DEE BENSON

MEMORANDUM DECISION

AND ORDER

Judge Dee Benson

This matter is before the court on defendant Stanley Wardle's motion to suppress. Defendant Wardle moves this court to suppress all evidence obtained from the execution of a search warrant, or alternatively all, evidence obtained as the result of an allegedly warrentless search of his computer. Having reviewed the relevant materials, the court now issues the following Memorandum Decision and Order.

BACKGROUND

In July of 2010, Casey Hill ("Agent Hill"), a special agent with the Internal Revenue Service ("I.R.S.") criminal investigation, prepared an affidavit in support of a search warrant related to the premises located at 2309 E. 1650 S., Spanish Fork, Utah. (Suppress. Hr'g Tr. 10-11, Mar. 18, 2013 (hereinafter "Tr."); Gov't Ex. 1.) That location was then the residence of defendant Wardle. (Tr. at 11.) The affidavit enumerated possible crimes for which evidence may exist at the defendant's residence, as well as provided probable cause that such evidence did exist at that location. (Tr. at 12.) The affidavit was offered for the sole purpose of establishing probable cause and did not purport to set forth all of the facts of the investigation. (Gov't Ex. 1 ¶ 6.) At the time the search warrant was issued, there was probable cause to conclude that the defendant was preparing false individual income tax returns using the fraudulent Forms 1099-OID scheme ("1099-OID scheme"). (Tr. at 13.)

The 1099-OID scheme relates to the fraudulent misuse of Forms 1099-OID to obtain large and unwarranted tax refunds from the IRS. (Gov't Ex. 1 ¶ 10.) As part of the scheme, either the promoter or the taxpayer would file documents with the IRS purporting to be from a financial institution (typically one to whom the taxpayer owed money, such as a bank) which reported that the financial institution had "paid" money to the taxpayer but had withheld the entire amount as a tax payment to the IRS. Id. A corresponding Form 1099-OID was then created, filed with the IRS, and used to prepare a fraudulent income tax return seeking a refund from the IRS. Id.

As part of the affidavit, agent Hill prepared an attachment, Attachment B, listing with specificity the items to be seized. (Tr. at 12; Gov't Ex. 1, Attach. B.) Among the items listed in Attachment B were tax returns that utilize the 1099-OID scheme, as well as other pertinent documents relating to the preparation of federal income tax returns. (Tr. at 13: Gov't Ex. 1, Attach. B. ¶¶ 2-3.) The search warrant authorized agents to search for, among other things, computers and computer equipment, hardware, software and records stored on computer media or on media capable of being read by a computer. (Tr. at 14; Gov't Ex. 1 ¶¶3, 23-28.) Pursuant to the warrant, agents seized a number of hard drives and other digital media belonging to the defendant. (Tr. at 15; Gov't Ex. 2 at 4-5.)

Agent Sabin took physical control of the digital media at the time of the search, then made mirror image copies of the digital media and returned the originals to the defendant. (Tr. at 16.) Agent Sabin removed system files, program files, non-user created data and a majority of the image files from the digital media as they were outside the scope of the warrant. (Tr. at 17.) Agent Hill then conducted a multi-level search of the digital media using varying search methods, all generally utilizing the Windows general search functionality. Agent Hill began with a narrow search focused on TurboTax file extensions. (Tr. at 20.) Anticipating finding additional documents, such as client tax returns prepared using TurboTax, Agent Hill broadened his search methods to include keyword searches focused on the known clients' last names and later to include keywords related to the 1099-OID scheme. (Tr. at 20,23.) Agent Hill kept track of files that appeared to be responsive by copying them into a separate directory. (Tr. at 21-22.)

During the course of his search, agent Hill came across documents related to an individual by the name of Michael Lavery, (Tr. at 24.) Agent Hill knew Lavery was a client of April Rampton and that Ms. Rampton had prepared a 1099-OID scheme tax return for Lavery. Id. Agent Hill did not know of a connection between Lavery and defendant Wardle prior to his search, but Lavery's name came up from various searches. (Tr. at 24, 41.) Agent Hill then utilized Lavery's name in keyword searches because he understood that Lavery could be connected to defendant Wardle through April Rampton's stepfather, Winston Shrout. (Tr. at 25.) Shrout is nationally known in connection with the "redemption theory," including the 1099-OID scheme. (Tr. at 26.) Agent Hill knew that defendant Wardle and Shrout were connected because, prior to the search, the defendant told agent Hill he knew Shrout. Id.

Keyword searches on Lavery's name also returned documents wholly unresponsive to the warrant. (Tr. at 26.) This was due in large part to the fact that the word "lavery" is a part of the word "slavery." (Tr. at 25, 27, 42.) As with other documents unrelated to the "lavery" keyword search, Agent Hill had to open and view each document in order to determine its responsiveness. (Tr. at 43, 45.)

After the indictment of the defendant, agent Hill again searched the hard drives for the keyword "lavery" to gather discovery for a separate prosecution of Michael Lavery. (Tr. at 5152.) Agent Hill saved the results of this search in a separate folder which he labeled "Lavery Discovery." (Tr. at 50-51.)

In addition to coming across documents related to Lavery and Shrout during the course of his search, agent Hill also discovered documents related to "mortgage remediation." (Tr. at 27.) Mortgage remediation relates to the same "redemption theory" as the 1099-OID scheme and is not a legal process. Id. Mortgage remediation requires the creation and fraudulent use of similar documents as the 1099-OID scheme, such as discharge bonds and promissory notes. (Tr. at 29.)

DISCUSSION

I. The search warrant is narrowly defined and limits the search to documents particularized in the warrant; no specific search methodology is required.

Defendant Wardle first argues that the search warrant was overbroad because it "placed no limits on law enforcement's abilities" to search defendant's computer hard drives. (Def.'s Mem. Supp. Mot. Suppress ("Dkt. No. 52") at 11.) To support this position, defendant argues that the Fourth Amendment requires that a search warrant "describe the things to be seized with sufficient particularity to prevent a general exploratory rummaging in a person's belongings," United States v. Campos, 221 F.3d 1143,1147 (10th Cir, 2000). In this case, the search warrant constrained law enforcement because it contained a particularized list of "Items to be Seized" in Attachment B. (Gov't Ex. 1, Attachment B.) This attachment extends to the entire search, including the search of computers.

In United States v. Brooks, the search warrant authorized officers to search two computers and a number of disks for evidence of child pornography. 427 F.3d 1246 (10th Cir. 2005). In Brooks, much like the instant case, the search warrant contained an "Attachment B" that listed the specific items to be seized. Id. at 1252. Brooks argued that the language in that attachment referencing "electronic text files, emails, and messages" was overbroad and allowed law enforcement to search those types of documents for evidence of any crime. The Brooks court, however, held that the entire warrant must be read in context. The court stated that "[w]hile the warrant does not explicitly instruct officers to look solely for those text files containing child pornography, in context . . . the restrictions placed upon searches for image files also apply to the other types of files." Id. The court continued by noting that "although the language of the warrant may, on first glance, authorize a broad, unchanneled search through . . . document files, as a whole, its language more naturally instructs officers to search those files only for evidence related to child pornography." Id. (emphasis in original). Finally, the court held that "[i]n this light, the warrant should [be] . . . read by officers to implicitly place the same restriction on the scope of the entire search." Id.

That is very similar to what occurred in the instant case. Agent Hill testified that the search methodology that he employed to comb through the thousands of files contained on the defendant's hard drives was informed by the language of the search warrant, specifically the language of Attachment B. (Tr. At 81.) Thus, so long as he was only searching for evidence related to an alleged tax fraud, he was working within the scope of the warrant.

The defendant further argues that language in the search warrant concerning "Computers, Electronic Storage, and Forensic Analysis" is "open-ended" and is premised on "unparticularized speculation regarding conditions that might be met in any computer search." (Dkt. No. 52 at 12.) This aspect of defendant's overbreadth argument fails for several reasons. First, in United States v. Leary, 846 F.2d 592, 600 (10th Cir. 1988), the Tenth Circuit set out the general standard for evaluating the Fourth Amendment's particularity requirement. There, the Leary court explained:

A description is sufficiently particular when it enables the searcher to reasonably ascertain and identify the things authorized to be seized. Even a warrant that describes the items to be seized in broad or generic terms may be valid when the description is as specific as the circumstances and the nature of the activity under investigation permit.

In this case, Agent Hill averred in his affidavit that based on his training, experience and witness statements, it was possible computers would be found at the defendant's home. (Gov't Ex. 1 ¶ 3.) Based on Agent Hill's training and experience, if computers were found it was likely they contained records responsive to the warrant as defined with particularity in Attachment B. (Gov't Ex. 1 at 3, 24.) The affidavit contains a description of the various forms these records might take and the various analytical tools that may be required to search or view those items. While the methods may be broad, they are necessarily so because it is difficult (if not impossible) to predict what forms computer and digital evidence may take. Reading the "Items to be Seized" in context with the search methods, as the Brooks court held, restricts the entire warrant and satisfies the Fourth Amendment.

The defendant argues that the warrant should have contained a "scripted methodology" that would have prevented Agent Hill's search from exceeding the scope of the warrant. (Dkt. No. 52 at 17.) However, the Tenth Circuit has "never required warrants to contain a particularized computer search strategy." Brooks, 427 F.3d at 1251. The court finds the search warrant to be neither overbroad nor a general warrant. Rather, the warrant is specifically informed, narrowly constrained and consistent with Tenth Circuit law.

II. The seizure of documents from the defendant's hard drive was within the scope of the warrant; the search was conducted consistent with the terms of the warrant and the requirements of the law.

The defendant's next argument is that law enforcement's search of the computer hard drives was in "flagrant disregard" of the terms of the search warrant. (Dkt. No. 52 at 19.) The defendant also argues that the use of certain keywords, not specifically mentioned in the search warrant, uncovered evidence of wholly separate crimes for which no probable cause was given or separate warrant issued.

The defendant relies heavily on United States v. Carey, 172 F.3d 1268 (10th Cir. 1999). In Carey, law enforcement obtained a warrant to search a computer device for evidence of drug dealing. Id. at 1270. While searching the computer's hard drive, a detective discovered an image depicting child pornography. Id. at 1271. At that moment, the detective "abandoned his search for evidence of drug dealing" and initiated a new and separate search for child pornography. Id. at 1273. The Carey court held that this was an unlawful expansion of the search beyond the scope of the warrant, turning the search into an "unconstitutional general search." Id.

The defendant argues that, as in Carey, when agent Hill "expanded" his search to include the names "Winston Shrout" and "Michael Lavery" - neither of which was specified in the warrant - agent Hill exceeded the scope of the warrant. Additionally, when using those search terms caused agent Hill to discover evidence related to "mortgage remediation" - also not specifically mentioned in the search warrant - he should have sought a separate warrant pertaining to that "separate" crime.

The defendant's arguments are not persuasive because, unlike using the knowledge of child pornography to search for more child pornography (which exceeded the scope of the "drug" warrant in Carey), using the names "Winston Shrout" and "Michael Lavery" to search for evidence on the defendant's hard drives did not exceed the scope of the "1099-OID scheme" warrant in this case. Shrout and Lavery were involved in the OID scheme, and a search using their names was within the scope authorized by the search warrant.

Defendant argues that "mortgage remediation" is a separate crime from those referenced in the search warrant and, therefore, agent Hill should have obtained a separate warrant before seizing that evidence. The defendant errs, however, in failing to recognize that mortgage remediation is based on the same "redemption theory" that is the foundation of the 1099-OID scheme. Both schemes are an attempt by the individual to get money he or she is not entitled to through a scheme based on a conspiracy theory about banks, the monetary system, and the International Revenue Service. Mortgage remediation documents are not evidence of a separate crime, they are additional evidence of the same crime. Paragraph II of Attachment B to the search warrant reads in part:

All records used in or resulting from the preparation of [1099-OID income tax returns] . . ., and other pertinent documents relating to the preparation of federal income tax returns.

III. The subsequent review of documents required a separate warrant.

The initial search of defendant Wardle's computer hard drives was conducted over a period of months pursuant to the terms of the search warrant. (Tr. at 49.) Several months later, agent Hill was requested to "search" the defendant's hard drives for documents pertinent to Lavery for purposes of discovery in the case of United States v. Lavery. Agent Hill performed a "separate Lavery Discovery" search, and placed the documents in a new folder. (Tr. at 51) (emphasis added). Agent Hill was instructed to run the keyword search "Lavery" and, unlike the prior search, he was instructed not to look at the results or remove unresponsive documents. The requested search was "very different than the process that Agent Hill went through when he actually looked at each document and made an assessment to whether it was responsive." (Tr. at 73.) The government argues this was merely a subsequent search pursuant to the initial warrant. However, the search warrant did not authorize a search of defendant Wardle's hard drive for the purpose of obtaining documents related to a different individual in response to discovery obligations in a different case. Because the second search was clearly performed for a distinct purpose that was not authorized by the warrant, the court can not find that the search was proper.

CONCLUSION

The search of defendant's computer hard drives was done pursuant to a narrowly defined search warrant that contained an appropriate methodology for seizing and searching defendant's digital media. The search warrant defined with sufficient particularity the objects of the search and the items to be seized. The use of keywords such as "Lavery," "Shrout" and "mortgage remediation" did not constitute an unconstitutional expansion of the search, nor did it constitute a "flagrant disregard" for the terms of the warrant. A separate warrant was not necessary to search such keywords, as the related documents fall within the scope of the initial search warrant. Lastly, we find the "second" search of the defendant's hard drives for the purposes of discovery in Lavery was not authorized under the initial search warrant. Therefore, suppression of the evidence recovered from the second search is proper. For the reasons stated above, and in the government's memorandum in opposition (Dkt. No. 53), the defendant's motion to suppress is GRANTED IN PART AND DENIED IN PART,

IT IS SO ORDERED.

BY THE COURT:

________________

HONORABLE DEE BENSON

United States District Court Judge