MEMORANDUM OPINION AND ORDER

RANDOLPH D. MOSS, District Judge.

Defendant David Lee Thomas moves to suppress evidence seized from a cell phone left behind in the course of a robbery. Although the government obtained a warrant to search the cell phone, Thomas alleges that the government examined the cell phone's contents before obtaining the warrant. Because the record does not support that contention, the Court will DENY Thomas's motion.

I. FINDINGS OF FACT

At approximately 5:00 p.m. on June 28, 2017, Metropolitan Police Department ("MPD") officers responded to a report of a robbery at a Dunkin Donuts at 4020 Minnesota Avenue, S.E., Washington, D.C. See Dkt. 23-1 at 3. Detective Daren Brake was the lead detective on the scene. Dkt. 31 at 17 (Apr. 5, 2019 Hrg. Tr.). According to Detective Brake, "the [store] clerk advised and the video surveillance confirmed" that a suspect "came into the store," waited until there were no customers present, "pulled a bandana that he had around his neck over his face," and approached the register. Id. at 18. The suspect "had in his hand a red bag and . . . his cell phone," id. at 19, which "appeared to be illuminated as if he might have been talking on it," id. at 18. The suspect then "pulled out a handgun and told the clerk to open the register." Id. at 19. The suspect "opened the bag, and between lifting up his bandana, opening the bag and holding onto the gun, he laid his cell phone down on the counter." Id. The clerk proceeded to place money into the bag after which the suspect exited the store. Id. at 19-20. According to Detective Brake, "[t]he video surveillance does not show the [suspect] picking up the cell phone that he laid down" before fleeing the scene. Id. at 19.

At the crime scene, the MPD recovered a cell phone that, according to the cashier, "was definitely not there" prior to the robbery. Id. at 20. Upon discovering the cell phone, Detective Brake "called the crime scene technician," Officer Jay Gregory, to collect and process the evidence. Id. at 21. Detective Brake did not "recall actually being in possession of the phone" at any point during the crime scene investigation, and he denied that he ever attempted to access any of the digital evidence contained on the cell phone. Id. at 21-22.

Officer Gregory arrived at the crime scene at 6:28 p.m. Id. at 102. He testified that he and two other crime scene technicians spoke with Detective Brake "about the crime scene," and Detective Brake informed Officer Gregory "that there was a cell phone that needed to be recovered." Id. at 70-71. Pursuant to MPD policy, Officer Gregory's colleagues "beg[a]n photographing immediately." Id. at 103. At the evidentiary hearing, the government offered into evidence photographs of the crime scene taken shortly after Officer Gregory arrived. See Gov. Exs. 3-5. The cell phone can be seen resting behind the counter, Gov. Ex. 4, "underneath" a "stand . . . on the counter that had some empty drink cups," Dkt. 31 at 71. According to Officer Gregory, he "put on a pair of rubber gloves[] and . . . picked up [the cell phone] from the counter and placed [it] directly into [a] paper bag." Id. at 75; see also id. at 76 ("I picked the phone up just before I placed it in the paper bag."). That paper bag was then placed in a clear evidence bag, see Gov. Ex. 9, which he initialed and sealed, Dkt. 31 at 81. Officer Gregory transported the cell phone to the MPD's Department of Forensic Science ("DFS") for processing. Id. at 82-83. Back at DFS, Officer Gregory removed the cell phone from the bag, "removed the back cover and removed the battery so that [he could] access the make, model and serial number of the phone," and he recorded that information. Id. at 77-78. He then placed the cell phone back in the paper bag and transferred it to an evidence storage bag, before depositing the cell phone with the Central Evidence Unit. Id. at 79-80. Officer Gregory provided the Central Evidence Unit with his "laboratory information management system ID card." Id. at 82. DFS then created and scanned a bar code for the cell phone and took the cell phone into the evidence storage area. Id. The chain of custody log shows that Officer Gregory deposited the cell phone with the Central Evidence Unit at 7:18 pm on June 28, 2017. Gov Ex. 10 at 1. According to their testimony, neither Officer Gregory nor Detective Brake has seen the cell phone since then. Dkt. 31 at 83; 62.

The chain of custody log shows that the cell phone remained in the Central Evidence Unit until July 6, 2017, when it was retrieved by Samantha Leach, a DFS employee. Gov Ex. 10 at 1. Although Leach did not testify, Officer Gregory explained that "[s]he would have been the one who obtained the swabbing of the phone" for "fingerprints or . . . DNA prior to [the phone] going to digital evidence." Dkt. 31 at 96. Leach returned the cell phone to the Central Evidence Unit at 12:32 p.m.—approximately five hours after retrieving it. Gov Ex. 10 at 1.

The MPD obtained a warrant to search the contents of the cell phone on July 10, 2017, and the warrant return states that the search of the cell phone was "executed" on July 13, 2017. See Gov. Ex. 1. Harry Lee, a forensic scientist then-employed by the digital evidence unit of DFS, testified that he received a copy of the warrant from his supervisor the day after the warrant issued, July 11, 2017, and he began work on analyzing the cell phone that day. Apr. 29, 2019 Hrg. Tr. (Rough at 5-6). Lee retrieved the cell phone from the Central Evidence Unit at 9:07 a.m., Gov. Ex. 10 at 1, placed the cell phone in a "faraday cage"— "a device that blocks all electronic communications in and out of a device," id. (Rough at 7)—and connected the cell phone to a "digital forensic workstation," id. Because "the phone had a device lock," Lee was unable to obtain a full image of the cell phone's contents. Id. (Rough at 8). Lee then requested that a colleague perform a "chip-off technique to retrieve the memory card"—a procedure by which one "disassemble[s]" the device by "melting the solder on the board to loosen the memory" to then "extract the memory card and place it on the memory card reader." Id. (Rough at 9). The chip-off technique "completely dismantled" the cell phone and rendered it inoperable, id. (Rough at 62-63), but enabled Lee to connect the memory card to a memory card reader and begin the process of acquiring the cell phone's contents, id. (Rough at 9-10).

After the acquisition was complete, Lee "tried to find any data that pertain[ed] to the search warrant" and "identified call logs, text message histories, any contacts e-mails, photos, videos and any sound recordings." Id. (Rough at 12). He documented his results in a "mobile device acquisition" report, Gov. Ex. 11. The acquisition report identifies the "acquisition date" as July 11, 2017, and states that the software had "yielded [a] full list of contacts, call logs, text messages, web history, images, videos, audios, etc." Id.; see also (Rough at 58) ("Q. And again, you said the you that the extraction was completed on the 11th? A. Yes."). According to Lee, "the analysis process" was also completed on July 11, 2017. Id. (Rough at 61); see also id. (Rough at 61) ("No more acquisition or analysis work was done after the 11th.").

Lee subsequently prepared a "report of examination," Gov. Ex. 12, which identifies the cell phone's telephone number, user name, and most frequently contacted "names" and "phone numbers." Gov. Ex. 12. Lee testified that he drafted the substance of his report on July 12, 2017, before returning the cell phone to the central evidence locker at 10:46 a.m. Apr. 29, 2019 Hrg. Tr. (Rough at 30-31). Lee further testified that he saved a copy of his report to a CD and notified Detective Brake that he could retrieve the report. Id. at 19-20. Lee did not recall contacting anyone about the contents of the search or his report prior to providing a copy of the report to Detective Brake on July 12, 2017. Id. at 20-21.

The next day, on July 13, 2017, Detective Brake successfully applied for a second search warrant, this time for the search of Thomas's residence on Texas Avenue, S.E., in Washington, D.C. See Gov. Ex. 2. In his supporting affidavit, Detective Brake attested that the cell phone was "processed" by DFS pursuant to the earlier-issued search warrant; id. at 2; that, based on that search, the owner of the cell phone appeared to be "Abe Thomas," id.; and that the MPD was able to ascertain the "phone numbers . . . called most frequently" from the cell phone," id. at 3. "The number called and texted most frequently by the defendant's cell phone," Detective Brake further attested, "was associated in the MPD database with a young woman whose first name is [`Witness One'] who is listed in a police report as being friends with another young woman whose first name is [`Witness Two']." Id. Detective Brake wrote that he also compared photographs on the cell phone with photographs taken on the surveillance footage of several robberies and spoke with an individual at "defendant's last known address," who "was shown a confirmation photograph of the defendant" on July 12, 2017. Id. At the suppression hearing, Detective Brake confirmed that the search of the cell phone provided the basis for the second search warrant, explaining that "we were able to access the call log which . . . led [him] to Witness One which also led [him] to Witness Two." Dkt. 31 at 25. During questioning, Detective Brake stated that he spoke to the witnesses "after [he] obtained the information from the [first] search warrant" and testified: "I obtained that information about July—I said July 13th, and we were trying to move pretty fast on this case. So it would have been around about that time." Id. at 39-40.

The affidavit in support of the second search warrant, however, stated that Detective Brake spoke with Witness One "on Tuesday, July 11, 2017"—that is, a day before Lee completed the "report of examination" and provided a copy of that report to Detective Brake. Gov. Ex. 2 at 2. When confronted with this inconsistency, Detective Brake testified, "I think I have my timeframe confused. I know we did the search warrant, the search warrant on the phone, on July 10th." Dkt. 31 at 41. When pressed that the warrant return for the search of the cell phone indicated that the search was "executed" on "July 13, 2017" at "1400 hours,"—that is, after both July 11, 2017 and July 12, 2017, the two dates that appeared in the second affidavit— Detective Brake stated:

Dkt. 31 at 41-42. He went on:

Id. at 42-43.1

Based on his July 13 affidavit, Detective Brake obtained a search warrant for Thomas's residence on July 13, 2017 and executed the search the following day. See Gov. Ex. 2 at 1. The search recovered, among other items, two red bags, two bandanas, and a silver revolver. Id. at 1. Thomas now moves to suppress all items recovered from the search of his residence and the search of his cell phone, alleging that Detective Brake's affidavit reveals that the MPD conducted a search of his cell phone prior to obtaining the July 10 warrant and that the Court must suppress all fruits of that search.2

II. ANALYSIS

The Fourth Amendment safeguards "[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures" and provides that "no [w]arrants shall issue, but upon probable cause." U.S. Const. amend. IV. The warrant requirement extends to cell phones. See Riley v. California, 573 U.S. 373, 386 (2014). This means that the MPD was required to obtain a warrant before searching Thomas's cell phone and that, had the MPD searched it without a warrant, the Court would need to exclude the evidence found on the cell phone and the evidence found at Thomas's residence as a fruit of that search. See Wong Sun v. United States, 371 U.S. 471, 484 (1963). The present dispute is not about the governing law but about the facts. Thomas contends that the MPD must have searched the cell phone before the warrant issued on July 10, 2017. The government disagrees, arguing that the search did not commence until Lee was able to access the memory card on July 11, 2017. As explained below, the Court finds that the MPD did not conduct a warrantless search of the cell phone.

Thomas posits that two searches occurred: (1) the search that Lee conducted after receiving the first search warrant, which Thomas does not challenge, and (2) an earlier search that Thomas infers the MPD must have conducted before that warrant issued—otherwise, Thomas contends, Detective Brake could not have located and spoken to Witness One on July 11, 2017, before he received Lee's July 12, 2017 report of examination. When, as here, a defendant hypothesizes that an unauthorized, surreptitious search occurred and that the evidence at issue was obtained from that search—and not from a separate, lawful search—the "burden is . . . on the accused in the first instance to prove to the trial court's satisfaction that" the surreptitious search occurred. Nardone v. United States, 308 U.S. 338, 341 (1939); see also 6 Wayne R. LaFave, Search & Seizure § 11.2(b), at nn.61-61 and accompanying text (5th ed., Oct. 2018 update). For present purposes, moreover, the Court need not decide whether, and under what circumstances, the accused may be able to shift the burden of production or proof to the government "by making some showing to contradict the government's assertion" that the hypothesized search did not occur. United States v. Williams, 580 F.2d 578, 586 (D.C. Cir. 1978). Rather, as explained below, regardless of which party carries the burden, the Court finds that no surreptitious search of the cell phone occurred.

Thomas's argument rests on three premises: First, Detective Brake attested in his affidavit in support of the application for a warrant to search the Texas Avenue apartment that he spoke to Witness One on July 11, 2017. Second, Detective Brake testified at the suppression hearing that the MPD identified Witnesses One and Two solely based on the information that Lee provided to him following the search of the phone. Dkt. 31 at 41. Third, Lee did not prepare his report based on the court-authorized search of the cell phone until July 12, 2019—the day after Detective Brake stated that he spoke to Witness One. As Thomas correctly observes, it is difficult to reconcile all three of these premises. Detective Brake concedes as much but testified at the suppression hearing that he must have "confused" the relevant dates. Dkt. 31 at 41. As he put it: "I just had to have been mistaken . . . because . . . there's no way I had [Witness One and Witness Two's] phone numbers prior to the search" that Lee conducted. Id. at 43. Thomas, on the other hand, argues that the Detective Brake's "affidavit under oath should predominate" over his subsequent oral testimony—also made under oath—"unless the Government can come forth with an explanation" as to why the date on the affidavit was incorrect. Dkt. 31 at 141.

As the record reflects, there is an inconsistency in the relevant dates: Lee finalized his report on July 12, but Detective Brake's affidavit states that he spoke to Witness One on July 11. There are three plausible explanations for this inconsistency. First, it is possible that Lee communicated the results of his search to Detective Brake on July 11—after he completed the search but before he prepared his official report—thus enabling Detective Brake to speak to Witness One on that date. Second, Detective Brake may have been mistaken when he attested that he spoke to Witness One on July 11, and he actually spoke to her on July 12. Third, it is possible that, as Thomas posits, the MPD conducted a warrantless search of the cell phone prior to the issuance of the warrant on July 10.3 For several reasons, the Court finds that the record does not support a finding that a search occurred before the July 10, 2017 warrant was issued, leaving only the benign theories as a plausible explanation.

First, Detective Brake consistently, and credibly, testified that he did not "personally recover th[e] cell phone," id. at 21; that he had no recollection of ever actually physically handl[ing] the phone, id. at 66; see also id. at 21-22; that it was DFS that "actually . . . searched the phone," id. at 41; and that "there's no way [he] could have talked to [the witnesses] prior to" receiving the results of that search, id.

Second, the evidence shows that the cell phone was recovered at the scene of the robbery and that the data on the phone was not accessed until Lee retrieved it on July 11 and 12, 2017. The chain of custody log shows that the cell phone was accounted for by DFS at all times from June 28, 2017 until July 12, 2017. See Gov. Ex. 10. According to Lee's testimony, moreover, the cell phone was locked when he retrieved it on July 11, 2017, and he was only able to access its contents by having a colleague perform the chip-off technique—a procedure that necessitated destroying the cell phone. Apr. 29, 2019 Hrg. Tr. (Rough at 62-63). To obtain the data at issue prior to that date, the MPD would have had to access the phone's contents in a manner that left the phone both intact and locked by the time Lee attempted to access it. Thomas has not hypothesized—let alone shown—how Detective Brake, or anyone else, could have done so. This is not a case, for example, where a police officer was able to take custody of a cell phone while a suspect was in the process of using it; to the contrary, the evidence shows that the phone was last used by its owner over forty minutes before the MPD was even called to respond to the robbery. Def. Ex. 2 (call made at 20:04 Coordinated Universal Time ("UTC")).

In an effort to show that it is possible that the MPD accessed the phone at the scene of the robbery, before it was logged into evidence and tracked by the Central Evidence Unit, Thomas notes that "a couple of hours" passed from the time of the robbery until Officer Gregory took custody of the phone, Apr. 29, 2019 Hrg. Tr. (Rough at 73), during this period of time the cell phone was moved, adding to the possibility that someone from the MPD accessed it, Dkt. 31 at 136. Thomas is correct that the cell phone was moved, but the inference he would have the Court draw is unsupported. As Thomas observes, the photographs provided by the government show that, at the time Officer Gregory recovered the phone, it was located behind the counter and to the side of the cash registers, see Gov. Ex. 3, and Officer Gregory conceded on cross-examination it "would [have been] a difficult reach for a customer to place his phone on that side of the counter," Dkt. 31 at 107. Thomas's argument, however, ignores Detective Brake's uncontroverted testimony explaining that the cashier had moved the cell phone:

Dkt. 31 at 22. That explanation is credible and disposes of Thomas's reliance on the location where Officer Gregory recovered the phone.

Third, the Court is unpersuaded by Thomas's contention that the T-Mobile billing records for the cell phone show that someone—presumably from the MPD—repeatedly accessed the phone after it was left on the counter. See Def. Ex. 2. Those records do, in fact, show multiple entries for incoming and outgoing calls occurring between 22:01 UTC (6:01 p.m. EST) on June 28, 2017 and 2:30 UTC on July 7, 2017 (10:30 p.m. EST on July 6, 2017). See id. at 6. According to Thomas, these entries support the inference that, while "the phone is there, a call comes in, [and an MPD officer] picks it up and calls back. Because you see an incoming; outgoing; incoming; outgoing. . . . [suggesting] a call is coming in, and someone immediately calls back." Apr. 29, 2019 Hrg. Tr. (Rough at 77).4 The record, however, does not support that inference, and Thomas declined to call a witness from T-Mobile or an expert to support his theory. To the contrary, for each call entry during the time in question—from the evening of June 28, 2017 (shortly after the robbery) until July 10, 2016 (the date the warrant issued)—the billing record includes service codes that indicate that call forwarding was in effect. Def. Ex. 2. The most plausible explanation of these entries, therefore, is not that they reflect calls made or received by the MPD after the cell phone was recovered, but, rather, calls that were forwarded from the phone to a different number or calls automatically forwarded to the phone's voicemail system. That explanation is further supported by Detective Brake, who was on scene before Officer Gregory and credibly testified that neither he nor "any other officers" made calls using the cell phone and that "[i]f there was any kind of investigation like that, I'd know about it. . . . [N]obody was using that phone." Dkt. 31 at 51-52 ("I can't think of any conceivable way in this investigation where anybody would be making calls on that phone."). And it explains how calls could have been made or received while the cell phone was held by the Central Evidence Unit.

Finally, the chain of custody, in conjunction with the timeline of events, also counsels against Thomas's contention that the MPD surreptitiously searched the cell phone prior to the July 10, 2017 search warrant. The chain of custody shows that the only time that the MPD could have searched the cell phone was on June 28, 2019, prior to Officer Gregory's arrival at the Dunkin Donuts. Yet, Thomas offers no explanation as to why the MPD waited almost two weeks until, according to Detective Brake's affidavit, July 11, 2019 to speak with Witness One. Given that the MPD was "trying to move pretty fast on th[e] case," Dkt. 31 at 30, such a lengthy delay makes little sense. The more plausible inference is that Detective Brake acted on the information as soon as he obtained it, on either July 11 or 12, as a result of information obtained in the courts of Lee's lawful search. The Court cannot say with certainty whether Detective Brake spoke with Witness One on July 11, which was the date Lee first had access to the information and could have relayed it to Detective Brake (although Lee does not recall doing so), or on July 12, which is the date Lee distributed his formal report to Detective Brake. But either of those theories of what happened is more likely than Thomas's theory that someone from the MPD obtained access to the phone (despite what is shown by the chain of custody log), opened the phone (even though it was locked by the time Lee accessed it), and obtained Witness One's telephone number as early as June 28 (yet waited until July 11 to speak to Witness One). Taken as a whole, therefore, the record provides no plausible evidence that anyone from the MPD searched the recovered cell phone prior to July 10, 2017, the date the warrant issued.

CONCLUSION

Defendant's motion to suppress the evidence obtained from the cell phone and the fruits of that search, including the search of the Texas Avenue apartment, Dkt. 21, is, accordingly, DENIED.

SO ORDERED.