Opinion
2:20-cr-00344-JAD-DJA
06-11-2024
United States of America, Plaintiff v. Kenton Hardy King, Defendant
ORDER OVERRULING OBJECTIONS, ADOPTING REPORT AND RECOMMENDATION, AND DENYING MOTION TO SUPPRESS
[ECF NOS. 74, 100, 101]
JENNIFER A. DORSEY, U.S. DISTRICT JUDGE
In June 2020, the Special Victims Unit (SVU) of the Henderson Police Department was investigating the report of a mother that her 15-year-old daughter “H.S.” had been the victim of sexual assault, extortion, and a host of other crimes perpetrated by an adult man whom H.S. knew as “James.” The investigation led them to Defendant Kenton Hardy King, and when King answered their knock at his door, Henderson SVU Detective Kari Skinner dialed the cell-phone number that H.S. had been using to communicate with “James.” The cell phone in King's pocket rang in response.
A warrant was obtained, and King's cell phones were seized and searched. The first part of the work was performed by Detective Jared Spangler, who conducted the forensic extraction of the data on the phones and used the Cellebrite Physical Analyzer software program to copy it into a more easily reviewable report format. Spangler gave those reports to Skinner for her substantive search of the phones' contents. The search turned up illicit photos and videos of H.S. and the robust history of communications between her and King, and King was charged with sexual exploitation of children, attempted sex trafficking of children, possession of child pornography, and coercion and enticement.
King moves to suppress the fruits of the search, arguing that the warrant was overbroad and did not properly incorporate the supporting affidavit that would have provided more specificity. Although the original round of briefing and orders focused on Skinner's search, in later rounds of briefing, the defense shifted the spotlight to Spangler's forensic-extraction work, and I held an evidentiary hearing to determine what Spangler did and whether he did it with the warrant and its supporting affidavit in hand.
ECF No. 74.
Having thoroughly evaluated the extended briefing on these suppression issues, a declaration by Skinner, and Spangler's evidentiary-hearing testimony, I find that the affidavit was incorporated into the warrant during these detectives' work, curing any overbreadth problem with the warrant itself, and that Spangler's forensic extraction did not exceed the scope of the warrant. So I overrule King's objections, adopt the magistrate judge's recommendations in this regard, and deny King's motion to suppress.
These details of the alleged offenses are not findings of fact but merely a summary of information in the affidavit in support of the search warrant, which was admitted as Exhibit 3 at the evidentiary hearing on this motion. ECF Nos. 45-1, 117-2.
A. The affidavit in support of the search warrant describes in detail H.S.'s cell-phone-centric alleged encounters with King.
King met 15-year-old H.S. online on a platform called Omegle.com and began messaging with her on June 2, 2020. He soon solicited nude photos and videos from her, which she sent over text messages. They arranged to meet in person that same day. King picked H.S. up from her house and brought her to his home where they engaged in sexual activity. He videorecorded and photographed their encounter using a cell phone and later threatened to release the images to her family and friends if she did not earn money for him by prostituting herself. He told H.S. that he had created an account for her on the Tinder online dating platform.
ECF No. 45-1 at 8.
Id.
Id.
Id. at 8-9.
Id. at 9.
Id. at 10.
H.S. and her mother reported the situation to the Henderson Police Department on June 4, 2020, and consented to a search of H.S.'s cell phone. On it, officers found the text messages, photos, and videos that H.S. had described (including an explicit photo showing the perpetrator and depicting his shoes) along with the phone number that King used to message her. They were also able to get enough GPS data-location information to pinpoint the home where H.S. had been taken for the alleged sexual assault.
Id. at 8.
Id. at 11.
ECF Nos. 75-7, 117-1 (evidentiary hearing Exhibit 2) at 5.
ECF No. 45-1 at 12.
Officers confronted King at his home, noticed that he was wearing the same shoes as the perpetrator in H.S.'s videos, and called the number that H.S. provided them, causing King's cell phone to ring in his pocket. They then obtained a search warrant for King's home and electronic devices from a Henderson Justice Court judge. The application for the warrant contained a five-page, single-spaced “Statement of Probable Cause” that details the report by H.S. and her mother, the results of the consent search of H.S.'s phone, and law enforcement's encounter with King at his doorstep. It also specifically identifies which facts provide probable cause for which crimes, walking through eight separate Nevada Revised Statute provisions, including NRS 201.560.4 (luring a child or mentally ill person with use of a computer or technology); NRS 200.725 (preparing, advertising, or distributing materials depicting pornography involving minor); NRS 200.730.1 (possession of visual pornography of a person less than 16); and NRS 200.310.1 (kidnapping of a minor).
Id.
Id. at 3.
Id. at 8-12.
Id. at 11. Twelve pages in total, the warrant package begins with the “Application and Affidavit for Search Warrant” by Henderson Police Department Detective Troy Star at pages 12; the Search Warrant itself on page 3, Exhibit 1 “Property to Be Searched” at pages 4-5, Exhibit 2 “Property and or Persons to be Seized” at pages 6-7, and the five-page Exhibit 3 “Statement of Probable Cause.”
B. Detective Spangler's forensic extraction of the contents of King's cell phones
Henderson Detective Kari Skinner, the lead detective on the case, gave Jared Spangler (a detective in Henderson's computer-crimes unit who worked in the digital-forensics lab) King's cell phones (an iPhone 7 and an iPhone XR) along with a paper copy of the search warrant and supporting affidavit so Spangler could forensically extract the data from the phones. Spangler had “[a]ll 12” pages of the warrant packet, which included the affidavit and its statement of probable cause, “physically right next to [him] or easily available to [him] throughout the time that [he was] conducting the extraction.”
ECF No. 120 at 45-46; ECF No. 75-7 at 10.
ECF No. 120 at 45-46.
Spangler performed a “file-system” extraction of both devices, which provides “a nice panoramic view of what's on the actual phone instead of just selectively taking small amounts.” While he had to look at various data points in the phones to perform these extractions, like checking the “general settings to make sure that the Bluetooth is turned off” and the phone is in airplane mode so it can't communicate “with anything,” determining whether there's an iTunes or email account, and obtaining the model and serial number of the device,when performing the extraction (or copying) of the phones' contents, he didn't look at that raw data. Instead, that raw data was automatically put into “a large, raw zipped file” that requires special software to open up and go through.
Id. at 49, 61.
Id. at 19-20.
Id. at 28.
Spangler then used the Cellebrite Physical Analyzer software program to “start an automated process” for “parsing” that raw data into a more easily searchable format. As Spangler explained, “all it's doing is . . . sectioning [the data] into artifact tabs so you can go through and say, I just want to look at phone calls,” for example. But while it's parsing, he can't see file names or any phone content. Once the parsing was done on King's phones, Spangler performed a few spot checks to make sure the software did its job. He checked something from the general phone information, clicked on “a random text message” to “make sure” it was pulled from the right database” and that its “time and date stamp is accurate,” and then picked one more item, like a photo. But when conducting those spot checks, he merely compares those items' “hex values” to those of the raw data, he doesn't check their words or images. He doesn't recall what items he spot-checked for King's phones. And when that work was complete, he had the Cellebrite program create a “portable report” of “everything” for Skinner to search. He then gave Skinner the phones and the reports.
Id. at 30, 61.
Id.
Id. at 32, 51-52.
Id. at 33-37.
Id. at 54.
Id. at 53.
Id. at 49:14-16; see also ECF Nos. 55:10-21; 75-7 at 10-11; 78:10-11.
ECF No. 75-7 at 11.
C. Detective Skinner's search of the phones
Because Skinner did not testify at an evidentiary hearing, we know less about her work.
What we do know comes from her declaration:
3. I conducted the search of King's digital devices.
4. When I conducted the search of King's digital devices, I had the entire search warrant application authorizing the search of King's digital devices, dated June 4, 2020, available to me, to include the search warrant, the list of property to be searched, the list of property to be seized, and the affidavit. I maintain a copy of those materials in my case file, and they were available to me for reference while I conducted the search.
ECF No. 94 at 22.
In her search, Skinner found the illicit photos and videos that King took of H.S. and the text messages exchanged between the two. King stands charged with four felony counts: sexual exploitation of children, attempted sex trafficking of children, possession of child pornography, and coercion and enticement.
ECF No. 78 at 4.
ECF No. 1.
Procedural Background
King filed a motion to suppress the evidence obtained from the search of his cell phones, arguing that the warrant was impermissibly overbroad. The government responded that the naked warrant was not overbroad but, even if it was, any overbreadth was cured by its incorporation of the detailed affidavit in support of it. The magistrate judge initially recommended that I grant the motion to suppress because the warrant on its own is overbroad and the government had not demonstrated that the affidavit was incorporated by the warrant.But the government quickly cured that deficiency in its objection to that recommendation by submitting a declaration from Skinner stating that the affidavit was available to her during the search. Because that declaration materially changed the record, I referred the suppression issue back to the magistrate judge for reconsideration. With this new evidence, the magistrate judge found that the warrant sufficiently incorporated the affidavit and was thus facially valid and that, even if it was overbroad, Skinner relied on it in good faith. So he amended his recommendation to one for denial of the suppression motion.
ECF No. 74.
ECF No. 78.
ECF No. 88 at 12-13.
ECF No. 94 at 22.
ECF No. 97 at 17.
ECF No. 100 at 2.
King objected to the amended recommendation. He argued that the magistrate judge got it wrong as the record does not show that the affidavit was truly incorporated. Plus Skinner wasn't the only detective who searched the phones, King argued-Spangler's forensic extraction was a Fourth Amendment search, too, and nobody had shown that he had the affidavit during his work. The government responded that the magistrate judge's conclusions about Skinner's search are supported by the law and the record and added-in a footnote-that Spangler's act of going into the phones and copying their data wasn't really a search.
ECF No. 101.
Id. at 5-6.
ECF No. 102 at 4 n.20.
The Spangler-search argument opened a new can of worms-one not capable of being resolved on the thin arguments raised in the parties' briefing. It took two hearings and another round of briefs to get to the bottom of it. In the second hearing, Spangler testified for more than an hour about his role, explaining the steps of his forensic analysis and establishing that he had a paper copy of all twelve pages of the search warrant-including the supporting affidavit-in his hand while performing his work. In the third and final round of briefing on this suppression issue, King maintains that Spangler's forensic examination was indeed a search. He argues that, even if Spangler had access to the warrant and affidavit, “it did not practically guide [his] search” because Spangler used the most intrusive search technique to gather data from King's cell phones, and the Fourth Amendment would not permit such an overly broad search. The government responds that Spangler's forensic examination was not a search at all because he never reviewed the contents of the extracted data, and placing temporal restrictions or other boundaries on Spangler's extraction method “defies technological capabilities.” But even if Spangler conducted a search and did so under an overly broad warrant, the government argues, the fruits of that search are saved from exclusion by the good- faith exception. I review the magistrate judge's challenged findings and recommendations de novo.
ECF Nos. 104, 107 (minute orders identifying this deficiency and setting hearing “on (1) whether Spangler conducted a search for Fourth Amendment purposes and (2) whether the affidavit was incorporated into the warrant during Spangler's forensic extraction”); ECF No. 110 (order scheduling evidentiary hearing).
ECF Nos. 125, 137.
ECF No. 117-2 (evidentiary hearing exhibit 3).
ECF No. 120 at 45 (transcript of evidentiary hearing).
ECF No. 125 at 3-4.
Id. at 5, 9-10.
ECF No. 137 at 9-11.
Id. at 11-14.
Id. at 14-15.
Fed.R.Civ.P. 72(b); 28 U.S.C. § 636(b)(1)(B); Local Rule IB 3-2(b) (requiring a district judge to review de novo only the portions of a report and recommendation addressing a case-dispositive issue that a party objects to).
Analysis
“The Fourth Amendment requires that a warrant particularly describe both the place to be searched and the person or things to be seized.” The warrant “must be specific enough to enable the person conducting the search reasonably to identify the things authorized to be seized.” This rule is meant to prevent “general, exploratory searches and indiscriminate rummaging through a person's belongings.”
United States v. Spilotro, 800 F.2d 959, 963 (9th Cir. 1986).
Id.
Id.
If a warrant on its face is not sufficiently particular, details in an accompanying affidavit may cure its deficiencies and allow the court to “evaluate the affidavit and the warrant as a whole.” The Ninth Circuit “consider[s] an affidavit to be part of a warrant, and therefore potentially curative of any defects, only if (1) the warrant expressly incorporated the affidavit by reference and (2) the affidavit either is attached physically to the warrant or at least accompanies the warrant while agents execute the search.” “The goal of the ‘cure by affidavit' rule is to consider those affidavits that limit the ‘discretion of the officers executing the warrant.'” Effectively, any collective set of documents incorporated into the warrant “simply are ‘the search warrant' for purposes of constitutional analysis.”
United States v. SDI Future Health, Inc., 568 F.3d 684, 699 (9th Cir. 2009).
Id.
Id. (quoting United States v. Towne, 997 F.2d 537, 545 (9th Cir. 1993)).
Towne, 997 F.2d at 548.
Here, the magistrate judge found the naked warrant impermissibly overbroad, but he then found that the overbreadth is cured when overlayed with the supporting affidavit. While there is no legitimate debate that the affidavit in support of this warrant was incorporated into the warrant by reference or that Spangler testified unequivocally that he had the paper version of the warrant and affidavit in hand during his work, King maintains that the record doesn't show that Skinner had the affidavit during her search. As to Spangler, King argues that the cure-by-affidavit rule can't apply to his search of the cell phones because “he wasn't guided by the affidavit at all” and “chose to ignore its limitations.”
ECF No. 88.
ECF No. 100 at 4-7.
The warrant doubly incorporates the affidavit, stating, “Proof having been made to me by Detective Troy Starr, said Affidavit attached hereto as Exhibit 3, and incorporated by reference herein by this reference.” ECF No. 45-1 at 3. Exhibit 3 contains the explicit details of the investigation. See id. at 8-12.
ECF No. 120 at 45 (Q. “So you had what I have in my hand right now, a paper copy of this affidavit and warrant?” A. “. . .Yes, I did.”); id. at 46 (Q: “The physical 12 pieces of paper, did you have all of those either physically right next to you or easily available to you throughout the time that you were conducting the extraction on the devices for this particular case?” A. “Yes, I did.” Q. “If you had any questions about what was authorized by the search or the terms of the warrant or the affidavit supporting the warrant, could you have picked up that piece of paper or these pieces of paper and looked through them?” A. “Yes, I could.”).
ECF No. 101.
ECF No. 125 at 5.
A. The incorporation of the affidavit into the warrant cured its overbreadth as to Detective Skinner.
The magistrate judge reviewed Detective Skinner's declaration and determined that the warrant sufficiently incorporated the affidavit because she had the affidavit at hand when she executed the search. King objects to this determination, arguing that the detective did not have the affidavit at hand; it was merely “available” to her in her case file during the search. The government responds that this was enough: the supporting affidavit needed only be available for reference, and here it was.
ECF No. 100 at 2.
ECF No. 101 at 5.
ECF No. 102 at 4.
1. An affidavit accompanies the warrant if it's available to the searcher.
Although the affidavit must “accompan[y] the warrant” during the search, the Ninth Circuit has recognized that it does not need to be physically attached to the warrant with “a staple, a paper clip, a bit of tape, or a rubber band,” nor does it need to be in the hands or pockets of every officer. An affidavit accompanies a warrant if it's available to those executing the search.
SDI Future Health, Inc., 568 F.3d at 693, 701.
Towne, 997 F.2d at 548.
SDI Future Health, Inc., 568 F.3d at 701 (“By making the affidavit available, the search team ensured that it ‘accompanied the warrant' to satisfy the requirements of incorporation.”) (quoting Towne, 997 F.2d at 548).
2. The record establishes that the affidavit was available to Detective Skinner during her search.
Detective Skinner's affidavit establishes that the affidavit was available to her during her search. Though she does not elaborate on whether she maintained a physical or digital copy, she does unequivocally state that she had access to it, along with the search warrant and the list of property to be searched and seized:
ECF No. 94 at 22.
When I conducted the search of King's digital devices, I had the entire search warrant application authorizing the search of King's digital devices, dated June 4, 2020, available to me, to include the search warrant, the list of property to be searched, the list of property to be seized, and the affidavit. I maintain a copy of those materials in my case file, and they were available to me for reference while I conducted the search.
Id. (emphasis added).
Circumstantial evidence further bolsters the conclusion that Skinner had the entire warrant packet while she performed her search. Spangler's evidentiary-hearing testimony established that it was Skinner who gave him all 12 pages of the warrant packet. The physical format of these documents also suggests that the warrant Skinner relied on was a twelve-page integrated document. The warrant itself lies at page 3 of the document, and it recites that it is based on the “Affidavit attached hereto as Exhibit 3, and incorporated by reference herein by this reference” and finds “probable cause to believe that certain property, hereto as Exhibit 2, is presently located as set forth in Exhibit 1.” Plus, there is simply no evidence in the record that either Spangler or Skinner performed this work with just the third page of this packet in hand, and such an assumption would be illogical given the clear incorporation of the various exhibits on the face of the warrant.
ECF No. 120 at 45. Spangler's narrative at ECF No. 75-7 at 10 further recites that “Detective Skinner provided a signed Search Warrant authorizing the search.”
ECF No. 45-1 at 3.
The purpose of the affidavit is to limit “the discretion of the officers executing the warrant and [ensure] that the person being searched has notice of the specific items the officer is entitled to seize.” Because the record sufficiently establishes that the affidavit of probable cause was readily available to Skinner during her search, it served this purpose of providing guidance in limiting the search. I thus find that, for purposes of Skinner's search, the warrant incorporated the affidavit and its detailed statement of probable cause, curing its overbreadth.
Towne, 997 F.2d at 548 (cleaned up).
To the extent that King's arguments can be construed to suggest that even with the affidavit incorporated, the warrant was still overly broad or facially deficient (a theory that the magistrate judge addressed and rejected in the amended report and recommendation, see ECF No. 100 at 6), the evidence gathered from King's phones would be spared from suppression based on the goodfaith exception. This case is analogous to United States v. Schesso, in which the Ninth Circuit found that an affidavit and warrant that contained “sufficient evidence connecting [the defendant] to the profile of a child pornography collector [] justif[ied] the officers' reliance on the warrant.” United States v. Schesso, 730 F.3d 1040, 1050 (9th Cir. 2013). While the warrant packet in Schesso merely described the characteristics of child-pornography collectors without connecting those characteristics to the defendant and the facts of his case,76 the Ninth Circuit found that the nature of the crime and the probable cause implied a higher likelihood that the defendant would have evidence of child pornography on other digital devices, so the good-faith exception applied. The court noted that it had “previously upheld comparably broad warrants based on similar evidence.” Id. at 1046; see United States v. Krupa, 658 F.3d 1174, 1178 (9th Cir. 2011) (finding that evidence of child neglect and one nude photo of a 15 to 17-year-old girl labeled www.nude-teens.com established probable cause to search 15 computers at the defendant's residence “even though the affidavit's description of the photograph did not necessarily support the conclusion that the photograph constituted child pornography”); United States v. Brobst, 558 F.3d 982, 993 (9th Cir. 2009) (holding that there was probable cause to seize computers and storage devices based on a single photograph in the defendant's home that could have been child pornography). Similarly here, the affidavit's five-page, single-spaced statement of probable cause details King's extensive use of his cell phone to visit different web-based platforms, send and receive text messages and phone calls, pick up H.S. and take her to his home, receive sexually explicit photos and videos, and film similar videos himself. ECF No. 45-1 at 8-10. The extent of that use, coupled with Spangler's testimony that such evidence on cell phones is often concealed by deletion, ECF No. 120 at 78, and the express and detailed protocol in the packet for “bit by bit image” extraction “by a forensic examiner” made it reasonable for Skinner and Spangler to rely on the warrant's validity in good faith.
B. Detective Spangler's search was not impermissibly overbroad.
For purposes of this motion to suppress, I assume without deciding that Spangler's work was a Fourth Amendment search and/or seizure. Though it declined to decide in United States v. Cano, 934 F.3d 1002 (9th Cir. 2019), whether a Cellebrite search constitutes a forensic search, the Ninth Circuit analyzed the border exception to the warrant requirement, concluded that a Cellebrite program extraction of cell-phone data is indistinguishable from a forensic laptop search, and emphasized the holding in Riley v. California, 573 U.S. 373, 401 (2014), that “‘a warrant is generally required' before searching a cell phone.” See also United States v. Kopankov, 672 F.Supp.3d 862, 866 (N.D. Cal. 2023) (finding that physical invasion into a cell phone to download its contents was a search and seizure that required a warrant).
While the defense acknowledges that Spangler had the entire warrant packet during his work, it contends that the details in the affidavit did nothing to narrow the scope of his search because he performed a “file system” extraction-which even he characterized as “the most intrusive in getting data from the device.” So even if the fully incorporated warrant isn't facially overbroad, Spangler's search was, King argues. The defense highlights that Spangler did nothing to limit his extractions to a date range or other details-like looking at individual text messages or photos to determine whether they involved H.S.
ECF No. 125 at 4-7; ECF No. 120 at 61:1-7 (cleaned up).
ECF No. 125 at 5.
Id. at 7.
1. A broader seizure can be justified by the nature of the crime or evidence.
The Ninth Circuit has acknowledged that a broad search or seizure of electronically stored data may be necessary in light of the nature of such storage or the crime. For example, in United States v. Lacy, the defendant challenged as unconstitutionally overbroad the seizure of his entire computer system based on two images of child pornography from a Danish computer bulletin-board system. The panel found that the scope was proper because the supporting affidavit “established probable cause to believe Lacy's entire computer system was ‘likely to evidence criminal activity.'” Although the computer equipment was described “in generic terms,” the court concluded that “this type of generic classification is acceptable ‘when a more precise description is not possible.'” And there it wasn't-“[t]he government knew Lacy had downloaded computerized visual depictions of child pornography” but didn't know where or how he stored them, so “there was no way” for agents to be more specific.
United States v. Lacy, 119 F.3d 742 (9th Cir. 1997).
Id. at 746 (quoting United States v. Kow, 58 F.3d 423, 427 (9th Cir. 1995)).
Id. (quoting United States v. Cardwell, 680 F.2d 75, 78 (9th Cir. 1982)).
Id. at 746-47. See also United States v. Brobst, 558 F.3d 982, 993-94 (9th Cir. 2009) (holding that seizure of all of his computer-related items based on “a single photograph, which one witness believed was from the internet” was not too broad because law enforcement “could not have known what storage media Brobst used”).
2. The nature of these crimes and evidence, and the limits of the technology, justified the scope of Detective Spangler's extraction.
Spangler's testimony established that similar challenges prevented him from a more narrow and targeted seizure of the data on King's cell phones. The affidavit detailed King's comprehensive use of cell phones in his dealings with H.S.: King had used numerous web-based and app platforms (including Omegle and Tinder), texted and received photographic and video images, and “grabbed his cell phone to film” his sexual encounter with then 15-year-old H.S.And it described how he had “used technology to lure” H.S. “to produce picture[s] and videos of herself nude” and masturbating, “and to entice [her] to meet with him to perform sexual acts,” which established probable cause “amounting to the crime[s] of Lure Child . . . with use of a Computer or Technology”; preparing, advertising, or distributing materials depicting pornography involving a minor; and possession of visual pornography of a person less than 16.
ECF No. 45-1 at 8-10.
Id. at 10-11. The Ninth Circuit's invalidation of an overly broad warrant in United States v. Kow, on which King relies, see ECF no. 125 at 14, is materially distinguishable. Unlike the fully incorporated warrant here, that “warrant failed to give any indication of the alleged crime to which the seized documents pertained” or specify in any way “the suspected criminal conduct.” Kow, 58 F.3d at 427. United States v. Lofstead, 574 F.Supp.3d 831 (D. Nev. 2021), is similarly distinguishable because that broad warrant for that cell-phone search detailed only a single instance of attempting to purchase sex from a minor, primarily via telephone calls, and the court found those facts insufficient to establish probable cause for other crimes or the attempted trafficking of other victims. Id. at 841-42.
Those uses and crimes informed the scope of the search and seizure here. Spangler explained that he had the option of performing one of two types of extractions on King's phones: a file-system extraction or a logical extraction. In a logical extraction, “you can specify the extraction artifacts,” meaning that you can select or include entire categories of files, like text messages or photos, but in a file-system extraction “you cannot decipher.” With either method, “it is impossible to restrict it to a specific time frame.” So, while Spangler could have excluded wholesale categories of data from extraction, the technology did not permit him to make choices based on date ranges. And when asked why he chose the file-system method instead of the more targeted logical extraction, Spangler explained that it was the nature of these crimes and how evidence of them is often stored in the phones that guided his choice:
ECF No. 120 at 24-27.
Id. at 25.
Id. at 72.
[W]hen we investigate these types of crimes, it's common that the suspect will try and conceal their actions. If we're wanting deleted data, you will not get any form of deleted data through a logical extraction. You'll get zero. If you want anything that's been erased and it's still on the phone that's available, you have to do the file system. It's the only way.
Id. at 78:15-23.
Spangler's explanation of his work makes this case analogous to United States v. Adjani, in which the Ninth Circuit rejected an overbreadth challenge regarding a computer that was seized and searched. Like King here, the Adjani defendants argued that the searcher could have cast a more narrow net with “a less invasive search of Adjani's email inbox and outbox for the addresses specifically cited in the warrant, as opposed to the wholesale search of the contents of all emails purportedly looking for evidence reflecting communications with those individuals.” The panel found that “[a]voiding that kind of specificity and limitation was not unreasonable under the circumstances here, however. To require such a pinpointed computer search, restricting the search to an email program or to specific search terms, would likely have failed to cast a sufficiently wide net to capture the evidence sought.” It reasoned that “[c]omputer files are easy to disguise or rename, and were we to limit the warrant to such a specific search protocol, much evidence could escape discovery simply because of . . . labeling of the files documenting [the] criminal activity. The government should not be required to trust the suspect's self-labeling when executing a warrant.”
United States v. Adjani, 452 F.3d 1140 (9th Cir. 2006).
Id. at 1149.
Id. at 1149-50.
Id. at 1150.
Nor should the government be required to trust that the defendant hasn't deleted or moved evidence of a crime from the main files or folders in his electronic devices. In United States v. Flores, the Ninth Circuit found that the seizure of all 11,000 pages of the defendant's Facebook account-when only 100 pages were responsive and ultimately just two messages were admitted into evidence-didn't make the warrant or the search based on it unconstitutionally overbroad. “‘Over-seizing' is an accepted reality in electronic searching because ‘there is no way to be sure exactly what an electronic file contains without somehow examining its contents,'” the Flores court explained. And because the warrant expressly authorized the seizure of “the entire contents of Flores's account,” “the government executed the warrant exactly as it was written.”
United States v. Flores, 802 F.3d 1028 (9th Cir. 2015).
Id. at 1044-45 (quoting United States v. Comprehensive Drug Testing, Inc., 621 F.3d 1162, 1176 (9th Cir. 2010) (en banc) (per curiam)). Plus, no evidence admitted at trial exceeded the scope of the warrant or probable cause. Id. at 1046. Similarly, King has not shown that any evidence obtained through the work of either detective here exceeded the scope of probable cause or the fully incorporated warrant.
Id. at 1046.
Spangler's testimony established that law enforcement encountered the very same situation here. He explained that neither process available to law enforcement allowed him to cull through and examine the individual files on the phone while they were being extracted, so like the Flores agents couldn't whittle the 1100 Facebook pages down further for a narrower seizure, neither could Spangler extract text messages between just a select few people or those created between June 2nd and June 4th. Even the warrant recognizes that a two-step process would be necessary here as it authorized “a bit by bit image of all data storage devices [to] be made by a forensic examiner to be searched through at a later date.” To borrow the language from Flores, “[i]n short, the government executed the warrant exactly as it was written.” I thus find that Spangler's forensic extraction did not exceed the scope of the fully integrated warrant.
ECF No. 120 at 24-27, 72, 78.
ECF No. 45-1 at 7.
Flores, 802 F.3d at 1046.
Conclusion
Because I find that the affidavit was sufficiently incorporated into the warrant, curing any overbreadth problem, and the detectives' work here did not exceed the scope of that fully integrated warrant, IT IS ORDERED that Kenton King's objection [ECF No. 101] is OVERRULED, the magistrate judge's report and recommendation [ECF. 100] is ADOPTED to the extent stated herein, and King's motion to suppress cell-phone evidence [ECF No. 74] is DENIED.