United States v. Galpin , 720 F.3d 436 ( 2013 )

11-4808-cr
U.S. v. Galpin
1 UNITED STATES COURT OF APPEALS
2 FOR THE SECOND CIRCUIT
3 ______________________
4 August Term 2012
5 (Argued: November 19, 2012 Decided: June 25, 2013)
6 Docket No. 11-4808-cr
7 _______________________
8 UNITED STATES OF AMERICA,
9 Appellee,
10 — v. —
11 JAMES R. GALPIN, JR.,
12 Defendant-Appellant.
13 ________________________
14 Before:
15 JACOBS, Chief Judge, WINTER, Circuit Judge,
16 and SWAIN, District Judge.*
17 ________________________
18 Appeal, following conditional guilty plea, from denial of motion to suppress
19 evidence indicative of guilt of child pornography-related offenses. Affirmed in part, and vacated
20 and remanded in part.
21 ___________________
22 * The Honorable Laura Taylor Swain of the United States District Court for the Southern
23 District of New York, sitting by designation.
1
1 _____________________________
2 JAMES P. EGAN (Lisa Peebles and James F. Greenwald on the brief)
3 Federal Public Defender’s Office, Northern District of New York,
4 Syracuse, New York, for Defendant-Appellant James Galpin, Jr.
5 PAUL D. SILVER, Assistant United States Attorney (Richard S. Hartunian, United
6 States Attorney, and Miroslav Lovric, Assistant United States Attorney,
7 on the brief), Northern District of New York, Albany, New York, for
8 Appellee.
9 _______________________________
10 SWAIN, District Judge:
11 Defendant-Appellant James R. Galpin, Jr. (“Galpin”), was convicted in the United
12 States District Court for the Northern District of New York (McAvoy, J.) upon a conditional
13 guilty plea, of several counts of production of child pornography, committing a felony offense
14 involving a minor while being required to register as a sex offender, and possession of child
15 pornography. He was sentenced on November 1, 2011, principally to 572 months of
16 imprisonment. Prior to his guilty plea, Galpin had moved to suppress all of the evidence,
17 including images of child pornography found on Galpin’s computer, digital cameras, and digital
18 storage devices, that had been seized in the execution of a search warrant that authorized officers
19 to search for “evidence that will constitute, substantiate or support violations of NYS
20 Corrections Law, section 168-f subdivision four, NYS Penal Law and or Federal Statutes.”1 The
21 district court denied Galpin’s motion in its entirety, holding that, although the warrant was
22 overbroad and probable cause was lacking for its authorization to conduct a search for child
23 pornography, the warrant was severable and the images that were found would have been in
1
The cited Correction Law provision requires the registration of certain internet
service provider and communications accounts. [See infra note 2].
2
1 plain view during the execution of a properly limited search. Galpin appeals from the district
2 court’s November 2, 2011, judgment. We affirm the district court’s determinations that the
3 officers lacked probable cause to search for evidence of child pornography and that the warrant
4 was facially overbroad. Because we find deficient the factual and analytical record as to whether
5 the warrant was severable and whether the images of child pornography were seized in plain
6 view, we vacate the judgment and remand the case for further proceedings consistent with this
7 opinion.
8 BACKGROUND
9 The Underlying Investigation
10 Galpin was convicted in New York in 1991 of Sexual Abuse in the First Degree.
11 He had abused 22 boys between the ages of 10 and 15. In June 2009, several years after his
12 release from custody and following a tip from a “concerned citizen” who reported having seen
13 Galpin with a young boy and calls from two parents reporting that Galpin had contacted their
14 children, the Southern Tier Cyber Predator Task Force opened an investigation. Law
15 enforcement officials in Tioga County, New York, installed a 24-hour surveillance camera
16 outside of Galpin’s residence. The surveillance revealed numerous boys between the ages of 10
17 and 16 visiting the residence and spending the night. The investigation also revealed that Galpin
18 was communicating with at least one minor boy on the Internet social networking site
19 “MySpace” using the screename “Medic Guy.” Specifically, investigators found Galpin’s
20 photograph and the “Medic Guy” online identity posted on the MySpace page of a 13-year old
21 boy, who was Galpin’s relative. Upon discovering the posting, investigators reviewed Galpin’s
22 sex offender registration and learned that he had failed to register the “Medic Guy” identifier as
3
1 required by N.Y. Correction Law § 168-f.2
2 The Search Warrant
3 On July 6, 2009, Tioga County Sheriff’s Department Senior Investigator Patrick
4 Hogan (“Hogan”) applied to the Owego Town Court for a warrant to search Galpin’s residence,
5 person, and vehicles for, inter alia, cameras, computers, cell phones, and any and all computing
6 or data processing software, “which may reveal evidence which substantiates violations of Penal
7 Law statutes, Corrections Law statutes and or Federal statutes.” Warrant Appl. 1, July 6, 2009.
8 In the warrant application, Hogan set forth the details of the investigation, including observed
9 interactions and communications with young males, and the fact that an internet provider had
10 revealed in response to a subpoena that the subscriber I.P. address associated with the “Medic
11 Guy” posting belonged to Galpin.
12 Based on this information, Hogan concluded in his application that Galpin was
13 “engaged in the use of the internet via MySpace and chat to lure juvenile males to the residence
14 for the purpose of engaging in sexual conduct, . . . using [his] cell phone to make contact with
15 and direct the pickup of juveniles, . . . [and] transport[ing] juvenile males to his residence.”
16 Warrant Appl. 2. Citing his training and experience, Hogan further proffered that “persons
17 involved in child sexual exploitation use the internet, cell phones and practices of becoming
2
N.Y. Correction Law § 168-f(4) provides, in relevant part, that: “Any sex
offender shall register with the division [of criminal justice] no later than ten
calendar days after any change of address, internet accounts with internet
access providers belonging to such offender, [and] internet identifiers that such
offender uses . . . .” “Internet identifiers” are defined as “electronic mail
addresses and designations used for the purposes of chat, instant messaging,
social networking or other similar internet communication.” N.Y. Correct. Law §
168-a(18).
4
1 juvenile friendly to groom juveniles for the purpose of engaging in sexual behavior with
2 children.” Warrant Appl. 2. In addition, Hogan made the following claim:
3 [I]t is reasonable to expect that upon execution of this warrant evidence will be
4 obtained that James Galpin Jr. is using his computer or other device[s] capable of
5 accessing the World Wide Web to include but not limited to computer’s [sic], cell
6 phones, game systems or ipod’s [sic] capable of communicating with other
7 persons, to post, chat, text, sending pictures or video’s [sic], or talk live and
8 evidence of such will be located at the residence or on the person, or vehicle of
9 James Galpin, Jr.
10 Warrant Appl. 3. Finally, again citing his training and experience, Hogan asserted that “persons
11 who engage in sexual predator behaviors do not provide current e-mail address’s [sic], user
12 names or passwords on their sexual offender registration to avoid detection of illegal activities
13 by Law Enforcement and to divert Law Enforcement to a plausible or legitimate e-mail which do
14 [sic] not contain any of the subjects [sic] illicit activities.” Warrant Appl. 3.
15 Upon being presented with the application, Town of Owego Justice Robert W.
16 Henning issued a warrant to search Galpin’s residence, vehicle, and person for property
17 “believed to contain evidence that will constitute, substantiate or support violations of NYS
18 Corrections Law, section 168-f subdivision four, NYS Penal Law and or Federal Statutes.”
19 Warrant 1, July 6, 2009. More specifically, the warrant, which did not incorporate the
20 application, authorized the seizure and subsequent search of:
21 1) Any Computers, central processing units, external and internal drives, storage
22 units or media terminals and video display units, together with peripheral
23 equipment such as keyboards, printers, modems, scanners or digital camera’s [sic]
24 and their internal or external storage media.
25
26 2) Any and all computing or data processing software, or data including but not
27 limited to hard disks, floppy disks, magnetic tapes, intregal [sic] RAM or ROM
28 units, and any other permanent or portable storage device(s) which may reveal
29 evidence and substantiates violations of the aforementioned NYS and federal
30 statutes.
5
1 3) The following records and documents, whether contained or stored on the
2 computer, magnetic tape, cassette, disk, diskette, photo optical device, or any
3 other storage medium:
4
5 a. Any access numbers, passwords, personal identification numbers
6 (PINS), logs, notes, memoranda and correspondence relating to
7 computer, electronic and voice mail systems, internet address’s
8 [sic] and/or related contacts.
9
10 b. Any computing or data processing literature, including, but not
11 limited to printed copy, instruction books, notes, papers, or listed
12 computer programs, in whole or in part.
13
14 c. Any audio or video cassette tape recordings, books magazines [sic],
15 periodicals, or other recorded or printed material, the possession
16 of which constitutes a violation of the aforementioned statutes of
17 the Laws of New York state or Federal Statutes.
18
19 d. Any and all photographs depicting sexual conduct by a child
20 and/or minors engaged in sexually explicit conduct.
21
22 e. Any records or correspondence relating to the possession,
23 transmission, collection, trading or production of the
24 aforementioned photographs.
25 Id.26 Hogan executed the warrant on July 8, 2009. Among the items discovered were a
27 computer and digital photography equipment that were found upon forensic examination to
28 contain images of child pornography. On March 10, 2010, a grand jury handed up a nine-count
29 indictment, charging Appellant with four counts of production of child pornography in violation
30 of 18 U.S.C. § 2251(a) and (e), one count of possession of child pornography in violation of 18
31 U.S.C. § 2252A(a)(5)(B), and four counts of committing a felony offense involving a minor,
32 specifically the four production counts, while being required to register as a sex offender in
33 violation of 18 U.S.C. § 2260A.
6
1 Galpin’s Suppression Motion
2 On December 16, 2010, Galpin moved to suppress the evidence obtained and
3 derived from the search warrant.3 Galpin argued that investigators lacked probable cause to
4 believe that he had committed any offense beyond failing to register an internet identifier, as
5 required by N.Y. Correction Law § 168-f(4), and thus had no basis for conducting a broad search
6 of the information contained on his computer and camera equipment. Galpin also argued that, by
7 expansively referencing “NYS Penal Law and or Federal Statutes,” the warrant authorized an
8 impermissible general search. The government opposed the motion to suppress, arguing that the
9 warrant application established probable cause to believe that Galpin was using the internet and
10 cell phones to lure minors for sexual activity, and that he had failed to register the “Medic Guy”
11 identifier that Galpin had used to contact a minor via MySpace. The Government also argued
12 that, even if the warrant was invalid insofar as it authorized a search for pornographic images,
13 such images were in plain view incident to the properly authorized search for evidence of a
14 registration offense and luring, and that, in any event, investigators acted on the warrant in good
15 faith, such that suppression was inappropriate under United States v. Leon, 468 U.S. 897 (1984).
16 On January 24, 2011, the district court held a suppression hearing, during which
17 the court heard oral argument from counsel and examined the warrant and underlying
18 application. Following the argument, the court made oral findings that “[t]he facts asserted in
19 the warrant application establish that the defendant was using the internet, including posting
20 images of himself online to communicate with minor males, in violation of the registration
3
Galpin also requested a hearing pursuant to Franks v. Delaware, 438 U.S. 154(1978). The district court denied that request and Galpin does not challenge that
ruling.
7
1 requirements,” and that it was “reasonable to conclude that engaging in such acts involved the
2 use of a computer or other device with access to the internet . . . .” The court continued:
3 [I]t was reasonable to conclude that relevant evidence would include any and all
4 information concerning defendant’s accessing the internet, including passwords
5 and other documents or information concerning his accessing the internet and
6 using screen names or accounts that he failed to register. This is because the
7 defendant used the internet in furtherance of his failure to register. It similarly is
8 reasonable to conclude that relevant evidence would include digital pictures that
9 he may have uploaded or downloaded in furtherance of his efforts to locate and
10 communicate with minor males under accounts that he did not register. Such
11 evidence would be relevant to whether it was actually defendant who was using
12 an unregistered user name or e-mail account.
13 The court also found that it was a “reasonable and logical inference to believe that persons who
14 communicate with one another via the internet will share photographs, whether sexually explicit
15 or not,” emphasizing that it had been established that the “defendant did upload an image of
16 himself to a minor’s MySpace page, albeit not a sexually explicit photograph.” The court
17 concluded that it was “not a far leap to conclude that there may have been evidence of defendant
18 uploading other pictures of himself or having downloaded pictures of the people he met online,
19 including minors” and, therefore, that the warrant authorizing the search of computers and digital
20 equipment for images was reasonable.
21 In addition, the district court found that there was probable cause to believe that
22 Galpin was “grooming or luring minor males for inappropriate sexual conduct or had engaged in
23 unlawful sexual conduct with a minor,” based on the warrant affidavit’s proffers concerning
24 Galpin’s criminal history, surveillance observation of overnight stays by young males in
25 Galpin’s home, internet and other communications with minor males, the presence of computer
26 and massage equipment in Galpin’s home, “his bringing minor males to his home in his
27 vehicle[,] and his failure to register the user name that he was using to communicate with minor
28 males.”
8
1 The district court specifically found that the warrant application failed to establish
2 probable cause to search for child pornography and upheld Galpin’s overbreadth objection to the
3 extent the warrant authorized searches for evidence of unspecified New York State Penal Code
4 and Federal Law violations. The court concluded, however, that the invalid portions of the
5 warrant could be “redacted” from the valid ones, and directed that a hearing would be held to
6 determine whether the evidence of child pornography was seized in plain view during the
7 execution of the search warrant.
8 Although the district court did not identify specifically the elements of the
9 warrant that could be redacted or those that would remain, it observed that the “affidavit clearly
10 discusses activity relating to defendant’s failure to register and his attempting to lure minor
11 males for sexual activity . . . [and that i]t, thus, appears that Hogan intended to look only for
12 evidence relating to the failure to register and efforts by the defendant to lure minor males for
13 purposes of sexual activity.” The district court also found, subject to receipt of evidence as to
14 the search methodology that had revealed the child pornography, that, “[c]onsidering the totality
15 of the nature of the investigation, the documents in support of the warrant, and the warrant itself,
16 the Court does not discern deliberate police misconduct in attempting to engage in a general
17 search such that exclusion would be justified.”
18 The Evidentiary Hearing
19 An evidentiary hearing in connection with the suppression motion was held on
20 March 1, 2011. At the hearing, the government called Marsha Powell (“Powell”), a computer
21 forensics analyst with the Computer Analysis and Technical Services lab of the Broome County
22 Security Division. Powell testified that law enforcement officers had provided her with
23 materials and information in support of their request that consisted of, inter alia, the warrant
9
1 affidavit and warrant contents, a timeline of activity in connection with the investigation, and of
2 Galpin’s post-warrant arraignment on 20 charges of a criminal sex act in the second degree,
3 misdemeanor sexual abuse charges, and charges of forceable touching and endangering the
4 welfare of a child. Powell testified that, in conducting her examination, she looked for files
5 associated with the names of suspected minors who were listed in the timeline report and the
6 “Medic Guy” identifier, as well as “images of a sexual nature if they involved what [she] thought
7 might be underage males or younger males,” and for “images that [she] believed would be of Mr.
8 Galpin.”4 Before Powell conducted her examination of Galpin’s computer, digital camera, and
9 digital storage media, she learned that Galpin had accessed web sites, especially social
10 networking sites such as MySpace. She testified that she knew that there might be images of
11 Galpin on at least one of those web sites, and that the storage media might contain the names and
12 images of potential male victims of Galpin’s.
13 Powell explained that, in order to conduct the analysis of Galpin’s
14 computer and devices, she first made an image, or duplicate, of the hard drive. The forensic
15 analysis was conducted on that duplicate. Powell began her examination of the computer by
16 doing word searches for pertinent names based upon her review of the information provided to
17 her. Once the initial word searches were completed, Powell segregated the types of files that had
18 been identified as containing relevant information. These files were then opened and examined
19 individually. Powell explained that each file on the hard drive contained an extension
4
See also the district court’s Decision and Order, United States v. Galpin, No. 10-
110, slip op at 3 (N.D.N.Y. Mar. 3, 2011), ECF No. 33 (“Powell was looking for
evidence of online communications between Defendant and minors and evidence
that Defendant had shared digital photographs of himself with minors or obtained
digital photographs of minors, which may have included pornography.”).
10
1 corresponding to the type of associated file (e.g., “doc” for Microsoft Word documents or “jpeg”
2 for image files). Powell testified that, while the file name signifies the file type, the name may
3 bear no relationship to the file’s content; therefore, the only way to determine the content is to
4 open the file. As Powell reviewed the files, she bookmarked ones she deemed relevant to the
5 investigation. In addition to searching all of the images and text files on the computer and
6 storage media, Powell testified, she opened and viewed every video file. Powell admitted that,
7 after she conducted a search of the hard drive for files containing certain terms, she conducted a
8 search of the entire hard drive. During the search, Powell stated, she was looking for internet
9 history showing child pornography, evidence of sexual abuse of children, evidence of
10 communications with children, and “images of a sexual nature if they involved what [Powell]
11 thought might be underage males or younger males.”
12 On March 3, 2011, the District Court issued a written opinion denying Galpin’s
13 suppression motion. Crediting Powell’s testimony, the district court found that the forensic
14 examination of Galpin’s computer required opening and viewing every file to determine whether
15 it contained relevant content. In doing so, the district court found, Powell had inadvertently
16 observed images of child pornography. Consequently, the district court held, the plain view
17 doctrine applied because (1) the government had probable cause to search Galpin’s computer for
18 “images or other evidence concerning the sex offender registration violation”; (2) the discovery
19 was inadvertent “in that Powell had to open each file to determine whether they fell within the
20 scope of the warrant”; and (3) “the incriminating nature of the evidence was readily apparent by
21 simply looking at the pictures and drawing logical inferences concerning the depictions therein.”
11
1 The Plea and Aftermath
2 On March 9, 2011, Galpin entered a conditional plea of guilty to the nine-count
3 indictment. The plea agreement preserved his right to appeal the district court’s denial of his
4 motion to suppress evidence. On November 2, 2011, the district court entered judgment
5 sentencing Galpin principally to a 572-month term of imprisonment. Galpin filed a timely notice
6 of appeal on November 10, 2011.
7 DISCUSSION
8 The standard of review for evaluating the district court's ruling on a suppression
9 motion is clear error as to the district court's factual findings and de novo as to questions of law.
10 United States v. Rodriguez, 356 F.3d 254, 257 (2d Cir. 2004). The evidentiary record is
11 reviewed in the light most favorable to the government. United States v. Rosa, 626 F.3d 56, 61
12 (2d Cir. 2010).
13 I.
14 The Fourth Amendment to the Constitution of the United States provides that:
15 “The right of the people to be secure in their persons, houses, papers, and effects, against
16 unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon
17 probable cause, supported by Oath or affirmation, and particularly describing the place to be
18 searched, and the persons or things to be seized.” U.S. Const. amend. IV.
19 The chief evil that prompted the framing and adoption of the Fourth Amendment
20 was the “indiscriminate searches and seizures” conducted by the British “under the authority of
21 ‘general warrants.’” Payton v. New York, 445 U.S. 573, 583 (1980); Arizona v. Gant, 556 U.S.
22 332, 345 (2009) (“[T]he central concern underlying the Fourth Amendment [is] the concern
12
1 about giving police officers unbridled discretion to rummage at will among a person’s private
2 effects.”). To prevent such “general, exploratory rummaging in a person’s belongings” and the
3 attendant privacy violations, Coolidge v. New Hampshire, 403 U.S. 443, 467 (1971), the Fourth
4 Amendment provides that “a warrant may not be issued unless probable cause is properly
5 established and the scope of the authorized search is set out with particularity.” Kentucky v.
6 King, --- U.S.---, 131 S. Ct. 1849, 1856 (2011).
7 The particularity requirement has three components. First, a warrant must
8 identify the specific offense for which the police have established probable cause. See United
9 States v. Bianco, 998 F.2d 1112, 1116 (2d Cir. 1993) (warrant that contained no particular
10 description of items and made no mention of any criminal statute or criminal conduct was “not
11 supportable”), abrogated on other grounds by Groh v. Ramirez, 540 U.S. 551 (2004); United
12 States v. George, 975 F.2d 72, 76 (2d Cir. 1992) (warrant authorizing search for evidence
13 “relating to the commission of a crime” was overbroad because “[n]othing on the face of the
14 warrant tells the searching officer for what crimes the search is being undertaken”).5 Second, a
15 warrant must describe the place to be searched. United States v. Voustianiouk, 685 F.3d 206,
5
Mindful that the purpose of this requirement is to minimize the discretion of the
executing officer, other Circuits have held that even warrants that identify catch-
all statutory provisions, like the mail fraud or conspiracy statutes, may fail to
comply with this aspect of the particularization requirement. See, e.g., United
States v. Leary, 846 F.2d 592, 594 (10th Cir. 1988) (warrant authorizing search of
export company’s business records for violation of the “Arms Export Control Act,
22 U.S.C. § 2778, and the Export Administration Act of 1979, 50 U.S.C.App. §
2410,” held overbroad); Voss v. Bergsgaard, 774 F.2d 402 (10th Cir. 1985)
(warrant specifying 18 U.S.C. § 371, the general federal conspiracy statute, held
overbroad); United States v. Roche, 614 F.2d 6, 8 (1st Cir. 1980) (concluding that
a limitation of a search to evidence relating to a violation of 18 U.S.C. § 1341, the
general mail fraud statute, provides “no limitation at all”).
13
1 211 (2d Cir. 2012); 2 W. LaFave, Search and Seizure § 4.6(a) (5th ed. 2012) (“[G]eneral
2 searches are prevented by the other Fourth Amendment requirement that the place to be searched
3 be particularly described.”). Third, the warrant must specify the “items to be seized by their
4 relation to designated crimes.” United States v. Williams, 592 F.3d 511, 519 (4th Cir. 2010); see
5 also United States v. Buck, 813 F.2d 588, 590-92 (2d Cir. 1987) (finding that a warrant
6 authorizing the seizure of “any papers, things or property of any kind relating to [the] previously
7 described crime” failed the particularization requirement because it “only described the crimes –
8 and gave no limitation whatsoever on the kind of evidence sought”). “[A]n otherwise
9 unobjectionable description of the objects to be seized is defective if it is broader than can be
10 justified by the probable cause upon which the warrant is based.” 2 W. LaFave, Search and
11 Seizure § 4.6(a) (5th ed. 2012).
12 In an oft-quoted passage, the Supreme Court has held that the particularity
13 requirement “makes general searches . . . impossible and prevents the seizure of one thing under
14 a warrant describing another. As to what is to be taken, nothing is left to the discretion of the
15 officer executing the warrant.” Marron v. United States, 275 U.S. 192, 196 (1927). To be sure,
16 we have noted that this “no discretion” standard “has not always been applied literally,” and that
17 courts may tolerate some ambiguity in the warrant so long as “law enforcement agents have done
18 the best that could reasonably be expected under the circumstances, have acquired all the
19 descriptive facts which a reasonable investigation could be expected to cover, and have insured
20 that all those facts were included in the warrant.” United States v. Young, 745 F.2d 733, 759 (2d
21 Cir. 1984). Nonetheless, we have emphasized that “a failure to describe the items to be seized
22 with as much particularity as the circumstances reasonably allow offends the Fourth Amendment
14
1 because there is no assurance that the permitted invasion of a suspect’s privacy and property are
2 no more than absolutely necessary.” George, 975 F.2d at 76.
3 Where, as here, the property to be searched is a computer hard drive, the
4 particularity requirement assumes even greater importance. As numerous courts and
5 commentators have observed, advances in technology and the centrality of computers in the lives
6 of average people have rendered the computer hard drive akin to a residence in terms of the
7 scope and quantity of private information it may contain.6 See United States v. Payton, 573 F.3d
8 859, 861-62 (9th Cir. 2009) (“There is no question that computers are capable of storing
9 immense amounts of information and often contain a great deal of private information. Searches
10 of computers therefore often involve a degree of intrusiveness much greater in quantity, if not
11 different in kind, from searches of other containers.”); United States v. Otero, 563 F.3d 1127,
12 1132 (10th Cir. 2009) (noting computer’s potential “to store and intermingle a huge array of
13 one’s personal papers in a single place”); Orin Kerr, Searches and Seizures in a Digital World,
14 119 Harv. L. Rev. 531, 569 (2005) (Computers “are postal services, playgrounds, jukeboxes,
15 dating services, movie theaters, daily planners, shopping malls, personal secretaries, virtual
16 diaries, and more.”). The potential for privacy violations occasioned by an unbridled,
17 exploratory search of a hard drive is enormous. This threat is compounded by the nature of
18 digital storage. Where a warrant authorizes the search of a residence, the physical dimensions of
19 the evidence sought will naturally impose limitations on where an officer may pry: an officer
6
Tellingly, at the January 24, 2011, district court hearing, the government itself
compared the hard drive search to a house search: “[the] search of a computer is
no different than an officer searching various places in the home. An officer can’t
tell what’s in the drawer or what’s in the folder if he has or she has authority to
look in those places.”
15
1 could not properly look for a stolen flat-screen television by rummaging through the suspect’s
2 medicine cabinet, nor search for false tax documents by viewing the suspect’s home video
3 collection.7 Such limitations are largely absent in the digital realm, where the size or other
4 outwardly visible characteristics of a file may disclose nothing about its content.8
5 As the Ninth Circuit has explained, because there is currently no way to ascertain
6 the content of a file without opening it and because files containing evidence of a crime may be
7 intermingled with millions of innocuous files, “[b]y necessity, government efforts to locate
8 particular files will require examining a great many other files to exclude the possibility that the
9 sought-after data are concealed there.” United States v. Comprehensive Drug Testing, Inc., 621
10 F.3d 1162, 1176 (9th Cir. 2010) (en banc) (per curiam). Once the government has obtained
11 authorization to search the hard drive, the government may claim that the contents of every file it
12 chose to open were in plain view and, therefore, admissible even if they implicate the defendant
13 in a crime not contemplated by the warrant. There is, thus, “a serious risk that every warrant for
14 electronic information will become, in effect, a general warrant, rendering the Fourth
15 Amendment irrelevant.” Id. This threat demands a heightened sensitivity to the particularity
16 requirement in the context of digital searches.
7
Cf. United States v. Ross, 456 U.S. 798, 824 (1982) (the scope of a lawful search
is “defined by the object of the search and the places in which there is probable
cause to believe that it may be found. Just as probable cause to believe that a
stolen lawnmower may be found in a garage will not support a warrant to search
an upstairs bedroom, probable cause to believe that undocumented aliens are
being transported in a van will not justify a warrantless search of a suitcase.”).
8
See, e.g., United States v. Crespo-Rios, 645 F.3d 37, 43 (1st Cir. 2011)
(recognizing that files may easily be manipulated through, inter alia, mislabeling
to disguise their content); accord United States v. Hill, 459 F.3d 966, 977-78 (9th
Cir. 2006).
16
1 II.
2 The district court determined, and the government does not dispute, that insofar as
3 the warrant generally authorized officers to search Galpin’s physical property and electronic
4 equipment for evidence of violations of “NYS Penal Law and or Federal Statutes,” the warrant
5 violated the Fourth Amendment’s particularity requirement. See, e.g., United States v. Rosa,
6 626 F.3d 56, 62 (2d Cir. 2010) (warrant authorizing seizure of electronic equipment without
7 specifying the legal violation “provided [officers] with no guidance as to the type of evidence
8 sought” and constituted a general warrant); United States v. George, 975 F.2d 72, 76 (2d Cir.
9 1992) (“Mere reference to ‘evidence’ of . . . general criminal activity provides no readily
10 ascertainable guidelines for the executing officers as to what items to seize . . . . [A]uthorization
11 to search for ‘evidence of a crime,’ that is to say, any crime, is so broad as to constitute a general
12 warrant.”); see also United States v. Burgess, 576 F.3d 1078, 1091 (10th Cir. 2009) (“If the
13 warrant is read to allow a search of all computer records without description or limitation it
14 would not meet the Fourth Amendment's particularity requirement.”).
15 The only crime that is specified in the warrant at issue here is the registration
16 offense. The district court found (and the government concedes) that there was no probable
17 cause to believe that Galpin possessed or produced child pornography – crimes that were
18 mentioned neither in the warrant application nor in the warrant itself, which nonetheless
19 authorized a search for images depicting child sexual activity. While the district court found that
20 the warrant application provided probable cause to believe that Galpin was communicating with
21 and luring young males to his residence, the government does not contend that the warrant
22 authorized officers to search for evidence of luring. Nor could it, given the fact that the warrant
23 neither mentions the luring offense nor incorporated the warrant application. See Groh v.
17
1 Ramirez, 540 U.S. 551, 557 (2004) (“The fact that the application adequately described the
2 ‘things to be seized’ does not save the warrant from its facial invalidity. The Fourth Amendment
3 by its terms requires particularity in the warrant, not in the supporting documents.” (emphasis in
4 original)).
5 While we agree that the warrant was facially overbroad and thus violated the
6 Fourth Amendment, this conclusion does not end the inquiry. As the district court recognized,
7 the proper next steps are, first, to determine whether the warrant is severable – i.e., whether it is
8 possible to carve out the portions of the warrant authorizing a search for evidence of a
9 registration offense from the constitutionally infirm remainder – and, if so, whether the
10 challenged evidence was in plain view when it was seized. Because we find the district court’s
11 analysis and the factual record deficient as to both issues, we will vacate the judgment and
12 remand for further proceedings consistent with the discussion that follows.
13 A. Severability
14 When a warrant is severable, the portion of the warrant that is “constitutionally
15 infirm . . . – usually for lack of particularity or probable cause – is separated from the remainder
16 and evidence seized pursuant to that portion is suppressed; evidence seized under the valid
17 portion may be admitted.” George, 975 F.2d at 79. The severance doctrine is animated by the
18 need to balance the considerable social costs of suppressing evidence of guilt against the need to
19 deter police misconduct, and the judgment that it would be unduly “harsh medicine” to suppress
20 evidence whose seizure was authorized by a particularized portion of a warrant simply because
21 other portions of the warrant failed that requirement. LaFave, Search and Seizure § 4.6(f).
22 However, we have cautioned that severance is not an available remedy for an overbroad warrant
23 “where no part of the warrant is sufficiently particularized, where no portion of the warrant may
18
1 be meaningfully severed, or where the sufficiently particularized portions make up only an
2 insignificant or tangential part of the warrant.” George, 975 F.2d at 79-80 (internal citations
3 omitted).
4 We have not previously prescribed how the severance analysis is to be conducted.
5 We do so now, adopting the step-by-step methodology for warrant redaction that was established
6 in United States v. Sells, 463 F.3d 1148 (10th Cir. 2006). First, the court must separate the
7 warrant into its constituent clauses. Id. at 1155; see also United States v. Christine, 687 F.2d
8 749, 754 (3d Cir. 1982). Second, the court must examine each individual clause to determine
9 whether it is sufficiently particularized and supported by probable cause. Sells, 463 F.3d at10 1157. Third, the court must determine whether the valid parts are distinguishable from the non-
11 valid parts. Id. at 1158 (“some part of the warrant must be both constitutionally valid and
12 distinguishable from the invalid portions in order for severability to apply” (quotation marks
13 omitted)); Christine, 687 F.2d at 754 (“Redaction is inappropriate when the valid portions of the
14 warrant may not be meaningfully severable from the warrant as a whole.”). To be
15 distinguishable, “each of the categories of items to be seized [must] describe[] distinct subject
16 matter in language not linked to language of other categories, and each valid category [must]
17 retain[] its significance when isolated from rest of the warrant.” Sells, 463 F.3d at 1158. In sum,
18 the court must be able to excise from the warrant those clauses that fail the particularity or
19 probable cause requirements in a manner that leaves behind a coherent, constitutionally
20 compliant redacted warrant.
21 However, the warrant’s grammatical amenability to severance is not alone
22 sufficient to justify enforcement of the remainder. The district court must also determine
23 whether the valid portions make up “only an insignificant or tangential part of the warrant.”
19
1 George, 975 F.2d at 80. Even where parts of the warrant are valid and distinguishable, severance
2 may be inappropriate where, for instance, the sufficiently particularized portion is “only a
3 relatively insignificant part of a sweeping search,” United States v. Spilotro, 800 F.2d 959, 967
4 (9th Cir. 1986), or where “the warrant is generally invalid but as to some tangential item meets
5 the requirement of probable cause,” United States v. Freeman, 685 F.2d 942, 952 (5th Cir. 1982);
6 see also United States v. Kow, 58 F.3d 423, 428 (9th Cir. 1995) (severance inapplicable where
7 the constitutionally compliant part is a “relatively insignificant part of an otherwise valid
8 search”). This step of the analysis should not simply be a technical exercise of counting words
9 and phrases but, rather, “a holistic test that examines the qualitative as well as the quantitative
10 aspects of the valid portions of the warrant relative to the invalid portions.” Sells, 463 F.3d at11 1160.
12 The district court did not articulate the mode of analysis underlying its conclusion
13 that the warrant was severable. The court appears to have concluded that the warrant could be
14 severed merely by eliminating the authorization to search for (1) evidence of unspecified state or
15 federal offenses and (2) evidence of photographs depicting sexual conduct by a minor. Those
16 two redactions, however, would not cure the warrant’s apparent overbreadth. It is important at
17 this juncture to emphasize that the only offense particularized in the warrant was failure to
18 register an internet service provider account or communication identity. The sole legal
19 predicates for a registration offense are possession and usage of an unregistered internet account
20 or communication identifier. The manner or purpose for which the internet account or identifier
21 is used – whether to send an innocuous email, post a picture on MySpace, or to lure minors in a
22 chat room – is not an element of the offense.
20
1 Even after the references to state and federal law and images of child pornography
2 are removed, there remain numerous clauses whose relationship to the registration offense is, at
3 best, unclear. After redaction of the two clauses identified above, the first and second
4 paragraphs of the warrant would still broadly authorize a search of “[a]ny computers,” “external
5 and internal drives,” “digital camera’s [sic] and their internal or external storage media,” “[a]ny
6 and all computing or data processing software,” and any electronic storage device for any
7 evidence substantiating a registration violation, without providing the forensic examiner with
8 any guidance or limitations as to what kinds of files might be relevant. Warrant 1. While those
9 provisions describe the places to be searched, they do not describe with adequate particularity
10 the “items to be seized by their relation to designated crimes.” United States v. Williams, 592
11 F.3d 511, 519 (4th Cir. 2010) (emphasis added). The third paragraph of the warrant
12 particularizes the items that the government may seize, but nothing in the current record explains
13 how the vast majority of those items – e.g., access numbers, passwords, and PINS relating to
14 voice mail systems, computing or data processing literature (including written materials), audio
15 or video cassette tape recordings, books, and magazines – could possibly reveal evidence that
16 Galpin possessed or used an unregistered internet account or communication identity.
17 Nor did the district court weigh any particularized component(s) of the warrant
18 against the invalid portions to determine whether the particularized portions were insignificant or
19 tangential in relation to the search authorization as a whole. The government asserts that
20 severance was appropriate because “[e]vidence of Galpin’s failure to register his online identity
21 . . . was a prominent aspect of the investigation and of the evidence sought to be obtained.”
22 However, while the MySpace posting led to probable cause to believe that there was a
23 registration violation, the investigation itself, and the forensic review of Galpin’s property,
21
1 focused not on his failure to register but on his activities involving young boys and suspected
2 involvement with child pornography. Mere mention of the crime that prompted the investigation
3 will not ensure that an authorization to search for evidence relating to that crime is more than an
4 insignificant or tangential element of a warrant focused on evidence of other criminal activity.
5 See, e.g., Cassady v. Goering, 567 F.3d 628, 636 (10th Cir. 2009). Rather, the court must assess
6 the relative importance on the face of the warrant of the valid and invalid provisions, weigh the
7 body of evidence that could have been seized pursuant to the invalid portions of the warrant
8 against the body of evidence that could properly have been seized pursuant to the clauses that
9 were sufficiently particularized, and consider such other factors as it deems appropriate in
10 reaching a conclusion as to whether the valid portions comprise more than an insignificant or
11 tangential part of the warrant.
12 Because the current factual record is focused principally on the proper scope and
13 conduct of a computer search for evidence of child pornography and contact with minors, the
14 district court must, on remand, develop a record as to the proper scope and conduct of a search
15 for evidence of the existence of unregistered internet accounts and internet communication
16 identifiers. That record will help to inform the court’s determination as to whether any valid
17 portions of the warrant were more than insignificant or tangential and will also be relevant to any
18 plain view and/or good faith determinations that will be necessary if the court determines that the
19 seizures or search exceeded the bounds authorized by any valid aspects of the warrant.
20 B. Plain View Doctrine
21 If, on remand, the district court again finds that the warrant was severable but that
22 the evidence of child pornography was outside the properly authorized scope of the search, it
23 will again have to address the question of whether that evidence was in plain view in the course
22
1 of the authorized search. The plain view doctrine permits an officer to seize evidence outside a
2 warrant’s authorization “when it is immediately apparent that the object is connected with
3 criminal activity, and where such search and seizure do not involve an invasion of privacy.”
4 George, 975 F.2d at 78. A quintessential example of a warrantless seizure saved by the plain
5 view doctrine is one by an officer who, acting pursuant to a valid warrant, enters a house to
6 search for a weapon used to commit a crime and seizes a bag of cocaine that he found sitting on
7 the kitchen counter. In order for the search and seizure to not involve an improper invasion of
8 privacy, however, the officer must lawfully have been in the place from which the object could
9 be seen in plain view. Minnesota v. Dickerson, 508 U.S. 366, 375 (1993). Thus, “an essential
10 predicate of the plain view doctrine is that the initial intrusion not violate the Fourth
11 Amendment.” George, 975 F.2d at 78; see also Horton v. California, 496 U.S. 128, 136 (1990).
12 The district court here held that the clause of the warrant authorizing officers to
13 search for evidence of a registration violation permitted the officers to open all of Galpin’s
14 computer and digital storage files because opening each file was the only means of determining
15 its content. However if, on remand, the district court finds that the warrant was not severable,
16 then the “initial intrusion” was unconstitutional – the entire hard drive search would have been
17 without valid authorization – and the plain view doctrine could not be invoked to validate the use
18 of any of the evidence the officers seized. The court’s determination, on remand, as to the
19 appropriate scope of the authorized search should be informed by a better-developed, more
20 relevant factual record; the court’s determination as to whether the image files that were seized
21 would have been in plain view in the conduct of that search will similarly be informed by that
22 augmented record.
23
1 Unlike the Ninth Circuit, we have not required specific search protocols or
2 minimization undertakings as basic predicates for upholding digital search warrants, and we do
3 not impose any rigid requirements in that regard at this juncture. See United States v.
4 Comprehensive Drug Testing, Inc., 621 F.3d 1162, 1176 (9th Cir. 2010) (en banc) (per curiam).
5 However, the district court’s review of the plain view issue should take into account the degree,
6 if any, to which digital search protocols target information outside the scope of the valid portion
7 of the warrant. To the extent such search methods are used, the plain view exception is not
8 available.
9 As the record is currently constituted, there is little indication as to whether the
10 forensic examiner’s search was even directed – much less properly limited – to those files that
11 would substantiate a registration violation. The district court held that the redacted warrant
12 authorized the forensic examiner to open and seize any image file because digital pictures
13 “would be relevant to whether it was actually defendant who was using an unregistered user
14 name or an e-mail account.” The district court’s speculation as to the probative value of the
15 digital pictures is unsupported by the record developed below and appears somewhat strained,
16 given that officers had determined, before even seeking the warrant, that Galpin’s I.P. address
17 was the source of the “Medic Guy” posting and the photograph of Galpin found on the child’s
18 MySpace page. The record indicates, moreover, that the investigator opened and played video
19 image files in order to determine whether they contained sexual content. Nothing in the record is
20 indicative of any possible evidentiary connection between the content of video files and the
21 possession of an unregistered internet service provider account, internet communication
22 identifier, or email address. On remand, the district court must determine whether a search
23 limited to evidence of a registration violation would have necessitated the opening of image files
24
1 or the playing of video files.9
2 C. Good Faith Exception
3 The government contends that, even if the warrant was invalid or the
4 pornographic images would not have been in plain view in the course of a properly authorized
5 search, the denial of Galpin’s suppression motion should nonetheless be upheld because the
6 investigators reasonably relied on the warrant and the accompanying affidavit when executing
7 the search.
8 In United States v. Leon, the Supreme Court recognized an exception to the
9 exclusionary rule for “evidence obtained in objectively reasonable reliance on a subsequently
10 invalidated search warrant.” 468 U.S. 897, 922 (1984). However, the Supreme Court identified
11 four circumstances in which the good faith exception to the exclusionary rule would not apply:
12 (1) where the issuing magistrate has been knowingly misled; (2) where the issuing
13 magistrate wholly abandoned his or her judicial role; (3) where the application is
14 so lacking in indicia of probable cause as to render reliance upon it unreasonable;
15 and (4) where the warrant is so facially deficient that reliance upon it is
16 unreasonable.
17 United States v. Moore, 968 F.2d 216, 222 (2d Cir. 1992) (citing Leon, 468 U.S. at 923).
18 Because the district court found that the warrant was severable and that the image files had been
19 in plain view, the district court never reached the issue of whether Leon’s good faith exception
20 applied to this case.
21 Galpin argues that the officers deliberately searched for evidence beyond the
22 scope of the probable cause supporting the warrant and thus did not act in good faith. He also
9
Paragraph 3(e) of the warrant authorized a search for “records or correspondence
related to the possession, transmission, collection, trading or production of [child
pornography].” As explained above, we affirm the district court’s uncontested
determination that there was no probable cause to search for child pornography.
25
1 argues that the warrant application was so lacking in indicia of probable cause, and the face of
2 the warrant was so plainly overbroad, that no officer could reasonably have relied on the warrant
3 when executing the search. The district court’s only finding on point was its conditional
4 determination – which the court did not revisit at or after the evidentiary hearing – that the pre-
5 evidentiary hearing record revealed no evidence of deliberate police misconduct. That finding,
6 in any event, only relates to the first of the four circumstances the Leon Court identified as
7 foreclosing the good faith exception.
8 The district court did not address the question of whether the warrant, which
9 purported to authorize a search for violations of “NYS Penal Law or Federal statutes,” was “so
10 facially deficient that reliance upon it [was] unreasonable.” See United States v. Moore, 968 F.2d
11 at 222; cf. George, 975 F.2d at 77 (holding that, “[s]ince it was quite clear when [the subject]
12 warrant was executed that ‘limits’ to a search consisting only of a broad criminal statute were
13 invalid, a fortiori, a warrant not limited in scope to any crime at all is so unconstitutionally broad
14 that no reasonably well-trained police officer could believe otherwise”). Nor has the district
15 court yet had occasion to address the implications for the good faith inquiry of its finding (which
16 we affirm) that the application did not establish probable cause for a search for child
17 pornography.
18 Here, there is ample evidence that investigators sought evidence beyond the scope
19 of the one crime that was particularized in the warrant application and for which the application
20 supplied probable cause. The forensic examiner testified that, having reviewed a report on the
21 entire investigation, she was looking for images of “younger . . . males,” “regardless of whether
22 they’re pornographic or not,” that she read individual “documents,” that she opened and
23 reviewed video files, and that she set up a search filter that identified child pornography websites
26
1 Galpin had visited. Indeed, during cross-examination, the examiner confirmed that she went
2 beyond the files that had been identified as potentially indicative of contact with the victims
3 whose names she had been given. Galpin’s defense attorney asked: “[A]ssume that [the files
4 identified by targeted searches] comprise[] two percent of all the material that’s on the hard drive
5 and the other 98 percent has nothing to do with any of those names . . . . So you look through
6 [the other 98 percent of the files]?” The forensic examiner responded, “[a]bsolutely.”
7 Should the district court determine that neither severability nor the plain view
8 doctrine supports denial of the suppression motion, it will have to determine whether,
9 notwithstanding the exceptions delineated in United States v. Leon, the motion can be denied on
10 the ground that the officers acted in good faith.
11 CONCLUSION
12 Accordingly, we AFFIRM the district court’s determination that the warrant
13 application failed to establish probable cause to search for evidence of child pornography, and its
14 determination that the warrant’s references to the New York State Penal Law and “Federal
15 Statutes” were impermissibly broad. We VACATE the judgment in all other respects and
16 REMAND the case for further proceedings consistent with this opinion.
27