FILED
                                                 United States Court of Appeals
                     UNITED STATES COURT OF APPEALS      Tenth Circuit

                                                                   September 3, 2008
                                TENTH CIRCUIT
                                                                  Elisabeth A. Shumaker
                                                                      Clerk of Court
 UNITED STATES OF AMERICA,

              Plaintiff - Appellee,

 v.                                                     No. 07-3062
                                                           D. Kan.
 DOUGLAS WELCH,                                 (D.C. No. 05-CR-20033-JWL)

              Defendant - Appellant.


                           ORDER AND JUDGMENT *


Before MURPHY and O’BRIEN, Circuit Judges, and KANE, ** Senior District
Judge.



      Douglas Welch appeals from a child pornography conviction – more

specifically, the denial of his motions to suppress evidence obtained through the

search of his home and computers. Exercising jurisdiction pursuant to 28 U.S.C.

§ 1291, we affirm.




      *
        This order and judgment is not binding precedent except under the
doctrines of law of the case, res judicata, and collateral estoppel. It may be cited,
however, for its persuasive value consistent with Fed. R. App. P. 32.1 and 10th
Cir. R. 32.1.
      **
        The Honorable John L. Kane, United States District Court for the District
of Colorado, sitting by designation.
                              I. BACKGROUND

      This case results from two separate investigations by the Drug Enforcement

Administration (DEA) into Douglas Welch's activities: the first encompassed

Welch's manufacture of ecstasy and methamphetamine; the second, child

pornography. We recount Welch's drug activities because they bear on how the

DEA obtained some of the child pornography evidence against Welch.

      In June 2000, the DEA received an anonymous tip indicating Welch was

manufacturing ecstasy in his basement. 1 Based on this information, it conducted

five "trash pulls" from Welch's Leawood, Kansas residence during August and

October 2000. The DEA retrieved several empty bottles with labels identifying

common adulterants, precursors and cutting agents used to manufacture ecstasy

and methamphetamine. It also discovered tubing containing trace evidence of

methamphetamine, packing labels and paperwork addressed to Welch. It then

subpoenaed Welch's toll and credit card records. The resulting evidence revealed

Welch ordered and received several shipments from various chemical and

laboratory supply companies between March and May 2000. The contents of the

shipments were consistent with the manufacture of ecstasy and methamphetamine.

      The investigation of Welch stalled after October 2000. But on February 6,

2001, DEA Special Agent Michael Scalise interviewed two of Welch's former

      1
       Welch was alleged to have manufactured two forms of the drug
commonly known as ecstasy and scientifically identified as Gamma-
Hydroxybutric acid (GHB) and 3, 4-methylenedioxymethaphetamine (MDMA).

                                       -2-
computer business partners. One said Welch had a hydrometer delivered to the

office within the previous two years. The other said Welch was running a child

pornography website from his home. Agent Scalise did not follow up on the child

pornography lead; instead he concentrated on the drug investigation.

      Nothing further happened until law enforcement received an anonymous tip

on April 9, 2001, indicating Welch was operating a child pornography website.

DEA Agent Frank Feden investigated the tip further. Feden verified Welch and

his computer company were running a for-profit pornographic website. The first

page of the site contained pornographic images of females between the ages of

two and seventeen. 2

      The drug investigation again stalled until Sherry Peyton, Welch's former

girlfriend, contacted the Leawood Police Department on August 9, 2001. Peyton

said Welch had ejected her from his residence two and a half weeks prior and

would not permit her to retrieve her possessions. She told the officers Welch

manufactured methamphetamine in October 2000 and manufactured ecstasy from

approximately January 2000 to January 1, 2001, when he ceased manufacturing

drugs. Peyton said Welch was storing lab equipment and chemicals in boxes at a

rental home he owned in Overland Park, Kansas. Peyton provided the address

and said William Holt, the father of her child, lived there.


      2
        The record does not reveal why the pornography investigation was not
continued or Welch charged.

                                         -3-
      The DEA obtained a search warrant from a state court judge authorizing the

search of the rental house. There the DEA found approximately thirty boxes,

some of which were marked with Welch's name. Inside some of the marked

boxes the agents found chemicals and glassware consistent with drug

manufacturing. The DEA had Holt deliver approximately seven of the boxes to

Welch's home in Leawood in order to "expand the case as far as [possible]." 3

(Appx. at 148.)

      At approximately 3:00 a.m. on August 10, 2001, Holt knocked on Welch's

door to explain he no longer wanted to store the boxes for Welch. Holt said

Peyton was upset and might contact the police. Welch opened his garage door

and helped Holt unload the boxes from his vehicle. Welch began placing the

boxes in his garage and Holt left the area.

      Once the DEA observed Welch take possession of the boxes, the agents

detained him in his garage. The agents believed Welch's receipt of the boxes

established probable cause for his arrest, negating any need for an arrest warrant.

The agents took Welch inside his residence in order to question him privately.

While inside, the agents performed a protective sweep observing chemicals and



      3
         At the suppression hearing, Agent Scalise testified the delivery was made
with the hope of later obtaining a search warrant for Welch’s residence to seize
other items Welch had purchased. Scalise, however, was unsure of the exact
number of boxes delivered or their contents other than that they contained
“glassware and some chemicals.” (Appx. at 197.)

                                         -4-
glassware in plain view. After being read his Miranda rights, 4 Welch indicated

he purchased glassware from the internet to resell for profit.

      Later that day, Agent Scalise, with help from the United States Attorney's

office, obtained a federal search warrant to search Welch's residence for evidence

of drug manufacturing. The supporting affidavit based probable cause on the

June 2000 anonymous tip, trash pull evidence, Peyton's recent tip, the controlled

delivery, plain view evidence and Welch's statement. The affidavit did not

mention the investigation into Welch's suspected child pornography activities or

his computer business. A warrant issued permitting the DEA to search for:

      MDMA, methamphetamine, precursor chemicals, glassware, any and
      all chemicals and apparatus that either have been or could be used to
      manufacture a controlled substance, drug records, U.S. Currency,
      firearms that may facilitate the possession, protection or distribution
      of MDMA or methamphetamine, formulas containing methods to
      manufacture MDMA or methamphetamine, and computers.


(Appx. at 15.)

      During execution of the search warrant, agents observed numerous

computers and memory storage devices located throughout the house, some of

which were networked together. 5 Vicent Castaldo with the Overland Park Police

Department was brought in by Agent Feden to seize computer equipment under

      4
          See Miranda v. Arizona, 

(1966).
      5
         The record does not reveal how many computers and computer-related
equipment were found in Welch’s home. It does indicate the quantity was
significantly more than might be found in the typical home.

                                         -5-
the warrant and conduct a forensic examination. Because the network of

computers could have been supporting a legitimate business, Castaldo

concentrated on the non-networked computer equipment located in Welch's home

office. He seized two laptop computers, a loose hard drive, forty-two compact

disks, a Jaz drive and some back-up disks and brought these items to the Overland

Park Police Department to be searched.

      Castaldo utilized a software program to search the seized computer

equipment for images of drug labs and glassware without disturbing its contents.

He began by identifying the file folder structure on the memory storage devices.

From there he opened individual folders, viewing twenty-five images at a time in

a gallery view, and looked at the image files with extensions ending in .html (web

page documents), .jpg, .bmp and .gif. 6 He searched for downloaded web page

images which may show the purchase of glassware over the internet and images

of how to design a drug lab. Castaldo also looked for pictures of a person

assembling a drug lab or making drugs. During his search of the unallocated

portion of a seized hard drive, 7 Castlado discovered eleven images of child

pornography which did not have any particular title or description. At that point,



      6
        Files with .jpg, .bmp and .gif extensions indicate the file contains
graphics – a photograph, drawing, chart, etc., but such files can also contain text
or a combination of text and graphics.
      7
        The unallocated portion of a hard drive consists of files which do not
have a formal folder structure and can include deleted files.

                                         -6-
Castaldo felt it was necessary to contact the DEA and seek a search warrant to

look for additional evidence of child pornography. 8

      Agent Feden obtained a supplemental federal search warrant on August 14,

2001. The supporting affidavit based probable cause on information from the

April 9, 2001 anonymous tip and the eleven images Castaldo found during the

search of Welch's computers. Upon obtaining the supplemental search warrant,

Castaldo returned to Welch's residence and seized approximately seventy hard

drives and several compact disks. A further search revealed the child

pornography website Welch had created and a list of its members. The search

also revealed diagrams and terminology related to drug manufacturing.

      In March 2005, Welch was indicted on one count of knowingly and

intentionally possessing more than 600 images of child pornography in violation

of 18 U.S.C. § 2252(a)(4)(B). He filed two motions to suppress the evidence

seized during the search of his home and computers arguing the warrants were

issued in violation of his Fourth Amendment rights.

      The government conceded the warrantless arrest of Welch in the garage

attached to his residence lacked exigent circumstances and thus, some of the

information in the August 10th affidavit after his arrest should not be considered,

      8
         The affidavit supporting the search warrant for child pornography
indicates Castaldo was informed prior to his initial search of Welch’s computers
that Welch maintained an adult pornography website. At the suppression hearing,
however, Castlado testified he was aware of a possible website on the computers
but unaware of its nature prior to his initial search.

                                         -7-
e.g., the fruits of the protective sweep and his statements to the police. However,

the government argued probable cause existed to support the August 10th search

warrant even without this information.

      After an evidentiary hearing the district court denied both motions. The

court found Welch failed to point to any evidence or inference indicating the

issuing judge was swayed by allegedly false or misleading information in the

affidavit. Along this line, the court found the affidavit was not so lacking in

indicia of probable cause for the agents to rely on it in good faith. It specifically

found a minimal nexus between Welch's residence and his suspected criminal

activity through the controlled delivery of boxes to his house. And, based on the

information not excised from the affidavit, the officers had reason to believe

evidence of a crime would be found at his residence. The court further rejected

Welch's contention that much of this information was stale. It found Peyton's

August 9, 2001 tip resurrected the investigation and Welch's acceptance of the

controlled delivery provided a "burst of new evidence" effectively corroborating

and refreshing the allegedly stale information. 9 (Appx. at 84.)

      With regard to the search of Welch's computer equipment, the court

concluded the August 10th search warrant was not invalid merely because it failed

to provide a computer search methodology. It also found the government

      9
         The district court did not explain how Welch’s acceptance of the boxes
was probative. And the government has offered no persuasive explanation in its
brief or when asked at oral argument.

                                          -8-
properly complied with the search warrant's terms. Though the description in the

warrant was not limited to a particular computer, the court found the language

sufficiently enabled the searcher to ascertain and identify the things authorized to

be searched and seized from Welch's computer equipment, namely items related

to drug records, formulas for the manufacture of ecstasy and methamphetamine

and items related to setting up and maintaining a drug manufacturing operation.

Finally, it found Officer Castaldo understood and respected this limit and did not

engage in a fishing expedition beyond the warrant's scope because he terminated

his search after inadvertently finding eleven images of child pornography and

properly sought an additional search warrant to pursue a search for child

pornography.

      After the denial of his motions to suppress, Welch waived his right to a

jury trial and stipulated to case facts with the government. A bench trial was held

on February 1, 2006, where Welch was found guilty. Judgment was subsequently

entered and Welch was sentenced to 60 months imprisonment. 10

                                 II. DISCUSSION

      Welch argues the affidavit supporting the August 10th search warrant for

his home lacked probable cause because it contained stale information. He also

      10
         Welch’s notice of appeal, filed February 23, 2007, is deemed timely
filed even though it was submitted before judgment and sentence. See Fed. R.
App. P. 4(b)(2) (“A notice of appeal filed after the court announces a decision,
sentence, or other – but before the entry of judgment or order – is treated as filed
on the date of and after the entry.”).

                                         -9-
argues the same search warrant was facially overbroad because it failed to

designate which computers could be seized and the execution of the computer

search exceeded the warrant's scope. Finally, Welch argues the August 14th

warrant was obtained as a result of the unlawful execution of the August 10th

warrant and all evidence obtained pursuant to the later warrant should be

suppressed as a fruit of the poisonous tree.

      In reviewing a trial court's disposition of a motion to suppress, "we accept

the factual findings unless they are clearly erroneous, and review questions of law

de novo." United States v. Gonzales, 

, 1228 (10th Cir. 2005).

Whether a warrant is supported by probable cause or is overbroad and whether the

Leon good faith exception applies are all questions of law. See id.; United States

v. Harris, 

, 774 (10th Cir. 1990); see also Untied States v. Leon, 

(1984) (establishing exceptions to the exclusionary rule where law

enforcement officers rely in good faith upon a subsequently invalidated search

warrant). We consider the evidence in the light most favorable to the

government. See United States v. Green, 

, 1104 (10th Cir. 1999).

However, the ultimate determination of reasonableness under the Fourth

Amendment is a question of law. 

10th Search Warrant – Welch's Residence

      1. Probable Cause and Staleness

      The district court did not reach the issue of whether the August 10th search

                                         -10-
warrant lacked probable cause. Rather, it determined the officers acted in good

faith reliance on the judge's decision to issue the warrant. We can assume the

district court would have found probable cause lacking and agree with such a

conclusion. The tip received from Peyton clearly established probable cause to

believe evidence of drug manufacturing would be found at Welch's rental house in

Overland Park. The problem arises with establishing probable cause to believe

evidence of a crime would also be found at his Leawood residence. Welch argues

the affidavit supporting the August 10th search of his residence was based on

stale information which could not support probable cause.

      In determining whether a search warrant was supported by probable cause,

we review "the sufficiency of the affidavit upon which a warrant [wa]s issued by

looking at the totality of the circumstances [to ensure] 'that the [issuing judge]

had a substantial basis for concluding that probable cause existed.'" United States

v. Tisdale, 

, 970 (10th Cir. 2001) (quoting Illinois v. Gates, 

, 238-39 (1983)). We afford the issuing judge's finding of probable cause

great deference unless the affidavit fails to provide that substantial basis. See

United States v. Rowland, 

, 1204 (10th Cir. 1998). However, like

the district court, we disregard the information in the affidavit obtained after

Welch's arrest and, from this view point, assess whether there were sufficient

remaining facts to establish probable cause. See United States v. Cusumano, 

, 1250 (10th Cir. 1996) (en banc) ("In our review, we may disregard

                                         -11-
allegedly tainted material in the affidavit and ask whether sufficient facts remain

to establish probable cause.").

      "It is generally recognized that probable cause is one of probabilities and a

valid warrant may issue when the circumstances before a proper officer are such

that a person of reasonable prudence would believe that a crime was being

committed on the premises to be searched or evidence of a crime was being

concealed there." United States v. Rahn, 

, 292 (10th Cir. 1975); see

also United States v. Corral-Corral, 

, 937 (10th Cir. 1990)

("Probable cause undoubtedly requires a nexus between suspected criminal

activity and the place to be searched."). This belief "cannot be based on stale

information that no longer suggests that the items sought will be found in the

place to be searched." United States v. Snow, 

, 1459 (10th Cir.

1990). "Probable cause existing at some time in the past will not suffice unless

circumstances exist from which it may be inferred that the grounds continued to

the time the affidavit was filed." United States v. Neal, 

, 309 (10th

Cir. 1974).

      Our concern is not with counting the number of days between facts to

support probable cause and the issuance of the search warrant. See United States

v. Shomo, 

, 983-84 (10th Cir. 1986). Rather, we look to "the nature

of the criminal activity, the length of the activity, and the nature of the property

to be seized." 

"Thus, where the property sought is likely to remain in

                                          -12-
one place for a long time, probable cause may be found even though there was a

substantial delay between the occurrence of the event relied on and the issuance

of the warrant." 

court determined Peyton's tip resurrected the stalled drug

investigation against Welch and his acceptance of the boxes gave a burst of new

evidence effectively refreshing any stale information in the affidavit. Recent

evidence of continuing illegal activity may corroborate and refresh dated or stale

information. See United States v. Harris, 

, 1165-66 (10th Cir.

2004) (evidence of drug related activities four years prior to search warrant

sufficiently corroborated and refreshed by events occurring up to a month before

its issuance); United States v. Jardine, 

, 1205 (10th Cir. 2004)

(eight month old evidence of past drug sales refreshed by evidence of attempted

drug sales days prior to issuance of search warrant), vacated on other grounds,

(2005). To be sure, Peyton's tip confirmed prior information in the

hands of the police and provided new information as to the present location of

evidence of a crime (the lab equipment) – Welch's rental house. Peyton's tip,

however, provided no new information connecting the lab equipment to Welch's

residence, in fact it did just the opposite.

      What is known from the anonymous tip and trash pulls is that Welch had

been manufacturing drugs at his residence the previous year. Peyton's tip

corroborated this dated information. However, her information failed to fill in the

                                           -13-
gap in time between the stale information and the search warrant application, thus

distinguishing this case from Harris and Jardine. More important, her

information indicated the drug manufacturing enterprise ceased to exist several

months prior to her statement and the evidence of drug manufacturing had been

moved from Welch's residence to the rental house. Thus, nothing in the affidavit

suggests a continuing criminal drug enterprise at Welch's residence nor does it

contain probable cause to believe evidence of the past manufacturing operation

would still be present there.

      The district court also relied on Agent Scalise's suppression hearing

testimony that someone with a significant investment in glassware and chemicals

would not stop manufacturing methamphetamine, especially if addicted to it. But

nothing in the record indicates Welch was addicted to methamphetamine. And any

inference that he would continue to manufacture drugs because of his investment

in equipment evaporated with Peyton's statement that he stopped manufacturing

and stored the equipment. Peyton's statement was contained in the affidavit and

therefore before the issuing judge.

      Apart from the stricken evidence, the affidavit contained no indication that

additional evidence of drug manufacturing would likely be found at Welch's

residence. So the question necessarily becomes whether the delivery of boxes

from the rental house in Overland Park to Welch's residence creates probable

cause to believe evidence of a crime will be found at the residence. It does not.

                                        -14-
      Welch took possession of the boxes containing lab equipment which could

reasonably imply ownership. And from all of the evidence one could reasonably

infer the contents could have been found at Welch's residence in the past – some

time before they were boxed up and moved. But this does not provide probable

cause to believe additional evidence of drug manufacturing would be found at his

residence. 11 Nor does it provide probable cause for an arrest. Unlike actual drugs

or contraband, the contents of the boxes were not per se illegal. Moreover, the

agents (let alone Welch) were not sure what was in the boxes they had Holt

deliver.

      The information in the affidavit, sans excised material, could not provide a

basis for the issuing judge to conclude there was probable cause to believe

evidence of a drug crime would be found at Welch's residence. That brings us to

the Leon exception.

      2. Leon Good Faith Exception.

      Even though the information supporting the search warrant was insufficient

to establish probable cause, the evidence against Welch need not be excluded if

the agents acted in good faith reliance on the judge's decision to issue the warrant.

The district court concluded the Leon good faith exception was applicable here.

In Leon, the Supreme Court held the purpose of the exclusionary rule is to deter

police misconduct and "suppression of evidence obtained pursuant to a warrant

      11
           What is one to do when a tenant delivers boxes at 3:00 a.m.?

                                        -15-
should be ordered only on a case-by-case basis and only in those unusual cases in

which exclusion will further" that purpose. 

, 918. "Where an officer

acting with objective good faith obtains a search warrant from a detached and

neutral magistrate and the executing officer acts within its scope, there is nothing

to deter." United States v. Nolan, 

, 1184 (10th Cir. 1999).

      The Supreme Court recognized four situations in which an officer cannot be

found to have relied on a warrant in good faith. See 

. We

can easily eliminate three of the four. Welch does not argue the "issuing

magistrate wholly abandoned his judicial role" or the warrant was "so facially

deficient . . . the executing officers [could] not [have] reasonably presume[d] it to

be valid." 

district court he argued the issuing judge "was misled by

information in [the] affidavit that the affiant knew was false or would have known

was false except for his reckless disregard of the truth," but, as the district court

concluded, he failed to point to any evidence or inference proving such an

allegation. 

does not argue this issue on appeal, we deem it

waived. See State Farm Fire & Cas. Co. v. Mhoon, 

, 984 n.7 (10th

Cir. 1994).

      Welch does briefly argue that based on the stale information and lack of

nexus to the Leawood address, the police did not have probable cause to believe

evidence of a crime would be found at his residence. Therefore, "[a] reasonably

well-trained officer should have recognized the warrant's infirmity and would

                                          -16-
have known that the search was illegal despite the magistrate's authorization."

(Appellant's Br. at 14-15.) We read this to argue the warrant was "so lacking in

indicia of probable cause as to render official belief in its existence entirely

unreasonable," the remaining situation from Leon. 

(quotations omitted). On this issue it is the government's burden to prove "its

agents' reliance upon the warrant was objectively reasonable." 

(quotations omitted).

      "Just as reviewing courts give 'great deference' to the decisions of judicial

officers who make probable-cause determinations, police officers should be

entitled to rely upon the probable-cause determination of a neutral magistrate

when defending an attack on their good faith for either seeking or executing a

warrant." 

"This is particularly true, where, as here, with the benefit of

hindsight and thoughtful reflection, reviewing judges still cannot agree on the

sufficiency of the affidavit." 

ordinary case, an officer cannot be expected to question the
      magistrate's probable-cause determination or his judgment that the
      form of the warrant is technically sufficient. Once the warrant
      issues, there is literally nothing more the policeman can do in
      seeking to comply with the law. Penalizing the officer for the
      magistrate's error, rather than his own, cannot logically contribute to
      the deterrence of Fourth Amendment violations.

(quotations, citations and internal brackets omitted).

      Such deference, "however, is not boundless." 

Law enforcement

officials "are presumed to have a reasonable knowledge of the law and we

                                          -17-
determine good faith in this context by considering whether a reasonably well

trained officer would have known that the search was illegal despite the

magistrate's authorization." 

(quotations and citation

omitted); but see United States v. Cardall, 

, 1133 (10th Cir. 1985)

("[I]t must . . . be remembered that the knowledge and understanding of law

enforcement officers and their appreciation for constitutional intricacies are not to

be judged by the standards applicable to lawyers."). "For good faith to exist,

there must be some factual basis connecting the place to be searched to the

defendant or suspected criminal activity." 

. When

such a minimal nexus is absent, "the affidavit and resulting warrant are 'so

lacking in indicia of probable cause as to render official belief in its existence

entirely unreasonable.'" 

468 at 923).

      While the expectation of finding evidence of a crime at Welch's residence

does not reach the level of probable cause, our test for good faith requires

significantly less, merely a minimal nexus. The officers knew of Welch's past

drug manufacturing in his residence, confirmed by trash pulls, telephone logs,

anonymous tips and Peyton's statement. The staleness test does not apply with

equal vigor to the minimal nexus test; while it may not be probable that evidence

of drug manufacturing would (at the time of the warrant application) be present at

the residence it was not illogical to suspect it might be. Officer misconduct has

not been shown and the issuing judge found probable cause. The Leon test is

                                          -18-
satisfied. 12

B.     August 10th Search Warrant – Welch's Computers

       Welch argues the August 10th search warrant was unconstitutionally

overbroad because it lacked a limitation on the computers to be seized and

guidance as to the files to be searched. The district court found the term

"computers" to be sufficiently contained within the context of the search for

evidence of drug manufacturing. (Appx. at 85.) It also found Castaldo, the

officer who searched the computers, understood the limitations of the search

warrant and did not conduct a general search.

       "The Fourth Amendment requires that a search warrant describe the things

to be seized with sufficient particularity to prevent a general exploratory

rummaging in a person's belongings." United States v. Carey, 

,

1272 (10th Cir. 1999). We look at the description of the items to be seized

practically and the warrant's language in a common sense fashion. See Davis v.

Gracey, 

, 1478 (10th Cir. 1997). A warrant is sufficiently


       12
          In United States v. Herrera, we interpreted the good-faith exception to
be hinged, to a great extent, upon whose mistake produces the Fourth Amendment
violation. 

, 1250 (10th Cir. 2006.) We stated “because the purpose
underlying this good-faith exception is to deter police conduct, logically Leon’s
exception most frequently applies where the mistake was made by someone other
than the officer executing the search that violated the Fourth Amendment.” 

such a conclusion is dicta, Agent Scalise, who obtained and executed
the warrant, sought guidance and a review of his affidavit from the United States
Attorney’s office prior to applying for the search warrant. [Appx. at 207-208]
Thus, we cannot say he was solely relying on the issuing judge.

                                        -19-
particular "when it enables the searcher to reasonably ascertain and identify the

things authorized to be seized." United States v. Wolfenbarger, 

,

752 (10th Cir. 1982) (quotations omitted). Broad and generic terms may be

sufficient if "the description is as specific as the circumstances and the nature of

the activity under investigation permit." United States v. Leary, 

,

600 (10th Cir. 1988) (quotation omitted). However, the description must be made

"with as much specificity as the government's knowledge and circumstances

allow, and warrants are conclusively invalidated by their substantial failure to

specify as nearly as possible the distinguishing characteristics of the goods to be

seized." 

      In Leary, we invalidated the search warrant because it merely made an

"unadorned reference to a broad federal statue," and authorized the seizure of

"virtually every document that one might expect to find in a . . . company's

office." 

This included documents with no connection to the criminal

activity at issue in the case. Welch argues the August 10th search warrant was

analogous to the warrant issued in Leary and should likewise be deemed

overbroad. See 

We find such similarities lacking.

      The description of the items to be seized in the August 10th search warrant

for Welch's residence, while not a model of clarity, was sufficient for the police

to know which items could be seized. A reasonable interpretation of the warrant's

language confined the computers (and files within them) to be seized and

                                         -20-
searched to those connected with the manufacture of ecstasy and

methamphetamine. It did not merely reference a broad criminal statute or

authorize the seizure of computers connected to the operation of a legitimate

business. Under the circumstances of the case, the DEA had no information

which could have provided further clarity. It had no idea what kinds of computer

equipment it might find. As it turned out, Welch had a significant number of

computers and other computer equipment throughout his house in both business

and personal spaces. Without knowing ahead of time which pieces of equipment

Welch used in conducting his drug business, the DEA could not specifically

identify the computers to be seized. See generally United States v. Perrine, 

, 1199 n.2 (10th Cir. 2008) ("The IP, or Internet Protocol, address is

unique to a specific computer. Only one computer would be assigned a particular

IP address.") (quotations omitted). The DEA was thus limited by the information

it had to describing the computers suspected to be connected to Welch's criminal

activity. The same applies to files and folders within the computers. The folders

are unlikely to be conveniently labeled "Meth Manufacturing Files." More likely

the names would be coded necessitating at least a cursory search of many folders.

The same is true of files. The evidence relating to drug manufacturing could be

in word processing files (e.g., .doc, .docx, .wpd, .rtf, .txt, .wps extensions), spread

sheet or presentation files (e.g., .xls, .xlsx, .ppt extensions), database files (e.g.,

.accdb, .mdb, .ldb, .wdb extensions), internet files (e.g., .html, .mhtml, .xhtml,

                                           -21-
.xml extensions), or graphic files (e.g., .jpg, .bmp, .gif, .tif extensions) to name

just a few. See generally Wikipedia, List of file formats,

http://en.wikipedia.org/wiki/List_of_file_formats (last visited Aug. 28, 2008). It

would not be possible for the warrant to restrict the search by folder name or file

extension. Any guidelines would have to be functional – files likely to contain or

capable of containing evidence related to drug manufacturing – not descriptive to

the point of limiting file type, format or name.

      The warrant's authorization to seize computers was implicitly constrained

by context to those likely to house drug manufacturing information. Likewise the

folders and files to be searched were, by clear implication, also so limited. The

search warrant was not necessarily overbroad. Potential overbreadth concerns

fade to oblivion when the DEA's execution of the warrant is factored into the mix.

It knew it could only seize those computers and files connected to Welch's drug

activities. It understood and respected the warrant's implied limits. It only seized

computers in Welch's home office, declining to remove and inspect computers it

believed could be supporting a legitimate network. Also, when the pornography

files were discovered the DEA halted the search and obtained a warrant

specifically authorizing such a search. See 

.

      Welch also argues the search of his computers exceeded the scope of the

warrant because, without a limitation detailed in the warrant, the officers were




                                          -22-
unable to adopt the search methodology described in Carey. 13 

(outlining approach for law enforcement officers to search computers with

relevant and irrelevant documents intermingled together). In Carey we were

careful to limit the decision to the particular facts of that case. 

Nevertheless, we provided some rough guidance for those conducting searches (as

opposed to those issuing warrants). In Carey, officers discovered child

pornography .jpg images in a directory with sexually suggestive titles while

searching a computer for evidence of a drug crime (pursuant to a warrant

authorizing the search of the computer for drug information). 

Upon that discovery, the officers abandoned the search for drug related

information and focused their file search on pornography. They failed to obtain a

new search warrant authorizing a search for evidence related to the newly

discovered pornography crime. We concluded the officers exceeded the scope of

the drug crime search warrant when they undertook a comprehensive pornography

search with the knowledge that the images with sexually suggestive titles were

most likely child pornography and not drug related. 

We

      13
          Welch asserts the police engaged in a general search of his computers by
failing to distinguish between relevant and irrelevant files. He finds this
particularly egregious given the fact the DEA had previous knowledge of his child
pornography website and implies the police were never interested in searching for
evidence of drugs, but instead for child pornography. While DEA Agent Feden
certainly knew of Welch’s website, the record clearly indicates Officer Castaldo
with the Overland Park Police Department did not have this knowledge ahead of
time. Welch has not argued Castaldo should be charged with this information by
agency theory or otherwise.

                                         -23-
instructed the proper procedure upon discovery of pornography when searching

for evidence of a different crime would be to impound the computer and apply for

a new warrant focused on the pornography, precisely the procedure followed here.

      As we stated in United States v. Brooks, "[t]his court has never required

warrants to contain a particularized computer search strategy. We have simply

held that officers must describe with particularity the objects of their search."

, 1251 (10th Cir. 2005). In some circumstances, "law enforcement

must engage in the intermediate step of sorting various types of documents and

then only search those ones specified in a warrant." 

.

This occurs "[w]here officers come across relevant documents so intermingled

with irrelevant documents that they cannot feasibly be sorted at the site," and in

that case, "the officers must seal or hold the documents pending approval by a

magistrate . . . [t]he magistrate should then require officers to specify in a warrant

which type of files are sought." 

"However, we have not

required a specific prior authorization along the lines suggested in Carey in every

computer search." 

.

      In Brooks, we reiterated the factors requiring a predetermined search

protocol is necessary. See 

We consider: "(1) the object of the

search, (2) the types of files that may reasonably contain those objects, and (3)

whether officers actually expanded the scope of the search upon locating evidence

                                         -24-
of a different crime." 

In this instance, a predetermined search

protocol was not necessary. The object of the search was for evidence of drug

manufacturing. Castaldo looked at .html documents (web pages) and other

images saved as .jpg, .bmp and .gif files on the data storage devices for

information relating to the purchase of glassware and the assembly of a drug lab.

Such evidence could reasonably be contained within these file types. Castaldo's

search in the unallocated portion of the hard drives did not venture beyond the

scope of the search. Logically, someone looking to conceal incriminating images

would delete or hide them under a different name in an unlikely location.

Furthermore, once the eleven images of child pornography were discovered, none

of which had a title suggesting pornographic content, Castaldo ceased searching

and obtained an additional search warrant to look for evidence of this different

crime. He did not expand his search to look for more images. Castaldo's actions

were far more reasonable than in Carey where the officer continued to open image

files with names suggesting their content. The discovery of child pornography

images during Castaldo's search does not, per se, mean he engaged in the type of

general exploratory rummaging we prohibit. Officer Castaldo's actions were

appropriately circumscribed within the bounds of the search warrant.

C.    August 14th Search Warrant – Fruit of the Poisonous Tree

      Finally, Welch argues the August 14, 2001 search warrant was obtained as

a result of the unlawful execution of the August 10, 2001 warrant and all evidence

                                         -25-
discovered pursuant to the later warrant should be suppressed as a fruit of the

poisonous tree. See generally Wong Sun v. United States, 

(1963).

Because the officers acted in good faith reliance on the August 10th search

warrant, and the search of his computer did not violate the Fourth Amendment,

the evidence subsequently obtained need not be suppressed as a fruit of the

poisonous tree.

      AFFIRMED.

                                               ENTERED FOR THE COURT


                                               Terrence L. O’Brien
                                               Circuit Judge




                                        -26-