Upload
others
View
2
Download
0
Embed Size (px)
Citation preview
10-50403
UNITED STATES COURT OF APPEALS
FOR THE NINTH CIRCUIT
UNITED STATES OF AMERICA,
Plaintiff-Appellee,
vs.
DAVID GRUMMER
Defendant-Appellant.
Appeal from the United States District Courtfor the Southern District of California
Dana M. Sabraw, District Judge, Presiding
APPELLANT’S OPENING BRIEF
DAVID J. ZUGMAN GABRIEL L. COHANAttorney at Law Attorney at Law964 5th Ave. Suite 300 444 West C Street, #444San Diego, CA 92101 San Diego, CA 92101Telephone: (619) 699-5931 Telephone: (619) 236-0244Facsimile: (619) 699-5932 Facsimile: (619) 768-0333
Counsel for Mr. Grummer
UNITED STATES COURT OF APPEALS
FOR THE NINTH CIRCUIT
UNITED STATES OF AMERICA, ) No. 10-50403)
Plaintiff-Appellee, ) D.C. No. CR-08-4402-DMS)
v. ))
DAVID GRUMMER ) Southern District) of California,
Defendant-Appellant. ) San Diego)
)
QUESTIONS PRESENTED FOR REVIEW
1. Was the search of Mr. Grummer’s computersunreasonable because it occurred outside thewarrant’s 90-day limit and after Mr. Grummer hadpled guilty with a cooperation plea agreement?
2. Did Agent Adkison’s June 9, 2008, searchpurportedly based on the January 16, 2008,warrant violate the Fourth Amendment becauseAdkison intentionally ignored the warrant whilehe searched and the search went beyond the scopeof the warrant, requiring suppression?
3. Did Agent Gorman’s Search Warrant Applicationand Affidavit violate the Fourth Amendment byauthorizing a search of personal records forwhich there was no probable cause to search?
4. Does double jeopardy preclude Mr. Grummer’sconviction for both possession and receipt ofthe child pornography where neither theindictment, jury instruction, nor verdict formtold the jury that the possession and receipthad to be premised on distinct conduct?
TABLE OF CONTENTS
QUESTIONS PRESENTED FOR REVIEW. . . . . . . . . prefix
TABLE OF AUTHORITIES. . . . . . . . . . . . . . . . . v
I. STATEMENT OF JURISDICTION. . . . . . . . . . 6
A. DISTRICT COURT JURISDICTION. . . . . . . 6B. THE JUDGMENT IS FINAL. . . . . . . . . . 7C. COURT OF APPEALS JURISDICTION. . . . . . 7D. THE APPEAL IS TIMELY.. . . . . . . . . . 7
II. BAIL STATUS. . . . . . . . . . . . . . . . . 7
III. STATEMENT OF THE ISSUES. . . . . . . . . . . 8
A. THE WARRANT HAD EXPIRED AT THE TIME OF THESEARCH.. . . . . . . . . . . . . . . . . 9
B. THE SEARCH PARAMETER OF “THE AGENT CANLOOK AT EVERYTHING” IS NECESSARILY OVER-BROAD AND INVALID UNDER THE FOURTHAMENDMENT... . . . . . . . . . . . . . 11
C. IF THE WARRANT ALLOWED AN ALL-RECORDSSEARCH, IT WAS OVER-BROAD IN VIOLATIONOF THE FOURTH AMENDMENT AND GOOD-FAITHDOES NOT APPLY.. . . . . . . . . . . . 13
D. POSSESSION IS A LESSER INCLUDED OFFENSEOF RECEIPT OF CHILD PORNOGRAPHY. . . . 14
IV. STATEMENT OF THE CASE. . . . . . . . . . . 15
A. THE EPA CASE: SOURCE OF THE CHILDPORNOGRAPHY CHARGES. . . . . . . . . . 15
B. THE CHILD PORNOGRAPHY CHARGES. . . . . 18C. MOTION TO SUPPRESS EVIDENCE .. . . . . 18
1. Motions and Responses. . . . . . . 182. The Disputed Warrant. . . . . . . 23
a. The Application. . . . . . . . 23b. The Computer Search Protocol At ¶59
. . . . . . . . . . . . . . . 25c. The Agent’s Testimony
. . . . . . . . . . . . . . . 29
d. The District Court’s Findings. 35
D. TRIAL AND SENTENCING.. . . . . . . . . 36
V. SUMMARY OF ARGUMENTS. . . . . . . . . . . . 37
VI. STANDARD OF REVIEW. . . . . . . . . . . . . 39
VII. ARGUMENTS. . . . . . . . . . . . . . . . . 40A. THE WARRANT WAS MORE THAN A MONTH
EXPIRED AT THE TIME OF THE SEARCH. . . 42B. LOOKING THROUGH THE FILES TO SEE WHICH ONES
ARE RELEVANT IS NOT “CULLING”, IT ISSEARCHING AND IT VIOLATES THE SCOPE OF THESEARCH.. . . . . . . . . . . . . . . . 451. Attachment B. . . . . . . . . . . 482. Computer Search Protocol: ¶59 Of The
Affidavit. . . . . . . . . . . . . 51C. GOOD-FAITH DOES NOT APPLY. . . . . . . 64D. THE WARRANT WAS OVER-BROAD.. . . . . . 66E. MR. GRUMMER’S CONVICTION FOR BOTH THE
POSSESSION AND RECEIPT OF CHILDPORNOGRAPHY VIOLATED DOUBLE JEOPARDY.. 74
VIII. CONCLUSION. . . . . . . . . . . . . . . . . 78
APPENDIX OF STATUTES. . . . . . . . . . . . . . . . 79
CERTIFICATE OF RELATED CASES. . . . . . . . . . . . 86
Certificate of Compliance Pursuant to Fed. R. App.32(a)(7)(c)and Circuit Rule 32-1 for Case Number 10-50403.. . . . . . . . . . . . . . . . . . . . . . . . . . 87
PROOF OF SERVICE. . . . . . . . . . . . . . . . . . 89
iv
TABLE OF AUTHORITIES
SUPREME COURT CASES
Arizona v. Hicks, 480 U.S. 321 (1987).. . . . . . . 54
Blockburger v. United States, 284 U.S. 299 (1932).. 14
Coolidge v. New Hampshire, 403 U.S. 443 (1971). . . 73
Herring v. United States, 555 U.S. 135 (2009).. 65, 66
Tennessee Valley Authority v. Hill, 437 U.S. 153 (1978).. . . . . . . . . . . . . . . . . . . . . . . . . . 56
United States v. Grubbs, 547 U.S. 90 (2006).. . . . 46
United States v. Leon, 468 U.S. 897 (1984). . . . . 65
CONSTITUTIONAL PROVISIONS
Amend. IV.. . . ii, 11, 13, 41, 43, 46, 56, 65, 72, 74
FEDERAL CASES
Berman v. United States, 302 U.S. 211 (1937). . . . . 7
Garcia-Aguilar v. U.S. Dist. Ct. for S. Dist. of Cal.,535 F.3d 1021 (9th Cir. 2008).. . . . . . . . . . . 31
United States v. Abrams, 615 F.2d 541 (1st Cir. 1980).. . . . . . . . . . . . . . . . . . . . . . . . . 9, 41
United States v. Adjani, 452 F.3d 1140 (9th Cir. 2006).. . . . . . . . . . . . . . . . . . . . . . . . . . 41
United States v. Carey, 172 F.3d 1268 (10th Cir. 1999).. . . . . . . . . . . . . . . . . . . . . . 67, 72, 73
United States v. Comprehensive Drug Testing, Inc. 621F.3d 1162 (9th Cir. 2010) (en banc).. . . . . . . . . .
v
.. . . . . . . . . . . 11, 12, 14, 39, 55-57, 65, 69, 70
United States v. Davenport, 519 F.3d 940 (9th Cir. 2008).. . . . . . . . . . . . . . . . . . . . 14, 39, 75, 76
United States v. Foster, 100 F.3d 846 (10th Cir. 1996).. . . . . . . . . . . . . . . . . . . . . . . . . . 72
United States v. Furrow, 229 F.3d 805 (9th Cir. 2000)overruled on other grounds by United States v. Johnson,256 F.3d 895 (9th Cir. 2001) (en banc). . . . . . . 10
United States v. Giberson, 527 F.3d 882 (9th Cir. 2008).. . . . . . . . . . . . . . . . . . 11, 39, 67, 68, 76
United States v. Hernandez-Guardado, 228 F.3d 1017 (9thCir. 2000). . . . . . . . . . . . . . . . . . . . . 40
United States v. Hill, 459 F.3d 966 (9th Cir. 2006).. . . . . . . . . . . . . . . . . . . . . . . . . . 42
United States v. Hitchcock, 2002 U.S. App. LEXIS 15726(9th Cir. 2002).. . . . . . . . . . . . . . . . . 9, 43
United States v. Krupa, 633 F.3d 1148 (9th Cir. 2011).. . . . . . . . . . . . . . . . . . . . . . . . . . 39
United States v. Lynn, 2011 U.S. App. LEXIS 11254 (9thCir. 2011).. . . . . . . . . . . . . . . . . . 15, 77
United States v. Payton, 573 F.3d 859 (9th Cir. 2009).. . . . . . . . . . . . . . . . . . . . . . . . 19, 37
United States v. Rettig, 589 F.2d 418 (9th Cir. 1978).. . . . . . . . . . . . . . . . . . . . . . . . . . 42
United States v. Rude, 88 F.3d 1538 (9th Cir. 1996).. . . . . . . . . . . . . . . . . . . . . . . . . . 10
United States v. Schales, 546 F.3d 965 (9th Cir. 2008).. . . . . . . . . . . . . . . . . . . . . . . 15, 75-77
vi
United States v. Stanert, 762 F.2d 775 (9th Cir. 1985).. . . . . . . . . . . . . . . . . . . . . . . . . . 10
United States v. Stanert, 762 F.2d 775 (9th Cir. 1985).. . . . . . . . . . . . . . . . . . . . . . . . . . 64
United States v. Summers, 268 F.3d 683 (9th Cir. 2001).. . . . . . . . . . . . . . . . . . . . . . . . . . 40
United States v. Syphers, 426 F.3d 461 (1st Cir. 2005).. . . . . . . . . . . . . . . . . . . . . . . . . . 44
United States v. Tamura, 694 F.2d 591 (9th Cir. 1982).. . . . . . . . . . . . . . . . . . . . . . . . . 9, 41
United States v. Walser, 275 F.3d 981 (10th Cir. 2001).. . . . . . . . . . . . . . . . . . . . . . . . . . 68
FEDERAL STATUTES
18 U.S.C. § 2251. . . . . . . . . . . . . . . . . . 79
18 U.S.C. § 2252. . . . . . . . . . . . . . . . 18, 82
18 U.S.C. § 3231. . . . . . . . . . . . . . . . . . . 7
18 U.S.C. § 3742. . . . . . . . . . . . . . . . . . . 7
18 U.S.C. §§ 2251.. . . . . . . . . . . . . . . . . 18
28 U.S.C. § 1291. . . . . . . . . . . . . . . . . . . 7
OTHER AUTHORITIES
Paul Ohm, Massive Hard Drives, General Warrants, And ThePower of Magistrate Judges, 97 Va. L. Rev. 1 (2011).. . . . . . . . . . . . . . . . . . . . . . . . . . 47
Raphael Winick, Searches and Seizures of Computers andComputer Data, 8 Harv. J. L. & Tech. 75 (1994). 73, 74
vii
www.computer-forensics.net/what-is-a-file-signature?/; en.wikipedia.org/wiki/File_signature... . . . . . . 71
www.zdnet.com/news/faq-forty-years-of-moores-law/42082.. . . . . . . . . . . . . . . . . . . . . . . . . . 39
viii
UNITED STATES COURT OF APPEALS
FOR THE NINTH CIRCUIT
UNITED STATES OF AMERICA, ) No. 10-50403)
Plaintiff-Appellee, ) D.C. No. CR-08-4402-DMS)
v. ))
DAVID GRUMMER ) Southern District) of California,
Defendant-Appellant. ) San Diego)
)
I.
STATEMENT OF JURISDICTION
A. DISTRICT COURT JURISDICTION
The United States charged Mr. Grummer with violating
United States Code with respect to receipt and possession
of child pornography and with a single count of attempted
production of child pornography. [CR 25; ER1 46-55]. 1
The district court had jurisdiction per 18 U.S.C. § 3231.
B. THE JUDGMENT IS FINAL
A judgment of conviction and sentence is a final
“CR” refers to the clerk’s record of 08cr4402-DMS. 1
“CR2" refers to the clerk’s record of 08cr1140-L “ER1”refers to Appellant’s Excerpts of Record, Volume I; “ER2"refers to Appellant’s Excerpts of Record, Volume II.
1
order subject to appeal under 28 U.S.C. § 1291. Berman
v. United States, 302 U.S. 211, 212-13 (1937).
C. COURT OF APPEALS JURISDICTION
The district court’s judgment and commitment is a
final order subject to review under 28 U.S.C. § 1291.
[CR 76; ER2 11-14]
D. THE APPEAL IS TIMELY
Mr. Grummer notice his appeal the day the district
court entered judgment: August 20, 2010. [CR 77; ER 1].
This appeal is timely.
II.
BAIL STATUS
Mr. Grummer is incarcerated. The Bureau of Prisons
projects Mr. Grummer’s release for August 23, 2031.2
III.
STATEMENT OF THE ISSUES
David Grummer was arrested in an Environmental
Protection Agency (“EPA”) investigation into the sale of
www.bop.gov/iloc2/LocateInmate.jsp2
2
DDT and Freon over the internet. Agents learned that3
Grummer worked at a hazardous waste facility and that he
was siphoning off hazardous illegal chemicals (like DDT
and Freon) and reselling them over the internet. Agents
were easily able to establish contact with Grummer,
arrange a few sales, and bust him for selling illegal,
environment-destroying chemicals.
Mr. Grummer pled guilty, with a plea agreement, and
was cooperating with the government at the time that his
computers’ graphics files were searched one by one to
look for evidence of crime. [CR2 1-4; ER2 180-193].
This search was illegal for a variety of reasons.
A. THE WARRANT HAD EXPIRED AT THE TIME OF THE SEARCH
The warrant sets forth that any search of the
computer per the warrant had to be completed in 90 days.
[CR 35-1; ER 297-298]. The warrant’s time limitation is
a normal and important feature given the concerns that
when the government searches a personal computer, there
Mr. Grummer was ultimately sentenced to 18 months3
for that case, U.S. v. Grummer, 08cr1140!L. Thissentence is running consecutively to the 295 monthsimposed for the conviction being appealed.
3
is a substantial amount of over-seizure of documents and
information protected by the 4th Amendment. When the
government over-seizes, United States v. Tamura, 694 F.2d
591, 596 (9th Cir. 1982), requires that removal be
monitored by the magistrate judge. Searching outside the
time boundary of the warrant to review every single
picture in all of Mr. Grummer’s directories constituted:
“the kind of investigatory dragnet the fourth amendment
was designed to prevent.” Id. at 595 (quoting United
States v. Abrams, 615 F.2d 541, 543 (1st Cir. 1980)).
The time restrictions of a warrant are treated as
limiting the scope of the warrant. United States v.
Hitchcock, 2002 U.S. App. LEXIS 15726, *18-19 (9th Cir.
2002). The computer was seized January 17, 2008, and4
“The good faith exception has no application4
here, where there is no dispute about the searchwarrant’s validity but only about whether the agentsexecuted the warrant before it was effective. Rather, theissue is whether the search was conducted within thescope of a warrant, though here the issue is temporalscope whereas in the ordinary case what is at issue arethe items for which the search warrant was issued or theplaces the warrant authorizes to be searched. See, e.g., United States v. Furrow, 229 F.3d 805, 816 (9th Cir.2000) (considering whether search of four ‘outbuildings’was properly within the scope of search warrant),
4
search occurred late May 2008. Mr. Grummer pled guilty
with a cooperation plea agreement April 24th. The
offensive image was found on June 9, 2008. [CR2 1-4].
If the government wanted to search the computer in May of
2008, it needed to get a new warrant and explain to the
Magistrate Judge why probable cause was satisfied and
what sort of search parameters would be appropriate in
light of the change in circumstances. United States v.
Stanert, 762 F.2d 775 (9th Cir. 1985).
B. THE SEARCH PARAMETER OF “THE AGENT CAN LOOK ATEVERYTHING” IS NECESSARILY OVER-BROAD ANDINVALID UNDER THE FOURTH AMENDMENT.
The affidavit asked for the ability to view
information outside the scope of the warrant, but assured
that it would “not be made available to the investigating
agents unless it appears to the examiner that the
information relates to the commission of offenses not
covered by this warrant.” [CR 35-1]. That is the
overruled on other grounds by United States v. Johnson,256 F.3d 895 (9th Cir. 2001) (en banc); United States v.Rude, 88 F.3d 1538, 1551-52 (9th Cir. 1996) (consideringwhether seized documents were outside the scope of searchwarrant).”
5
“general warrant” condemned by this Court in United
States v. Comprehensive Drug Testing, Inc. 621 F.3d 1162,
1176 (9th Cir. 2010) (en banc) (“CDT II”). Magistrate
judges should insist that the government waive reliance
upon the plain view doctrine in digital evidence cases.
CDT II, 621 F.3d at 1170-71(Maj. Op.); id. at 1177-78
(Kozinski, C.J., concurring). 5
If the segregation is to be done by government
computer personnel, the government must agree in the
warrant that the computer personnel will not disclose to
“When the government wishes to obtain a warrant5
to examine a computer hard drive or electronic storagemedium to search for certain incriminating files, or whena search for evidence could result in the seizure of acomputer, see, e.g., United States v. Giberson, 527 F.3d882 (9th Cir. 2008), magistrate judges should insist thatthe government forswear reliance on the plain viewdoctrine. They should also require the government toforswear reliance on any similar doctrine that wouldallow retention of data obtained only because thegovernment was required to segregate seizable fromnon-seizable data. This will ensure that future searchesof electronic records do not ‘make a mockery of Tamura’--indeed, the Fourth Amendment--by turning all warrantsfor digital data into general warrants. Maj. op. at13950. If the government doesn’t consent to such awaiver, the magistrate judge should order that theseizable and non-seizable data be separated by anindependent third party under the supervision of thecourt, or deny the warrant altogether.”
6
the investigators any information outside the scope of
the warrant. Id. at 1180. The government’s search
protocol must be designed to identify only information
within the scope of the probable cause; that is the only
information which may be examined by the case agents.
Id. at 1170-72.
It defies credulity to believe that the agent was
searching for more evidence on the already pled guilty
and cooperating EPA case. Under the Agent’s proposed
rationale for the search (more EPA evidence), he would
plow through giga-byte after gigabyte of data -- what the
government described as a stack of paper the size of the
Washington Monument -- in order to get to the bottom of
that EPA case. Adkinson was looking at the computer data
in bulk (480 images per view) stretched on 2 screens.
One could not design a more invasive method of searching
other than going every photo a person has their computer
or phone. The government cannot search a person’s
computer for evidence in this way without making a farce
of the individual’s privacy. Agent Adkinson seeks
credulity by saying he “didn’t get to search the evidence
7
in this case.” [ER2 101]. Agent Adkinson had already
found and book marked the EPA evidence he was allegedly
seeking when he began the methodical search of every
photograph on Mr. Grummer’s drive.
C. IF THE WARRANT ALLOWED AN ALL-RECORDS SEARCH, ITWAS OVER-BROAD IN VIOLATION OF THE FOURTHAMENDMENT AND GOOD-FAITH DOES NOT APPLY.
The search warrant listed seventeen broad categories
of documents (a. through q.) all of which began with the
language “all permanent and temporary files containing.”
This sounds like the all-records search which eliminates
any possible individual privacy regarding computer
information. But to the extent that any privacy interest
remained, the warrant ended with a proviso for items
beyond the warrant’s scope: “The forensic examiner may
still view information not within the scope of the
warrant but it will not be made available to the
investigating agents unless it appears to the examiner
that the information relates to the commission of
offenses not covered by this warrant.” [CR 35-1].
Whatever of the search protocols described in the
warrant, the government’s actual search was nothing other
8
than the “general exploratory rummaging” condemned by
Chief Judge Kozinski in the context of electronic
evidence. Comprehensive Drug Testing, Inc. 621 F.3d
1162, 1180 (Kozinski, C.J., concurring).
D. POSSESSION IS A LESSER INCLUDED OFFENSE OFRECEIPT OF CHILD PORNOGRAPHY.
It is established that if one receives contraband,
the person has taken possession of the contraband.
United States v. Davenport, 519 F.3d 940, 947 (9th Cir.
2008)(concluding that possession was a lesser-included
offense of receipt for purposes of the Blockburger v.
United States, 284 U.S. 299, 304 (1932) test). Thus, Mr.
Grummer cannot be convicted of both receipt and
possession of the same offensive images. See United
States v. Lynn, 2011 U.S. App. LEXIS 11254 (9th Cir.
2011) (plain error reversal on possession/receipt double
jeopardy violation, case remanded); United States v.
Schales, 546 F.3d 965, 980 (9th Cir. 2008). In the
instant matter, Mr. Grummer was convicted of the receipt
of particular images as well as possession of the
computer drives in which such images were encoded.
9
Nothing in the jury instructions or the indictment
instructed the jury that Mr. Grummer could not be
convicted of possession of the computer drives only based
upon images separate from those underlying the receipt
counts. United States v. Schales, 546 F.3d at 980 (“If
the government wishes to charge a defendant with both
receipt and possession of material involving the sexual
exploitation of minors based on separate conduct, it must
distinctly set forth each medium forming the basis of the
separate counts.”)
IV.
STATEMENT OF THE CASE
A. THE EPA CASE: SOURCE OF THE CHILD PORNOGRAPHY CHARGES
In April of 2006, the EPA learned of David Grummer’s
sale of unregistered pesticides over the internet; EPA
Special Agent Leslie Gorman was assigned. [CR 35].
Grummer had an advertisement to sell DDT and chlordane (a
banned pesticide) on Agriseek.com. [Id.] Agent Gorman,
with six years experience, emailed Grummer and the EPA
prepared to conduct a few controlled buys. [Id.]
10
Grummer sold chlordane, DDT and R-12 Freon for small
amounts of money to the agents over the course of months.
Mr. Grummer did nothing during the case which would
make anyone believe that he was seeking to conceal his
identity or hide information. The reply email to Agent
Gorman was addressed “David Grummer” from yahoo email
stating that he accepted “paypal and check” and “any
questions call” and gave his phone number. [Id.]
Despite the impressive array of electronic evidence --
emails, checks, checking account, paypal information --
Gorman began surveillance. [Id.]
The government arranged several controlled buys and
deployed 2 under cover agents. [ER2 60] Grummer gave
the government his business card for being the “HHW
Project Manager” for Clean Harbors Environmental Services
in San Diego. [CR 35]. Mr. Grummer sold the agents a
quart bottle of liquid chlordane and a quart bottle,
approximately half full of liquid DDT for approximately
one hundred and ninety dollars. [Id.] Grummer offered
to sell Freon. [ER2 58].
On June 7, 2007, Grummer sold the undercover agents
11
a 30-pound cylinder of Freon for approximately $300
dollars. [CR 35]. The meeting and sale took place at
the City of Vista’s Household Hazardous Waste (HHW)
facility where Grummer worked. [Id.]
The agents got Mr. Grummer to sell them $37 worth of
freon. [CR 35]. The agents followed him home and then
seized him at FedEx in Oceanside with a package
containing 3 14-ounce cans labeled “Sercon, Refrigerant
12.” [CR 35].
Thus, Agent Gorman explained that, based on the
investigation, there was probable cause to believe that
Grummer’s residence in Oceanside contained evidence of
violations of FIFRA (illegal sale of chlordane and DDT,
which are banned pesticides), the CAA (illegal sale of
CFC R-12, a listed Class I Substance under the CAA, to an
individual who does not possess the proper EPA
certification), and the HMTS (improper packaging,
labeling and marking of HazMat shipment; improper or
false declaration of HazMat; and the transportation of
HazMat without shipping papers). [CR 35].
On April 24, 2008, Grummer made a first appearance,
12
waiver of indictment, and guilty plea per a cooperation
plea agreement. [CR 33-1; CR 39-3]. Sentencing was set
for July 7, 2008.
B. THE CHILD PORNOGRAPHY CHARGES
On December 17, 2008, Grummer was indicted for two
counts of receipt and possession of child pornography in
violation of 18 U.S.C. § 2252. [CR 9]. A superseding
indictment was filed on September 23, 2009, charging 1
count of attempted sexual exploitation of a minor, and 23
counts of receipt and possession of child pornography: 18
U.S.C. §§ 2251, 2252. [CR 25;].
C. MOTION TO SUPPRESS EVIDENCE
1. Motions and Responses
On March 5, 2010, Grummer filed a Motion to Suppress
Evidence, [CR 33], arguing that on June 9, 2008, the EPA
conducted a warrantless search of his hard drives and no
exigent circumstance or other exception obviated the
warrant requirement. [CR 33]. Grummer argued this was
an all records, all container search in violation of
United States v. Payton, 573 F.3d 859, 862 (9th Cir.
2009). [CR 33]. Grummer asserted a personal privacy
13
interest in his personal data on the computer. See
United States v. Payton, 573 F.3d at 864 (noting special
privacy concerns regarding computer storage.)
Grummer also argued that probable cause had expired
or was stale. [CR 33]. The suspected image of child
pornography was, of course, the “probable cause” that
tainted the second warrant issued June 27, 2008.
In its Response and Opposition to Defendant’s Motion
to Suppress, the government conceded that Agent Adkison
did not discover the thumbnail image he believed to be
child pornography until June 2008. [CR 35]. This was
nearly five months after the January 17, 2008, search and
seizure and two months past the deadline. The Affidavit
in support of the warrant and incorporated states at
paragraph 59. a., “The imaging and preliminary review
process, depending upon the number of computers seized,
the volume of data contained on the computers, any steps
taken by the owners to conceal the stolen data (sic) or
use of that data and the software deployed on the
computers, can take up to 90 days.” [CR 35-1].
The government first attempts to re-brand its
14
protocol as a “graphics review” in which Agent Adkison
located a series of images with “chlordane” in the
filename and tagged them with book marks. [CR 35]. The
image encountered by Adkinson was a thumbnail file of
child pornography on HD 2 of “Bdrm PC 1”:
“(Hussyfan)(pthc)(r@ygold)-Trish&Dragon (13 yr old)
py4.jpg.” [Id.] The dissimilarity between this filename
and the word “chlordane” eliminates the possibility that
these files would appear near one another in an
alphabetized list. The thumbnail image was located in6
the Program Files/Kazaa/My Shared Folder of the hard
drive. [Id.] There is no indication that the offensive
picture was located in a segment or folder wherein
information about the EPA case would be found. Agent
Adkison claims he immediately discontinued analysis of
the seized evidence upon discovering the image. [Id.]
At the suppression hearing, the government took every
position to validate the search. The search was not even
Computers have default sorting rules which are6
familiar to most users. File names are sortedalphabetically. See msdn.microsoft.com/en-us/goglobal/bb688122
15
a search because it was a part of the original search.
The Agent claimed to be searching for more evidence on
that EPA cases because a “a probability existed” that7
more incriminating evidence could be located for
sentencing enhancement purposes or further investigation.
[Id.] This statement is difficult to square with the
government’s cooperation plea agreement with Mr. Grummer
which prohibited the government from sentencing
enhancements not set forth in the agreement [ER2 190-
193].
At the motion hearing, the district court asked to
the parties to file further briefing regarding the
circumstances attendant at the time of the search.
Grummer complied and set forth undisputed facts. [CR
39]. Shortly after the warrants were executed, Mr.
Grummer began to meet and cooperation with the EPA
investigation. [Id.] During the months of February and
March, Grummer met with EPA agents and provided
Although not entirely clear, it appears the agent7
meant that it was theoretically possible that moreevidence existed.
16
additional incriminating information. [Id.] Based on
this cooperation, a plea agreement on the EPA
investigation was reached. [Id.] Grummer noted in his
supplemental memorandum that the common thread in the
cases cited by the court was the potential for abuse in
extended searches and that nothing impaired the EPA from
completing the search prior to Grummer’s tendering his
guilty plea. [Id.] The guilty plea was entered just
after expiration of the 90 days deadline for the forensic
search. [CR2 1-4].
The government’s supplemental response and opposition
argued that off-site forensic examinations take a long
time, probable cause remained attendant, this search was
simply a continuation of the original search, and
Grummer’s guilty plea did not affect the status of the
warrant or the probable cause underlying the January 2008
EPA warrant and, Agent Adkison was acting in good-faith
in any case so the invalidity of the warrant was
irrelevant. [CR 40].
2. The Disputed Warrant
EPA Agent Gorman prepared an Application and
17
Affidavit for Search Warrant for Grummer’s residence
consisting of: Attachment “A” -- a description of the
premises to be searched; Attachment “B” -- the list of
items concealed on the premises to be searched and
seized; and it incorporated the attached Affidavit of
Agent Gorman providing the facts supporting probable
cause and the protocol for seizure and search of
computers and computer media. [CR 35-1].
a. The Application
On January 16, 2008, Agent Gorman sought approval of
an Application and Affidavit for Search Warrant of
Grummer’s residence in Oceanside, California, and several
other locations, from Magistrate Judge Nita L. Stormes.
[CR 35]. The affidavit claimed probable cause existed to
believe evidence of crimes concerning violations of the
Federal Insecticide, Fungicide, and Rodenticide Act
(“FIFRA”), 7 U.S.C. § 136(a)(1)(A), the Clean Air Act
(“CAA”), 42 U.S.C. § 7413(c)(1), and the Hazardous
Materials Transportation Statute (“HMTS”), 49 U.S.C. §
5124 would be found at Grummer’s residence. [Id.]
The premises to be searched was described in
18
Attachment A. [CR 35]. Grummer’s residence was
described therein and two photographs were included with
Attachment A: Exhibit 1 was a photograph of the street
address numbers on the left side of the two-car garage
and Exhibit 2 was an aerial photograph of the residence.
[Id.]
Attachment B described the property to be searched,
including physical documents and electronic data. [Id.]
Attachment B stated that the seizure and search of
computers and computer media will be conducted in
accordance with paragraph 59 of the affidavit
(incorporating the 90-day limitation in ¶59 a). [Id.]
The search was to include deleted data, remnant data and
slack space. [Id.] Paragraph 4 of Attachment B listed
17 categories (a. through q.) of records for the period
from April, 2005, through the present (January 16, 2008).
[Id.] Each of these 17 categories began with the
language “all permanent and temporary files containing,”
then listing various items and categories of items.
[Id.]
b. The Computer Search Protocol At ¶59
19
Agent Gorman requested authorization to make forensic
images of the computers on the premises. She concluded
there was probable cause to believe that the computer(s)
used by Grummer had evidence of crime - the solicitations
to purchase the unregistered pesticides and CFC-12. [CR
35]. She then went on to describe the imaging procedure:
As this data cannot effectively be segregatedonsite from other data which may be stored onthe computer(s) and cannot be left behind, thecomputers will be seized and transported offsitefor imaging. Once a verified image has beenobtained and the data subjected to preliminaryreview, any computers which do not containevidence of the sale and shipment ofunregistered pesticides, CFC-12 or improperlyshipped hazardous materials will be returned tothe owner. The imaging and preliminary reviewprocess, depending upon the number of computersseized, the volume of data contained on thecomputers, any steps taken by the owners toconceal the stolen data (sic) or use of thatdata and the software deployed on the computers,can take up to 90 days. It should be noted thatsome database programs cannot be searched bykeywords without first extracting the data fromthe image and importing it into a new, cleancompatible version of the database software on aseparate, forensic computer.
[Id.]
The affidavit stated it was necessary to create a
forensic image, an exact physical copy of the hard drive
20
or other media, before conducting any search of the data
to prevent changing or irretrievably losing any data.
[Id.] Creating the forensic image(s) was necessary to
prevent the operating system from writing hundreds of new
files about its status and operating environment that
might delete or alter other files or metadata. [Id.]
Next, the affidavit explains how the forensic
analysis would be conducted, starting at ¶59 d. Agent
Gorman explained it can take days to properly search a
single hard drive for specific data because searching by
keywords, for example, often yields many thousands of
“hits,” each of which must be reviewed in context to
determine whether the data is within the scope of the
warrant. [CR 35]. Moreover, the computer may have
metadata stored about a relevant hit with additional
information: who created it, when was it was created,
when it was last accessed, when it was last modified,
when it was last printed and when it was deleted. [Id.]
Sometimes it is even possible, Agent Gorman claims, to
recover an entire document that never was saved to the
hard drive if the document was printed. [Id.] Certain
21
file formats do not lend themselves to keyword searches
such as many common electronic mails (e.g. Microsoft
Outlook), database and spreadsheet applications that do
not store data as searchable text; instead, it is saved
in a proprietary non-text format. [Id.] Agent Gorman
further claims that graphics images, such as faxes sent
to the computer or even documents printed by the computer
but not saved, are not text searchable. [Id.]8
In paragraph 59. f., Agent Gorman briefly addresses
difficulties in analyzing computer data onsite due to the
volume of data stored on a typical computer system. A
single megabyte of storage space is the equivalent of 500
double-spaced pages of text. [CR 35]. A single gigabyte
of storage space, or 1,000 megabytes, is the equivalent
of 500,000 double-spaced pages of text. [Id.] In 2008,
it was common for computer hard drives to store more than
100 gigabytes of data. [Id.] Forensic examination of a
hard drive images) may require a range of data analysis
This ignores the fact that software can convert8
images into text. This is commonly called OpticalCharacter Recognition (“OCR”) software and it was readilyavailable in 2008.
22
techniques and may take weeks or even months. [Id.]
Considering these difficulties, Agent Gorman
requested “permission to use whatever data analysis
techniques reasonably appear necessary to locate and
retrieve digital evidence within the scope of the
warrant.” [CR 35]. Magistrate Judge Stormes was assured
that “all forensic analysis of the imaged data will be
directed exclusively to the identification and seizure of
information within the scope of the warrant.” [Id.]
Agent Gorman then stated in the same paragraph, the
forensic examiner may still view information not within
the scope of the warrant, but it will not be made
available to the investigating agents unless it appears
to the examiner that the information relates to the
commission of offenses not covered by this warrant.
[Id.]
c. The Agent’s Testimony
Agent Gorman, the case agent and affiant, explained
that the time of the search she had subpoenaed records
from PayPal and Ebay. [ER2 58-59]. The records she
received from PayPal and Ebay identified individuals who
23
purchased DDT and chlordane from Grummer. [ER2 59]. The
EPA interviewed some people who purchased DDT and
chlordane from Grummer. [ER2 59-60].
Agent Gorman acknowledged that Attachment B to the
Search Warrant for Grummer’s residence authorized agents
to search for records identifying the buyer, recipient,
seller, shipper and/or broker of CFCs and unregistered
pesticides. [ER2 64]. It also authorized her to search
for documents identifying persons doing business with Mr.
Grummer. [Id.]
At the time the image suspected to be child
pornography was found, Agent Gorman claimed she was
awaiting the results of the search of the seized
computers from Agent Adkison at the NCFL [ER2 64],
including electronic records identifying people who may
have purchased unregistered pesticides from Mr. Grummer-
- although she already possessed the PayPal and Ebay
records. [ER2 64-55]. She had no contact with Adkison
from January 17, 2008, to June 9, 2008.
Grummer met with investigators for proffer sessions
in February and March of 2008. [ER2 65]. Agent Gorman
24
scheduled and attended multiple debriefs or proffers
where Grummer was cooperating. [ER2 66-67]. Grummer
explained his involvement with DDT and chlordane,
including what he did with it and how he would sell it
and ship it. [ER2 77]. Reports were written by the
agents recording that information. [ER2 79-80]. Gorman
conferred with the AUSA prosecuting the EPA case
concerning the plea offer extended to Grummer. [ER2 83-
85]. She was informed that on April 24, 2008, Grummer
pled guilty in the EPA case. [ER2 68].
Agent Gorman testified that the guilty plea before
the magistrate judge did not end her case because it was
not “official” until accepted by the district judge.
[ER2 69-70, 50-54]. The Agent indicated that she thought9
that because the plea was not accepted, then the case was
not final, and the computer could be searched just it
could searched at any time. Agent Gorman admitted that
she did not have a thorough understanding of the
The agent’s understanding of the law was wrong. 9
See Garcia-Aguilar v. U.S. Dist. Ct. for S. Dist. ofCal., 535 F.3d 1021, 1025 (9th Cir. 2008).
25
controlling circuit authority. [ER2 89]. While Gorman
was aware of the plea, she had not follo1wed up to see if
the computer had already been searched. [ER2 91-92].
Agent Adkison is an EPA criminal investigator in
their National Computer Forensics Lab (NCFL) [CR 55; ER2
101], where he had worked for four and a half years at
the time of the suppression hearing. [Id.] Prior to
working for the EPA, Adkison was a special agent with the
State Department, [ER2 102], where he worked for eight
years. [ER2 103]. He has considerable experience as a
law enforcement officer and as a computer forensic
examiner.
His explanation for why the search commenced in May
2008 was that Department policy (now changed) required
the computer seizing agent to be the computer searching
agent. [ER2 121]. Adkinson described his circumstances
with personal and medical leave time, training and other
cases which delayed him from getting to Mr. Grummer’s
computer. (Apparently, there is a staffing issue, too.
[ER2 124]). The policy requiring the search warrant
agent to do the forensic analysis had also been changed
26
before the evidentiary hearing. [ER2 124-125].
Agent Adkinson loaded up all of Mr. Grummer’s drives
at once and began going though them 480 images a click.10
The examination software was a blunt tool which looks for
the least common denominators: file type and any possible
relevancy. [Id.] The Agent described the software as
giving a complete look at everything on the computer:
“for example, if I want to look at all the documents on
the computer, I click on the documents tab, basically.
It brings up all of the documents that are on that
computer.” [ER2 130]. FTK allows the examiner to bring
up a family of files as opposed to a specific file type,
including documents, emails, multi media, and graphics.
[ER2 131]. In the graphics view of FTK it brings up all
.bmp files -- bit maps; .jpgs -- typical graphics files
created by a camera; .tiff files, which tend to be fax
files; and Powerpoint presentations. [Id.] There is a
significant list of files that FTK believes are graphics.
The agent described looking at two 24-inch10
screens loaded with graphics files from across all fivecomputers. [ER2 133, 135].
27
[Id.]
Agent Adkison testified that he was doing a graphics
review or graphics search when he encountered the
thumbnail image he suspected was child pornography. [ER2
131]. Additionally, Agent Adkinson had little problem
finding the EPA evidence that he was allegedly seeking
since he found documents with the term “chlordane.” [ER2
135, 108]. The Agent had found the files for which
probable cause existed as being in the series of photos
with “chlordane” in the filename. [ER2 136]. Adkinson
book marked these files. [Id.]
Adkison testified further that: (1) while doing the
graphics search he was not aware that Grummer had already
pled guilty in April [ER2 139]; (2) he had no contact
with the case agent after executing the seizures [ER2
142]; (3) he had his marching orders and the search
warrant for guidance [Id.]; and (4) he was not asked to
speed up his review for sentencing purposes. [ER2 148].
The district court asked Agent Adkison some follow up
questions, to which he responded that he was not
searching for any specific criteria, only “culling the
28
data” [ER2 150]: “I wasn’t looking for anything. I was
just looking to get rid of data.” [ER2 151].
THE COURT: ...What sets the parameters of yoursearch? In other words, in any given case, whatis it that tells you what the parameters are,what you are looking for, amidst all thegigabytes of data?AGENT ADKISON: Can I answer that in two parts?THE COURT: I am sorry?AGENT ADKISON: Can I answer that in two parts?THE COURT: Yes.AGENT ADKISON: I didn’t get to search theevidence in this case.
* * *
AGENT ADKISON: I didn’t get to search theevidence in this case for any specific criteria. I was going through the culling process to getto a definitive search based on what the searchwarrant allowed me to search for, and then whatthe case agent specifically asked me to searchfor which might be of evidentiary value. So Idid not get to search this case for anythingspecific.
[ER2 150].
Relying on this dichotomy between “culling” and
“searching,” Agent Adkison admitted he never even
attempted to speak with the case agent to limit the scope
of the search he labeled “the culling phase.” [ER2 150].
His procedure was to do “the culling” first followed by
a search within the parameters of the warrant. [ER2
29
151]. In Agent Adkison’s experience at his prior job as
a forensic examiner for the State Department, he was not
bound by the search warrant during the culling phase.
[ER2 152].
d. The District Court’s Findings
The district court accepted Adkison’s label, i.e.
Adkison was “simply going through a culling process,
weeding out irrelevant information, not looking for
anything specific;” rather, he was looking for items to
exclude. [ER1 44]. The district court found that: “the
identification of the child pornography was inadvertent.
It was not targeted, it was not designed, it wasn’t
premeditated.” [Id.]
The motion to suppress evidence was denied. [CR 42].
D. TRIAL AND SENTENCING
Mr. Grummer proceeded to trial and was convicted on
all counts except for the attempted production of child
pornography. The indictment charged Grummer with the
receipt of images in counts 2-19, and possession of the
computers which contained those images (and others) in
counts 20-24. Mr. Grummer made a timely Rule 29 motion
30
at the close of evidence. [ER1 5-11].
The jury instructions for these 2 counts were largely
duplicates of one another. The only real difference was
that counts 2-19 charged liability for particular images
whereas the possession offenses involved the actual drive
on which an image was stored. [CR 65, ER1 29-30]. With
respect to the possession counts, the verdict form only
stated that the jury found Grummer guilty of “of
Possession of Images of Minors Engaged in Sexually
Explicit conduct as charged in Count 20 of the indictment
on or about” and then would specify the time period
recited in the indictment for the count. [CR 66].
Nothing required the jury to find that the possession
offense be based upon images different or conduct
separate from that underlying the receipt counts.
V.
SUMMARY OF ARGUMENTS
The search protocol was designed to review the
private and 4th Amendment protected records. The warrant
actually asked for authority to search beyond what
probable cause would justify and, if upheld, would
31
eliminate the possibility of privacy in a personal
computer. Cf. United States v. Payton, 573 F.3d at 864
(“In order to uphold the search in this case, we would
have to rule that, whenever a computer is found in a
search for other items, if any of those items were
capable of being stored in a computer, a search of the
computer would be permissible. Such a ruling would
eliminate any incentive for officers to seek explicit
judicial authorization for searches of computers.”)
Moreover, this search simply looks fishy. It occurred
outside the 90 days given in the warrant on a case that
had already settled with a cooperation plea agreement.
These are material changes in circumstance which the
issuing judge could have found suspicious. Certainly,
given that the government was meeting with Mr. Grummer
and had all this evidence about how he did business, no
serious contention could be made that Mr. Grummer was
encrypting files and engaging in sophisticated deceit.
The government’s purported justifications for search
add to the irregularity. The government had Grummer’s
pay pal records, ebay, and personal records. People that
32
do business over the internet on these sites are easily
traceable. Additionally, it is no coincidence that the
search protocol employed by Adkinson was to first search
for the keywords of the restricted chemicals and then go
straight to the picture directories. If one were
interested in searching for child pornography under the
guise of investigating the EPA case, that is the
straightest path.
Mr. Grummer is part of an evolving body of case law
whose importance cannot be overstated. Computers have
unmatched ability to manage and catalogue our lives. The
idea that computers are like filing cabinets
fundamentally misunderstands the nature of the device.
File cabinets do not double their storage capacity every
18 months. File cabinets do not condense all other file11
cabinets into searchable formats. The view that
computers are not different from other 4th Amendment
The common Moore’s law analogy is the automobile. 11
If autos followed Moore’s law, cars would get 100,000miles to the gallon, cost nearly nothing, and be smallenough to fit in the pocket of trousers.www.zdnet.com/news/faq-forty-years-of-moores-law/42082
33
subjects, cf. United States v. Giberson, 527 F.3d 882
(9th Cir. 2008), has been correctly rejected by United
States v. Comprehensive Drug Testing, Inc., 621 F.3d 1162
(9th Cir. 2010)(en banc).
Additionally, Mr. Grummer was convicted of both the
receipt and possession of child pornography. This
violates double jeopardy. United States v. Davenport,
519 F.3d at 947.
VI.
STANDARD OF REVIEW
Denial of a motion to suppress evidence is reviewed
de novo. United States v. Krupa, 633 F.3d 1148, 1151
(9th Cir. 2011). The trial court’s factual findings are
reviewed for clear error. United States v. Summers, 268
F.3d 683, 686 (9th Cir. 2001).
It is unclear whether a double jeopardy claim that
was not raised in the district court is subject to plain
error review or is deemed to have been waived. See
United States v. Hernandez-Guardado, 228 F.3d 1017, 1028
(9th Cir. 2000) (noting that “the case law in this
34
circuit reflects some uncertainty as to whether a double
jeopardy claim not raised in the district court is
subject to plain error review [or waived],” and applying
plain error review without deciding the issue).
VII.
ARGUMENTS
The search of Mr. Grummer’s computer was performed in
the maximally constitutionally offensive way. Agent
Adkinson found the files that he needed for the EPA case
upon his use of the appropriate key words. He then
embarked on a picture by picture search of the hard-
drive. This search was unconstitutional and the evidence
should be suppressed.
That computers create special privacy concerns has
been known since the advent of the personal computer.
United States v. Adjani, 452 F.3d 1140 (9th Cir. 2006).
See United States v. Tamura, 694 F.2d at 591, 595 (9th
Cir. 1982) (“[T]he wholesale seizure for later detailed
examination of records not described in a warrant is
significantly more intrusive, and has been characterized
as ‘the kind of investigatory dragnet the fourth
35
amendment was designed to prevent’”(quoting United States
v. Abrams, 615 F.2d 541, 543 (1st Cir. 1980))). See
Tamura, 694 F.2d at 596 (“The essential safeguard
required is that wholesale removal must be monitored by
the judgment of a neutral, detached magistrate.”)
All warrants, even those with the most expansive of
language, are subject to the inherent limitations of the
Fourth Amendment. Whether a particular search protocol12
is described in the warrant, the officer is always
“limited by the longstanding principle that a duly issued
warrant, even one with a thorough affidavit, may not be
used to engage in a general exploratory search.” See
United States v. Hill, 459 F.3d 966, 978 (9th Cir. 2006).
See also, United States v. Rettig, 589 F.2d 418, 423 (9th
Cir. 1978)(“Where evidence is uncovered during a search
pursuant to a warrant, the threshold question must be
“The right of the people to be secure in their12
persons, houses, papers, and effects, againstunreasonable searches and seizures, shall not beviolated, and no Warrants shall issue, but upon probablecause, supported by Oath or affirmation, and particularlydescribing the place to be searched, and the persons orthings to be seized.” U.S. Const. Amend. IV.
36
whether the search was confined to the warrant’s
terms.... [T]he search must be one directed in good faith
towards objects specified in the warrant or for other
means and instrumentalities by which the crime charged
has been committed. It must not be a general exploratory
search ....”(internal quotation marks omitted)). New
technology may become readily accessible, for example, to
enable more efficient or pinpointed searches of computer
data, or to facilitate onsite searches. Hill, 459 F.3d
979.
A. THE WARRANT WAS MORE THAN A MONTH EXPIRED AT THETIME OF THE SEARCH
The government’s right to search for a definite
period of time is part of the warrant and defines the
warrant’s scope. United States v. Hitchcock, 2002 U.S.
App. LEXIS 15726 at *18-19. Here the five month delay
between execution of the search warrant and analysis of
the seized computer evidence was outside the temporal
scope of the warrant and therefore unreasonable.
After the seizure on January 17, 2008, Adkison took
the imaged hard drives to his lab in Jacksonville,
37
Florida to search. [ER2 111]. The government concedes
that Adkison did not begin his search until late May
2008. He did not discover the image of child pornography
until June 9, 2008, almost five months after seizures,
six weeks after Mr. Grummer pled guilty on April 24,
2008, and nearly two months after the 90-day
authorization in the warrant had expired. Renewed
judicial authorization was necessary to prevent this
broad seizure from violating the Fourth Amendment.
Wholesale removal of records for later examination
must be monitored by the magistrate judge to prevent the
kind of general rummaging the Fourth Amendment was
designed to prevent. See United States v. Tamura, 694
F.2d 591 (9th Cir. 1992). If the Agent had sought
renewed authorization, it would have been incumbent on
the agent to explain the delay and disclose that Grummer
had pled guilty and was now cooperating with the
government.
The government concedes that a computer forensic
examination may become unreasonable, even though
supported by probable cause, merely based on delay. [CR
38
40]. Based on the length of delay, the affidavit and
search warrant, the government was required to obtain
authorization from the magistrate judge to extend the
deadline. United States v. Syphers, 426 F.3d 461, 469
(1st Cir. 2005) (file encryption and a large of backlog
of cases was sufficient cause for a magistrate judge to
extend the time frame for warrant’s execution.)
Agent Adkison did not speak to the case agent about
case’s progress during the five months between the
seizure of the evidence and Adkison’s search. [ER2 150].
The five month delay involved Agent Adkison taking almost
a month of personal and medical leave, 3 weeks of
training, and the policy requiring the agent assisting
with the seizure to conduct the search (a policy
subsequently changed because of inefficiency), and
Adkinson’s caseload. [ER2 122-123]. All these factors
were controlled by Agent Adkison or the EPA.
It appears that much of the backlog at the computer
lab is self-inflicted. Adkinson testified that he builds
an entirely new computer system for each search, then
disassembles the system after he finishes the search.
39
[ER2 128, 141]. Not only does he need to assemble the
hardware each time, he also must reinstall the operating
system and forensic analysis software. [Id.] He
literally starts from scratch on each case, creating
inefficiency with no justification. Imaged hard drives
can be loaded onto and unloaded from a forensic review
system to change data sets without disassembling the
equipment and reinstalling all the software. Clean rooms
are important in the production of silicon chips, not
looking up the boolean strings they contain.
B. LOOKING THROUGH THE FILES TO SEE WHICH ONES ARERELEVANT IS NOT “CULLING”, IT IS SEARCHING AND ITVIOLATES THE SCOPE OF THE SEARCH.
In order to be constitutional, a warrant cannot
authorize search for items which are not the subject of
probable cause. The government is not allowed to conduct
searches in a maximally intrusive way so that it gets a
look at more than it is entitled. U.S. Const. Amend. IV
(“The right of the people to be secure in their persons,
houses, papers, and effects, against unreasonable
searches and seizures, shall not be violated, and no
Warrants shall issue, but upon probable cause, supported
40
by Oath or affirmation, and particularly describing the
place to be searched, and the persons or things to be
seized.”) A file by file search of the hard-drive is
like a body-cavity search of the hard-drive. If the
Tamura filing cabinet analogy is employed, it begins the
search for financial records at the underwear drawer.
The warrant sought by the government was quite broad,
but it still had the ex ante Fourth Amendment
restrictions. Cf. United States v. Grubbs, 547 U.S. 90,
99 (2006)(the warrant process protects the property owner
by imposing “ex ante” restrictions on how and when
warrants issue.) Thus, Adkinson’s chosen search
methodology -- look through everything piece by piece --
violates the fundamental restriction that the search must
be focused. That the methodology employed be designed to
find the evidence that the investigator seeks. While
there may be greatly differing opinions about what
constitutes the best search criteria, there could be no
argument that “culling” satisfies the condition of only
looking for what the warrant justifies looking for. This
is the broadest possible search protocol: every thumbnail
41
on the drive, 480 at a time.
Ex ante restrictions in a warrant generally are13
designed to cure the manifest lack of probable cause and
particularity in every computer search case. See Paul
Ohm, Massive Hard Drives, General Warrants, And The Power
of Magistrate Judges, 97 Va. L. Rev. 1, 4 (2011). Both
the manner and timing of this search were unreasonable.
Although the warrant authorized wholesale seizure of all
of Mr. Grummer’s computer data for later examination, it
delineated seventeen broad categories of records in
Attachment B to the Application and Affidavit to the
Search Warrant. [CR 35-1; ER 276-277].
1. Attachment B
The warrant alleged certain property concealed in
Grummer’s residence was evidence, fruits, or property
used in committing a crime [CR 35], listing the items by
broad categories in Attachment B to the Application and
Affidavit for Search Warrant:
Grummer uses “ex ante” to signify the inherent13
constitutional limitations on a search ofconstitutionally protected matters.
42
This authorization... includes electronic datato include deleted data, remnant data and slackspace. The seizure and search of computers andcomputer media will be conducted in accordancewith paragraph 59 of the affidavit submitted insupport of the warrant. Evidence to be seizedincludes the following:....
4. The following records for the period fromApril, 2005, through the present:
all permanent and temporary files containing...
a. records relating to the purchase, sale,transfer, storage, inventory, distribution,and shipment of CFCs and unregisteredpesticides, including DDT and chlordane;
b. purchase orders, packing lists, invoices,bills of lading, receipts, electronic mail,PayPal records, and other records related tothe shipping of CFCs, including CFC-12, andunregistered pesticides, including DDT andchlordane;
c. correspondence, facsimiles, records oftelephone conversations relating to thesale, and distribution of CFCs, includingCFC-12, and unregistered pesticides,including DDT and chlordane;
d. records identifying the buyer, recipient,seller, shipper, and/or broker of CFCs, andunregistered pesticides;
e. financial records, including ledgers,records of wire transfers, bank statementsand cancelled checks, indicating thetransfer of funds relating to purchases,sales and shipment of CFCs and unregistered
43
pesticides;
f. phone books, day planners, rolodexes,business cards and other documentsidentifying persons doing business withDavid Grummer;
g. copies of CAA Section 609 Certifications forpurchasers of CFCs;
h. David Grummer’s hazardous materials trainingrecords, including training recordsregarding the shipment of hazardousmaterials;
i. records related to the storage of CFCs andunregistered pesticides, including recordsof the date of accumulation of the hazardousmaterials;
j. records related to the transportation ofhazardous materials by David Grummer;
k. records related to the purchase, sale,shipment, transportation and storage ofhazardous materials by David Grummer forcommercial purposes;
l. records, notes, lists, memorandums, or othermedia showing user names, account names,passwords, personal identification numbersthat are related to the access ofelectronically stored data;
m. records related to communication betweenDavid Grummer and/or Free ElectronicsDisposal, and Federal Express and otherinterstate commercial transporators (sic),including invoices, billing statements,delivery records, shipping records, andrecords of payment;
44
n. records related to federal rules andregulations applicable to the shipment ortransportation of hazardous materials,including brochures, pamphlets, industrypublications, guidance letters, informationprinted on internet websites and trainingmaterials;
o. records indicating the method and means thatDavid Grummer obtained the unregisteredpesticides and CFCs, including intakerecords, electronic mail, correspondence,facsimiles, records of telephoneconversations and records of accumulatedstorage time;
p. hazardous waste manifests and other recordsof the transporation, storage and disposalof hazardous waste by David Grummer;
q. records of offers to sell and distribute forsale CFCs and unregistered pesticides overthe internet, included but not limited toeBay, Agriseek and other postings, andrecords of payment for such transactions,including but not limited to PayPal recordsand records of wire transactions.
[CR 35]. These records were to be seized and searched
“in accordance with paragraph 59 of the affidavit,” which
set some ex ante limitations on searching the seized
computer evidence.
2. Computer Search Protocol: ¶59 Of The Affidavit
Paragraph 59 required agents executing the search
45
warrant to “employ the following procedures regarding
computers that may be found on the premises,” [CR 35],
including creating forensic images of the computers found
onsite and then forensic analysis of the data later
because “[the above listed] data cannot effectively be
segregated onsite from other data which may be stored on
the computer(s) and cannot be left behind.” [CR 35].
Agent Gorman requested up to 90 days for imaging and
preliminary review of the seized data. [Id.] Due to the
volume of data stored on a typical computer system,
agents would not even attempt to segregate data onsite
before determining to seize everything. [Id.]
The forensic examination was to be done by keyword
searches and other methods where “certain file formats do
not lend themselves to keyword searches.” [Id.] One
such file format was listed as documents printed by the
computer, even if never saved to the hard drive, stored
as a graphic image. [Id.] Faxes sent to the computer
stored as graphics images were also listed as not being
keyword searchable. [Id.]
Agent Gorman also expressed concern about the
46
possibility that criminals might “mislabel and hide files
and directories, use codes to avoid using keywords,
encrypt files, deliberately misspell certain words,
delete files and take other steps to defeat law
enforcement.” [Id.] Given these potential problems, she
requested permission to “use whatever data analysis
techniques reasonably appear necessary to locate and
retrieve digital evidence within the scope of this
warrant.” [Id.] Agent Gorman assured the magistrate
judge that “all forensic analysis will be directed
exclusively to the identification and seizure of
information within the scope of the warrant.” [Id.]
Despite that assurance, Agent Gorman also claimed “the
forensic examiner may view information not within the
scope of the warrant,” and, “such information will not be
made available to the investigative agents unless it
appears to the examiner that the information relates to
the commission of offenses not covered by this warrant.”
[Id.]
Agent Adkison is a highly trained and experienced
criminal investigator and forensic examiner, [ER 52-56],
47
who chose a “very gross and blunt” tool to conduct an all
records search (i.e., “culling”) before consulting the
warrant. Culling is searching. Adkison’s stated reasons
for conducting a “graphics review” were illogical: (1) he
never attempted to search for image files corresponding
with printed but not saved business records or faxes
concerning purchase, sale and shipment of CFCs and
unregistered pesticides, (2) nothing in the warrant or
“reasonableness” justifies initially searching for
pictures of chlordane, and (3) “culling” image files
would not eliminate the standard program files he claimed
to be trying to eliminate “before searching.”
If an agent or officer conducts an unreasonable
search, any evidence seized from that unwarranted search
may be suppressed. See, e.g., Arizona v. Hicks, 480 U.S.
321, 324-25 (1987)(moving shooting suspect’s stereo in
order to record serial numbers without probable cause
forced suppression of evidence).
During the suppression hearing, the district court
twice asked Agent Adkison “What sets the parameters of
your search?” Agent Adkison did not give a direct
48
response, “Can I answer that in two parts?” [ER2 150].
Although the search was nothing other than looking at
every picture on the drive -- an exploratory rummaging –
Agent Adkison would not even admit that what he did was
a search:
I didn’t get to search the evidence in this casefor any specific criteria. I was going throughthe culling process to get to a definitivesearch based on what the search warrant allowedme to search for.
[ER 150]. There is a word that the founders would use
for the “the culling process”: a search.
The district court ended up accepting this
distinction between culls and searches. But the process
described by Adkinson was a search in every sense of the
word which allow Adkinson to look at everything and
anything on the drive. The upshot of Adkinson’s
testimony was that he looked at the data on the drive
without restriction as to file type or likelihood that it
would be related to probable cause.” Adkinson emphasized
that this “culling” behavior predates and search and is
somehow not a search.
The danger is open, obvious, and known with respect
49
to giving the government the ability to search though an
individual’s personal computer. Adkison’s real skill was
not in using a culling procedure, it was to introduce the
idea that this sort of practice was something other than
a search. This is the sort of double-speak that this
Court cannot tolerate. Comprehensive Drug Testing, Inc.,
621 F.3d at 1170 (Maj. Op.).
The district court found that this search of the
computers photos did not count because it occurred in the
course of preparing to search (and also after the files
with relevant names had been tagged):
I accept the testimony here ... particularlythat of Agent Adkison ... that he was “simplygoing through a culling process, weeding outirrelevant information, not looking for anythingspecific; rather, he was looking for items toexclude so that he could later focus within thescope of the search warrant...
* * *
...the identification of the child pornographywas inadvertent. It was not targeted, it wasnot designed, it wasn’t premeditated.
[ER1 39-45]. In other words, the district court found
that as long as the searching agent’s discovery was
inadvertent and not premeditated, the agent is not
50
looking at all for Fourth Amendment purposes. This
creates precisely zero limitation on the government’s
ability to look at any bit of data on a hard-drive. It
means that searching is not searching when properly
labeled. “‘When I use a word,’ Humpty Dumpty said, in
rather a scornful tone, ‘it means just what I choose it
to mean-neither more nor less.’ ” Tennessee Valley
Authority v. Hill, 437 U.S. 153, 174 n.18 (1978).
To the extent that a culling process occurred, it
should have been done by specialized personnel or an
independent third party. Comprehensive Drug Testing,
621 F.3d 1162, 1178-1179 (Kozinski, C.J., concurring);
Id. at 1168-70, 1170-72 (Maj. Op). If the segregation is
to be done by government computer personnel, the
government must agree in the warrant application that the
computer personnel will not disclose to investigators any
information other than that which is the target of the
warrant. Id. at 1180. Agent Adkison is not the type of
neutral or detached independent third party this Court
envisioned in CDT II.
The sort of review described by Adkinson involved him
51
looking at plainly unrelated files. Perhaps there is a
circumstance where the government would have no choice
but to look file by file because no other option was
present, but there was nothing unusual about the search
and described mountainous data came from the standard
pre-loaded operating system programs. For example, “the
pinball games that come preloaded, the solitaire, all of
those programs have graphics associated with them.” In
no set of circumstances can the protocol of eyeballing
each photo increase efficiency (as Adkinson claimed the
culling process did. [ER2 135]).
Adkison searched all data on all five seized hard
drives simultaneously using Forensic Toolkit (FTK). [ER2
128]. Thus, Adkison conducted an all records search of
all computer hard drives placing everything that was a
graphics file in plain view even though none of the
evidence of the EPA violations could be identified
without words or letters on the images, i.e. “chlordane,”
“Freon,” “DDT,” or “CFC.” FTK allows forensic examiners
to go through computer images – based on keyword
searches, graphics displays, documents tab, emails and
52
other criteria. [ER2 128-131]. Accordingly, if Adkison
were seeking only evidence of EPA violations he would
have searched all images by keyword, employing an optical
character recognition program. [Id.] The documents tab
in FTK also shows all standard documents recognized by
the software, including WordPerfect, Open Office,
Microsoft Word. [Id.] FTK allows examiners to view a
family of files – i.e., “several different kind (sic) of
canned, if you will, divisions that it already has in it”
– as opposed to a specific file type. [ER2 131]. The
documents tab was the most likely division to return the
type of electronic evidence the warrant described.
Similarly, a graphics display in FTK would include things
like graphics generated by a digital camera, fax files,
Powerpoint presentations, and a significant list of other
file types. [Id.]
As a sophisticated forensic examiner, Agent Adkison
knew his methodology was fatally flawed. First, pre-
loaded games like solitaire, pinball and other irrelevant
images within Microsoft’s operating system are stored in
standard locations on the hard drive, easily and less
53
intrusively eliminated at the directory review -- the
surgical tool for limiting the search.
Second, by 2008 computers could quickly process the
amount of data in Grummer’s computers obviating the need
for “culling” graphics files in pinball and solitaire.
Moreover, additional computer hardware, e.g., a faster
processor, parallel processing, and additional RAM could
be added to any forensic review system processing data
too slowly.
Third, there was no relationship or link between the
files Agent Adkison claimed to be reviewing with
“chlordane” in the filename and the suspected image of
child pornography. The government withheld the exact
directory locations of the images allegedly with
“chlordane” in the filename that Adkison supposedly
discovered right before he encountered the image of child
pornography. The name “chlordane,” if actually searched
using keywords in the graphics review, would not return
the file suspected to be child pornography. The image of
child pornography was named, “ (Hussyfan)(pthc)(r@yGold)
- Trish&Dragon(13 yr old)pt4.avi.jpg”. Obviously, there
54
is nothing in that filename resembling “chlordane.”
Alternatively, if Adkison was searching graphics
organized alphabetically by filename alone, rather than
by keyword, these images would also be many pages apart.
Fourth, the actual location of child pornography that
Adkison found bears no relationship to the location of
images built-in with the Microsoft operating system. The
thumbnail image that Adkison encountered was stored
within the “Program Files\Kazaa\My Shared Folder”
directory - a location related to Grummer’s file sharing
program Kazaa, which was stored within its own directory
inside the Program Files folder. Pinball, solitaire, and
other built-in image files are located in completely
separate standard operating system directories associated
with Microsoft operating system files (not Kazaa).
Adkison decided to simultaneously sweep literally
hundreds of images lacking words or letters into “plain
view” using the “blunt” graphics review that presented
him with the image of child pornography, despite the fact
that without words or letters like “chlordane,” “Freon,”
“DDT,” or “CFC” those images could not constitute
55
evidence of EPA violations because none of the regulated
substances is recognizable in an image without words or
letters.
Fifth, graphics review was unnecessary given the
items listed in Attachment B and the availability of
specific, less intrusive directory level review, or other
sharper tools. The warrant authorized searching for
business records related to purchase, sale and shipment
of CFCs and unregistered pesticides, which were almost
certainly standard word processing type documents,
spreadsheets or emails. An image of this type of
document would have been identifiable and separable from
other images using Optical Character Recognition (OCR)
software.
Any search of image files should have been conducted
using less intrusive OCR software, protecting the
contents of every image file from “plain view.” Adkison
should have isolated all image type files without
searching them, then processed them with OCR software
that would return text if the image contained relevant
text. For example, OCR technology makes all .PDF
56
transcript documents searchable. The OCR text could then
be reviewed using keywords and the privacy interest in
image files would be protected.
Sixth, the government will likely assert the graphics
search was warranted because printed, but not saved,
document files or even faxes would be stored somewhere on
the computer as image files. [CR 35]. The affidavit
states:
Documents printed by the computer, even if thedocument was never saved to the hard drive, arerecoverable by forensic examiners but notdiscoverable by keyword searches because theprinted document is stored by the computer as agraphic image and not as text. Similarly, faxessent to the computer are stored as graphicsimages and not as text.
[Id.] This argument is equally unavailing: (1) Adkison’s
report concedes he never performed Analysis of Residual
Data to locate these types of files [id.]; (2) these
files would be stored in a standard system directory of
the Windows operating systems predetermined by the
version of Windows Grummer was running; and, (3) these
files would also have a standard file extension, which
should have been searched instead of every graphic image.
57
Adkison’s report says:
Residual data can include deleted and purgedfiles and artifacts from previously deletedfiles. Residual data may also include deletedtemporary files, such as Internet Cache Files &Printer or Fax Spool files. These files andartifacts are not available through normal useraccess. Residual data is located in portions ofthe computer media that are not activelyallocated for use. These portions of the mediaare normally not visible through normal useraccess. Result: Residual data on hard drives 1- 5 was not examined.
[Id.]
Adkison’s “blunt” plain view search was unreasonable
because less intrusive means would identify this type of
printed file or fax (e.g., directory view searching, file
extension or keyword searching, and/or OCR searching).
Adkison’s report concedes he knew exactly where to search
for these types of files. The government’s misleading
statement about and omission of the search technology
available in 2008 obviating the need to search images in
this case lacking words or letters indicating EPA
violations requires suppression of the child pornography
evidence. United States v. Stanert, 762 F.2d 775, 780-
782 (9th Cir. 1985).
58
C. GOOD-FAITH DOES NOT APPLY
Conducting searches in such a way as to sweep
everything into plain view is not good faith. “When, as
here, the government comes into possession of evidence by
circumventing or willfully disregarding limitations in a
search warrant, it must not be allowed to benefit from
its own wrongdoing by retaining the wrongfully obtained
evidence or any fruits thereof. When the district court
determines that the government has obtained the evidence
through intentional wrongdoing--rather than through a
technical or good faith mistake--it should order return
of the property without the need for balancing that is
applicable in the more ordinary case. CBT II, 621 F.3d
at 1174.
The exclusionary rule is not an individual right and
applies only where it “results in appreciable
deterrence.” Herring v. United States, 555 U.S. 135, 129
S.Ct. 695 (2009)(quoting United States v. Leon, 468 U.S.
897, 909 (1984)(internal quotations omitted)). “The
extent to which the exclusionary rule is justified by
these deterrence principles varies with the culpability
59
of the law enforcement conduct. As we said in Leon, ‘an
assessment of the flagrancy of the police misconduct
constitutes an important step in the calculus’ of
applying the exclusionary rule. 468 U.S. at 911.
Similarly, in Krull we elaborated that ‘evidence should
be suppressed ‘only if it can be said that law
enforcement officer had knowledge, or may be properly
charged with knowledge that the search was
unconstitutional under the Fourth amendment.’’ 480 U.S.,
at 348-349 (quoting United States v. Peltier, 422 U.S.
531, 542 (1975).” Herring, 129 S.Ct. At 701.
D. THE WARRANT WAS OVER-BROAD
Agent Adkison equated one gigabyte of data to printed
sheets of paper stacked 555 feet tall. [ER2 110]. He
seized a total of 710 gigabytes of data or 710 such
stacks. [ER2 132]. The vast majority of this data was
unrelated to the EPA case. However, the warrant
purported to authorize the search of “all permanent and
temporary internet files containing,” seventeen
categories of records (a. through q.) in Attachment B,
authorizing examination of all permanent and temporary
60
files regardless of their locations.
The warrant was interpreted as authorizing a search
of any file: “all permanent and temporary files
containing records, notes, lists, memorandums, or other
media showing user names, account names, passwords,
personal identification numbers that are related to the
access of electronically stored media.” Perhaps program
files would not satisfy the list, but that appears to be
the only exclusion. This mandates searching everything
stored by any user anywhere and all other computers
accessed across the internet (using all recovered user
and account names or PINs with recovered passwords),
including information unrelated to purchase, sale and
shipment of CFCs and unregistered pesticides.
The warrant sweeps well beyond what probable cause
authorizes. This search was invalid even under the
expansive language of Giberson. In Giberson, agents
conducted a computer forensic search for evidence related
to false identifications. Giberson, 527 F.3d at 890.
During that search an agent inadvertently discovered
child pornography. [Id.] Mr. Grummer’s case is not like
61
Giberson because in Mr. Grummer’s case, the agents had
found the documents with chlordane and the other relevant
file and were thereafter systematically eyeballing every
picture file. Thus, this is an instance where the Agent
strayed from the path of looking for items for which
probable cause existed:
Our holding is not inconsistent with UnitedStates v. Carey, 172 F.3d 1268 (10th Cir. 1999).There, the Tenth Circuit suppressed evidencefound when an officer, who was supposed to besearching a computer for drug-related documents,stumbled upon child pornography and began tosearch for more. Id. at 1276. Based on theofficer's own testimony, the court found thatthe child pornography was not "inadvertentlydiscovered" because the officer had temporarilyabandoned the search authorized by the warrantin order to look for child pornography,contravening the limitations of the searchwarrant. Id. at 1273. The court was careful tostate that the result in the case (suppressionof the evidence) was "predicated only upon theparticular facts of this case, and a search ofcomputer files based on different facts mightproduce a different result." Id. at 1276(footnote omitted). A concurring opinion statedthat "if the record showed that [the officer]had merely continued his search for drug-relatedevidence and, in doing so, continued to comeacross evidence of child pornography, . . . adifferent result would be required." Id. at 1277(Baldock, B., concurring).
United States v. Giberson, 527 F.3d at 890; see also
62
United States v. Payton, 573 F.3d at 864 (suppression
required where agents abandoned search for narcotics and
began searching for child pornography). This is just
the sort of “widest possible net” search that sweeps
everything into plain view and eliminates any possibility
of privacy simply because a computer has categories of
files. Cf. United States v. Walser, 275 F.3d 981, 986
(10th Cir. 2001)(“The underlying premise in Carey is that
officers conducting searches (and the magistrates issuing
the warrants for those searches) cannot simply conduct a
sweeping, comprehensive search of a computer’s hard
drive”). Just because it is possible for a computer to
pull every picture file on a laptop in order to find out
if it relates to the illegal sale of pesticides does not
mean that the government should be allowed to leaf
through every personal picture a person has on their
drive. Clearly, the government is asking for the right
to look at everything. The purpose of the exclusionary
rule is to deter “knowing,” “widespread,” “routine” or
“systemic” police misconduct. Ample evidence in the
warrant affidavit and Adkison’s testimony establishes
63
“knowingly” and “systematically” contriving to create
plain view of everything seized, outside probable cause
for purchasing, selling and shipping CFCs and
unregistered pesticides. The second warrant based on the
illegally obtained evidence doesn’t survive the
requirements of CDT II, viz. magistrate judges should
require waiving “plain view.” Comprehensive Drug
Testing, 621 F.3d 1162, 1177-1178 (Kozinski, C.J.,
concurring); Id. at 1170-71 (Maj. Op).
It may well be the case that some computer users are
extremely sophisticated and can hide files in inventive
ways. There was no reason to believe that David Grummer
was one of those individuals. Indeed, it did not appear
that Mr. Grummer was making any efforts whatsoever to
conceal his EPA violating sales. Moreover, Mr. Grummer
was cooperating with the government at the time of the
search and had pled guilty. Thus, when the affiant says
that “criminals can mislabel and hide files and
directories, use codes to avoid using keywords, encrypt
files, deliberately misspell certain words, delete files
and take other steps to defeat law enforcement,” [CR 35],
64
while theoretically possible, there was no reason to
believe such a circumstance obtained. Comprehensive
Drug Testing, 621 F.3d 1162, 1178-1179 (Kozinski, C.J.,
concurring); Id. at 1167-68, 1175-76 (Maj. Op). Here,
the risk asymptotically approaches zero, which was not
disclosed to the magistrate judge who requires this
information to determine probable cause and proper
protocols to search computers. Id. at 1170-72 (Maj. Op).
Only once a targeted search has failed should the
possibility be entertained that Mr. Grummer was hiding
files with misleading names or formats.
Thousands of file types exist; most have been
standardized, meaning a signature – or header – is
recognized by the program the file belongs to and the
operating system. One tactic to hide data is changing
the 3 letter extension on a file or removing the file
extension altogether. Performing a signature analysis,
however, identifies which files may have been altered to
h i d e t h e i r t r u e f u n c t i o n . S e e
www.computer-forensics.net/what-is-a-file-signature?/;
en.wikipedia.org/wiki/File_signature. FTK and other
65
forensic examination software can identify files with bad
signatures to limit searches to these suspect files.
This technology obviates the need to open every image
file in case a criminal attempting to frustrate a search
renamed his “criminal_conspiracy_notes.doc” to
“sundayschoolphoto.jpg.” The bad signature on such files
flags them for investigators, eliminating the excuse to
“check everything.”
Similarly, hidden files and directories are
detectable using the operating system and with forensic
search software. Initial steps in computer forensic
searches should employ the forensic software to find
every file on the computer, particularly those hidden
deleted, encrypted, or protected by passwords, and
deleted but not yet overwritten. Searches are neither
defeated nor impeded by “hidden” files or directories.
If probable cause exists such files should be searched,
but mere possibility of or encounter with these types of
files cannot justify placing everything in plain view.
The search of Carey’s computer transformed the
warrant into a “general warrant,” constituting a general,
66
illegal search in “flagrant disregard” for the terms of
the warrant and in violation of the Fourth Amendment.
Carey, 172 F.3d at 1272. Despite the specificity of the
warrant, files unrelated to sale or distribution of
controlled substances were opened and searched. Id.
citing United States v. Foster, 100 F.3d 846, 859-850
(10th Cir. 1996).
The claim that mislabeled files could contain
evidence of EPA violations is not credible here, where
the putative “disguise” suggests the heinous crime of
possessing child pornography. The Supreme Court has
instructed, “the plain view doctrine may not be used to
extend a general exploratory search from one object to
another until something incriminating at last emerges.”
Coolidge v. New Hampshire, 403 U.S. 443, 466 (1971).
That principle is crystallized in computer search
contexts by this Court in CDT II.
As in Carey, there are no ambiguously labeled files
contained on Grummer’s hard drive directories. 172 F.3d
at 1275. There was no need to open each file to discover
its contents. Id. Relying on analogies to closed
67
containers or file cabinets may lead courts to
“oversimplify a complex area of Fourth Amendment
doctrines and ignore the realities of massive modern
computer storage.” Id. quoting Raphael Winick, Searches
and Seizures of Computers and Computer Data, 8 Harv. J.
L. & Tech. 75, 104 (1994).
Just as in Carey, officers seized the computers;
there were no “exigent circumstances or practical reasons
to permit officers to rummage through all of the stored
data regardless of its relevance or its relation to the
information specified in the warrant.” Id. at 1276,
quoting Winick, 8 Harv. J.L. & Tech. At 105. With the
computer images in his custody, Agent Adkison could have
avoided searching file types not identified in the
warrant by observing file types and titles listed in the
directory, doing a key word search for relevant terms,
checking file signatures and identifying hidden files and
directories as necessary, and even using OCR searching of
images rather than opening them, if warranted. Id. at
107.
Agent Adkison never bothered to list files on the
68
directory and conduct keyword searches, nor did he use
information from the warrant or the case agent to limit
his searches to items specified in the warrant, nor seek
a new warrant authorizing a search for any image files.
Carey, 172 F.3d at 1276. Accordingly, this Court should
hold that Adkison violated the limits of the warrant, the
search violated the Fourth Amendment, and remand to the
district court to suppress the evidence.
E. MR. GRUMMER’S CONVICTION FOR BOTH THE POSSESSIONAND RECEIPT OF CHILD PORNOGRAPHY VIOLATED DOUBLEJEOPARDY
In United States v. Davenport, this Court held that
possession was a lesser included offense of receipt. 519
F.3d at 947 (“Having rejected the government’s argument
that possession of child pornography requires proof of an
element that receipt does not, we conclude that, under
the Blockburger test, the offense of possessing child
pornography is a lesser included offense of the receipt
of child pornography.” Mr. Grummer’s case involves
convictions for both possession and receipt and the
evidence overlapped between the counts.
The only distinction to be drawn in Mr. Grummer’s
69
case is that the government charged the possession of
specific images in the receipt counts, but charged the
possession of the storage devices in the possession
counts. [CR 25]. This Court rejected a similar style
argument in United States v. Schales:
If the government wishes to charge adefendant with both receipt and possession ofmaterial involving the sexual exploitation ofminors based on separate conduct, it mustdistinctly set forth each medium forming thebasis of the separate counts. For example, wenote that there would have been no doublejeopardy violation if the government haddistinctly charged Schales with both receipt ofmaterial involving the sexual exploitation ofminors for the images that he downloaded fromthe internet and with possession of materialinvolving the sexual exploitation of minors forthe images that he transferred to and stored oncompact discs. However, the indictment aswritten does not allow us to conclude that thejury found Schales guilty of separate conduct.Instead, the indictment charges Schales withreceipt of the material by way of downloading itfrom the internet onto his computer andpossession of this material in the same medium.This is multiplicitous. See Davenport, 519 F.3dat 947; Giberson, 527 F.3d at 891.
546 F.3d at 980.
The indictment’s allegation of different dates of
commission for the possession and receipt counts is
insufficient to save the charges from a double jeopardy
70
claim:
The allegation of different dates ofcommission for each offense, by itself, isinsufficient to carve out separate conduct. Oncea person receives something, he also necessarilypossesses it as of that moment, based upon asingle action (like downloading a file). SeeDavenport, 519 F.3d at 943. Thus, merely citingdifferent dates or date ranges for the receiptand possession charges alone does not suffice toseparate the conduct for double jeopardypurposes. Cf. Schales, 546 F.3d at 979-80(noting that the indictment charged Schales withpossession during a period that was a monthlonger than the period charged for the receiptoffense, but nevertheless concluding theindictment was multiplicitous). Rather, thegovernment must allege and prove distinctconduct underlying each charge, whether theconduct underlying each charge occurred on thesame or different dates.
United States v. Lynn, 2011 U.S. App. LEXIS 11254, 24-25
(9th Cir. Cal. May 31, 2011).
The burden is on the government to allege distinct
conduct for each charge: “If the government wishes to
charge a defendant with both receipt and possession of
material involving the sexual exploitation of minors
based on separate conduct, it must distinctly set forth
each medium forming the basis of the separate counts.”
Schales, 546 F.3d at 980. The government “must allege in
71
what form the defendant received the image and in what
form he possessed it. In Schales, the indictment did not
specifically allege different media, nor did the
instructions or verdict reflect separate conduct;
therefore, the dual convictions violated double jeopardy.
United States v. Lynn, 2011 U.S. App. LEXIS 11254 at
25-26.
Nothing in the indictment required the jury to find
that Mr. Grummer’s possession convictions be premised on
different images than those involved in the receipt
convictions. [CR 25]. Nothing in the jury instructions
told the jurors that the possession convictions had to be
premised on different images. [CR 65]. The jury’s
verdict form did not require any finding that a different
image was involved. [CR 66].
Inasmuch as the Court has consistently found that
receipt/possession double jeopardy violation should be
noticed on plain error review, e.g. Davenport and Lynn,
Mr. Grummer’s possession or receipt convictions ought to
be vacated.
72
VIII.
CONCLUSION
Mr. Grummer’s conviction should be vacated and the
matter remanded to the district court to suppress the
illegally obtained evidence.
Respectfully Submitted,
Date: August 11, 2011 /S/DAVID J. ZUGMANDAVID J. ZUGMANGABRIEL L. COHANCounsel for Mr. Grummer
73
APPENDIX OF STATUTES
18 U.S.C. § 2251. Sexual exploitation of children
(a) Any person who employs, uses, persuades, induces,entices, or coerces any minor to engage in, or who has aminor assist any other person to engage in, or whotransports any minor in or affecting interstate orforeign commerce, or in any Territory or Possession ofthe United States, with the intent that such minor engagein, any sexually explicit conduct for the purpose ofproducing any visual depiction of such conduct or for thepurpose of transmitting a live visual depiction of suchconduct, shall be punished as provided under subsection(e), if such person knows or has reason to know that suchvisual depiction will be transported or transmitted usingany means or facility of interstate or foreign commerceor in or affecting interstate or foreign commerce ormailed, if that visual depiction was produced ortransmitted using materials that have been mailed,shipped, or transported in or affecting interstate orforeign commerce by any means, including by computer, orif such visual depiction has actually been transported ortransmitted using any means or facility of interstate orforeign commerce or in or affecting interstate or foreigncommerce or mailed. (b) Any parent, legal guardian, or person having custodyor control of a minor who knowingly permits such minor toengage in, or to assist any other person to engage in,sexually explicit conduct for the purpose of producingany visual depiction of such conduct or for the purposeof transmitting a live visual depiction of such conductshall be punished as provided under subsection (e) ofthis section, if such parent, legal guardian, or personknows or has reason to know that such visual depictionwill be transported or transmitted using any means orfacility of interstate or foreign commerce or in oraffecting interstate or foreign commerce or mailed, ifthat visual depiction was produced or transmitted usingmaterials that have been mailed, shipped, or transported
74
in or affecting interstate or foreign commerce by anymeans, including by computer, or if such visual depictionhas actually been transported or transmitted using anymeans or facility of interstate or foreign commerce or inor affecting interstate or foreign commerce or mailed. (c) (1) Any person who, in a circumstance described inparagraph (2), employs, uses, persuades, induces,entices, or coerces any minor to engage in, or who has aminor assist any other person to engage in, any sexuallyexplicit conduct outside of the United States, itsterritories or possessions, for the purpose of producingany visual depiction of such conduct, shall be punishedas provided under subsection (e). (2) The circumstance referred to in paragraph (1) isthat-- (A) the person intends such visual depiction to betransported to the United States, its territories orpossessions, by any means, including by using any meansor facility of interstate or foreign commerce or mail; or (B) the person transports such visual depiction tothe United States, its territories or possessions, by anymeans, including by using any means or facility ofinterstate or foreign commerce or mail. (d) (1) Any person who, in a circumstance described inparagraph (2), knowingly makes, prints, or publishes, orcauses to be made, printed, or published, any notice oradvertisement seeking or offering-- (A) to receive, exchange, buy, produce, display,distribute, or reproduce, any visual depiction, if theproduction of such visual depiction involves the use ofa minor engaging in sexually explicit conduct and suchvisual depiction is of such conduct; or (B) participation in any act of sexually explicitconduct by or with any minor for the purpose of producinga visual depiction of such conduct; shall be punished as provided under subsection (e). (2) The circumstance referred to in paragraph (1) is
75
that-- (A) such person knows or has reason to know thatsuch notice or advertisement will be transported usingany means or facility of interstate or foreign commerceor in or affecting interstate or foreign commerce by anymeans including by computer or mailed; or (B) such notice or advertisement is transportedusing any means or facility of interstate or foreigncommerce or in or affecting interstate or foreigncommerce by any means including by computer or mailed. (e) Any individual who violates, or attempts or conspiresto violate, this section shall be fined under this titleand imprisoned not less than 15 years nor more than 30years, but if such person has one prior conviction underthis chapter, section 1591 [18 USCS § 1591], chapter 71,chapter 109A, or chapter 117 [18 USCS §§ 2251 et seq., 18USCS §§ 1460 et seq., 2241 et seq., or 2421 et seq.], orunder section 920 of title 10 (article 120 of the UniformCode of Military Justice), or under the laws of any Staterelating to aggravated sexual abuse, sexual abuse,abusive sexual contact involving a minor or ward, or sextrafficking of children, or the production, possession,receipt, mailing, sale, distribution, shipment, ortransportation of child pornography, such person shall befined under this title and imprisoned for not less than25 years nor more than 50 years, but if such person has2 or more prior convictions under this chapter, chapter71, chapter 109A, or chapter 117 [18 USCS §§ 2251 etseq., 18 USCS §§ 1460 et seq., 2241 et seq., or 2421 etseq.], or under section 920 of title 10 (article 120 ofthe Uniform Code of Military Justice), or under the lawsof any State relating to the sexual exploitation ofchildren, such person shall be fined under this title andimprisoned not less than 35 years nor more than life. Anyorganization that violates, or attempts or conspires toviolate, this section shall be fined under this title.Whoever, in the course of an offense under this section,engages in conduct that results in the death of a person,shall be punished by death or imprisoned for not lessthan 30 years or for life.
76
18 U.S.C. § 2252. Certain activities relating to materialinvolving the sexual exploitation of minors
(a) Any person who-- (1) knowingly transports or ships using any means orfacility of interstate or foreign commerce or in oraffecting interstate or foreign commerce by any meansincluding by computer or mails, any visual depiction,if-- (A) the producing of such visual depiction involvesthe use of a minor engaging in sexually explicit conduct;and (B) such visual depiction is of such conduct; (2) knowingly receives, or distributes, any visualdepiction using any means or facility of interstate orforeign commerce or that has been mailed, or has beenshipped or transported in or affecting interstate orforeign commerce, or which contains materials which havebeen mailed or so shipped or transported, by any meansincluding by computer, or knowingly reproduces any visualdepiction for distribution using any means or facility ofinterstate or foreign commerce or in or affectinginterstate or foreign commerce by any means including bycomputer or through the mails, if-- (A) the producing of such visual depiction involvesthe use of a minor engaging in sexually explicit conduct;and (B) such visual depiction is of such conduct; (3) either-- (A) in the special maritime and territorialjurisdiction of the United States, or on any land orbuilding owned by, leased to, or otherwise used by orunder the control of the Government of the United States,or in the Indian country as defined in section 1151 ofthis title [18 USCS § 1151], knowingly sells or possesseswith intent to sell any visual depiction; or (B) knowingly sells or possesses with intent tosell any visual depiction that has been mailed, shipped,or transported using any means or facility of interstateor foreign commerce, or has been shipped or transportedin or affecting interstate or foreign commerce, or which
77
was produced using materials which have been mailed or soshipped or transported using any means or facility ofinterstate or foreign commerce, including by computer,if-- (i) the producing of such visual depictioninvolves the use of a minor engaging in sexually explicitconduct; and (ii) such visual depiction is of such conduct;or (4) either-- (A) in the special maritime and territorialjurisdiction of the United States, or on any land orbuilding owned by, leased to, or otherwise used by orunder the control of the Government of the United States,or in the Indian country as defined in section 1151 ofthis title [18 USCS § 1151], knowingly possesses, orknowingly accesses with intent to view, 1 or more books,magazines, periodicals, films, video tapes, or othermatter which contain any visual depiction; or (B) knowingly possesses, or knowingly accesses withintent to view, 1 or more books, magazines, periodicals,films, video tapes, or other matter which contain anyvisual depiction that has been mailed, or has beenshipped or transported using any means or facility ofinterstate or foreign commerce or in or affectinginterstate or foreign commerce, or which was producedusing materials which have been mailed or so shipped ortransported, by any means including by computer, if-- (i) the producing of such visual depictioninvolves the use of a minor engaging in sexually explicitconduct; and (ii) such visual depiction is of such conduct; shall be punished as provided in subsection (b) of thissection. (b) (1) Whoever violates, or attempts or conspires toviolate, paragraph (1), (2), or (3) of subsection (a)shall be fined under this title and imprisoned not lessthan 5 years and not more than 20 years, but if such
78
person has a prior conviction under this chapter, section1591 [18 USCS § 1591], chapter 71, chapter 109A, orchapter 117 [18 USCS §§ 2251 et seq., §§ 1460 et seq.,2241 et seq., or 2421 et seq.], or under section 920 oftitle 10 (article 120 of the Uniform Code of MilitaryJustice), or under the laws of any State relating toaggravated sexual abuse, sexual abuse, or abusive sexualconduct involving a minor or ward, or the production,possession, receipt, mailing, sale, distribution,shipment, or transportation of child pornography, or sextrafficking of children, such person shall be fined underthis title and imprisoned for not less than 15 years normore than 40 years. (2) Whoever violates, or attempts or conspires toviolate, paragraph (4) of subsection (a) shall be finedunder this title or imprisoned not more than 10 years, orboth, but if such person has a prior conviction underthis chapter, chapter 71, chapter 109A, or chapter 117[18 USCS §§ 2251 et seq., §§ 1460 et seq., 2241 et seq.,or 2421 et seq.], or under section 920 of title 10(article 120 of the Uniform Code of Military Justice), orunder the laws of any State relating to aggravated sexualabuse, sexual abuse, or abusive sexual conduct involvinga minor or ward, or the production, possession, receipt,mailing, sale, distribution, shipment, or transportationof child pornography, such person shall be fined underthis title and imprisoned for not less than 10 years normore than 20 years. (c) Affirmative defense. It shall be an affirmativedefense to a charge of violating paragraph (4) ofsubsection (a) that the defendant-- (1) possessed less than three matters containing anyvisual depiction proscribed by that paragraph; and (2) promptly and in good faith, and without retainingor allowing any person, other than a law enforcementagency, to access any visual depiction or copy thereof-- (A) took reasonable steps to destroy each suchvisual depiction; or (B) reported the matter to a law enforcement agencyand afforded that agency access to each such visual
79
depiction
80
CERTIFICATE OF RELATED CASES
Mr. Grummer is unaware of other cases related to his
own.
Respectfully submitted,
S/David ZugmanDated: August 11, 2011 David Zugman
Attorney for Mr. Grummer
81
CERTIFICATE OF COMPLIANCE PURSUANT TO FED. R. APP. 32(A)(7)(C)AND
CIRCUIT RULE 32-1 FOR CASE NUMBER 10-50403
I certify that: (check appropriate options(s))
X 1. Pursuant to Fed. R. App. P. 32(a)(7)(C)and Ninth CircuitRule 32-1, the attached opening/answering/reply/crossappeal brief is
X Proportionately spaced, has a typeface of 14 points or more and contains 12874 words (opening, answering, and the second and third briefs filedin cross-appeals must NOT exceed 14,000 words; reply briefs mustNOT exceed 7,000 words),
or is
Monospaced, has 10.5 or fewer characters per inch and contains ______words or _____ lines of text (opening, answering, and second and thirdbriefs filed in cross-appeals must NOT exceed 14,000 words, or 1,300lines of text; reply briefs must NOT exceed 7,000 words or 650 lines oftext).
2. The attached brief is NOT subject to the type-volume limitations of Fed. R.App. P. 32(a)(7)(B) because
This brief complies with Fed. R. App. P. 32(a)(1)-(7) and is a principalbrief of no more than 30 pages or a reply brief of no more than 15 pages;
This brief complies with a page or size-volume limitation established byseparate court order date __________ and is
Proportionately spaced, has a typeface of 14 points or more andcontains ____ words,
or is Monospaced, has 10.5 or fewer characters per inch and contains
____ pages or ____ words or ____ lines of text.
82
____ 3. Briefs in Capital Cases
This brief is being filed in a capital case pursuant tot he type-volume limitations set fourth a Circuit Rule 32-4 and is
Proportionately spaced, has a typeface of 14 points or more andcontains __________ words (opening, answering, and the secondand third briefs filed in cross-appeals must NOT exceed 21,000words; reply briefs must not exceed 9,800 words)
Monospaced, have 10.5 or fewer characters per inch and contain___________ words or _________ lines of text (opening,answering, and the second and third briefs filed in cross-appealsmust NOT exceed 75 pages or 1,950 lines of text; reply briefsmust NOT exceed 35 pages or 910 lines of text).
_____4. Amicus Briefs
Pursuant to Fed. R. App. P. 29(d) and 9th Cir. R. 32-1, theattached amicus brief is proportionally spaced, has a typeface of14 points or more and contains 7,000 words or less.
or is
Monospaced, has 10.5 or fewer characters per inch and containsnot more than either 7,000 words or 650 lines of text.
or is
NOT subject to the type-volume limitation because it is anamicus brief of no more than 15 pages and complies with Fed. R.App. P. 32(a)(1)(5).
S/David ZugmanDate: August 11, 2011 DAVID ZUGMAN
Signature of Filing Party
83
PROOF OF SERVICE
I hereby certify that on August 11, 2011, Ielectronically filed the foregoing with the Clerk of theCourt for the United States Court of Appeals for theNinth Circuit by using the appellate CM/ECF system.
I certify that all participants in the case areregistered CM/ECF users and that service will beaccomplished by the appellate CM/ECF system.
s/David J. ZugmanDavid J. Zugman
84