Opinion
CRIMINAL 3:21-cr-00004-TCB-RGV
10-25-2023
UNITED STATES OF AMERICA v. ROBERT PURBECK
MAGISTRATE JUDGE'S REPORT, RECOMMENDATION, AND ORDER
Defendant Robert Purbeck (“Purbeck”) is charged in an eleven-count indictment with computer fraud and abuse, in violation of 18 U.S.C. §§ 1030(a)(2)(C), 1030(a)(7)(B), 1030(c)(2)(B)(i), 1030(c)(2)(B)(iii), 1030(c)(3)(A), and 2; wire fraud, in violation of 18 U.S.C. §§ 1343 and 2; and access device fraud, in violation of 18 U.S.C. §§ 1029(a)(2), 1029(c)(1)(A)(i), and 2. [Doc. 1]. Purbeck has filed a motion for leave to file a supplemental motion to suppress, [Doc. 97], which the government opposes, [Doc. 102], and he also moves to suppress evidence obtained as a result of a recent search of two iPhones, [Doc. 99], which the government initially opposed, [Doc. 101], but subsequently indicated that it will not use the evidence obtained from either of the phones in its case in chief at trial, [Doc. 107-1]. For the reasons that follow, it is RECOMMENDED that Purbeck's motion for leave to file a supplemental motion to suppress, [Doc. 97], be DENIED, and that his motion to suppress evidence obtained from the recent search of two iPhones, [Doc. 99], be DENIED AS MOOT.
The listed document and page numbers in citations to the record refer to the document and page numbers shown on the Adobe file reader linked to the Court's electronic filing database, CM/ECF.
Purbeck's motion for leave to file the motion to suppress evidence obtained as a result of the search of two cellular telephones, [Doc. 95], which was not opposed by the government, was granted during the telephone conference held on August 2, 2023, see [Doc. 98], and the Court directed the Clerk to file the motion on the docket, [id.]; see also [Doc. 99]. However, Purbeck's motion for leave to file a supplemental motion to suppress regarding the search and seizures arising out of the August 21, 2019, search of Purbeck's residence, [Doc. 97], was taken under advisement and the Court set a briefing schedule as to both the motion to suppress the 2023 searches of the two iPhones and the motion for leave to file a supplemental motion to suppress related to the search and seizures of evidence from his residence, see [Doc. 98].
On October 11, 2023, the government filed an unopposed motion for leave to file a sur-reply to Purbeck's reply brief, [Doc. 107], and although “[n]either the Federal Rules nor the Court's Local Rules allow sur-reply briefs as a matter of right, and the Court normally does not permit sur-replies,” USMoney Source, Inc . v. Am. Int'l Specialty Lines Ins. Co., No. 1:07-cv-0682-WSD, 2008 WL 160709, at *2 n.5 (N.D.Ga. Jan. 15, 2008) (citation omitted), rev'd on other grounds, 288 Fed.Appx. 558 (11th Cir. 2008) (per curiam) (unpublished); see also Leatherwood v. Anna's Linens Co., 384 Fed.Appx. 853, 857 (11th Cir. 2010) (per curiam) (unpublished) (citation omitted), “the Court may in its discretion permit the filing of a surreply . . . where a valid reason for such additional briefing exists,” Fedrick v. Mercedes-Benz USA, LLC, 366 F.Supp.2d 1190, 1197 (N.D.Ga. 2005) (citation omitted). The government seeks leave to file a sur-reply to “correct the record,” and it has indicated that Purbeck “does not oppose [the] motion.” [Doc. 107 at 1]. Accordingly, the government's motion for leave to file a sur-reply, [Doc. 107], is GRANTED, and the Court will consider the sur-reply brief, [Doc. 107-1], contained within the government's motion, in ruling on the pending motion to suppress the evidence obtained from the search of two iPhones, [Doc. 99].
I. PROCEDURAL AND FACTUAL BACKGROUND
On March 2, 2021, a federal grand jury in the Northern District of Georgia returned an indictment against Purbeck, a resident of Meridian, Idaho, charging him with computer fraud and abuse, wire fraud, and access device fraud in connection with a series of computer breaches involving medical practices in Griffin, Georgia, and Locust Grove, Georgia; the government of the City of Newnan, Georgia; and an orthodontist in Wellington, Florida. See [Doc. 1]. In particular, the indictment alleges that from June 2017 until about June 2018, Purbeck purchased access credentials, including usernames and passwords, on a criminal marketplace and then later used these stolen access credentials to access the victims' protected computers without authorization to do so and steal medical records, police reports, and other documents containing sensitive personally identifying information. [Id. at 2-4 ¶¶ 7-14]. The indictment also alleges that in July 2018, Purbeck harassed the orthodontist in Wellington, Florida, and threatened to disclose and sell the stolen patient files unless he paid a ransom demand and that he also allegedly identified the names and social security numbers of the orthodontist's minor children and threatened to disclose and sell their personal information. [Id. at 4 ¶¶ 15-16].
Based on these factual allegations, the indictment specifically charges in Counts One through Three that Purbeck, who was also known as “Lifelock,”
“Studmaster,” and “Studmaster1,” intentionally accessed protected computers of the Griffin, Georgia, medical clinic on June 25, 2017; the City of Newnan, Georgia, on February 9, 2018; and the Locust Grove, Georgia, medical practice on April 28, 2018, without authorization, and obtained personally identifying information, including names, addresses, birth dates, and social security numbers, for commercial advantage and private financial gain, in violation of 18 U.S.C. §§ 1030(a)(2)(C), 1030(c)(2)(B)(i), 1030(C)(2)(B)(iii), and 2. [Id. at 5-6 ¶¶ 17-18]. Count Four charges that on or about June 18, 2018, and continuing through about July 9, 2018, Purbeck, with the intent to extort money and other things of value, including funds in Bitcoin, from the orthodontist in Florida, transmitted in interstate and foreign commerce, including this district, a “communication containing a threat to obtain information from a protected computer without authorization and to impair the confidentiality of information obtained from a protected computer without authorization,” in violation of 18 U.S.C. §§ 1030(a)(7)(B), 1030(c)(3)(A), and 2. [Id. at 6 ¶¶ 19-20]. Counts Five through Eight charge that Purbeck, having knowingly devised a scheme to defraud and obtain money and property under false pretenses, caused the transmission of wire communications to each of the four victims from “Meridian, Idaho, to computer servers located in the Northern District of Georgia,” for the purpose of executing his scheme, in violation of 18 U.S.C. §§ 1343 and 2. [Id. at 6-7 ¶¶ 21-22]. Finally, Counts Nine through Eleven charge that Purbeck, knowingly and with the intent to defraud, used and trafficked unauthorized access devices of the two medical practices in Georgia and the City of Newnan, in violation of 18 U.S.C. §§ 1029(a)(2), 1029(c)(1)(A)(i), and 2. [Id. at 7-8 ¶¶ 23-24].
On August 19, 2019, Atlanta-based Federal Bureau of Investigation (“FBI”) Special Agent Roderick Coffin (“Agent Coffin”) submitted to the Honorable Ronald E. Bush, Chief United States Magistrate Judge of the United States District Court for the District of Idaho, an affidavit and application for a search warrant for Purbeck's residence in Meridian, Idaho, based on the FBI's identification of Purbeck, an Information Technology professional employed by Ada County, Idaho, as an individual suspected of being involved in a series of computer intrusion attacks. See [Doc. 41-2]. In addition to Agent Coffin's affidavit, Judge Bush asked Agent Coffin questions in open court to obtain further information with respect to several paragraphs in his affidavit. See [Doc. 42]. After receiving this oral testimony from Agent Coffin, Judge Bush signed the search warrant for the residence on August 19, 2019. See [Docs. 41-2 & 42]; see also [Doc. 28-6]. The search warrant authorized the seizure of “[e]vidence, instrumentalities, fruits and contraband concerning violations of 18 U.S.C. §§ 1343 and 1349 (conspiracy to commit wire fraud) 1956(a) and (h) (laundering of monetary instruments), 18 U.S.C. § 1030 (computer fraud and abuse), and 18 U.S.C. § 875 (extortion),” including various records related to the alleged criminal offenses; routers, modems, and network equipment used to connect computers to the internet; computers, mobile communication devices, and storage media used as a means to commit the violations; and passwords, encryption keys, and other access devices that may be necessary to access computers, among other items such as “evidence indicating the [computer] user's state of mind as it relates to the crime under investigation]” [Doc. 41-2 at 1, 28-33]; see also [id. at 20-26 ¶¶ 64-70]. On August 21, 2019, law enforcement agents, including Agent Coffin, executed the search warrant and seized computer equipment, electronic storage devices, cell phones, financial documents, and other items and also provided Purbeck a copy of the front page of the search warrant and a handwritten inventory of items seized from the residence. [Doc. 38 at 4]; see also [Doc. 41-2; Doc. 76 at 6-10, 16, 25, 65, 74, 11314, 142, 187, 198-99; Doc. 77 at 39, 42, 47, 59].
During the course of the execution of the warrant, the agents interviewed Purbeck about, among other things, the hacking victims and the computers inside his residence, and Purbeck identified which computer and external hard drive he had used for hacking activities and explained that they were password-protected by VeraCrypt, a type of encryption software. [Doc. 76 at 34, 71]. He also agreed to provide passwords for certain encrypted devices and consented to the FBI assuming his online identities and gaining access to multiple email accounts, and he provided his account names and passwords, which were recorded on a form. [Id. at 34-37, 73, 101, 174; Doc. 77 at 170-71].
On December 13, 2021, Purbeck filed several pretrial motions, including motions to suppress statements and password disclosures, motions to suppress the search and seizure of evidence from his residence and from email searches, as well as a motion to dismiss for lack of venue. [Docs. 25, 26, 27, 30]. Purbeck amended his motions to suppress on January 14, 2022, [Docs. 38 & 39], and on September 1 and 2, 2022, an evidentiary hearing was held on Purbeck's motion to suppress statements and password disclosures, see [Docs. 76 & 77]. On February 13, 2023, Purbeck filed his post-hearing brief, [Doc. 80], to which the government responded on March 15, 2023, [Doc. 82], and Purbeck filed a reply on April 11, 2023, [Doc. 85]. On May 18, 2023, a Report, Recommendation, and Order, was issued recommending that Purbeck's motions to suppress and motion to dismiss be denied, [Doc. 87], which the Honorable Timothy C. Batten, Sr., Chief United States District Judge for the Northern District of Georgia, adopted on July 26, 2023, [Doc. 96], after consideration of the objections Purbeck filed on June 26, 2023, [Doc. 92].
In particular, Purbeck moved to suppress evidence obtained from the August 21, 2019, search of his residence in Meridian, Idaho, [Docs. 26 & 38], arguing that evidence obtained following the search of his residence and seizure of various items pursuant to the search warrant issued on August 19, 2019, should be suppressed on a number of grounds, including: (1) the agents “did not have and/or did not show or leave with [] Purbeck the search warrant affidavit and/or any other information describing either the place to be searched or the items to be seized”; (2) “the search warrant was based on illegally-obtained probable cause, the unreliable allegations of a confidential informant, and contained false and/or omitted material statements that were intentionally or recklessly included or left out, and removing the offending portions results in a warrant that is not based on probable cause”; (3) “the search warrant was overbroad and did not meet the Fourth Amendment's particularity requirement”; (4) the agents “seized far more than what was authorized under the warrant”; and (5) “the information presented to the magistrate judge in 2019 concerned events in 2016-2017 and thus was stale, precluding probable cause,” [Doc. 38 at 2-3 (footnote and citation omitted)]. Additionally, on January 13, 2022, the government notified Purbeck that it recently had been able to decrypt one of his computers that was seized during the execution of the August 21, 2019, residential search warrant, and this computer was searched pursuant to that residential warrant, see [Doc. 44 at 5], and Purbeck argued that the search of his computer on January 13, 2022, should be suppressed for all the reasons related to the residential search warrant, as well as its untimeliness, [Doc. 39 at 20].
The May 18, 2023, Report, Recommendation, and Order explained, among other things, that because “Rule 41(e)(2)(B) specifically authorizes ‘the seizure of electronic storage media or the seizure or copying of electronically stored information,' and ‘[u]nless otherwise specified, the warrant authorizes a later review of the media or information consistent with the warrant,'” and “further provides that the time for executing such a warrant ‘refers to the seizure or on-site copying of the media or information, and not to any later off-site copying or review,'” and the “residential warrant [at issue] did not place a time limit on the off-site copying and review of the records obtained pursuant to the warrant,” the “search of Purbeck's computer on January 13, 2022, was timely.” [Doc. 87 at 12728 n. 50 (citations omitted)].
On July 20, 2023, Purbeck filed a motion for leave to file a motion to suppress evidence obtained from the recent search of two iPhones, [Doc. 95], and on July 26, 2023, he filed a motion for leave to file a supplemental motion to suppress evidence obtained as a result of searches of computers, phones, hard drives, and storage devices that were seized pursuant to the August 21, 2019, search warrant for his residence, [Doc. 97]. Following a telephone conference on August 2, 2023, during which the Court granted Purbeck's motion for leave to file the motion to suppress the evidence obtained from the recent search of the two iPhones, [Doc. 95]; see [Doc. 98], Purbeck's motion to suppress the searches of the two iPhones was filed on the docket, [Doc. 99]. On September 7, 2023, the government filed responses to Purbeck's motions, [Docs. 101 & 102], and Purbeck filed replies in support of each of his motions, [Docs. 104 & 106]. The government filed a sur-reply to Purbeck's motion to suppress the evidence obtained from the search of the two iPhones, [Doc. 107-1], and Purbeck's pending motions, [Docs. 97 & 99], are now ripe for ruling.
In particular, Purbeck explains that on June 22, 2023, the government advised him that “it had recently searched and extracted the data from two phones belonging to him, which phones were seized on August 21, 2019[,] as part of the search of his residence.” [Doc. 95 at 1]; see also [Doc. 101 at 5]. On July 7, 2023, the government provided Purbeck “forensic images of the iPhones” on a hard drive. [Doc. 95 at 1-2; Doc. 101 at 5].
II. DISCUSSION
A. Purbeck's Motion for Leave to File a Supplemental Motion to Suppress, [Doc. 97]
After the time for filing pretrial motions had passed and the Court ruled on the various pretrial motions that had been filed, Purbeck filed a motion for leave to file a supplemental motion to suppress, [Doc. 97], explaining that “[t]his supplemental motion would supplement the motion to suppress that he [] previously filed, which the [] Court has already denied,” [id. at 1]. In particular Purbeck asserts that the Eleventh Circuit's decision in United States v. Vedrine, No. 20-13259, No. 21-13624, 2022 WL 17259152 (11th Cir. Nov. 29, 2022) (per curiam), renders illegal the government's searches of his electronic devices seized from his residence during the execution of a search warrant on August 21, 2019, that occurred more than fourteen days after the August 19, 2019, search warrant was signed. [Doc. 97-1 at 1-2]. In response, the government contends that the Court “should deny Purbeck's motion as untimely filed without good cause.” [Doc. 102 at 1]. The Court will address the timeliness of Purbeck's motion, as well as its merits, in turn.
Purbeck points out that the discovery that has been produced by the government shows that between August 27 and August 28, 2019, “law enforcement extracted the data from the Seagate Tower . . . that it seized on August 21, 2019 and placed that extracted data on hard drives,” but that it appears that “law enforcement wiped that extracted information clean on or about September 17-18, 2019,” which error law enforcement discovered on October 3, 2019, and then waited until February 13, 2020, to reimage the Seagate Tower, which was “well after the time authorized by the original search warrant and without getting a new warrant.” [Doc. 97-1 at 3-4 (citations omitted)]. He also asserts that the government “extracted data from other devices . . . well after the 14 days,” and points out that on October 3, 2019, “the government extracted [] data from an ‘HP Laptop Elite Book' . . . that [it] seized . . . on August 21, 2019”; that on the same day, the government “imaged the data from a[n] ‘HP Z240 Tower S/N ZVA6060RF1' . . . that [it] seized on August 21, 2019,” and that the government “imaged the data from that same HP Tower again on August 12, 2021”; that on June 25, 2021, the government “imaged a ‘Mac Book Pro S/N C02JKT67D853' . . . that it seized . . . on August 21, 2019”; and that on June 28, 2021, the government “sought assistance from an FBI computer scientist to image a whole series of computers, hard-drives, and external storage devices,” all of which Purbeck maintains “were well outside of the legal time for extracting the data from these devices using the authority granted by the August 19, 20[19] search warrant issued by the federal court in Idaho.” [Id. at 4-5 (citations omitted)].
Pursuant to Federal Rule of Criminal Procedure 12(c), “[t]he court may . . . set a deadline for the parties to make pretrial motions,” and “[i]f a party does not meet the deadline for making a Rule 12(b)(3) motion, the motion is untimely.” Fed. R. Crim. P. 12(c)(1), (3); see also LCrR 12.1(B), NDGa. (“Motions filed in criminal proceedings shall be filed with the clerk within fourteen (14) days after arraignment. A magistrate judge may for good cause extend the filing time for one fourteen (14)-day period.”). “A defendant who fails to file his motion within the deadlines set by the court waives his right to assert this motion,” but “this waiver may be excused for good cause.” United States v. Atkins, 702 Fed.Appx. 890, 894 (11th Cir. 2017) (per curiam) (unpublished) (alterations, citations, and internal marks omitted); see also United States v. Lawrence, CRIMINAL ACTION NO. 1:17-cr-00126-LMM-CMS, 2019 WL 3006620, at *1 (N.D.Ga. Mar. 14, 2019) (citations omitted), adopted by 2019 WL 2184818, at *3 (N.D.Ga. May 21, 2019); United States v. Petite, CRIMINAL NO. 16-00161-CG-B, 2017 WL 1352223, at *1 (S.D. Ala. Apr. 7, 2017) (citation and internal marks omitted) (“Good cause is a flexible standard that requires consideration of all interests in the particular case.”). However, “[a] defendant does not have good cause warranting relief from waiver when he had all the information necessary to bring a 12(b) motion before the date set for pretrial motions.” United States v. Searcy, 278 Fed.Appx. 979, 981 (11th Cir. 2008) (per curiam) (unpublished) (citation omitted).
On October 7, 2021, the Court ordered that the parties file pretrial motions by December 13, 2021, see [Doc. 24], and on that date, Purbeck filed several pretrial motions, see [Docs. 25, 26, 27, 29]. Following a pretrial conference, the Court provided Purbeck until January 14, 2022, to file additional motions based on supplemental discovery, see [Doc. 36], and on January 14, 2022, he filed amended motions to suppress, see [Docs. 38 & 39], and on September 1 and September 2, 2022, the Court held an evidentiary hearing on Purbeck's motion to suppress statements, see [Docs. 64, 65, 76, & 77]. Following the evidentiary hearing, Purbeck filed a post-hearing brief on his motion to suppress statements on February 13, 2023, [Doc. 80], the government filed its response on March 15, 2023, [Doc. 82], and Purbeck filed a reply on April 11, 2023, [Doc. 85]. A Report, Recommendation, and Order was issued on May 18, 2023, [Doc. 87], recommending that Purbeck's motions to suppress and motion to dismiss, [Docs. 25, 26, 27, 30, 38, & 39], be denied, and on June 26, 2023, Purbeck filed his objections to the Report, Recommendation, and Order, see [Doc. 92], and on July 20, 2023, he also filed a motion for leave to file a motion to suppress evidence obtained as a result of the recent search of two iPhones, [Doc. 95]. On July 26, 2023, Judge Batten adopted the May 18, 2023, Report, Recommendation, and Order, but decertified the case as ready for trial and referred Purbeck's motion for leave to file the motion to suppress evidence obtained as a result of the search of two cellular telephones, [Doc. 95], to the undersigned for consideration, see [Doc. 96]. On that same day, Purbeck then filed his motion for leave to file a supplemental motion to suppress. [Doc. 97].
In his motion for leave to file a supplemental motion to suppress, [id.], Purbeck maintains that because the government “did not seize and extract the contents of any of the devices it seized from [ his residence] on August 21, 2019 within the 14 days of the date the search warrant was issued (September 2, 2019), much less by August 30, 2019[,] the time set by the judge who issued the search warrant for [ his] home,” under the Eleventh Circuit's decision in Vedrine, issued on November 29, 2022, the government's “extraction of data more than 14 days following the issuance of the search warrant [was] unreasonable, violates Rule 41, violates the terms of the search warrant, and violates the Fourth Amendment.” [Doc. 97-1 at 6-7]. He therefore requests “leave of Court to file a supplemental motion to supplement his motion to suppress the searches and seizures arising from his home to raise the issue of the government's failure to timely extract the data from his computers, hard-drives, phones, storage devices, whatever medium on which the data was stored,” all of which he contends “were illegal under the Eleventh Circuit's 2022 decision in Vedrine, ” which he asserts “was issued well after briefing on his motion to suppress had already been completed.” [Doc. 97 at 3]. However, as the government points out, Purbeck failed to raise his concerns over the timeliness of the extraction of data from the various electronic storage devices and his contentions regarding the significance of the November 2022 Vedrine decision in his post-hearing brief filed in February 2023, his reply brief filed in April 2023, or his objections filed in June 2023, and that while Purbeck's counsel acknowledged during the August 2, 2023, telephone conference “that he recently discovered Vedrine, after the filing of the post-hearing brief in February 2023 and after the filing of Purbeck's objections . . . in June 2023,” he has failed to show good cause for his failure to raise his concerns earlier, and his argument in this respect “should be deemed untimely and waived.” [Doc. 102 at 3 & n.3 (citation omitted)]. The Court agrees that Purbeck's motion is untimely and due to be denied without an evidentiary hearing.
Rule 41(e) of the Federal Rules of Criminal Procedure requires that a warrant to search for and seize property must command the officer to “execute the warrant within a specified time no longer than 14 days[.]” Fed. R. Crim. P. 41(e)(2)(A)(i). The rule also provides that a warrant “may authorize the seizure of electronic storage media or the seizure or copying of electronically stored information,” and that “[u]nless otherwise specified, the warrant authorizes a later review of the media or information consistent with the warrant,” as “[t]he time for executing the warrant in Rule 41(e)(2)(A) . . . refers to the seizure or on-site copying of the media or information, and not to any later off-site copying or review.” Fed. R. Crim. P. 41(e)(2)(B). Thus, “[t]his rule acknowledges the need for a two-step process: officers may seize or copy the entire storage medium and review it later to determine what electronically stored information falls within the scope of the warrant,” as a “substantial amount of time can be involved in the forensic imaging and review of information” due to “the sheer size of the storage capacity of media, difficulties created by encryption and booby traps, and the workload of the computer labs.” Fed. R. Crim. P. 41(e)(2), advisory committee note to 2009 amendment.
Purbeck “has not made any argument to support a finding of good cause for filing [the instant] untimely motion,” United States v. Lawrence, CRIMINAL ACTION NO. 1:17-cr-00126-LMM-CMS, 2019 WL 3006620, at *3 (N.D.Ga. Mar. 14, 2019), adopted by 2019 WL 2184818, at *3 (N.D.Ga. May 21, 2019), and “the contents of [Purbeck's] motion show no good cause exists,” Petite, 2017 WL 1352223, at *1. Purbeck may well contend that he could not have filed his motion by the pretrial motions deadline of December 13, 2021, because it is dependent upon the ruling in Vedrine, which was not issued until November 29, 2022, but Vedrine did not announce a change in the law. Indeed, the Eleventh Circuit cited decisions from “sister circuits” in support of the ruling on which Purbeck relies, one of which was rendered nearly a decade ago. Vedrine, 2022 WL 17259152, at *6 (citing United States v. Cleveland, 907 F.3d 423, 431 (6th Cir. 2018); United States v. Huart, 735 F.3d 972, 974 n.2 (7th Cir. 2013)). Thus, the argument Purbeck advances was available to be made prior to the Vedrine decision and well before the deadline for filing pretrial motions in this case.
Moreover, because the Vedrine decision was issued in November 2022, there is no reason counsel could not have discovered the basis for his current motion prior to the issuance of the Report, Recommendation, and Order regarding his motions to suppress and the filing of his objections, which Judge Batten overruled and denied his motions, which all occurred after the Vedrine decision was issued. See United States v. Brandon, No. 1:12-cr-253, 2014 WL 5364205, at *6 (S.D. Ga. Oct. 21, 2014) (citation and internal marks omitted), aff'd, 636 Fed.Appx. 542 (11th Cir. 2016) (per curiam) (unpublished). And, the mere fact that he did not discover the Vedrine decision until after his objections to the Report, Recommendation, and Order were filed does not excuse the delay or show that good cause exists. See United States v. Copeland, CRIMINAL ACTION NO. 1:19-cr-00009-MHC-RGV, 2020 WL 2502423, at *8 (N.D.Ga. Jan. 27, 2020), adopted by 2020 WL 1131026, at *4 (N.D.Ga. Mar. 9, 2020); see also United States v. Castaneda, CRIMINAL CASE NO. 1:15-CR-213-ELR-LTW, 2018 WL 2145016, at *8 (N.D.Ga. Mar. 7, 2018), adopted by 2018 WL 2145007, at *1 (N.D.Ga. May 9, 2018), aff'd, 997 F.3d 1318 (11th Cir. 2021). Accordingly, because Purbeck has failed to identify good cause for the untimely filing of his pending motion, his motion for leave to file his supplemental motion to suppress, [Doc. 97], is due to be denied, see United States v. Mwangi, Criminal File No. 1:09-CR-107-TWT, 2010 WL 690136, at *3-4 (N.D.Ga. Feb. 18, 2010), adopted at *1. Alternatively, although Purbeck's motion, [Doc. 97], is untimely, the Court will briefly address the merits of the motion.
Even if Purbeck had shown good cause to file his untimely motion, his argument for suppression fails on the merits. Purbeck relies on the Eleventh Circuit's decision in Vedrine to support his contention that because the government did not extract the contents of any of the devices it seized pursuant to the search warrant within fourteen days of the date the warrant was issued on August 19, 2019, the “later extraction [was] illegal.” [Doc. 97-1 at 6]. He argues that Vedrine “is of particular significance here” because the Eleventh Circuit held that “once the data is seized and extracted by law enforcement, the warrant is considered executed for purposes of Rule 41, and under Rule 41(e)(2)(B), law enforcement may analyze that data at a later date,” and that pursuant to this holding, the government's “extraction of data more than 14 days following the issuance of the search warrant [was] unreasonable[.]” [Id. at 5-6 (emphasis, citation, and internal marks omitted)]. However, contrary to Purbeck's contention, Vedrine did not find that warrants are only executed once the data is extracted within the plain meaning of Rule 41.
In Vedrine, the defendant was arrested for driving a stolen vehicle, and during an inventory search of the vehicle, local law enforcement officers located several fraud-related documents, including credit card applications, re-encoded credit cards, and fake identifications. 2022 WL 17259152, at *1. At the time of the defendant's arrest, the officers also seized three cell phones, and fourteen days later, a federal law enforcement agent obtained a search warrant for the seized cell phones and data extraction was performed, but the data was not analyzed until a later time. Id. After the defendant was indicted for fraud-related crimes, he moved to suppress certain evidence, arguing, among other things, that the “warrant for his phones was executed unreasonably because the data from his cell phones was not analyzed until 21 days after extraction.” Id., at *2. The district court denied the defendant's motion to suppress on this basis, id., at *6, and the Eleventh Circuit affirmed the district court's ruling, explaining that “Rule 41(e)(2)(B) controls warrant execution for electronically stored information, and [] provides that the time for executing the warrant in Rule 41(e)(2)(A) refers to the seizure or on-site copying of the media or information, and not to any later off-site copying or review,” and that “once the data [was] seized and extracted by law enforcement, the warrant [was] considered executed for purposes of Rule 41, and under Rule 41(e)(2)(B), law enforcement may analyze that data at a later date,” id., at *5-6 (emphasis, alterations, citations, and internal marks omitted).
The Eleventh Circuit ruled that “[l]aw enforcement complied with Rule 41(e) and completed the data extraction within Rule 41(e)(2)(A)(i)'s 14-day timeline,” id., at *5, citing its agreement with rulings by the Sixth and Seventh Circuits, id., at *6 (citing Cleveland, 907 F.3d at 431; Huart, 735 F.3d at 974 n.2). In Cleveland, the Sixth Circuit explicitly held that pursuant to Rule 41, the “warrant's execution date set a deadline only for when the physical cellphone itself had to be seized, and not for when its data were to be extracted,” Cleveland, 907 F.3d at 431. Indeed, the Sixth Circuit further noted that while “an initial seizure of [the defendant's] phone after the 14-day expiration period would have contravened the terms of the warrant,” the “phone already was in government custody pursuant to a lawful seizure,” and “the fact that the government did not ‘review' the texts on the phone until after the warrant's expiration date [was] consistent with the warrant itself,” id. (first alteration in original) (citations omitted); see also Huart, 735 F.3d at 974 n.2 (noting that “under Federal Rule of Criminal Procedure 41(e)(2)(B), a warrant for electronically stored information is executed when the information is seized or copied,” and thus, it was executed when the phone was seized, and “[l]aw enforcement [was] permitted to decode or otherwise analyze data on a seized device at a later time”). Thus, despite Purbeck's argument to the contrary, Vedrine, did not find that a warrant for electronically stored information is only executed when data is extracted from the device, and as the government points out, “the accompanying advisory committee notes [to Rule 41(e)(2)]” makes clear that the “Rule limits the 14 day execution period to the actual execution of the warrant and the on-site activity,” [Doc. 101 at 5-6 (alterations, footnote, citations, and internal marks omitted)], and here, “Purbeck's iPhones were seized from his residence on August 21, 2019,” only “two days after the search warrant was signed,” and “[t]herefore, under the plain text of Rule 41(e)(2), the search warrant was timely executed in accordance with the Federal Rules of Criminal Procedure,” [id. at 7 (citation omitted)].
Purbeck concedes that if the government's “reading of Vedrine is correct, then the Court should deny this specific motion for leave to file a supplemental motion,” [Doc. 106 at 2], and contrary to Purbeck's contention, Vedrine is not directly contrary to this Court's decision in United States v. Dixon, CRIMINAL ACTION NO. 3:20-cr-00003-TCB-RGV, 2021 WL 2327063 (N.D.Ga. Apr. 15, 2021), adopted by 2021 WL 1976679, at *3 (N.D.Ga. May 18, 2021), which held that the government's “two-year delay in searching [the defendant's] iPhone [after it was seized pursuant to a search warrant executed at his residence] was not unreasonable,” 2021 WL 1976679, at *1-2, and, as the government points out, Vedrine “did not revolutionize settled law or otherwise provide any other justification for Purbeck's untimely motion,” but rather, “is consistent with prior judicial decisions . . . to have interpreted the plain language of Federal Rule of Criminal Procedure Rule 41(e)(2)(B),” [Doc. 102 at 4]; see also United States v. Ilonzo, Criminal File No. 1:12-CR-276-SCJ-GGB, 2015 WL 5827598, at *3-4 (N.D.Ga. Oct. 6, 2015) (rejecting defendants' argument that the government's failure to search the computers within the 14-day timeframe imposed by the search warrant rendered the search invalid where the computers were seized within the 14 days and the warrant “did not ‘otherwise specify' when the data had to be copied or reviewed” because “[u]nder Rule 41, off-site review or copying need not be completed by the deadline for execution”). Accordingly, even if Purbeck's motion had been timely filed, it would be due to be denied on the merits. Therefore, it is RECOMMENDED that Purbeck's motion for leave to file his supplemental motion to suppress, [Doc. 97], be DENIED.
Purbeck also asserts that regardless of when the search warrant was considered executed, his Fourth Amendment rights were violated because law enforcement agents failed to analyze the extracted data within a reasonable period of time, since “it appears that the delay is more than a matter of weeks,” which has been found to be reasonable, and “it also appears to be closer to 15 months or more,” which has been found to be unreasonable. [Doc. 97-1 at 7-8 (citing Vedrine, 2022 WL 17259152, at *5-6; United States v. Metter, 860 F.Supp.2d 205, 212 (E.D.N.Y. 2012))]. Aside from the fact that Purbeck has not explained his failure to raise a challenge to the searches on this basis at an earlier time, the warrant authorized the seizure of “digital devices or electronic storage media,” among other items, but did not include any additional language imposing a deadline for review of electronically stored information and instead authorized “a later review of the device[s] or information consistent with the warrant.” [Doc. 41-2 at 2-3, 20-26, 3033]. “The advisory committee notes to Rule 41(e) recognize that a substantial amount of time can be involved in the forensic imaging and review of information due to the sheer size of the storage capacity of media, difficulties created by encryption and booby traps, and the workload of the computer labs,” and this Court has found that a two-year delay was reasonable under certain circumstances. Dixon, 2021 WL 1976679, at *2 (citation and internal marks omitted). Indeed, Purbeck concedes that if “the government's reading of Vedrine is correct, then the Court should deny this specific motion for leave to file a supplemental motion,” [Doc. 106 at 2], and thus, the Court finds Purbeck's perfunctory argument with regard to the delay encountered in reviewing the extracted data, [Doc. 97-1 at 7-8], an argument that could have been raised earlier, is without merit and does not require “an evidentiary hearing . . . to determine whether the government has analyzed the data that it [] extracted within a reasonable time,” [id. at 8]; see Vedrine, 2022 WL 17259152, at *6 (rejecting “generalized time grievance” where the defendant “puts forth no persuasive evidence of unreasonable action”).
B. Purbeck's Motion to Suppress Evidence Obtained from the Searches of Two iPhones, [Doc. 99]
Purbeck has filed a motion to suppress, [Doc. 99], “the results and fruits of the recent searches of his [iP]hone 8 plus . . . and [iP]hone 7 . . . that the government conducted,” [id. at 1]. The government initially opposed Purbeck's motion, see [Doc. 102], and Purbeck filed a reply in support of his motion, see [Doc. 104]. The government then filed an unopposed motion to file a sur-reply, [Doc. 107], and in the sur-reply, [Doc. 107-1], the government explained that it has agreed “not to use evidence from the iPhones 7 and 8 in its case in chief at trial” and that Purbeck's motion should therefore be denied as moot, [id. at 2]. Accordingly, it is RECOMMENDED that Purbeck's motion to suppress evidence obtained as a result of the recent search of his two iPhones, [Doc. 99], be DENIED AS MOOT.
III. CONCLUSION
For the foregoing reasons, the government's motion for leave to file a sur-reply, [Doc. 107], is GRANTED, and it is RECOMMENDED that Purbeck's motion for leave to file a supplemental motion to suppress, [Doc. 97], be DENIED, and that his motion to suppress evidence obtained from the search of two iPhones, [Doc. 99], be DENIED AS MOOT.
There are no other pending matters before the Magistrate Judge, and the undersigned is aware of no problems relating to the scheduling of this case.
IT IS THEREFORE ORDERED and ADJUDGED that this action be and the same is hereby, certified Ready for Trial.
IT IS SO ORDERED and RECOMMENDED.