the *11-18. The case began with an anonymous tip received past. Id.° by Homeland Security Investigations from a source who had been contacted by an Iranian seeking assistance in Here, the fact that Kim's name had been provided in procuring parts for an Iranian power project. Id. connection with a prior alleged export violation did not —F.Supp.3d at —, at *1. Further investigation add shades of a more sinister meaning to what could have (utilizing information that was ultimately suppressed and been a routine trip to the United States, because nothing therefore not included in the reasonable suspicion about the one completed prior incident even involved a calculus) led to Hassanshahi. Id. — F.Supp.3d at —, trip to the United States. Cf. id. — F.Supp.3d at —, , —, at *1-2, 13. The investigating agent —, at *17 ("Hassanshahi traveled on multiple discovered information in TECS about a federal criminal occasions to the specific country at issue in the 2003 investigation in 2003 concerning Hassanshahi's alleged criminal investigation, thus making his travel far more participation in a conspiracy to establish an American probative of criminal conduct."). Also, in contrast to the company to partner with a Chinese company to build a information about Hassanshahi's phone calls and emails computer manufacturing facility in Iran. Id. — in Iran, the record here was devoid of any information F.Supp.3d at —, at *13. While no criminal revealing where Kim had gone during his trip or who he charges were filed at that time, the underlying facts were contacted during his travels. There was nothing about the later admitted in a civil action brought by Hassanshahi fact that Kim was travelling with an ordinary laptop that himself against the Chinese entity. Id. — F.Supp.3d at can be compared to the array of devices discovered in , —, at *13, n. 12. The information concerning the Hassanshai. And finally, the court in Hassanshahi made a prior transaction, while not sufficient on its own, was point of" `considering the totality of the circumstances as found to contribute to the reasonable suspicion calculus, the officer on the scene experienced them,' " giving due and in the court's view, it "also negatively colored the credit to that officer's ability to draw inferences and perception of any future travel by [Hassanshahi] to that deductions based upon the facts before him at the time. Id. specific country," transforming what might otherwise be — F.Supp.3d at —, —, at *16, quoting United general information about travel outside the United States States v. Edmonds, 240 F.3d 55, 59-60 (D.C.Cir.2001). into a "particularized and objective fact potentially Here, while the o-rings may be a circumstance this Court indicative of ongoing criminal activity." Id. — can consider, the fact is that Special Agent Hamako was WestlawNext' © 2015 Thomson Reuters. No claim to original U.S. Government Works. 13 EFTA01207805 United States v. Kim, — F.Supp.3d (2015) implementing a decision he had previously made functional equivalent of the inspection of a piece of elsewhere, and his collection of the laptop was not luggage or a cargo container, and that therefore it was informed in any way by his observations on the scene, presumptively reasonable and subject to no limitation filtered through his training and experience or othenvise.o under the border search doctrine. Gov't Opp. at 6, 9. After all, the prosecution points out, the experience was not *14 Since there was little or nothing to indicate that a physically invasive or embarrassing and not even crime was "afoot" in this case, the Court is of the view destructive of the laptop itself, which was returned to the that it cannot rely upon the approach utilized in defendant intact. Gov't Opp. at 8-9. Hassanshahi, and that it must go on to consider the constitutional question of whether the nature, scope, and But neither of those precedents can be easily compared to duration of the search were reasonable under the Fourth this case, and given the vast storage capacity of even the Amendment. In the end, the reasonable suspicion analysis most basic laptops, and the capacity of computers to may be largely beside the point because what took place retain metadata and even deleted material, one cannot here cannot be fairly compared to a Terry stop. treat an electronic storage device like a handbag simply because you can put things in it and then carry it onto a plane. As the court observed in Cotterman : II. Does the search pass muster under the Fourth The amount of private information carried by Amendment? international travelers was traditionally circumscribed I61"The Government's interest in preventing the entry of by the size of the traveler's luggage or automobile. This unwanted persons and effects is at its zenith at the is no longer the case. Electronic devices are capable of international border." United States v. Flores—Montano, storing warehouses full of information. 541 U.S. 149, 152, 124 S.Ct. 1582, 158 L.Ed.2d 311 iii (2004). Notwithstanding the broad scope of the government's authority at the border, the Supreme Court has suggested that even this power to search may be Laptop computers, iPads and the like are bounded by limits derived from the Fourth Amendment, simultaneously offices and personal diaries. They particularly when the search cannot be characterized as contain the most intimate details of our lives: financial "routine." See Montoya de Hernandez, 473 U.S. at 540, records, confidential business documents, medical 105 S.Ct. 3304 (observing that the Court has "not records and private emails. previously decided what level of suspicion would justify a *15 * * * seizure of an incoming traveler for purposes other than a routine border search"); Flores-Montano, 541 U.S. at Electronic devices often retain sensitive and 152, 155-56, 124 S.Ct. 1582 (discussing "the reasons that confidential information far beyond the point of might support a requirement of some level of suspicion in erasure, notably in the form of browsing histories and the case of highly intrusive searches of the records of deleted files. This quality makes it person—dignity and privacy interests of the person being impractical, if not impossible, for individuals to make searched," as well as when searches of property are meaningful decisions regarding what digital content to ultimately "destructive"). While the Supreme Court has expose to the scrutiny that accompanies international not provided much specific guidance about what those travel. limits might be, "reasonableness remains the touchstone for a warrantless search." Cotterman, 709 F.3d at 957; see 709 F.3d at 964-65. Judges across the country have also Brigham City, Utah v. Stuart, 547 U.S. 398, 403, 126 strained to select artful metaphors to use when comparing S.Ct. 1943, 164 L.Ed.2d 650 (2006). digital devices to containers ranging from slim leather valises to shipping containers, but this Court will not The few Supreme Court cases that explore the sorts of engage in that semantic exercise because the fact is, the border searches that might require some level of suspicion metaphors do not fit. As the District Court in Maryland involved unique and extreme situations: a highly intrusive put it in Saboonchi, "a forensic search is sui generis": physical examination of the defendant's person, Montoya de Hernandez, 473 U.S. 531, 105 S.Ct. 3304, 87 L.Ed.2d I cannot help but find that even if a computer or cell 381, and the complete destruction of another defendant's phone is analogized to a closed container, a forensic automobile gas tank, Flores—Montano, 541 U.S. 149, 124 search cannot be analogized to a conventional search of S.Ct. 1582, 158 L.Ed.2d 311, and they do not deal directly luggage or even of a person. A forensic search is far with the world of electronic media. The government takes more invasive than any other property search that I the position, then, that the search of a laptop is the WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 14 EFTA01207806 United States v. Kim, — F.Supp.3d (2015) have come across and, although it lacks the discomfort [a] conventional search at the or embarrassment that accompanies a body-cavity border of a computer or device may search, it has the potential to be even more revealing. include a Customs officer booting it up and operating it to review its A conventional computer search allows Customs contents, and seemingly, also officers to choose, within the finite amount of time would allow (but is not necessarily available to them while they detain the traveler, to limited to) reviewing a computer's decide where, within a veritable mountain of personal directory tree or using its search data, to focus their attention while searching for functions to seek out and view the contraband, threats, or criminality. And at the end of a contents of specific files or file conventional search, as with the conventional search of types.... And, just as a luggage lock a suitcase, a traveler regains custody of his possessions does not render the contents of a and information and proceeds about his business with a suitcase immune from search, a minimum of lingering inconvenience. A forensic password protected file is not search, on the other hand, allows a Customs officer to unsearchable on that basis alone. give uniquely probing review not only to the files on one's computer, but also any files that ever may have Id. at 560-61. By contrast, "[i]n a forensic search of been on that computer. And even after a traveler is electronic storage, a bitstream copy is created and then is cleared to enter the country, the search may continue searched by an expert using highly specialized analytical for months or even years afterwards. software—often over the course of several days, weeks, or months—to locate specific files or file types, recover 990 F.Supp.2d at 568. hidden, deleted, or encrypted data, and analyze the structure of files and of a drive." Id. at 561. But when faced with the task of applying eighteenth-century principles to this twenty-first-century !Which sort of search was conducted here? Another way technology, the Ninth Circuit and the District Court in to phrase the inquiry might be: the Supreme Court has Maryland adopted slightly different approaches. stated that "[r]outine searches of the persons and effects Cotterman concluded that a forensic search of an imaged of entrants are not subject to any requirement of computer was as invasive of the defendant's privacy as a reasonable suspicion, probable cause, or warrant," strip search, 709 F.3d at 966, and it concluded that Montoya de Hernandez, 473 U.S. at 538, 105 S.Ct. 3304, reasonable suspicion was required before investigators but was this search "routine"?" could engage in that sort of examination. Id. at 962. ("It is the comprehensive and intrusive nature of a forensic The record reflects that the examination of Kim's laptop examination—not the location of the examination—that is fell somewhere on the spectrum between the two poles the key factor triggering the requirement of reasonable described by other courts. suspicion here.... Agent Owen used computer forensic software to copy the hard drive and then analyze it in its Certainly no one simply turned it on and perused the files entirety, including data that ostensibly had been as might have been possible at the border. By making an deleted."). The court expressed "confidence in the ability exact copy of the hard drive and retaining it so that it of law enforcement to distinguish a review of computer could be subjected to a series of searches, using whatever files from a forensic examination," noting that "it requires software investigators deemed necessary, for a period of that officers made a commonsense differentiation between unlimited duration, the investigators gave themselves the a manual review of files on an electronic device and the luxury of the one thing that is absolutely not available on application of computer software to analyze a hard drive." the jetway: time. This, in and of itself, was one of the key Id. at 967. factors identified in Saboonchi as differentiating a routine border search from a non-routine border search. 990 *16 The Saboonchi court took issue with the Ninth F.Supp.2d at 547. Circuit's failure to define precisely what a "forensic" search might be. See 990 F.Supp.2d at 552-58. It attacked In addition, the search was facilitated by the application the question by differentiating a "routine" border search of additional forensic software that was not already from a non-routine border search and creating its own test loaded onto the computer, 418 Tr. at 10, which was for distinguishing the "forensic" examination for which another factor in both Saboonchi and Cotterman reasonable suspicion is required from a "conventional" underlying the determination that reasonable suspicion computer search. Id. at 560-69." According to that was required. 990 F.Supp.2d at 564-66; 709 F.3d at 962, opinion, WestlawNex! © 2015 Thomson Reuters. No claim to original U.S. Government Works. 15 EFTA01207807 United States v. Kim, — F.Supp.3d (2015) 967. distinguishes it from a conventional computer search."). Similarly, the volume of the material exported and *17 The Cotterman court placed some emphasis on the presented to Special Agent Hamako—six Microsoft fact that the forensic examination them enabled the agents Outlook email containers, each potentially containing to access even those files that have been deleted. 709 F.3d thousands of emails, 8,184 Microsoft Excel spreadsheets, at 962, 965. And Special Agent Marshall, who conducted II, 315 Adobe PDF files, 2,062 Microsoft Word the search, attempted to differentiate the search in this documents, and 879 Microsoft PowerPoint files, Dec. case from that sort of "full" forensic examination, which 2012 ROI at 4, from which 5,900 files were extracted is often called for in cases involving child pornography. using Special Agent Hamako's twenty-two keywords, 4/8 Tr. at 15-16, 19-20. But the forensic specialist also plus approximately 24,000 .jpg files, 4/8 Tr. at 13-14—is acknowledged that the term "forensic search" can hardly consistent with what the Cotterman and Saboonchi describe a range of examinations and that the term has no courts envisioned a "conventional" search to be. Even specific definition. 4/8 Tr. at 25. In the Court's view, the after the hard drive had been copied and the agent would fact that the agents in this case did not search the have had all the time he needed, Special Agent Marshall unallocated space for deleted material as they did in was concerned that the material on the hard drive "would Cotterman is not dispositive. Once an entire hard drive be a lot of data to look through manually," and he has been copied, the investigative imperatives of the case proposed narrowing the contents for Special Agent dictate the extent and nature of the examination, and the Hamako using forensic software and keywords. 4/8 Tr. at fact is that here, the agents found what they were looking 33. for sitting in the computer's allocated space and email containers, and they did not need to go further. But they Still, the search here was something of a hybrid, and not had created a copy of the unallocated space as well in the quite the scouring that was involved in Cotterman, so did event a search for deleted matter turned out to be it constitute a "forensic" search under either test?" Which indicated. test is the appropriate formulation? Both sides steered the Court away from engaging in that sort of academic The government tried to make the point that the use of the analysis. 4/8 Tr. at 58-59; 90. While the parties did not particular forensic search programs here was not agree on whether reasonable suspicion was needed, they significant, since a person with unlimited time (and both urged the Court not to select one test over the other presumably, patience) could use the search tools already and not to articulate yet another general rule for computer offered on a Windows-based laptop and eventually find searches, and that is sound advice. the emails and documents that the agent found. 4/8 Tr. at 81. Neither side produced much in the way of expert *18 In the end, the Court is not persuaded that it is testimony or literature that would illuminate these issues, necessary to develop law that does not exist in this Circuit but Special Agent Hamako did testify that the mere use of on the question of whether and when reasonable suspicion a password on the device or changed file extensions on would be constitutionally required, or to articulate a broad individual documents could inhibit such an effort. 4/7 Tr. rule of general applicability to future searches of at 45-47, and that Intella was more efficient than electronic media when the technology is constantly Outlook. 4/7 Tr. at 105. He also explained that Intella changing and the parties have not provided much allows agents to run keyword searches through emails, technical guidance. Because while the courts in Ickes, tracks what searches have been conducted, and provides Cotterman, and Saboonchi had little in the way of for tagging, marking, and categorizing emails without Supreme Court precedent to guide their way, the Supreme modifying the content of the emails themselves. 4/7 Tr. at Court has since issued its opinion in Riley v. California, 50; see also 4/8 Tr. at 31-32 (testimony from Special — U.S. —, 134 S.Ct. 2473, 189 L.Ed.2d 430 (2014). Agent Marshall explaining that Intella indexes and And in Riley, the Court made it clear that the breadth and categorizes the emails by information contained in them, volume of data stored on computers and other smart such as sender, recipient, dates, and attachments). More devices make today's technology different in ways that importantly, the agents' testimony about how long it took have serious implications for the Fourth Amendment them to do what they did, even when they had the benefit analysis, and it demonstrated how that analysis is of these additional programs, belies the notion that what supposed to proceed." Id. at 2489-91. So it is not was done is comparable to what an agent could have necessary to decide the constitutional question of what accomplished if he had simply powered up the computer level of suspicion is required to support a forensic search then and there and stood around the airport for a while. of a computer that began at the border, or what the See Saboonchi, 990 F.Supp.2d at 561 ("It is the determining features of a "forensic" search might be. potentially limitless duration and scope of a forensic search of the imaged contents of a digital device that ISI 191 1191Riley presented the question of whether the police WestlawNexI © 2015 Thomson Reuters. No claim to original U.S. Government Works. 16 EFTA01207808 United States v. Kim, — F.Supp.3d (2015) may search digital information on a cell phone as part of a destruction of evidence—are warrantless search incident to arrest. Id. at 2480. The present in all custodial arrests. starting point for the answer was the Fourth Amendment, There are no comparable risks and the Court reaffirmed two core propositions: first, that when the search is of digital data. "[a]s the text makes clear, 'the ultimate touchstone of the In addition, Robinson regarded any Fourth Amendment is reasonableness,' " Id. at 2482, privacy interests retained by an quoting Brigham City, 547 U.S. at 403, 126 S.Ct. 1943; individual after arrest as and second, "that '[w]here a search is undertaken by law significantly diminished by the fact enforcement officials to discover evidence of criminal of the arrest itself. Cell phones, wrongdoing, ... reasonableness generally requires the however, place vast quantities of obtaining of a judicial warrant.' " Id. quoting Vernonia personal information literally in the School Dist. 47J v. Acton, 515 U.S. 646, 653, 115 S.Ct. hands of individuals. A search of 2386, 132 L.Ed.2d 564 (1995). The Court went on to the information on a cell phone reiterate that "[i]n the absence of a warrant, a search is bears little resemblance to the type reasonable only if it falls within a specific exception to of brief physical search considered the warrant requirement," and it acknowledged that a in Robinson. We therefore decline search of the person of the accused incident to arrest is to extend Robinson to searches of such a well-recognized exception. Id. data on cell phones.... The Court then reviewed its precedents concerning the *19 Id. at 2484-85." lawful scope of a warrantless search of the property found on a suspect. Id. at 2483-84. In Chime! v. California, 395 "Thus, it appears to this Court that the analysis of U.S. 752, 89 S.Ct. 2034, 23 L.Ed.2d 685 (1969), the whether the search of Kim's laptop was reasonable under Court announced that it would be reasonable for an the Fourth Amendment does not simply end with the arresting officer to search for any weapons that might invocation of a statute or the well-recognized border endanger the officer's safety or be used to resist arrest or exception, as broad as it may be, and it does not turn on effect an escape, and that it would also be reasonable to the application of an undefined term like "forensic." search for and seize evidence that might otherwise be Instead, following the approach utilized in Riley, the concealed or destroyed. Riley, 134 S.Ct. at 2483, citing Court must proceed "'by assessing, on the one hand, the Chime!, 395 U.S. at 762-63, 89 S.Ct. 2034. In Robinson degree to which [the search] intrudes upon an individual's v. United States, 414 U.S. 218, 94 S.Ct. 467, 38 L.Ed.2d privacy, and, on the other, the degree to which it is needed 427 (1973), the Court announced that since an arrest for the promotion of legitimate governmental interests.' " based upon probable cause was itself a lawful intrusion Riley, 134 S.Ct. at 2484, quoting Wyoming v. Houghton, under the Fourth Amendment, no further justification or 526 U.S. 295, 300, 119 S.Ct. 1297, 143 L.Ed.2d 408 showing of any actual threat to the arresting officer was (1999). As part of that exercise, the Court should, as the needed for the officer to extend the search to encompass Supreme Court did, consider whether the application of property—in that case, a crumpled cigarette the recognized warrant exception to this particular package—found on the arrestee's person. Riley 134 S.Ct. category of personal property would " 'untether the rule at 2483-84, citing Robinson, 414 U.S. at 234, 94 S.Ct. from the justifications' " underlying the exception. Id. at 467. 2485, quoting Arizona v. Gant, 556 U.S. 332, 343, 129 S.Ct. 1710, 173 L.Ed.2d 485 (2009). While Riley did not But the availability of an exception alone was not enough have any reason to catalogue the interests underlying the to end the inquiry in Riley, and ultimately, the Court government's authority to search at the border, the rejected a "mechanical application" ofRobinson. opinion did strongly indicate that a digital data storage device cannot fairly be compared to an ordinary container [W]hile Robinson 's categorical when evaluating the privacy concerns involved. Id. at rule strikes the appropriate balance 2491. in the context of physical objects, neither of its rationales has much So what are the justifications underlying the exception to force with respect to digital content the warrant requirement that pertain at the border? At the on cell phones. On the government outset, it is important to note that we are not dealing with interest side, Robinson concluded an exception to the Fourth Amendment reasonableness that the two risks identified in requirement—only an exception to the warrant Chimel—harm to officers and requirement. See Ramsey, 431 U.S. at 621, 97 S.Ct. 1972. WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 17 EFTA01207809 United States v. Kim, — F.Supp.3d (2015) And the fact that the Supreme Court has specifically monitoring what comes in to the country apply in this likened the border search warrant exception to the search case. incident to arrest exception reinforces the Court's view that an analysis similar to the one in Riley should be It is true that there is case law that extends the search undertaken here. Id. ("[The border search exception] is a authority at the border to departures as well, and in longstanding, historically recognized exception to the particular, to potential violations of the export control Fourth Amendment's general principle that a warrant be laws. See, e.g., United States v. Boumeihem, 339 F.3d obtained, and in this respect, is like the similar 'search 414, 423 (6th Cir.2003) (finding that the government incident to lawful arrest' exception...."). properly searched a large cargo container before it left the United States because "the United States's interest in 'nine government's power at the border arises out of the preventing the export of weapons to other countries also sovereign's right and need to protect its territorial implicates the sovereign's interest in protecting itself'). integrity and national security. "[S]earches made at the But Riley indicates that the Fourth Amendment is not border, pursuant to the longstanding right of the sovereign necessarily satisfied by a simplistic likening of a to protect itself by stopping and examining persons computer to a searchable "container?" See 134 S.Ct. at crossing into this country, are reasonable simply by virtue 2491. of the fact that they occur at the border...." Ramsey at 616, 97 S.Ct. 1972. While there is authority that states that the Applying the Riley framework, the national security government's broad authority at the border extends to concerns that underlie the enforcement of export control those exiting the country as well as to those coming in, regulations at the border must be balanced against the United States v. Seipp:, 547 F.3d 993, 999 (9th Cir.2008), degree to which Kim's privacy was invaded in this quoting Ramsey 431 U.S. at 616, 97 S.Ct. 1972, the instance. And as was set forth above, while the immediate justifications for the exception to the warrant requirement national security concerns were somewhat attenuated, the are generally framed in terms of threats posed at the point invasion of privacy was substantial: the agents created an of entry. See, e.g., Montoya de Hernandez, 473 U.S. at identical image of Kim's entire computer hard drive and 537, 105 S.Ct. 3304 ("Since the founding of our Republic, gave themselves unlimited time to search the tens of Congress has granted the Executive plenary authority to thousands of documents, images, and emails it contained, conduct routine searches and seizures at the border, using an extensive list of search terms, and with the without probable cause or a warrant, in order to regulate assistance of two forensic software programs that the collection of duties and to prevent the introduction of organized, expedited, and facilitated the task. Based upon contraband into this country."); Ramsey, 431 U.S. at 620, the testimony of both Special Agent Hamako and Special 97 S.Ct. 1972 ("The border-search exception is grounded Agent Marshall, the Court concludes that wherever the in the recognized right of the sovereign to control, subject Supreme Court or the Court of Appeals eventually draws to substantive limitations imposed by the Constitution, the precise boundary of a routine border search, or who and what may enter the country."); United States v. however either Court ultimately defines a forensic—as Thirty-Seven (37) Photographs, 402 U.S. 363, 376, 91 opposed to a conventional—computer search, this search S.Ct. 1400, 28 L.Ed.2d 822 (1971) ("Customs officials was qualitatively and quantitatively different from a characteristically inspect luggage and their power to do so routine border examination, and therefore, it was is not questioned ...; it is an old practice and is intimately unreasonable given the paucity of grounds to suspect that associated with excluding illegal articles from the criminal activity was in progress. country."); Carroll v. United States, 267 U.S. 132, 154, 45 S.Ct. 280, 69 L.Ed. 543 (1925) ("Travelers may be More fundamentally, after hearing all of the facts, the [stopped and searched] in crossing an international Court cannot help but ask itself whether the examination boundary because of national self-protection reasonably in this case can accurately be characterized as a border requiring one entering the country to identify himself as search at all. And if not, it surely cannot be justified by entitled to come in, and his belonging as effects which the concerns underlying the border search doctrine. may be lawfully brought in."); United States v. 12 200-Ft. Reels of Super 8MM Film, 413 U.S. 123, 125, 93 S.Ct. It is true that Kim's laptop was seized at the border—in 2665, 37 L.Ed.2d 500 (1973) (border search authority is this case, LAX—but it was not even opened, much less justified by the need to the prevent smuggling and enforce searched, there. It was transported approximately 150 import restrictions); Almeida-Sanchez v. United States, miles to San Diego, it was retained for a limited period of 413 U.S. 266, 272, 93 S.Ct. 2535, 37 L.Ed.2d 596 (1973) time, and eventually, the laptop was returned. Meanwhile, (the power to exclude aliens from entering this country). there was so little of note found in Kim's luggage, and he posed so little of an ongoing threat to national security, *20 II3INone of those significant governmental interests in that he was permitted to board his flight. WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 18 EFTA01207810 United States v. Kim, — F.Supp.3d (2015) `maintain[ ] the integrity of the border conditions keeping *21 "The Court recognizes that the concept of the the search and seizure within the governmental necessities "border" for Fourth Amendment purposes extends beyond of the border.' " Id. quoting United States v. Fogelman, the physical boundary itself to the "functional equivalent" 586 F.2d 337, 350 (5th Cir.1978) (Brown, C.J., of the border, which may include "an established station concurring). near the border" or other nearby convenient locations. See A lemida-Sanchez v. United States, 413 U.S. 266, 272-73, Here, the search of the laptop was not predicated on any 93 S.Ct. 2535, 37 L.Ed.2d 596 (1973). And the Ninth observation of Kim's activities within the United States Circuit has held that the term "border" should be given a whatsoever. And given the extensive nature and duration geographically flexible reading within limits of reason of the search here and the use of a list of specific search derived from the underlying constitutional principles. terms, the search "did not possess the characteristics of a Castillo-Garcia v. United States, 424 F.2d 482, 485 (9th border search or other regular inspection procedures. It Cir.I970); see also Alexander v. United States, 362 F.2d more resembled the common nonborder search based on 379, 382 (9th Cir. 1966) (the legality of a search not in the individualized suspicion, which must be prefaced by the immediate vicinity of the border "must be tested by a usual warrant and probable cause standards...." United determination whether the totality of the surrounding States v. Brennan, 538 F.2d 711, 716 (5th Cir.1976).17 circumstances, including the time and distance elapsed...."). So if Special Agent Hamako needed the That point is driven home by a review of the warrant assistance of his forensic team to open the computer in the application that was filed after the so-called border search first instance, and that step was necessarily undertaken at was completed. After detailing his own experience and a DHS office rather than on the jetway, that aspect of the the statutory background, the agent set forth the facts proceedings could arguably be considered to be an supporting his view that there was probable cause to extension of the border. But while the laptop was within believe that the computer would contain evidence relating the government's custody and control, it was copied. And to violations of the Arms Export Control Act. SW Aft. ¶ it was the exact image of the hard drive that was subjected 10-42. First, the agent stated that emails already to the search by the government's forensic team, with the discovered on the computer revealed that in 2008, Kim fruits of that search provided to the investigating agent for had procured six Honeywell accelerometers and shipped further study. Indeed, the investigators' sworn testimony them to a Chinese national, who subsequently provided to the Court made it clear that the primary, if not the sole, them to two Iranian nationals. SW Aft. ¶¶ I I, 18-40, and purpose of the pre-planned encounter at the border was to Att. A—I. Paragraph 15 then summarizes—in one obtain the laptop and search it for evidence. sentence—the information provided by Yang, and it relates only to the completed transaction in 2008. SW Aft. Once the agents had secured the laptop and preserved ¶ 15. every single file and folder it contained for further examination, how does the examination of the copy and *22 After the affidavit lays out the probable cause, it the tens of thousands of emails and other files it contained describes the anticipated computer search protocol: "With for the next two weeks fall within the definition of a the approval of the Court in signing this warrant, agents border search, or the statutory provisions found in 19 executing this search will employ the following U.S.C. § 1581(a), at all? And what aspect of the security procedures regarding computers and other electronic or territorial integrity of the nation was implicated at that storage devices ...." SW Aff. ¶ 43. The first step described point that would justify unlimited scrutiny of the copy? was "[f]orensic [i]maging," which, of course, had already been accomplished, SW Aff. ¶ 44, and the next step was This case is entirely distinguishable from going to be the "[i]dentification and [e]xtraction of Castillo-Garcia, which involved continuous surveillance [r]elevant [cl]ata." SW Aft ¶¶ 45-50. of a car until it was stopped more than 100 miles from the border, 424 F.2d at 485, or United States v. Bilir, 592 The warrant affidavit goes on for paragraphs explaining F.2d 735, 741 (4th Cir. 1979). In Bilir, the court found that the highly technical process that is involved in identifying a "delayed search and seizure ... made some three to four and extracting data, the fact that it requires specific miles from the actual border, some seven hours after the expertise, equipment and software, and how challenging it observed border crossing; delayed primarily by a desire to can be. SW Aff. ¶145-46. There are paragraphs detailing confirm developing suspicion; and following practically the incredible volume of material that can be stored on a continuous surveillance in the interval" passed laptop and how much time it takes to review it all: constitutional muster as an extended border search. Id. at "Analyzing data has become increasingly time-consuming 741. In that case, the extended surveillance for the as the volume of data stored on a typical computer system purpose of confirming initial suspicion served to " and available storage devices has become WestlawNeff © 2015 Thomson Reuters. No claim to original U.S. Government Works. 19 EFTA01207811 United States v. Kim, — F.Supp.3d (2015) mind-boggling." SW Aff. ¶ 48. The agent concludes by invasive of Kim's privacy and so disconnected from not predicting that "[t]he identification and extraction only the considerations underlying the breadth of the process, accordingly, may take weeks or months" from government's authority to search at the border, but also the date of the warrant authorization. SW Aff.149. the border itself, that it was unreasonable. Therefore, the motion to suppress the evidence seized as a result of that But Special Agent Bamako and the forensics agent both search, which includes the materials listed in Attachment testified that no one performed any searching or B—I to the warrant affidavit, will be granted)* extraction after the warrant was obtained at all. 4/7 Tr. at 51; 4/8 Tr. at 23. In other words, the highly challenging and complicated examination of a mind-boggling volume of data was already complete. These undisputed facts militate against the conclusion that the only search that CONCLUSION was undertaken—without the warrant—was just a routine border search. For the reasons stated above, it is ORDERED that defendants' motion to suppress evidence [Dkt # 35] is After considering all of the facts and authorities set forth GRANTED. It is further ORDERED that a status above, then, the Court finds, under the totality of the conference is scheduled for May 18, 2015 at 10:00 a.m. in unique circumstances of this case, that the imaging and Courtroom 3. search of the entire contents of Kim's laptop, aided by specialized forensic software, for a period of unlimited duration and an examination of unlimited scope, for the All Citations purpose of gathering evidence in a pre-existing investigation, was supported by so little suspicion of F.Supp.3d 2015 WL 2148070 ongoing or imminent criminal activity, and was so Footnotes Agent Marshall appeared by telephone with the consent of defendants for the April 8, 2015 hearing. 4/8 Tr. at 4. 2 The laptop was returned to Kim around December 12, 2012. SW Atli 17. 3 Agent Marshall explained that "e-mail messages are stored in what we call a container. So if you have 5,000 e-mails, rather than having 5,000 files on your computer, you'll have one large file where all the e-mails are stored inside of that." 4/8 Tr. at 10. 4 This provision states: Any officer of the customs may at any time go on board of any vessel or vehicle at any place in the United States or within the customs waters or, as he may be authorized, within a customs-enforcement area established under the Anti-Smuggling Act, or at any other authorized place, without as well as within his district, and examine the manifest and other documents and papers and examine, inspect, and search the vessel or vehicle and every part thereof and any person, trunk, package, or cargo on board, and to this end may hail and stop such vessel or vehicle, and use all necessary force to compel compliance. 19 U.S.C. § 1581(a) (internal citation omitted). 5 The Fourth Circuit has found that a laptop being transported by a returning traveler at the port of entry fell well within the definition of the term "cargo" in 19 U.S.C. § 1581(a), and it upheld the inspection of a laptop in that case. See United States v. !ekes, 393 F.3d 501 (4th Cir.2005). But that opinion provides little guidance here because the constitutional challenge to the search was based on First Amendment grounds, and the search was initiated by agents at the border after they had already discovered child pornography in the defendant's possession and they were notified of an outstanding warrant for his arrest. Id. at 507. 6 See also 4/7 Tr. at 110 ("THE COURT: ... Basically, the government's opposition in this case ... says: Based upon the information Yang provided about Kim after Yang's arrest, as well as infommtion about Kim obtained during the investigation of Yang, Homeland Security Investigations Special Agent Bamako decided to conduct a border search of Kim when he returned to the United States. So it's fair to say that before you knew whether or when Mr. Kim was coming to the United States, you had already decided that if and when he came, you wanted to do a border search, correct? [SPECIAL AGENT HAMAKOJ: That's correct, Your Honor. THE COURT: And did you decide then that the border search would include doing a border search of his laptop? [SPECIAL AGENT HAMAKOJ: Yes, Your Honor."). WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 20 EFTA01207812 United States v. Kim, — F.Supp.3d (2015) 7 The dissent in Corterman criticized the majority's decision to rely in part on the fact that the defendant was returning from Mexico based on its vague association with "sex tourism," finding that Mexico is a popular travel destination for innocent reasons, including its "beaches, culture and weather, and not for its sex tourism." 709 F.3d at 992 (Smith, J., dissenting). The agents retained the electronic devices, and the next day, they were delivered to an ICE Computer Forensic Examiner who made copies of the hard drives. 709 F.3d at 958. On the following day, aided by the use of forensic software, the agent found seventy-five images of child pornography within the unallocated space of one of the laptops. Id. A further search of the password-protected files revealed an extensive collection of additional images of child pornography, including images of the defendant himself repeatedly molesting a child over a two-to-three-year period. Id. at 959. 9 Given the prevalence of laptops, tablets, cell phones, e-readers, and digital cameras, carried in combination by travelers ranging front elementary school students to senior citizens, and the availability of myriad electronic applications for news, sports, music, games, fitness, banking, personal organization, and travel, this Court is not necessarily persuaded that being equipped with multiple electronic devices is a strong indicator of business activity. But it notes that this factor was absent in this case in any event. In In United States v. Saboonchi. 990 F.Supp.2d 536, the court devoted only one page of its lengthy decision holding that reasonable suspicion was needed to its finding that the standard had been satisfied. Id. at 571. The opinion recounts that when Saboonchi, a dual citizen of the United States and Iran, arrived at the border, he was already the subject of ongoing investigations into export violations, and that evidence had already been gathered in response to several subpoenas. Id. There was information gleaned from both the subpoenas and witness interviews that the defendant had purchased two cyclone separators after representing that they would be used domestically, and that he had shipped them overseas, understating their value in a manner that suggested to the agent that he was seeking to avoid scrutiny. Id. at 542-43, 571. Also, it had already been determined that the recipient of the shipment was linked to a company in Iran. Id. at 571. But while it is true that this case also involves an investigation into a completed export violation, with little evidence that anything was ongoing at the border, the Saboonchi investigation was much further along than Special Agent Bamako's, which at that point consisted primarily of Yang's accusation. And the opinion, while it may be instructive on certain points, is not binding on this Court in any event. Such an analysis may have been necessary in that case since the Saboonchi court was otherwise constrained by the Fourth Circuit precedent in !ekes. 12 The First Circuit has proposed that the following non-exhaustive list of factors may be relevant when determining whether a search can be characterized as routine: "(i) whether the search results in the exposure of intimate body pans or requires the suspect to disrobe; (ii) whether physical contact between Customs officials and the suspect occurs during the search; (iii) whether force is used to effect the search; (iv) whether the type of search exposes the suspect to pain or danger; (v) the overall manner in which the search is conducted; and (vi) whether the suspect's reasonable expectations of privacy, if any, are abrogated by the search." United States K Brats. 842 F.2d 509, 512 (1st Cir.I988) (footnotes omitted). 13 The government, which had not even planned to call the forensic specialist until the Court indicated his testimony would be necessary, see 4/7 Tr. at 98, submitted that the search here did not meet the Correrman rest for a "forensic" examination, but it was not prepared to articulate why. 4/8 Tr. at 81-82. 14 The fact that Riley involved a cellular telephone rather than a laptop is of little moment; indeed, it was the fact that a cellular telephone is, for all intents and purposes, a small computer, that led that Court to find that the usual rules governing a search incident to arrest should not apply. 134 S.O. at 2489. 15 The level of concern expressed by the Supreme Court regarding the volume of personal data saved on an electronic device leads the Court to conclude that the decision in House V. Napoletano. 2012 WL 1038816 (D.Mass.2012), which was decided before Riley and is not binding in any event, is not instructive here. In that case, the District Court found that "the search of one's personal information on a laptop computer, a container that stores information, even personal information, does not invade one's dignity and privacy in the same way as an involuntary x-ray, body cavity, or strip search of a person's body or the type of search that has been held to be non-routine and require the government to assert some level of suspicion." Id. at '7. 16 For that reason, the Court does not feel compelled to follow the decision of the Fourth Circuit in Ickes. 393 F.3d at 501, which preceded Riley and is also distinguishable on other grounds. In that case, the border agents searched the defendant's computer only after finding other incriminating items during a physical search of the defendant's vehicle at a border crossing. Id. at 502-03, 506. In addition, the defendant's computer was seized and searched at the border, while the defendant was in the agents' custody. Id. at 503. 17 The Court need not determine whether the agent could have articulated probable cause to believe that Kim had participated in a criminal conspiracy in the past and that the laptop would contain evidence of that alleged conspiracy, because "[lin cases where searches are made without warrants, the Supreme Court has decreed that the existence of probable cause must be accompanied by WestlawNexts © 2015 Thomson Reuters. No claim to original U.S. Government Works. 21 EFTA01207813 United States v. Kim, — F.Supp.3d (2015) circumstances rendering the warrant procedure impracticable." Brennan, 538 F.2d at 721, citing Warden v. Hayden, 387 U.S. 294, 87 S.O. 1642, 18 L.Ed.2d 782 (1967). Since there were no exigent circumstances present in this case, if the search was not a "border" search within the meaning of Ramsey and other Supreme Court precedent, then the failure to obtain a warrant requires suppression. Ix The government did not even attempt to advance the argument that the issuance of the warrant, in which probable cause was predicated almost exclusively on the entails themselves, somehow cured the underlying illegality and provides grounds for denying the motion to suppress. End of Document t 2015 Thomson Reuters. No claim to original U.S. liovemment Works. WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 22 EFTA01207814