Summary
denying two-step Google search warrant application as overbroad where although "the government promises to limit its search to the relevant date ranges, nothing in the proposed warrant precludes its agents from perusing other email content regardless how remote or how unrelated that content may be to the current investigation"
Summary of this case from In re Search Info. Associated with Four Redacted Gmail AccountsOpinion
Case No. 3:14–mj–00387 KFM.
03-03-2015
In the Matter of the SEARCH OF GOOGLE EMAIL ACCOUNTS IDENTIFIED IN ATTACHMENT A.
Kyle Frederick Reardon, U.S. Attorney's Office, Anchorage, AK, for Plaintiff.
Kyle Frederick Reardon, U.S. Attorney's Office, Anchorage, AK, for Plaintiff.
ORDER DENYING SEARCH WARRANT APPLICATION
KEVIN F. McCOY, United States Magistrate Judge.
I. Introduction
Before the Court is the government's ex parte search warrant application seeking compelled disclosure of all email content associated with six third-party Gmail accounts hosted by Google, Inc. (Google) pursuant to Rule 41 of the Federal Rules of Criminal Procedure and 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). The application is tendered in connection with an ongoing investigation into suspected sexual exploitation of children. The application represents the government's second attempt to seize the content of emails from these six third-party email accounts. This Court granted the government's first application authorizing the seizure of email content from these accounts based on the government's probable cause showing for the limited time periods set forth in the application. Google declined to comply with the search warrant.
Aff. ¶ 2.
Id.; see also 18 U.S.C. §§ 2251, 2252(a)(2), 2252A(a)(2), 2252(a)(4)(B), and 2252A(a)(5)(B) which outlaw the production, distribution, receipt and possession of visual depictions of minors engaging in sexually explicit conduct and child pornography; and 18 U.S.C. § 2422(b) which outlaws coercion or enticement of a minor to engage in prostitution.
Aff. ¶ 3.
Id.
The government's current search application followed Google's untested claim that it is incapable of producing the requested email content for the limited time periods set forth in the first warrant. Instead of challenging this assertion, the government now presents the current application which seeks the entire content of the six third-party Gmail accounts without the time period limitation contained in the first warrant. The new application does not explain why such broad search and seizure authority is reasonable under the circumstances of the case. And while the government promises to limit its search to the relevant date ranges, nothing in the proposed warrant precludes its agents from perusing other email content regardless how remote or how unrelated that content may be to the current investigation. Under these circumstances, Search Warrant Application 3:14–mj–00387–KFM must be denied as overbroad. This order will explain why this result is compelled by the Fourth Amendment. Because the order addresses matters related to an ongoing investigation, it has been drafted in a manner designed not to compromise that investigation.
Id.
Of course, the government remains free to seek an order compelling Google to comply with the earlier warrant provided it limits the request to email content for the narrowly defined periods relevant to the investigation of the six third-party Gmail accounts. Alternatively, the government can renew the instant application if it proffers to seal, without any review absent further court order, material supplied by Google that is outside the time period for which probable cause has been established. II. Background
In the Matter of the Search of Google Email Accounts Identified in Attachment A, 3:14–mj–00352–KFM.
Craigslist, a free online advertising website, has been used in the past to solicit sexual encounters with minors by targeting adults who have access to minors. A concerned citizen contacted law enforcement to report one such advertisement. The posting included a photograph of a minor that, while sexually suggestive to some, would not qualify as child pornography. Law enforcement promptly identified and interviewed the individual responsible for the advertisement. This individual acknowledged the posting, admitted that images of child pornography would be found on the computer used create the post, and confirmed an interest in sexual contact with children. The individual admitted using [REDACTED poster]@yahoo.com to post the advertisement and to correspond with those who replied to the advertisement. Law enforcement thereafter obtained a search warrant to seize the computer used both to post the advertisement and to correspond with those who responded to the advertisement. That computer remains in the custody of investigators.
Aff. ¶¶ 13, 14.
Aff. ¶ 12.
Aff. ¶ 16; see 18 U.S.C. § 2256(8) (defining child pornography).
Aff. ¶¶ 15, 17, and 20.
Aff. ¶ 20.
Aff. ¶ 20(g). Because this matter relates to an ongoing investigation the actual email address used by the poster has been redacted.
Aff. ¶ 21.
Id. The affidavit supporting the current application, as well as the affidavit supporting the first application, fails to indicate whether this computer has been forensically examined to reveal the content of the email correspondence between [REDACTED poster]@yahoo.com and any of the six Gmail accounts.
Next, a grand jury subpoena dispatched to Craigslist produced a number of similar postings by the same individual over a six month period. As before, the postings appeared to solicit sexual contact with children through adults with access to children. The subpoena also revealed the email addresses of those who corresponded with [REDACTED poster]@yahoo.com after the problematic advertisements were posted. However, the subpoena did not produce the content of these email communications or any photographs that may have accompanied them. This application, as did the earlier application, demonstrated that six third-party Gmail accounts hosted by Google corresponded or attempted to correspond with [REDACTED poster]@yahoo.com after two of the postings. Again, law enforcement knew precisely when the advertisements were posted, precisely when the emails were exchanged, and the email addresses that were used. The following two charts outline the origin, timing, and number of emails relating to the two postings at issue in this warrant application.
Aff. ¶ 23. In total, the individual appears to have posted six problematic advertisements purporting to seek unlawful sexual contact with minors.
Aff. ¶¶ 23(a), (b), (c), (e) and (f).
First Posting
| Gmail account | Outgoing emails | Incoming emails | Correspondence dates |
|---|---|---|---|
| [REDACTED 1]@Gmail.com | 14 emails to [REDACTED poster]@Yahoo.com | 11 emails from [REDACTED poster]@Yahoo.com | All on the day immediately following the posting. |
| [REDACTED 2]@Gmail.com | 1 email to [REDACTED poster]@Yahoo.com | No response from [REDACTED poster]@Yahoo.com | 21 days after the posting |
| Gmail account | Outgoing emails | Incoming Emails | Date Range |
|---|---|---|---|
| [REDACTED 3]@Gmail.com | 5 emails to [REDACTED poster]@yahoo.com | 4 emails from [REDACTED poster]@yahoo.com | All on the same day as the posting |
| [REDACTED 4]@Gmail.com | 1 email to [REACTED poster]@yahoo.com | No response from [REDACTED poster]@Yahoo.com | On the same day as the posting |
| [REDACTED 5]@Gmail.com | 1 email to [REACTED poster]@yahoo.com | No response from [REDACTED poster]@Yahoo.com | On the day after the posting |
| [REDACTED 6]@Gmail.com | 3 emails to [REDACTED poster]@yahoo.com | 1 email to [REDACTED poster]@yahoo.com | All on the day after the posting |
A. The First Search Warrant Application Was Granted
The original application sought judicial authorization to seize and search the six third-party Gmail accounts shown above for correspondence related to sexual misconduct with minors for specific time periods the government represented were directly relevant to its investigation of the two postings. The time periods were as follows:
| GMAIL ACCOUNT | SEARCH DATE RANGE | ||
|---|---|---|---|
Aff. ¶ 23(d)
Aff., Attachment B, pg. 3.
Aff. ¶ 23(d).
Aff., Attachment B, pg. 3.
Aff.¶ 23(e).
Aff., Attachment B, pg. 3.
Aff. ¶ 23(e).
Aff., Attachment B, pg. 3.
Aff. ¶ 23(e).
Aff., Attachment B, pg. 3.
Aff. ¶ 23(e).
Aff., Attachment B, pg. 3.
Aff. ¶ 23(d)
Aff., Attachment B, pg. 3.
Aff. ¶ 23(d).
Aff., Attachment B, pg. 3.
Aff.¶ 23(e).
Aff., Attachment B, pg. 3.
Aff. ¶ 23(e).
Aff., Attachment B, pg. 3.
Aff. ¶ 23(e).
Aff., Attachment B, pg. 3.
Aff. ¶ 23(e).
Aff., Attachment B, pg. 3.
Because the request was for the limited time periods that were supported by probable cause—namely, these periods corresponded to the same time these accounts had been used to contact the problematic Craigslist advertisement—and because the application otherwise comported with the Fourth Amendment particularity requirement, this Court granted the first application and authorized the government to seize email content from the six third-party Gmail accounts from Google for the requested time periods. However, when the warrant was served Google unilaterally declined to turn over the requested information from the accounts, apparently claiming an inability to comply with the date range limitation set forth in the warrant. In particular, Google asserted:
In the Matter of the Search of Google Email Accounts Identified in Attachment A, 3:14–mj–00352–KFM.
Aff. ¶ 24
We have received your Search Warrant and after evaluating the items to be seized, we have determined that Google is not capable of identifying the specific records responsive to your request as currently described in the warrant. Because our production must adhere to the stated limits of the warrant, and we are unable to do so in this case, we require amended or re-issued process.
Id.
Id.
Rather than seek an order compelling Google to comply with the original warrant, the government presented the Court with a second application. The agent explained that “Google was unable to comply with the warrant as written because the time frame was too narrow,” “Google is unable or unwilling to parse individual accounts for” the specific emails, and “Google typically provide[s] broad ranges of information and place[s] the burden on the law enforcement officer searching the information to stay within the parameters of the warrant.”
Aff. ¶ 24
B. The Second Search Warrant Application Eliminates Any Date–Range Limitation
The current application seeks judicial authorization to seize the entire contents of the six third-party Gmail accounts, described as follow:
Aff., Attachment B, ¶ 3.
[T]he contents of electronic or wire communications held in the SUBJECT ACCOUNTS, including:
a) all electronic or wire communications with a minor or any person purporting to be a minor, or claiming to have access to a minor, or that otherwise involve the enticement of a minor to engage in sexual activity for which any person can be charged with a criminal offense (including email text, attachments, and imbedded files) in electronic storage by the PROVIDER, or held by the PROVIDER as a remote computing service (if any), within the meaning of Stored Communications Act;
b) all photos, files, data, or information in whatever form and by whatever means they have been created or stored relating to a minor, or individuals claiming to have access to a minor, or otherwise involve the enticement of a minor to engage in sexual activity for which any person can be charged with a criminal offense.
Aff., Attachment B, ¶ 3.
Aff., Attachment B, ¶ 3.
Once the government obtains the entirety of the email accounts from Gmail, it represents that it will only seize evidence from those accounts within the date ranges reflected in the first search warrant—i.e., the time periods that correspond to when these accounts were used to contact the problematic Craigslist advertisement.
Aff., Attachment B, ¶ 4.
In other words, the government's second warrant requests authorization to seize the six third-party Gmail accounts in their entirety.
Once the contents of the accounts are in its possession, the government appears to promise not to look at any emails outside the applicable date ranges. However, the warrant would not limit its ability to search the entirety of the Gmail accounts as the proposed warrant plainly authorizes the inspection of all email content in the accounts without regard to how remote in time or unrelated that content is to the current investigation.
Under these circumstances, the present application must be denied as overbroad.
III. Discussion
A. The Applicable Law
The Stored Communications Act of 1986 authorizes the government to obtain the “contents of electronic communication” that are in electronic storage in “an electronic communications system” pursuant to a search warrant under the Federal Rules of Criminal Procedure. Google, by hosting Gmail, qualifies as an electronic communication system that holds the “contents of electronic communication” in “electronic storage.” The Fourth Amendment provides that “no warrants shall issue, but upon probable cause, supported by oath or affirmation, particularly describing the place to be searched and the persons or things to be seized.”
18 U.S.C. §§ 2701 –2712.
U.S. Const. Amend. IV.
It is a bedrock principle of Fourth Amendment law that “a magistrate may authorize a search of a location only if officers establish probable cause to believe evidence of a crime may be found there.” Probable cause means “there is a fair probability that contraband or evidence of a crime will be found in a particular place.”
United States v. Hill, 459 F.3d 966, 970 (9th Cir.2006).
United States v. Needham, 718 F.3d 1190, 1194 (9th Cir.2013) (quoting Illinois v. Gates, 462 U.S., 213, 238, 103 S.Ct. 2317, 76 L.Ed.2d 527 (1983) ).
The Fourth Amendment also requires that search warrants describe items to be seized and the premises or persons to be searched with sufficient particularity. This requirement ensures that search warrants do not take on the character of a wide-ranging exploratory “general warrant,” forbidden by the Fourth Amendment. The particularity requirement bars overbroad search warrants. “ ‘Breadth deals with the requirement that the scope of the warrant be limited by the probable cause on which the warrant is based.’ ” Stated another way, overbreadth is a tailoring question: does the proposed warrant limit the government's search to the specific places that must be inspected to confirm or dispel the suspicion that gave rise to probable cause? The rise of personal computing and networking has heightened the risk of overbroad warrants. After all, when the government seeks to search electronic data for evidence of a crimes on a personal computer, how data is stored and how it can be hidden or disguised generally requires that the government search all of the files:
Payton v. New York, 445 U.S. 573, 584 n. 21, 100 S.Ct. 1371, 63 L.Ed.2d 639 (1980) (retracing the roots of the particularity requirement to the colonialists' objections to the writs of assistance); United States v. Nafzger, 965 F.2d 213, 214 (7th Cir.1992).
Hill, 459 F.3d at 973 (quoting United States v. Towne, 997 F.2d 537, 544 (9th Cir.1993) ).
Maryland v. Garrison, 480 U.S. 79, 84, 107 S.Ct. 1013, 94 L.Ed.2d 72 (1987) (“By limiting the authorization to search to the specific areas and things for which there is probable cause to search, the requirement ensures that the search will be carefully tailored to its justifications, and will not take on the character of the wire-ranging exploratory searches the Framers intended to prohibit.”) (emphasis added); see also United States v. Cardwell, 680 F.2d 75, 78 (9th Cir.1982) ; Wayne R. LaFave, Search and Seizure: A Treatise on the Fourth Amendment § 3.7(d) at 546 (West, 5th ed.2012) (describing overbreadth as the “object-place nexus” issue, and noting that the problem arises when a search warrant describes “the place be searched in broader terms than is justified by the probable cause showing in the affidavit.”).
This pressing need of law enforcement for broad authorization to examine electronic records ... creates a serious risk that every warrant for electronic information will become, in effect, a general warrant, rendering the Fourth Amendment irrelevant. The problem can be stated very simply: There is no way to be sure exactly what an electronic file contains without somehow examining its contents—either by opening it and looking, using specialized forensic software, keyword searching or some other such technique. But electronic files are generally found on media that also contain thousands or millions of other files among which the sought-after data may be stored or concealed. By necessity, government efforts to locate particular files will require examining a great many other files to exclude the possibility that the sought-after data are concealed there.
United States v. Comprehensive Drug Testing, Inc., 621 F.3d 1162, 1176 (9th Cir.2010) (en banc) (per curiam).
United States v. Comprehensive Drug Testing, Inc., 621 F.3d 1162, 1176 (9th Cir.2010) (en banc) (per curiam).
Thus, the reality is that “over-seizing is an inherent part of the electronic search process” that will be “far more common than in the days of paper records.”
Id. at 1177.
This inherent over-seizure necessarily risks over-searching. In constitutional terms, the balancing of the interests of personal privacy with the government's need to investigate criminal conduct in the information age boils down to this important question: does permitting unrestricted access to over-seized data improperly bring constitutionally protected data within the plain view exception of the warrant requirement and transform electronic data search warrants into general warrants?
Id. at 1176.
United States v. Schesso, 730 F.3d 1040, 1047 (9th Cir.2013) (citing Comprehensive Drug Testing, Inc., 621 F.3d at 1171 ).
The answer depends on whether, given the facts of a particular case, over-seizure/over-searching can be avoided. To ensure that Fourth Amendment principles are carried forward into the information age, the Ninth Circuit has admonished judicial officers to be vigilant
in striking the right balance between the government's interest in law enforcement and the right of individuals to be free from unreasonable searches and seizures. The process of segregating electronic data that is seizable from that which is not must not become a vehicle for the government to gain access to data which it has not probable cause to collect.
Comprehensive Drug Testing, Inc., 621 F.3d at 1177.
Comprehensive Drug Testing, Inc., 621 F.3d at 1177.
Thus, simply because over-seizure and over-searching is a risk in electronically-stored-data search cases does not authorize “an automatic blank check when seeking or executing warrants.”
Hill, 459 F.3d at 975.
Although computer technology may in theory justify blanket seizures ..., the government must still demonstrate to the magistrate factually why such a broad search and seizure authority is
reasonable in the case at hand. There may be situations where the government has no basis for believing that a computer search would involve this kind of technological problems that would make an immediate onsite search and selective removal of relevant evidence impracticable. Thus, there must be some threshold showing before the government may “seize the haystack to look for the needle.”
Id. (emphasis in original).
Id. (emphasis in original).
With the Fourth Amendment's principles and the Ninth Circuit's admonishment to curb over-seizure/over-searching when possible in mind, the Court turns to the warrant request in this case.
B. Application
This case well-illustrates the tensions addressed above, as it involves a probable-cause showing by the government that implicates only a few email transactions, yet the government seeks to obtain the Gmail email accounts in their entirety. As noted above, probable cause exists when “there is a fair probability that contraband or evidence of a crime will be found in a particular place.” Here, a grand jury subpoena revealed that the six subject Gmail accounts responded to a Craigslist advertisement that solicited sexual encounters with underage girls. The government seeks to confirm or dispel its suspicions that the users of the six Gmail accounts were interested in unlawful sexual contact with minors. Based on this record, the Court concludes that there is probable cause to believe that these email responses to the advertisement contain evidence of a crime—namely, that there was a fair probability that these responses show an interest in the illegal conduct solicited in the Craigslist advertisement.
Needham, 718 F.3d at 1194 (quoting Gates, 462 U.S at 238, 103 S.Ct. 2317 ).
However, the scope of the government's authority to search and seize under the warrant is not tailored to its probable cause showing. A warrant is overbroad if it expands the scope of the government's search beyond the places implicated by the probable-cause showing. Here, the warrant sought by the government is overbroad because it would authorize the government to seize and search the entirety of the six Gmail accounts, even though the government has only established probable cause to look at a small number of emails within a narrow date range.
Hill, 459 F.3d at 973 (quoting Towne, 997 F.2d at 544 ).
In this instance, the government knows the precise dates the problematic advertisements were posted, the precise dates of the email correspondence relating to the problematic advertisements, and the individual email addresses that were used to send and receive the correspondence. This is not a case where the government has established that evidence a crime lurks somewhere on a computer or third-party network, and law enforcement has a legitimate need “to scoop up large quantities of data, sift through it, carefully for concealed or disguised pieces of evidence....” Rather, this is an electronic-data case where the government has established probable cause that a specific date range of email communications may contain evidence of a crime. There has been absolutely no showing that the remaining balance of the email accounts would have any bearing on the investigation.
Comprehensive Drug Testing, Inc., 621 F.3d at 1176 (citing Hill, 459 F.3d 966 ); see also Schesso, 730 F.3d at 1045–46 (“There is no question that there was probable cause to believe that Schesso possessed the particular child pornography video uploaded to eDonkey in October 2008. Given the circumstances of that upload and the information supplied in the warrant application, the state court judge permissibly drew the ‘reasonable inference’ that there was probable cause to believe Schesso had other child pornography materials as well.”).
The facts of this case well-illustrate the troubling implications to Fourth Amendment jurisprudence of allowing the government to seize and inspect a person's entire email account. The warrant application establishes that three of the Gmail accounts each sent multiple emails to the Yahoo account that were responded to by the Yahoo account. But the application also showed that the other three Gmail accounts each sent only one email to the Yahoo account and never got a response. Common sense dictates that a prolonged back-and-forth conversation between the poster of the advertisement and a viewer of the advertisement may present a situation where both parties are comfortable with the posting and they are negotiating further details. By contrast, the probable cause calculus for the three Gmail accounts sending only a single email without any response is a closer question. Indeed, single email sent by a viewer of the advertisement that does not receive a response from the poster may simply reflect a situation where the viewer was uncomfortable with the advertisement and elected to contact the poster to voice disapproval and/or to demand the its removal. Regardless, given the gravity of the offense at issue (sexual exploitation of minors) and the manner by which Craigslist is accessed (someone has to purposefully navigate to the personal sections of the website), the Court concludes that there was a fair probability that these particular communications may contain evidence of a crime.
Based on these probable-cause conclusions, a narrow intrusion into the email accounts is warranted. But the present application goes well beyond the narrow intrusion justified by the probable cause showing. It seeks judicial authorization to seize and then search the entire content of the six third-party Gmail accounts with no justification other than that Google has unilaterally elected not to comply.
Additionally, the government lawfully seized the computer used to post the two Craigslist advertisements. There is no indication that the content of the correspondence from the six Gmail accounts responding to the advertisements could not be recovered from that computer.
Under these circumstances, the present application must be denied as overbroad because its request to seize and search the six Gmail accounts in their entirety is not tailored to its narrow probable cause showing for the limited time periods approved in the first warrant.
IV. Conclusion
For all these reasons, Search Warrant Application 3:14–mj–0387–KFM is denied. However, the Court's denial is without prejudice. The Court well-appreciates that the government is in a difficult position. It has shown probable cause for a narrow range of email communications, but Google has advised that it cannot or will not provide this narrow selection of data. Consistent with the Ninth Circuit's admonishment for “greater vigilance ... in striking the right balance between the government's interest in law enforcement and the right of individuals to be free from unreasonable searches and seizures” and with the understanding that Google has claimed that it cannot or will not provide emails from only the narrow date ranges sought, the Court reiterates that the government has two alternative avenues through which to seize and search the sought-after emails. First, the government remains free to seek an order compelling Google to comply with the earlier warrant provided it limits the request to email content for the narrowly defined periods relevant to the investigation of the six third-party Gmail accounts. Alternatively, the government can renew the instant application provided it proffers to seal, without any review absent further court order, material supplied by Google that is outside the time period for which probable cause has been established.
Comprehensive Drug Testing, Inc., 621 F.3d at 1177.
In the Matter of the Search of Google Email Accounts Identified in Attachment A, 3:14–mj–00352–KFM.
See e.g. In re the Search of Information Associated with [redacted]@mac.com that is Stored at Premises Controlled by Apple, Inc., 13 F.Supp.3d 157, 161 (D.D.C.2014) (“Attachment C to the government's revised application included the specific procedures for executing the search warrant wherein the government would first conduct a search of the e-mails produced by the Provider and determine which are within the scope of the information to be seized specified in Attachment B, and then copy and retain those emails that are within the scope of Attachment B. Law enforcement personnel would then seal any information from Apple that does not fall within the scope of Attachment B. and would be prohibited from further review [of] the information absent an order of the Court.”) (internal citations omitted).
--------