AMY BERMAN JACKSON, United States District Judge.
In this case involving the enforcement of export control laws and the trade embargo with Iran, defendant Jae Shik Kim has moved to suppress the evidence the United States harvested from a laptop computer it seized from him when he was departing the country through Los Angeles International Airport. Kim is a Korean businessman with business operations in both Korea and California, and in October of 2012, investigators with the Department of Homeland Security obtained information that he was involved in a previous shipment of controlled articles to a Chinese businessman in Korea, who then forwarded them to customers in Iran. The Special Agent handling the investigation decided to search Kim's laptop computer for evidence the next time Kim came to the United States, and in December 2012, he obtained the computer from Kim before permitting him to board his flight home. The next day, the laptop was shipped to an agency forensic specialist in San Diego, who created an identical copy of the hard drive, which was then searched using specialized software and a list of keywords. The thousands of files that were extracted from the keyword search were then burned onto a DVD and returned to the case agent for further review.
After incriminating emails were uncovered through that process, the agent sought and obtained a warrant based upon the content of the emails to conduct the search of the hard drive that had already been completed and to seize the emails that had already been reviewed. Those emails now form a part of the basis of this prosecution, and Kim moves to suppress that evidence, arguing that his rights under
The government points to its plenary authority to conduct warrantless searches at the border. It posits that a laptop computer is simply a "container" that was examined pursuant to this authority, and it submits that the government's unfettered right to search cargo at the border to protect the homeland is the beginning and end of the matter.
But to apply those principles under the facts of this case would mean that the border search doctrine has no borders. The search of the laptop began well after Kim had already departed, and it was conducted approximately 150 miles away from the airport. The government engaged in an extensive examination of the entire contents of Kim's hard drive after it had already been secured, and it accorded itself unlimited time to do so. There was little or no reason to suspect that criminal activity was afoot at the time Kim was about to cross the border, and there was little about this search—neither its location nor its scope and duration—that resembled a routine search at the border. The fundamental inquiry required under the Fourth Amendment is whether the invasion of the defendant's right to privacy in his papers and effects was reasonable under the totality of the circumstances, and the Court finds that it was not.
On March 28, 2013, Kim and his company, Karham Eng. Corp. ("Karham"), were indicted for violations of a number of statutes, including the International Emergency Economic Powers Act ("IEEPA"), 50 U.S.C § 1701 et. seq., the Arms Export Control Act ("AECA"), 22 U.S.C. § 2778, and the International Traffic in Arms Regulation ("ITAR"), 22 C.F.R. pts. 120-30. Indictment [Dkt. #1]. These laws and regulations govern economic sanctions imposed by the United States against certain countries, such as Iran, and the export of certain "defense articles" from the United States. The United States alleges that from around December 2007 through March 2010, defendants conspired to export defense articles without the required export licenses for sale to intermediaries in China and Korea and ultimate customers in Iran. Indictment ¶ 17. The defense articles at issue—six Q-Flex Accelerometers, Models QA-2000-10, QA-2000-20, or QA-3000—are aircraft parts manufactured by Honeywell Aerospace which are used in aircraft and missile navigation systems. Indictment ¶¶ 3, 16(1), 17(3). They appear on the export control list, and an export license is required before they may be exported legally from the United States. 22 U.S.C. § 2778(b)(2); 22 C.F.R. pt. 123.1(a).
On March 2, 2015, defendants filed the instant motion to suppress. Defs.' Mot to Suppress Evidence [Dkt. # 35] ("Defs.' Mot."). The parties briefed the motion, Gov't's Opp. to Defs.' Mot. [Dkt. # 37] ("Gov't Opp."); Defs.' Reply in Supp. of Defs.' Mot. [Dkt. # 38] ("Defs.' Reply"), and the Court held an evidentiary hearing on April 7 and 8, 2015, at which the following facts were established.
In 2011, Special Agent Kevin Hamako of the Department of Homeland Security ("DHS") Homeland Security Investigations office was investigating a Chinese national, Bin Yang, also known as Raymond Yang, for export control violations, specifically the unlawful export of accelerometers to China and Iran. Mots. Hr'g Tr., April 7, 2015 ("4/7 Tr.") at 7. As part of the investigation, Special Agent Hamako worked with an undercover agent who
On April 1, 2011, Yang sent the undercover agent an email asking to obtain Honeywell QA-3000-30's from him, and he offered: "Because my uncle has a sudden schedule to USA, he may could meet you and pay you." Report of Investigation, No. 107, May 20, 2011, Gov't Ex. 3 ("May 2011 ROI") at 3.
On April 4, 2011, Yang sent the undercover agent another email stating, "My uncle just has his sudden trip to US, he may meet you and only see the goods and maybe pay you." May 2011 ROI at 3.
In an April 5, 2011 telephone conversation between Yang and the undercover agent, Yang again volunteered that he had a contact who would be traveling to the United States who could inspect the QA-3000 accelerometers that Yang hoped to buy. May 2011 ROI at 3; 4/7 Tr. at 15-16. Yang proposed to have his "uncle" travel to the United States, inspect the accelerometers, and provide payment for them. 4/7 Tr. at 15-16. He also stated he did not want his "uncle" to physically carry the items out of the country because he was afraid that U.S. customs officials would discover them. 4/7 Tr. at 16; see also Report of Investigation, No. 114, Jun. 22, 2011, Gov't Ex. 2 ("Jun. 2011 ROI") at 3 (detailing information about the April 5, 2011 telephone call). At that point, the unidentified "uncle" became a further subject of the investigation. 4/7 Tr. at 16.
On April 27, 2011, Special Agent Hamako obtained and executed a warrant to search and seize Yang's emails, and on May 12, 2011, he received the emails. May 2011 ROI at 3; see also 4/7 Tr. at 17. The emails included several communications with "Uncle Kim" at JS@karham.co.kr:
May 2011 ROI at 4-6.
On April 5, 2011, Yang had the recorded telephone call with the undercover agent described above in which he proposed that his "uncle" could inspect the parts Yang hoped to buy. As of May 2011, though, the agents were aware that Yang's inquiry to Kim had borne no fruit and the undercover operation was over. 4/7 Tr. at 72 (stating the agents knew "fairly soon after, within maybe a couple of weeks" that the operation was not going ahead).
On June 21, 2011, Special Agent Hamako was able to identify "Uncle Kim" as defendant Jae Shik Kim by searching a government database for the JS@karham.co.kr email address. 4/7 Tr. at 21-22; Jun. 2011 ROI at 3-4. The email address appeared in U.S. State Department records on a non-immigrant visa application submitted by Kim. 4/7 Tr. at 21-22; Jun. 2011 ROI at 3. The application provided Special Agent Hamako with other information about Kim, including his date of birth, passport number, and nationality. Jun. 2011 ROI at 3-4; 4/7 Tr. at 22.
From the visa application, Special Agent Hamako also determined that Kim was president of corporate defendant Karham. 4/7 Tr. at 22. Through further research, he learned that Karham was located in South Korea and Stevenson Ranch, California, and that Karham shared its Stevenson Ranch, California address with a company called Apex Components. 4/7 Tr. at 22-23; see also Jun. 2011 ROI at 3-5 (providing information about the identification of Kim).
Special Agent Hamako researched Karham and Apex Components and found that Karham was involved in the export and sale of equipment used in the oil industry and petrochemical industries, including types of meters. 4/7 Tr. at 24. On a web-based government database, Special Agent Hamako found approximately thirty-nine shipper's export declarations ("SEDs") from Karham for the export of meters from the United States to Australia and South Korea. 4/7 Tr. at 24. He found eight shipper's export declarations from Apex Components, which also showed exports of various industrial equipment from the United States to South Korea. 4/7 Tr. at 25.
Finally, Special Agent Hamako found travel records showing that defendant Kim arrived in Los Angeles International Airport ("LAX") on April 2, 2011, and departed LAX for Narita, Japan on April 14, 2011. Jun. 2011 ROI at 4; see also 4/7 Tr. at 26.
Early the following year, in January 2012, Yang was arrested and, in May 2012, he was extradited from Bulgaria to the United States. 4/7 Tr. at 9. He agreed to be debriefed by U.S. authorities in an effort to ameliorate his sentence. 4/7 Tr. at 9; see also Search Warrant, Ex. B to Defs.' Mot. [Dkt. # 35-2] ("Search Warrant"); Aff. in Supp. of Appl. for Search Warrant, Ex. B to Defs.' Mot. [Dkt. # 35-2] ("SW Aff."), at 7 n.1.
On October 18, 2012, Special Agent Hamako interviewed Yang. 4/7 Tr. at 9; see also Report of Investigation No. 146, Nov. 15, 2012, Gov't Ex. 1 ("Nov. 2012 ROI") at 3-5 (reporting results of the Yang debrief). Yang told investigators that at some point in 2008 or 2009, he purchased six QA-2000 accelerometers from Kim, which were shipped to him in China without an export license. 4/7 Tr. at 10. Yang said that once he received the accelerometers, two of his Iranian customers traveled from Iran to China to receive them directly. Id.
As a result of the Yang interview, Special Agent Hamako decided to conduct what he characterized as a border search of Kim's electronic devices "as he was leaving the U.S. on his next travel." 4/7 Tr. at 110.
4/7 Tr. at 33. At that time, it was the agent's understanding that no suspicion was required to conduct a border search of any items Kim might be carrying, including electronic devices. 4/7 Tr. at 32.
Because of the ongoing investigation, Kim's name was in DHS's case management system, which meant Special Agent Hamako would receive an automatic email if Kim was booked on a flight to or from the United States. 4/7 Tr. at 32-33. Some time later, the agent received an email notifying him that Kim was going to return to the United States in November 2012, and that he would be departing LAX for South Korea on December 5, 2012. 4/7 Tr. at 33.
Special Agent Hamako testified that while he understood that he had the authority to conduct a border search of Kim without any level of suspicion that Kim was engaged in criminal activity, 4/7 Tr. at 34, he had grounds for that suspicion in any event.
4/7 Tr. at 35. Special Agent Hamako stated that although he knew Yang was incarcerated, he "wasn't sure if Mr. Kim was in contact with other individuals who might be seeking to illegally procure U.S. goods," and that his goal was to ascertain whether Kim had other customers. 4/7 Tr. at 35-36. Under questioning by the prosecutor at the hearing, the agent agreed that he also thought it was reasonable to believe that records of the 2008 transactions, including emails, could still be saved on the computer. 4/7 Tr. at 38-39.
Special Agent Hamako said he intended to conduct a border search of Kim as he departed the country rather than as he entered the country,
4/7 Tr. at 34-35. He added that based on Yang's statements and Karham's general business activities, he was "concerned that [Kim] could be involved in further activity in the [S]tates regarding illegal exports." 4/7 Tr. at 39. But he testified that he did not know at the time—and he does not know now—what Kim did while he was in the United States between November 25 and December 5, 2012, and that he did not conduct any surveillance or take any steps to find out before carrying out his plan to obtain the laptop. 4/7 Tr. at 81.
On December 5, 2012, working with a LAX duty agent and Customs and Border Protection officers, Special Agent Hamako conducted the planned search of Kim as he departed the country. 4/7 Tr. at 40. First, he searched Kim's checked luggage, which was located behind the check-in counter with Korean Airlines. Id. He found no accelerometers or contraband. 4/7 Tr. at 82-83. He did find a small plastic bag containing plastic o-rings, some unidentified industrial metal objects, and some product brochures. 4/7 Tr. at 40-41, 90. The agent was not able to identify the applications of these particular o-rings because he was not an aircraft parts expert, but said that he knew "in other cases the Iranian Air Force had been seeking o-rings for their aircraft," and so he thought that these small plastic ones "could be" on the munitions list, and he kept them to determine their application. 4/7 Tr. at 41-42. He later spoke with the manufacturer, and determined "it was very unlikely that they were export controlled items," and shipped them back to Kim. 4/7 Tr. at 43. Special Agent Hamako also testified that the metal objects in the luggage did not appear to have any moving parts or sensors or electronics and may have been a tripod, and the product brochures "didn't seem to be pertinent at the time." 4/7 Tr. at 87-88, 90. So he did not retain either the metal objects or the brochures and did not photograph or document what they were. 4/7 Tr. at 88-89.
Next, Special Agent Hamako stopped Kim on the jetway between the gate and the airplane as Kim was boarding his flight. 4/7 Tr. at 40, 43. He identified himself and asked Kim if he had any electronics, to which Kim responded that he had a laptop. 4/7 Tr. at 44. Special Agent Hamako told Kim that he would be detaining the laptop pursuant to a border search and that he would return it once the search was complete. Id. He also told Kim that he would be detaining the o-rings until their export control status was determined. Id. Special Agent Hamako testified that he did not have an interpreter during the encounter with Kim because he did not anticipate that he was likely to say anything incriminating. 4/7 Tr. at 94.
4/7 Tr. at 95. This is precisely what took place, and Kim boarded his flight. 4/7 Tr. at 45.
Special Agent Hamako did not turn the laptop on or review its contents in any way during his search of Kim at LAX. 4/7 Tr. at 45. He explained that "it would be inappropriate to search his laptop without—without an individual who's qualified to preserve the contents of the laptop. Because if I were to turn on the laptop and just begin searching it there, that would be altering the information on the laptop and could render any evidence I found on it tainted or otherwise questionable, since I would be modifying the contents of the laptop by conducting searches on it. And also, because based on the time available,
On December 6, 2012, Special Agent Hamako submitted Kim's laptop to Special Agent David Marshall of the Homeland Security Investigation San Diego Computer Forensics Group. Report of Investigation, No. 147, Dec. 11, 2012, Gov't Ex. 5 ("Dec. 2012 ROI") at 1, 3; Mots. Hr'g Tr., April 8, 2015 ("4/8 Tr.") at 7-8;
To carry out Special Agent Hamako's request, Special Agent Marshall removed the hard drive from Kim's laptop and created a forensic image, or a duplicate copy, of it. 4/8 Tr. at 8. To do this, Special Agent Marshall connected a piece of hardware "about the size of a shoebox" to the laptop hard drive: the hardware creates "an exact copy, reading every single bit, as we call it, every single piece of data on the hard drive and making a copy of that for me to analyze later on." 4/8 Tr. at 8-9.
The imaged copy included all files from both the allocated and unallocated space on the computer, which Special Agent Marshall explained as follows:
4/8 Tr. at 9.
Special Agent Marshall placed the hard drive back into Kim's laptop and returned the laptop to Special Agent Hamako on December 7, 2012. 4/8 Tr. at 8.
Also on December 7, 2012, Special Agent Marshall employed a software program called EnCase to export files from Kim's computer. 4/8 Tr. at 10; see also Dec. 2012 ROI at 4 (stating that he used commercially available email analysis software to export files). He used EnCase to export six Microsoft Outlook email containers,
Special Agent Marshall used another program, Intella, to process the files. 4/8 Tr. at 10; see also Dec. 2012 ROI at 4. He testified that Intella is a powerful piece of software with a variety of capabilities, including the ability to search the text of emails that are not otherwise searchable. 4/8 Tr. at 31. It also indexes and categorizes emails:
4/8 Tr. at 31-32. And according to Special Agent Hamako, it would have been "impractical" to use the search function in Outlook instead; given the investigators' search methodologies, "Intella is more efficient." 4/7 Tr. at 105.
These files were copied to a "case agent review" laptop for Special Agent Hamako to review. 4/8 Tr. at 11. When Special Agent Marshall saw the number of files on the laptop, he asked Special Agent Hamako to give him a keyword list to use to "filter down the amount of information for him to review." 4/8 Tr. at 11.
On December 10, 2012, Special Agent Hamako gave Special Agent Marshall a list of twenty-two keywords: QA-2000, QA-3000, G-2000, 7270A, accelerometers, gyroscope, angular, sensor, Honeywell, Endevco, Northrop, Grumman, ITAR, sensitive, export, shipment, military, aircraft, missile, satellite, ballistic, and nuclear. 4/8 Tr. at 12-13. Using these keywords to screen the files on Kim's laptop, Special Agent Marshall found approximately 5,900 files that had a keyword match. 4/8 Tr. at 13. He burned the files to a DVD and gave the DVD to Special Agent Hamako, along with the case agent review laptop. Dec. 2012 ROI at 4; 4/8 Tr. at 13.
The next day, on December 11, 2012, Special Agent Marshall exported all of the picture files, which can include images of documents and not simply photographs, that were located in the allocated space of the computer—approximately 24,900 .jpg files. 4/8 Tr. at 13-14; Dec. 2012 ROI at 4. He copied all of those onto another DVD and gave the DVD to Special Agent Hamako. 4/8 Tr. at 13-14; Dec. 2012 ROI at 4.
Special Agent Hamako then spent "[s]everal days" reviewing the files obtained from Kim's computer, conducting keyword searches of the emails and documents. 4/7 Tr. at 47; Search Warrant ¶ 17 (stating that Special Agent Hamako received the emails on December 10, 2012 and reviewed them until December 19, 2012). He found emails consistent with the 2008 transaction Yang described during the interview, and those form the basis for the criminal charges in this case. 4/7 Tr. at 47-48.
On January 13, 2013, Special Agent Hamako filed an application for a search warrant in the U.S. District Court for the Southern District of California. Search Warrant. He provided an affidavit with the application, in which he stated his belief that there was "probable cause to believe that evidence relating to violations" of the ACEA, IEEPA, the Iranian Transactions Regulations, and other statutes would be contained in the files on Kim's laptop. SW Aff. ¶ 10. The affidavit states that the laptop was detained during a border search, that the government had imaged the laptop, and that Special Agent Hamako reviewed emails obtained from the laptop for ten days. SW Aff. ¶¶ 16-17. The affidavit then describes the contents of emails between Kim and Yang from December 2007 through April 2008, showing that Kim helped Yang purchase six accelerometers without the required export control license, and that the items were to be forwarded to Iran. SW Aff. ¶¶ 18-40.
The application stated further that, "[w]ith the approval of the Court in signing this warrant, agents executing this
SW Aff. ¶¶ 45-46.
According to the agent's affidavit, the "mind-boggling" amount of data stored on computers makes analyzing the data "increasingly time-consuming." SW Aff. ¶ 48. Therefore, Special Agent Hamako predicted that "[t]he identification and extraction process . . . may take weeks or months." SW Aff. ¶ 49. He also averred that the government "has not attempted to obtain this data by other means, except 1) through border search authority . . . and 2) some email communications between Kim and Yang . . . previously obtained pursuant to court authorized search warrants of Yang's email accounts." SW Aff. ¶ 52.
On January 16, 2013, the U.S. District Court for the Southern District of California signed the warrant. Search Warrant.
But Special Agent Hamako and Special Agent Marshall each testified that after the search warrant was obtained, no further searches or analyses were undertaken. 4/7 Tr. at 51 ("THE COURT: Was there some new, different program that was applied after you got the warrant that did something more to the computer, or is it just a matter that you actually seized the e-mails? [Special Agent Hamako]: That's correct, Your Honor. We didn't use any different programs after obtaining the search warrant."); 4/8 Tr. at 23 ("THE COURT: Did you do anything to—either the complete image that you had created or the case agent's laptop, did you do any further searching or application of any programs after the search warrant was obtained? [Special Agent Marshall]: No.").
The government argues first and foremost that a laptop is nothing more than a sort of container, and that the agents had full authority to scour its contents without the need for a warrant or a showing of any particular level of suspicion simply because the search was initiated at the border. Gov't Opp. at 6, citing, inter alia, United States v. Ramsey, 431 U.S. 606, 97 S.Ct. 1972, 52 L.Ed.2d 617 (1977), and 19 U.S.C. § 1581.
In Cotterman, the Ninth Circuit announced that reasonable suspicion was required before investigators could undertake the forensic examination of a computer hard drive as part of a search that began as a cursory review at the border. 709 F.3d at 957. In this case, the government argues both that no suspicion was necessary since this was an ordinary, reasonable border search that can be distinguished from the forensic examination that took place in Cotterman, and also that the necessary suspicion was present. Gov't Opp. at 10-14.
Neither the Supreme Court nor the D.C. Circuit has weighed in on this issue, so there is no binding precedent to be applied by this Court.
The Supreme Court has defined reasonable suspicion as "a particularized and objective basis for suspecting the particular person stopped of criminal activity." United States v. Cortez, 449 U.S. 411, 417-18, 101 S.Ct. 690, 66 L.Ed.2d 621 (1981). The standard is met when a law enforcement officer can point to "specific and articulable facts," which, when considered together with the rational inferences that can be drawn from those facts, indicate that criminal activity "may be afoot." Terry v. Ohio, 392 U.S. 1, 21, 30, 88 S.Ct. 1868, 20 L.Ed.2d 889 (1968). As the government has pointed out in this case, a court's determination of whether the officer had reasonable suspicion must be based upon the totality of the circumstances.
But what is it that the officer must reasonably suspect? Neither party focused in on that issue, but a review of the cases decided in the wake of Terry makes it clear that the reasonable suspicion standard relates to ongoing or imminent crime. See Cortez, 449 U.S. at 417, 101 S.Ct. 690 ("An investigatory stop must be justified by some objective manifestation that the person stopped is, or is about to be, engaged in criminal activity."); United States v. Edmonds, 240 F.3d 55, 59 (D.C.Cir. 2001) ("[T]he issue is whether a reasonably prudent man in the circumstances would be warranted in his belief that the suspect is breaking, or is about to break, the law.") (citation and internal quotation marks omitted). Therefore, if this Court were to determine, after considering the totality of the circumstances, that a reasonably prudent officer would have been justified in his belief that Kim was engaged in ongoing criminal activity at the time he was stopped at LAX, then the search would have been lawful under the Cotterman standard. And then, the Court could adopt the approach taken by the District Court in Hassanshahi and find the constitutional question of whether the search of the computer required reasonable suspicion to be moot.
In this case, though, the Court is troubled by the lack of particularized grounds to believe that this defendant was engaged in criminal activity at the time he was exiting the United States. First of all, there is no question that the decision to conduct the search was not made on that basis: Special Agent Hamako candidly testified that he made the decision to obtain the laptop and search it for evidence of the alleged conspiracy with Yang based upon his understanding that such a search required no level of suspicion at all. 4/7 Tr. at 34. He testified that once he had information from Yang that defendant Kim had been his source in 2008, he decided to conduct what he termed a "border search" the next time Kim came to the United States for the purpose of obtaining the laptop. 4/7 Tr. at 33-34, 94. And he made that decision before he knew when Kim would be travelling to the United States, whether he would be travelling, or why, and in the absence of any information whatsoever about what Kim would or did do while he was in the country. 4/7 Tr. at 81, 33.
Notwithstanding these undisputed facts, the government takes the position that the agent had reasonable suspicion to search the laptop under the Terry standard
But the government's use of such language as "perhaps" and "any" was not at all reassuring, as it served to highlight how thin the showing is in this case. And the agent's testimony confirmed that gathering evidence of a completed crime was the central motivation here. See 4/7 Tr. at 95 ("[M]y main goal was to obtain his electronics and then let him go on his way.").
The government points out that the subjective intent of the agent is irrelevant. Gov't Opp. at 12 (stating that "only a `minimal level of objective justification'" is required), quoting Hassanshahi, 75 F.Supp.3d at 123, 2014 WL 6735479, at *16. And at the hearing on the motion, it posited that there was reasonable suspicion to support the search based upon the following circumstances: the pre-existing ongoing investigation into Kim's involvement in Yang's 2008 transaction with Iran; the fact that Kim's name came up in connection with the more recent attempt to engage Yang in an undercover transaction; the fact that Kim did travel to the United States at the time Yang said he would be traveling; the business relationship between Kim and Yang; and the discovery of the o-rings. 4/8 Tr. at 77-78; Gov't Opp. at 12-14.
But even if one credits Special Agent Hamako's testimony that Yang told him Kim knew that the items shipped in 2008 were bound for Iran, see 4/7 Tr. at 10-11—despite the agent's failure to mention that key detail in either his contemporaneous report or the affidavit he submitted in support of the search warrant, see Nov. 2012 ROI; SW Aff.—and even if one credits Yang's account of the previous transaction, evidence of prior criminal conduct alone is not sufficient to give rise to reasonable suspicion. Hassanshahi, 75 F.Supp.3d at 120-21, 2014 WL 6735479, at *14, citing United States v. Johnson, 482 Fed.Appx. 137, 148 (6th Cir.2012); United States v. Walden, 146 F.3d 487, 490 (7th Cir.1998). This is particularly true under the circumstances of this case, where the only evidence of more recent activity was Yang's inquiry to Kim on behalf of the undercover officer, which did not result in any action on Kim's part. As of December 5, 2012, all that Special Agent Hamako knew about ongoing activity was that Yang had contacted Kim and the approach had quickly come to a dead end, that Yang was under arrest and no longer conspiring with anyone, and that the search of Kim's luggage revealed no accelerometers or obviously controlled items.
The government points to Kim's previous travel and the fact that exports to Yang and others were a regular part of his business, but this is the sort of evidence the Supreme Court has cautioned against according much weight in the reasonable suspicion analysis because it "describe[s] a very large category of presumably innocent travelers." Reid v. Georgia, 448 U.S. 438, 441, 100 S.Ct. 2752, 65 L.Ed.2d 890 (1980).
Further, it is difficult to find that the o-rings had anything other than marginal importance. The testimony was that they were small and plastic, and it was not obvious to an agent who was well trained in the contents of the munitions list that
The agent's answers to questions posing obvious propositions that do not depend on sophisticated investigatory experience, see 4/7 Tr. at 48 ("Q. . . . [I]f you knew that Mr. Yang and Mr. Kim had conspired to export the accelerometers Mr. Yang told you about, did you have reason to suspect Mr. Kim could have had other people he was working with? A. That's correct. It's common in our investigations that individuals will have different coconspirators and customers for goods. . . ."), did little to lift the evidence out of the realm of hunch or speculation, particularly given the fact that the one known prior alleged conspiracy did not involve entry into or exit from the United States at all. 4/7 Tr. at 10-11; see also id. at 53 (agent admitted on cross examination that while it was a "possibility" that Kim had other co-conspirators, he had no evidence of any other questionable transactions besides the one with Yang).
Looking at all of the circumstances presented, then, while it is a close case, it seems clear to the Court that the search of the laptop was predicated upon the agent's expectation that the computer would contain evidence of past criminal activity, but there was no objective manifestation that Kim was or was "about to be, engaged in criminal activity" at that time. Cortez, 449 U.S. at 417, 101 S.Ct. 690; see also 4/7 Tr. at 32-33 (after the Yang debriefing, the agent arranged to be notified of any planned travel by Kim so that he could take proactive steps such as surveillance or a border search "to determine if he was engaged in any potential criminal activity while in the United States") (emphasis added). With respect to ongoing activity, the search was nothing more than a fishing expedition to discover what Kim might have been up to. See also 4/7 Tr. at 35-36 ("Q [by AUSA]. Now, you knew that Mr. Yang was locked up and could not engage in activity with Mr. Kim, correct? A. That's correct. However, based on the fact that I wasn't able to search Mr. Kim's e-mail, I wasn't sure if Mr. Kim was in contact with other individuals. . . . So, at that time I wasn't sure if Mr. Yang was Mr. Kim's only customer. Q. Were you intending to investigate whether he had other customers? A. I was. That was a primary goal of our investigation.") Indeed, when Special Agent Hamako took the time to detail the evidence against Kim in the affidavit in support of the search warrant, he did not include any facts or allegations related to anything that was supposedly going on in December of 2012. He simply averred, "[a]fter his arrest, Yang stated that he had previously purchased six Honeywell QA-2000 accelerometers from Kim." See SW Aff. ¶ 15. And therefore, this case is distinguishable from Cotterman and the decision from this District in Hassanshahi.
The court in Cotterman noted that the agents at the Mexican border made their initial decision to search the defendant's belongings on his way into the country after the Treasury Enforcement Communication System ("TECS") revealed that the defendant was a known sex offender. 709 F.3d at 957. Based on the TECS alert, the border agents believed that the defendant had a prior conviction for child pornography, that he was possibly involved in child sex tourism, and that he was arriving from a country associated with that
While neither the prior conviction nor the use of password-protected files alone would have sufficed, the court concluded that "Cotterman's TECS alert, prior child-related conviction, frequent travels, crossing from a country known for sex tourism, and collection of electronic equipment, plus the parameters of the Operation Angel Watch program, taken collectively, gave rise to reasonable suspicion of criminal activity." Id. at 969. The court added that where there are other indicia of criminal activity, the password protection of individual files—as opposed to the commonplace use of a password to protect an entire device—could be considered as part of the totality of the circumstances, but only in a situation, such as a child pornography case, where the encryption or protection of files would have some relationship to the suspected criminal activity. Id. at 969. Given the combination of the TECS hit and the discovery of the inaccessible files, and crediting the agents' observations and experience, the Ninth Circuit found that "[t]he border agents `certainly had more than an inchoate and unparticularized suspicion or hunch' of criminal activity to support their decision to more carefully search for evidence of child pornography." Id. at 970, quoting United States v. Montoya de Hernandez, 473 U.S. 531, 542, 105 S.Ct. 3304, 87 L.Ed.2d 381 (1985).
Here there was nothing about Kim's particular travel plans that would arouse suspicion; he was returning to his home in Korea and he was known to have business operations within the United States. And, the agent did not even open the laptop—which did not turn out to contain password protected files in any event—on the scene. So while in Cotterman, the court characterized the forensic search as one that grew out of observations made during the initial cursory examination at the border, the search here was not prompted, even in part, by anything that raised the agent's level of concern upon a first glance at the device at the border. Compare Cotterman, 709 F.3d at 969-70 (pointing to the password-protected files on Cotterman's computer as a circumstance justifying the scope of the search).
The TECS information about Hassanshahi revealed additional travel involving Iran: in 2006, twice in 2008, once in 2010, in May 2011, and in either late 2011 or early 2012, all of which supported the notion that his Iranian business dealings were ongoing. Id. In addition, the fact that the defendant's email account was accessed twenty-four times from an Iranian IP address between December 8, 2011 and December 15, 2011, and the evidence that around the time the defendant traveled to Iran, he made contact with one Iranian telephone number and received a missed call from another, reinforced the conclusion that Hassanshahi was engaged in business activity during his recent trip. Id. 75 F.Supp.3d at 121-23, at *15. Finally, the court took note of the fact that Hassanshahi was travelling with multiple electronic devices and data storage accessories, including a laptop computer, multimedia cards, thumb drives, a camcorder, SIM cards, and a cell phone. Id. It observed, "[t]hough it generally is unremarkable nowadays for a person traveling abroad to bring a computer, camcorder, or cell phone with them, Hassanshahi's possession of multiple data storage devices appears to be inconsistent with just personal use while traveling," and it found that the volume of equipment supported the inference that the defendant had traveled to Iran to continue the same sorts of business activity in which he had been engaged in the past. Id.
Since there was little or nothing to indicate that a crime was "afoot" in this case, the Court is of the view that it cannot rely upon the approach utilized in Hassanshahi, and that it must go on to consider the constitutional question of whether the nature, scope, and duration of the search were reasonable under the Fourth Amendment. In the end, the reasonable suspicion analysis may be largely beside the point because what took place here cannot be fairly compared to a Terry stop.
"The Government's interest in preventing the entry of unwanted persons and effects is at its zenith at the international border." United States v. Flores-Montano, 541 U.S. 149, 152, 124 S.Ct. 1582, 158 L.Ed.2d 311 (2004). Notwithstanding the broad scope of the government's authority at the border, the Supreme Court has suggested that even this power to search may be bounded by limits derived from the Fourth Amendment, particularly when the search cannot be characterized as "routine."
The few Supreme Court cases that explore the sorts of border searches that might require some level of suspicion involved unique and extreme situations: a highly intrusive physical examination of the defendant's person, Montoya de Hernandez, 473 U.S. 531, 105 S.Ct. 3304, 87 L.Ed.2d 381, and the complete destruction of another defendant's automobile gas tank, Flores-Montano, 541 U.S. 149, 124 S.Ct. 1582, 158 L.Ed.2d 311, and they do not deal directly with the world of electronic media. The government takes the position, then, that the search of a laptop is the functional equivalent of the inspection of a piece of luggage or a cargo container, and that therefore it was presumptively reasonable and subject to no limitation under the border search doctrine. Gov't Opp. at 6, 9. After all, the prosecution points out, the experience was not physically invasive or embarrassing and not even destructive of the laptop itself, which was returned to the defendant intact. Gov't Opp. at 8-9.
But neither of those precedents can be easily compared to this case, and given the vast storage capacity of even the most basic laptops, and the capacity of computers to retain metadata and even deleted material, one cannot treat an electronic storage device like a handbag simply because you can put things in it and then carry it onto a plane. As the court observed in Cotterman:
709 F.3d at 964-65. Judges across the country have strained to select artful metaphors to use when comparing digital devices to containers ranging from slim leather valises to shipping containers, but this Court will not engage in that semantic exercise because the fact is, the metaphors do not fit. As the District Court in Maryland put it in Saboonchi, "a forensic search is sui generis":
990 F.Supp.2d at 568.
But when faced with the task of applying eighteenth-century principles to this twenty-first-century technology, the Ninth Circuit and the District Court in Maryland adopted slightly different approaches. Cotterman concluded that a forensic search of an imaged computer was as invasive of the defendant's privacy as a strip search, 709 F.3d at 966, and it concluded that reasonable suspicion was required before investigators could engage in that sort of examination. Id. at 962. ("It is the comprehensive and intrusive nature of a forensic examination—not the location of the examination—that is the key factor triggering the requirement of reasonable suspicion here. . . . Agent Owen used computer forensic software to copy the hard drive and then analyze it in its entirety, including data that ostensibly had been deleted."). The court expressed "confidence in the ability of law enforcement to distinguish a review of computer files from a forensic examination," noting that "it requires that officers made a commonsense differentiation between a manual review of files on an electronic device and the application of computer software to analyze a hard drive." Id. at 967.
The Saboonchi court took issue with the Ninth Circuit's failure to define precisely what a "forensic" search might be. See 990 F.Supp.2d at 552-58. It attacked the question by differentiating a "routine" border search from a non-routine border search and creating its own test for distinguishing the "forensic" examination for which reasonable suspicion is required from a "conventional" computer search. Id. at 560-69.
Id. at 560-61. By contrast, "[i]n a forensic search of electronic storage, a bitstream
Which sort of search was conducted here? Another way to phrase the inquiry might be: the Supreme Court has stated that "[r]outine searches of the persons and effects of entrants are not subject to any requirement of reasonable suspicion, probable cause, or warrant," Montoya de Hernandez, 473 U.S. at 538, 105 S.Ct. 3304, but was this search "routine"?
The record reflects that the examination of Kim's laptop fell somewhere on the spectrum between the two poles described by other courts.
Certainly no one simply turned it on and perused the files as might have been possible at the border. By making an exact copy of the hard drive and retaining it so that it could be subjected to a series of searches, using whatever software investigators deemed necessary, for a period of unlimited duration, the investigators gave themselves the luxury of the one thing that is absolutely not available on the jetway: time. This, in and of itself, was one of the key factors identified in Saboonchi as differentiating a routine border search from a non-routine border search. 990 F.Supp.2d at 547.
In addition, the search was facilitated by the application of additional forensic software that was not already loaded onto the computer, 4/8 Tr. at 10, which was another factor in both Saboonchi and Cotterman underlying the determination that reasonable suspicion was required. 990 F.Supp.2d at 564-66; 709 F.3d at 962, 967.
The Cotterman court placed some emphasis on the fact that the forensic examination there enabled the agents to access even those files that have been deleted. 709 F.3d at 962, 965. And Special Agent Marshall, who conducted the search, attempted to differentiate the search in this case from that sort of "full" forensic examination, which is often called for in cases involving child pornography. 4/8 Tr. at 15-16, 19-20. But the forensic specialist also acknowledged that the term "forensic search" can describe a range of examinations and that the term has no specific definition. 4/8 Tr. at 25. In the Court's view, the fact that the agents in this case did not search the unallocated space for deleted material as they did in Cotterman is not dispositive. Once an entire hard drive has been copied, the investigative imperatives of the case dictate the extent and nature of the examination, and the fact is that here, the agents found what they were looking for sitting in the computer's allocated space and email containers, and they did not need to go further. But they had created a copy of the unallocated space as well in the event a search for deleted matter turned out to be indicated.
The government tried to make the point that the use of the particular forensic search programs here was not significant,
Still, the search here was something of a hybrid, and not quite the scouring that was involved in Cotterman, so did it constitute a "forensic" search under either test?
In the end, the Court is not persuaded that it is necessary to develop law that does not exist in this Circuit on the question of whether and when reasonable suspicion would be constitutionally required, or to articulate a broad rule of general applicability to future searches of electronic media when the technology is constantly changing and the parties have not provided much technical guidance. Because
Riley presented the question of whether the police may search digital information on a cell phone as part of a warrantless search incident to arrest. Id. at 2480. The starting point for the answer was the Fourth Amendment, and the Court reaffirmed two core propositions: first, that "[a]s the text makes clear, `the ultimate touchstone of the Fourth Amendment is reasonableness,'" Id. at 2482, quoting Brigham City, 547 U.S. at 403, 126 S.Ct. 1943; and second, "that `[w]here a search is undertaken by law enforcement officials to discover evidence of criminal wrongdoing, . . . reasonableness generally requires the obtaining of a judicial warrant.'" Id. quoting Vernonia School Dist. 47J v. Acton, 515 U.S. 646, 653, 115 S.Ct. 2386, 132 L.Ed.2d 564 (1995). The Court went on to reiterate that "[i]n the absence of a warrant, a search is reasonable only if it falls within a specific exception to the warrant requirement," and it acknowledged that a search of the person of the accused incident to arrest is such a well-recognized exception. Id.
The Court then reviewed its precedents concerning the lawful scope of a warrantless search of the property found on a suspect. Id. at 2483-84. In Chimel v. California, 395 U.S. 752, 89 S.Ct. 2034, 23 L.Ed.2d 685 (1969), the Court announced that it would be reasonable for an arresting officer to search for any weapons that might endanger the officer's safety or be used to resist arrest or effect an escape, and that it would also be reasonable to search for and seize evidence that might otherwise be concealed or destroyed. Riley, 134 S.Ct. at 2483, citing Chimel, 395 U.S. at 762-63, 89 S.Ct. 2034. In Robinson v. United States, 414 U.S. 218, 94 S.Ct. 467, 38 L.Ed.2d 427 (1973), the Court announced that since an arrest based upon probable cause was itself a lawful intrusion under the Fourth Amendment, no further justification or showing of any actual threat to the arresting officer was needed for the officer to extend the search to encompass property—in that case, a crumpled cigarette package—found on the arrestee's person. Riley, 134 S.Ct. at 2483-84, citing Robinson, 414 U.S. at 234, 94 S.Ct. 467.
But the availability of an exception alone was not enough to end the inquiry in Riley, and ultimately, the Court rejected a "mechanical application" of Robinson.
Id. at 2484-85.
Thus, it appears to this Court that the analysis of whether the search of Kim's laptop was reasonable under the Fourth Amendment does not simply end with the invocation of a statute or the well-recognized border exception, as broad as it may be, and it does not turn on the application of an undefined term like "forensic." Instead, following the approach utilized in Riley, the Court must proceed "`by assessing, on the one hand, the degree to which [the search] intrudes upon an individual's privacy, and, on the other, the degree to which it is needed for the promotion of legitimate governmental interests.'" Riley, 134 S.Ct. at 2484, quoting Wyoming v. Houghton, 526 U.S. 295, 300, 119 S.Ct. 1297, 143 L.Ed.2d 408 (1999). As part of that exercise, the Court should, as the Supreme Court did, consider whether the application of the recognized warrant exception to this particular category of personal property would "`untether the rule from the justifications'" underlying the exception. Id. at 2485, quoting Arizona v. Gant, 556 U.S. 332, 343, 129 S.Ct. 1710, 173 L.Ed.2d 485 (2009). While Riley did not have any reason to catalogue the interests underlying the government's authority to search at the border, the opinion did strongly indicate that a digital data storage device cannot fairly be compared to an ordinary container when evaluating the privacy concerns involved. Id. at 2491.
So what are the justifications underlying the exception to the warrant requirement that pertain at the border? At the outset, it is important to note that we are not dealing with an exception to the Fourth Amendment reasonableness requirement—only an exception to the warrant requirement. See Ramsey, 431 U.S. at 621, 97 S.Ct. 1972. And the fact that the Supreme Court has specifically likened the border search warrant exception to the search incident to arrest exception reinforces the Court's view that an analysis similar to the one in Riley should be undertaken here. Id. ("[The border search exception] is a longstanding, historically recognized exception to the Fourth Amendment's general principle that a warrant be obtained, and in this respect, is like the similar `search incident to lawful arrest' exception. . . .").
The government's power at the border arises out of the sovereign's right and need to protect its territorial integrity and national security. "[S]earches made at the border, pursuant to the longstanding right of the sovereign to protect itself
None of those significant governmental interests in monitoring what comes in to the country apply in this case.
It is true that there is case law that extends the search authority at the border to departures as well, and in particular, to potential violations of the export control laws. See, e.g., United States v. Boumelhem, 339 F.3d 414, 423 (6th Cir.2003) (finding that the government properly searched a large cargo container before it left the United States because "the United States's interest in preventing the export of weapons to other countries also implicates the sovereign's interest in protecting itself"). But Riley indicates that the Fourth Amendment is not necessarily satisfied by a simplistic likening of a computer to a searchable "container."
Applying the Riley framework, the national security concerns that underlie the enforcement of export control regulations at the border must be balanced against the degree to which Kim's privacy was invaded in this instance. And as was set forth above, while the immediate national security
More fundamentally, after hearing all of the facts, the Court cannot help but ask itself whether the examination in this case can accurately be characterized as a border search at all. And if not, it surely cannot be justified by the concerns underlying the border search doctrine.
It is true that Kim's laptop was seized at the border—in this case, LAX—but it was not even opened, much less searched, there. It was transported approximately 150 miles to San Diego, it was retained for a limited period of time, and eventually, the laptop was returned. Meanwhile, there was so little of note found in Kim's luggage, and he posed so little of an ongoing threat to national security, that he was permitted to board his flight.
The Court recognizes that the concept of the "border" for Fourth Amendment purposes extends beyond the physical boundary itself to the "functional equivalent" of the border, which may include "an established station near the border" or other nearby convenient locations. See Alemida-Sanchez v. United States, 413 U.S. 266, 272-73, 93 S.Ct. 2535, 37 L.Ed.2d 596 (1973). And the Ninth Circuit has held that the term "border" should be given a geographically flexible reading within limits of reason derived from the underlying constitutional principles. Castillo-Garcia v. United States, 424 F.2d 482, 485 (9th Cir.1970); see also Alexander v. United States, 362 F.2d 379, 382 (9th Cir.1966) (the legality of a search not in the immediate vicinity of the border "must be tested by a determination whether the totality of the surrounding circumstances, including the time and distance elapsed. . . ."). So if Special Agent Hamako needed the assistance of his forensic team to open the computer in the first instance, and that step was necessarily undertaken at a DHS office rather than on the jetway, that aspect of the proceedings could arguably be considered to be an extension of the border. But while the laptop was within the government's custody and control, it was copied. And it was the exact image of the hard drive that was subjected to the search by the government's forensic team, with the fruits of that search provided to the investigating agent for further study. Indeed, the investigators' sworn testimony to the Court made it clear that the primary, if not the sole, purpose of the pre-planned encounter at the border was to obtain the laptop and search it for evidence.
Once the agents had secured the laptop and preserved every single file and folder it contained for further examination, how does the examination of the copy and the tens of thousands of emails and other files it contained for the next two weeks fall within the definition of a border search, or the statutory provisions found in 19 U.S.C. § 1581(a), at all? And what aspect of the security or territorial integrity of the nation
This case is entirely distinguishable from Castillo-Garcia, which involved continuous surveillance of a car until it was stopped more than 100 miles from the border, 424 F.2d at 485, or United States v. Bilir, 592 F.2d 735, 741 (4th Cir.1979). In Bilir, the court found that a "delayed search and seizure . . . made some three to four miles from the actual border, some seven hours after the observed border crossing; delayed primarily by a desire to confirm developing suspicion; and following practically continuous surveillance in the interval" passed constitutional muster as an extended border search. Id. at 741. In that case, the extended surveillance for the purpose of confirming initial suspicion served to "`maintain[ ] the integrity of the border conditions keeping the search and seizure within the governmental necessities of the border.'" Id. quoting United States v. Fogelman, 586 F.2d 337, 350 (5th Cir.1978) (Brown, C.J., concurring).
Here, the search of the laptop was not predicated on any observation of Kim's activities within the United States whatsoever. And given the extensive nature and duration of the search here and the use of a list of specific search terms, the search "did not possess the characteristics of a border search or other regular inspection procedures. It more resembled the common nonborder search based on individualized suspicion, which must be prefaced by the usual warrant and probable cause standards. . . ." United States v. Brennan, 538 F.2d 711, 716 (5th Cir.1976).
That point is driven home by a review of the warrant application that was filed after the so-called border search was completed. After detailing his own experience and the statutory background, the agent set forth the facts supporting his view that there was probable cause to believe that the computer would contain evidence relating to violations of the Arms Export Control Act. SW Aff. ¶¶ 10-42. First, the agent stated that emails already discovered on the computer revealed that in 2008, Kim had procured six Honeywell accelerometers and shipped them to a Chinese national, who subsequently provided them to two Iranian nationals. SW Aff. ¶¶ 11, 18-40, and Att. A-1. Paragraph 15 then summarizes—in one sentence—the information provided by Yang, and it relates only to the completed transaction in 2008. SW Aff. ¶ 15.
After the affidavit lays out the probable cause, it describes the anticipated computer search protocol: "With the approval of the Court in signing this warrant, agents executing this search will employ the following procedures regarding computers and other electronic storage devices. . . ." SW Aff. ¶ 43. The first step described was "[f]orensic [i]maging," which, of course, had already been accomplished, SW Aff. ¶ 44, and the next step was going to be the "[i]dentification and [e]xtraction of [r]elevant [d]ata." SW Aff. ¶¶ 45-50.
The warrant affidavit goes on for paragraphs explaining the highly technical process
But Special Agent Hamako and the forensics agent both testified that no one performed any searching or extraction after the warrant was obtained at all. 4/7 Tr. at 51; 4/8 Tr. at 23. In other words, the highly challenging and complicated examination of a mind-boggling volume of data was already complete. These undisputed facts militate against the conclusion that the only search that was undertaken—without the warrant—was just a routine border search.
After considering all of the facts and authorities set forth above, then, the Court finds, under the totality of the unique circumstances of this case, that the imaging and search of the entire contents of Kim's laptop, aided by specialized forensic software, for a period of unlimited duration and an examination of unlimited scope, for the purpose of gathering evidence in a pre-existing investigation, was supported by so little suspicion of ongoing or imminent criminal activity, and was so invasive of Kim's privacy and so disconnected from not only the considerations underlying the breadth of the government's authority to search at the border, but also the border itself, that it was unreasonable. Therefore, the motion to suppress the evidence seized as a result of that search, which includes the materials listed in Attachment B-1 to the warrant affidavit, will be granted.
For the reasons stated above, it is ORDERED that defendants' motion to suppress evidence [Dkt. # 35] is GRANTED. It is further ORDERED that a status conference is scheduled for May 18, 2015 at 10:00 a.m. in Courtroom 3.
19 U.S.C. § 1581(a) (internal citation omitted).
