MEMORANDUM AND ORDER DENYING APPLICATION FOR SEARCH WARRANT

DAVID J. WAXSE, Magistrate Judge.

The United States has submitted an Application and Affidavit for Search Warrant ("Application") pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A) requiring an electronic communication services provider ("Email Provider"), to disclose copies of electronic communications, including the content of email and other account-related information, for the email accounts ("target email accounts") identified in the Application. Here, the Email Provider is Microsoft Corporation. In the affidavit in support of probable cause, the government alleges that the target email accounts were utilized to obtain, crack, and facilitate the distribution of illicit versions of proprietary software, in violation of 18 U.S.C. §§ 371 (conspiracy), 1029 (access device fraud), 1030 (computer intrusion), 1343 (wire fraud), and 2319 (copyright infringement). The Application seeks a search warrant to obtain ESI in each target email account from Microsoft in its search for fruits, evidence and/or instrumentalities of the violation of those laws. For the reasons discussed below, the Application for search warrant is denied without prejudice.

I. PROPOSED SEARCH WARRANT

The proposed search warrant is structured to identify two categories of information: (1) information to be disclosed by an Email Provider to the government under 18 U.S.C. § 2703, and (2) information to be seized by the government. The first section of the warrant orders Microsoft (the Email Provider) to disclose to the government copies of the following records and other information, including the content of the communications, for each account or identifier associated with the target email accounts:

The second section of the proposed warrant provides:

II. BACKGROUND

For clarity, the Court needs to define or more fully define some terms that will be used throughout this Memorandum Opinion. As this opinion focuses on a warrant for email, the Court will use the term "electronically stored information," or "ESI" for short, to describe the all of the possible information that may be found in an email account. This obviously includes the email communications themselves, but it also includes any other digital data that may reside, or is associated with, the email account, such as contact lists, chat transcripts, calendars, pictures, and files. Basically, anything that can be stored in an email account falls under this umbrella term. The Court will also be using the terms ex ante and ex post, which mean before and after, respectively. Magistrate judges decide ex ante because the facts of the case have not developed—indeed, no case has been filed other than the request for the warrant. District judges decide ex post because the facts of the case have developed already, as the search warrant has been executed. This Court will speak of "ex ante instructions," which simply means a set of instructions—which may contain conditions, limitations, restrictions, or guidelines—given before the warrant is approved but which govern the warrant should it be approved. Similarly, the Court will use the term "search protocol," which is a document submitted by the government explaining to the Court how it will conduct its search of an individual's ESI. A search protocol may set forth how the government will search the ESI, the search software used, the keywords for which the government will search, or what the government will do with ESI that falls outside the scope of the warrant (such as returning or destroying it). Importantly, a search protocol is to inform the Court as to how the government intends to search the ESI. A search protocol may be required as part of a court's ex ante instructions.

Finally, the Court will also be referring to "imaging," which in the technological sense to which the Court is referring means making an exact, duplicate copy—the result of which is an "image." Law enforcement commonly images a seized hard drive in order to perform a search of the data at their forensic lab. This allows the individual to retain the computer or device (assuming they have not been arrested) and allows the government to retain an exact copy of the device as it existed in that particular moment.

III. RELEVANT LAW

A. The Stored Communications Act, 18 U.S.C. §§ 2701 et seq.

The Application seeks authorization to obtain from and search the ESI contained in the email account of a particular customer (suspect) of Microsoft pursuant to the Stored Communications Act of 1986 ("SCA").2 In the email context, a government entity may require an Email Provider to disclose the contents of a wire or electronic communication that has been in electronic storage for 180 days or less pursuant to a warrant issued in compliance with the Federal Rules of Criminal Procedure.3 For contents stored for more than 180 days, the statute authorizes a government entity to require an Email Provider to disclose the contents of the communications under the procedures outlined in subsection (b).4 Section 2703(b)(1)(A) authorizes a government entity to require a provider of remote computing services to disclose the contents of any wire or electronic communication without notice to the subscriber or customer if the government obtains a warrant issued pursuant to the Federal Rules of Criminal Procedure.

B. Federal Rule of Criminal Procedure 41

Federal Rule of Criminal Procedure 41 governs searches and seizures. In 2009, Rule 41 was amended to address ESI. Rule 41(e)(2)(B) sets forth a two-step procedure ("Two-Step Procedure") for warrants seeking ESI. On Step One, "officers may seize or copy the entire storage medium;" on Step Two, officers can review—i.e. search—that copy later "to determine what electronically stored information falls within the scope of the warrant."5 This process is necessary because "computers and other electronic storage media commonly contain such large amounts of information that it is often impractical for law enforcement to review all of the information during execution of the warrant at the search location."6 Importantly, however, the Advisory Committee notes: "[t]he amended rule does not address the specificity of description that the Fourth Amendment may require in a warrant for electronically stored information, leaving the application of this and other constitutional standards concerning both the seizure and the search to ongoing case law development."7

C. The Fourth Amendment to the United States Constitution

Underlying all of the above, of course, is the Fourth Amendment to the United States Constitution. The Fourth Amendment guarantees the right of citizens against unreasonable searches and seizures, providing:

The manifest purpose of the Fourth Amendment particularity requirement is to prevent the Framers' chief evil: general searches.9 A general search "le[aves] to the discretion of the executing officials the decision as to which persons should be arrested and which places should be searched . . . [and] provide[s] no judicial check on the determination of the executing officials that the evidence available justified an intrusion into any particular [place]."10 A warrant must provide the officer conducting the search with sufficiently precise language to allow him or her to determine which items are properly subject to seizure and which items are irrelevant.11 Thus, "[t]he requirement that warrants shall particularly describe the things to be seized makes general searches under them impossible and prevents the seizure of one thing under a warrant describing another."12 In other words, "[a]s to what is to be taken, nothing is left to the discretion of the officer executing the warrant."13 "As the text makes clear, the ultimate touchstone of the Fourth Amendment is reasonableness."14 "A search is undertaken by law enforcement officials to discover evidence of criminal wrongdoing . . . reasonableness generally requires the obtaining of a judicial warrant."15 Such a warrant must: (1) be issued by a neutral magistrate; (2) allow the magistrate to find probable cause to believe that the evidence sought will "aid in a particular apprehension or conviction' for a particular offense;" and (3) describe with specificity the "things to be seized, as well as the place to be searched."16

The Supreme Court has established that judicial scrutiny of proposed search warrants "is intended to eliminate altogether searches not based on probable cause. The premise here is that any intrusion in the way of search or seizure is an evil, so that no intrusion at all is justified without careful prior determination of necessity."17 Determining probable cause in a warrant requires the magistrate judge to decide "whether, given all the circumstances set forth in the affidavit before him, including the veracity and basis of knowledge of persons supplying hearsay information, there is a fair probability that contraband or evidence of a crime will be found in a particular place."18

The Fourth Amendment particularity requirement enables the court to "ensure that the search will be carefully tailored to its justifications, and will not take on the character of the wide-ranging exploratory searches the Framers intended to prohibit."19 It also assures both the court and the individual whose property is searched or seized of the lawful authority of the executing officer, the officer's need to search, and the limits of the officer's power to search.20 "To determine if the place to be searched is particularly described, courts ask whether the description is sufficient `to enable the executing officer to locate and identify the premises with reasonable effort, and whether there is any reasonable probability that another premise might be mistakenly searched.'"21 To determine if the things to be seized are particularly described, there must be language in the warrant that creates a nexus between the suspected crime and the things to be seized.22 Thus, the description of the items to be seized must be confined to "particularly described evidence relating to a specific crime for which there is demonstrated probable cause."23 Taking the above together, the scope of a lawful search is:

III. DISCUSSION

Although there are many cases addressing the Fourth Amendment's particularity requirements as to computer searches, there is little guidance on the particularity that should be applied to search warrants seeking ESI stored with an Email Provider. Due to the sealed nature of applications for search warrants, few reported opinions exist addressing the factors or standards that should be used in determining whether search warrants seeking ESI are sufficiently particular under the Fourth Amendment. In 201225 and 2013,26 this Court denied search warrant applications that requested electronic communications in an email account based upon concerns that the warrants violate the Fourth Amendment's probable cause and particularity requirements. In March27 and April28 of 2014, Magistrate Judge John Facciola of the United States District Court for the District of Columbia denied a similar search warrant for the same reasons.29 Both courts have extended their rationale to search warrants of other electronic devices and web-based services.30 Outsiders wondered if this was the beginning of a "magistrates' revolt."31

A. Developments Since Email II

Since then, other federal magistrate judges have entered the fray.32 In NDCal Email, the court denied a similar search warrant for email. It wrote:

In SDNY Email, however, the court granted a search warrant for email, explaining that the opinions of this Court and Magistrate Judge Facciola too narrowly construe the Fourth Amendment's particularity requirement and are contrary to "copious precedent." The court framed the issues as follows:

As to the first question, the court answered "no" for two reasons. First, it believes "courts have long recognized the practical need for law enforcement to exercise dominion over documents not within the scope of the warrant in order to determine whether they fall within the warrant."36 Second, the court found that the warrant complied the Fourth Amendment because "Rule 41 embodies standards which conform with the requirements of the Fourth Amendment"37 and the warrant implemented Rule 41(e)(2)(B)'s Two-Step Procedure. Moreover, the court perceived "no constitutionally significant difference between the searches of hard drives just discussed and searches of email accounts" because, in many cases, there will be less ESI in an email account than on a personal computer hard drive.38 The court concluded it is well-established that a search warrant can properly permit access to ESI for purposes of a search even where the probable cause showing does not apply to the entirety of the ESI.

As to the second question (could the court require the Email Provider to perform the investigatory search of the emails and produce only the responsive emails falling within the scope of the warrant?), the court found such a requirement would impose undue burdens on all parties involved. It puts the Email Provider's employees in the position of appearing to act as agents of the government. Additionally, those employees are not trained in investigatory techniques thereby hampering the government's interest in effectively investigating suspected criminals. However, the court conceded that "[t]here might be some force to requiring an email host to cull emails from an email account where a limitation in the scope of the items to be seized would allow the email host to produce responsive material in a manner devoid of the exercise of [investigatory] skill or discretion, for example, under a warrant requiring disclosure of all emails from a particular time period."39

"No" was the court's answer to the third question—should the court require the government follow certain protocols (whether as to length of the search, manner of the search, or length of retention of the emails) as a condition of obtaining the warrant? It reasoned that "[j]udging the reasonableness of the execution of a search ex ante, however, is not required by Supreme Court precedent."40 The court further explained that Dalia held "the manner in which a warrant is executed is subject to later judicial review as to its reasonableness"41 and that the Constitution "interpos[es], ex ante, the deliberate, impartial judgment of a judicial officer" and provides "ex post, a right to suppress evidence improperly obtained and a cause of action for damages" for an unreasonable search.42

In passing, the court addressed the indefinite retention of the ESI obtained by the government, one of the concerns raised in Email II, DC Email, and NDCal Email. It assumed without deciding two issues: (1) the court has the power to impose limitations on the retention of ESI at the time a warrant for email is approved; and (2) the court has the power to include search protocols in a warrant, such as the type of search to be conducted. The court declined to impose a search protocol because, while courts may be empowered to include one, courts have never been required to include them, especially in the ESI context.43

On the heels of those magistrate judges' opinions, a federal district court finally weighed in. In Matter of Search of Info. Associated with [redacted]@mac.com that is Stored at Premises Controlled by Apple, Inc. ("DC District Email"),44 the Chief Judge of the United States District Court for the District of Columbia, Richard W. Roberts, vacated Magistrate Judge Facciola's April 7 opinion, finding the government's proposed warrant complied with the Fourth Amendment. Specifically, the court found the place to be searched—[redacted]@mac.com—and the things to be seized—ESI constituting "evidence and instrumentalities of violations of 41 U.S.C § 8702 (Solicitation and Receipt of Kickbacks) and 18 U.S.C. § 371 (Conspiracy), dated between January 14, 2014, to the present, including e-mails referring or relating to a government investigation involving any or all of the following: [individuals and entities have been redacted]"—were described with sufficient particularity.45 Like SDNY Email, the court relied upon the warrant's implementation of Rule 41(e)(2)(B)'s Two-Step Procedure. In its final point, the court acknowledged that searches for ESI may present increased risks to an individual's right to privacy, and thus courts must strike the proper balance "between protecting an individual's right to privacy and ensuring that the government is able to prosecute suspected criminals effectively."46 However, the court did not attempt to balance those interests. While the court wrote "with these considerations in mind," it only listed one consideration:

No counterpoint(s) regarding Americans' right to privacy in their ESI was even mentioned, let alone analyzed. The court simply jumped to the conclusion that, on balance, the unique challenges for law enforcement officials in searching ESI outweighs an individual's right to privacy.

Despite differing conclusions, every court (including this one) that has participated in this discussion agrees on three points: (1) individuals have a right to privacy with respect to email;48 (2) magistrate judges have the authority to impose search protocols but the Fourth Amendment does not require them;49 and (3) the Fourth Amendment does not require the government to delegate its investigatory search of ESI within the target email account to the Email Provider to ascertain what ESI falls under the scope of the warrant. This Court, however, continues to disagree with cases that find the proposed warrants were not overly broad in their authorization for the Email Provider to disclose—without limitation or any concern for the privacy rights of the account holder or any person communicating with that account—all ESI in or associated with the target email account.

B. General Warrant Equals Invasion of Privacy

The chief aim of this Court's email (and cellular phone) opinions has been preventing the issuance of general warrants in the context of ESI. This Court has discussed the abhorrence of "general warrants," which were the chief evil the Framers were concerned with when drafting the Fourth Amendment.50 These days, courts discuss general warrants in boilerplate fashion: a quote or two in the legal standards section of an opinion, backed up with the same general case citations, and with the seemingly sole purpose of reiterating the fact that the court knows it should protect against general warrants. The problem with this framing is that the term "general warrants" fails to grasp courts' attention, having been beaten into rote regurgitation. Perhaps the time has come to reframe the discussion in terms of Americans' right to privacy.51 Privacy has become the main thrust of the Fourth Amendment since Justice Harlan's concurrence in United States v. Katz,52 which outlined the "reasonable expectation of privacy" standard.53 As Justice Scalia wrote: "[T]here is nothing new in the realization that the Constitution sometimes insulates the criminality of a few in order to protect the privacy of us all."54 The proper question is "where the proper balance should be struck."55 The Ninth Circuit believes that courts must strike the proper balance "between protecting an individual's right to privacy and ensuring that the government is able to prosecute suspected criminals effectively."56

The first question is whether an individual has a right to privacy in his or her ESI. The answer is unequivocally yes. The Supreme Court has found privacy interests in telephone communications,57 regular mail,58 text messages on a pager,59 and cellular phones.60 The Sixth Circuit has found privacy interests in email, a decision that remains uncontested.61 Having established an individual has a right to privacy in his or her ESI (here, an email account), the next question is how should the court weigh the individual's right to privacy against the government's ability to prosecute suspected criminals effectively.

Before balancing the interests involved, the Court must first answer a preliminary question: what is privacy? In this context, Vermont Warrant is particularly helpful, as it discusses privacy in great detail.62 There, the state and dissent argued that allowing information to be viewed by a third party (e.g. special master, court-appointed expert, filter team, etc.)—even one behind a firewall—eliminates the individual's legitimate privacy interest. But the Supreme Court of Vermont rejected that argument, wisely noting that not all exposures of data are created equal because "privacy concerns not only our interest in determining whether personal information is revealed to another person but also our interest in determining to whom such information is revealed."63 Exposure of the same information to one person may harm the individual's privacy more than to another. "If an embarrassing or humiliating piece of personal information must be revealed to someone, it is surely worse to have it revealed to the neighborhood busybody or to one's boss than it is to have it revealed to a stranger."64 If a boss discovers embarrassing information about us, the harm may be greater because it may impair our relationship with that boss. Put another way: "Our interests in privacy have to do with relating to others on our own terms."65

The relationship between an individual and a police officer is inherently "asymmetric and laden with potential consequences. Unlike virtually any other person, an investigating police officer has the power to place a citizen at the mercy of the State. We have the greatest interest in keeping our private information from someone who could do the most damage with it."66 Because law enforcement is engaged in the competitive enterprise of ferreting out crime, police officers are, by definition, not a detached individual because they carry a certain perspective. A truly detached individual, like a magistrate judge,

For these reasons, this Court agrees with that court in that one "can[not] draw a categorical line between the probable cause inquiry and considerations of privacy."68 Privacy interests of the person to be searched are always relevant to a judicial officer issuing a warrant because "[p]articularity is not defined in purely physical terms but in terms of how human behavior delineates zones of privacy."69 This is why the Tenth Circuit has repeatedly warned about searches of ESI found on computers.70 The privacy implications are enormous, as Judge Kleinfeld poignantly points out:

The Supreme Court has begun addressing the impact of technology on privacy. In each case, the Court found that, on balance, an individual's right to privacy outweighed the government's interest in effectively prosecuting suspected criminals. In Kyllo v. United States, the Court found a privacy interest in an individual's heat signatures in part because of the implications that data suggests—such as when the "lady of the house takes her daily sauna and bath—a detail that many would consider `intimate.'"72 In United States v. Jones, the Court was concerned about GPS tracking and the data it produces about an individual such as one's "familial, political, professional, religious, and sexual associations."73 In Riley v. California, the Court found a privacy interest in cellular phones because of the vast amount of data about an individual that can be found on the device.74 Email is no different.

So what consequences does authorizing the seizure and/or search of an entire email account have on and individual's privacy? Here are some examples.

While these are just hypothetical examples, the real case of United States v. Ganias highlight the dangers of authorizing, without limitation, the seizure and subsequent search of massive amounts of ESI. Professor Kerr recounts the facts of Ganias:

The Second Circuit, in a now-vacated opinion, held that the 2003 warrant authorized the indefinite seizure of responsive files, but it did not give the agents unlimited authority to indefinitely seize and then use nonresponsive files.76 The Court further held that obtaining the 2006 warrant did not cure the wrongful, permanent seizure of non-responsive files because it "reduces the Fourth Amendment to a form of words."77 So even though the Court has couched its argument in terms of general warrants, the Court is simultaneously discussing Americans' right to privacy and the governmental intrusions into that privacy that these types of warrants authorize. These privacy concerns underlie the remainder of this Memorandum Opinion.

C. Application to the Instant Application

The Application can be divided into two sections, reflecting Rule 41's Two-Step Procedure: Paragraphs 2 and 3 reflect Step One, and paragraph 4 reflects Step Two. Paragraph 2 states the government wishes to search "information associated with [the three target email addresses] that is stored at premises controlled by Microsoft." Paragraph 3 directs Microsoft to disclose to the government "copies of information (including the content of communications) that is within the possession, custody, or control of [Microsoft], including any emails, records, files, logs, or information that has been deleted but is still available to [Microsoft], or has been preserved pursuant to a request made under 18 U.S.C. § 2703(f)."78 Paragraph 4 of the application authorizes the government to review the information provided by Microsoft. It sets limitations on what ESI the government may seize. In this case, the government may seize evidence of the crimes under investigation (conspiracy, access device fraud, computer intrusion, wire fraud, and copyright infringement) that have occurred after a specific time period (September 7, 2008-Present) and/or relate to several named persons and usernames or a web address. None of those limitations applies to paragraphs 2 and 3. The Court will address these separately but in reverse order because the problems with particularity as to the things to be seized underscore the problems with particularity as to the place to be searched.

1. Application Paragraph 4—Step Two, or the Things to be Seized

Paragraph 4 of the Application authorizes the government to review the information provided by Microsoft and specifies what the government may seize for its investigation. The Court remains concerned that the warrant is overly broad as to the things to be seized. Even though the government has established probable cause to seize ESI occurring since September 7, 2008 that is related to violations of specific statutes and/or seven people or entities, the government has not established probable cause as to the rest of the ESI, which it has seized upon disclosure from Microsoft.79 While nothing in § 270380 or Fed. R. Crim. P. 41 may specifically preclude the government from requesting all ESI contained within a specific email account, the Fourth Amendment does.

The Court remains concerned that each of the target email accounts may—and likely do—contain large numbers of emails and files unrelated to the alleged crimes being investigated and/or for which the government has no probable cause to search or seize. Email II explained these warrants are akin to "a warrant asking the post office to provide copies of all mail ever sent by or delivered to a certain address so that the government can open and read all the mail to find out whether it constitutes fruits, evidence or instrumentality of a crime. The Fourth Amendment would not allow such a warrant and should therefore not permit a similarly overly broad warrant just because the information sought is in electronic form rather than on paper."81

Riley bolsters that conclusion.82 While Riley only decided whether a search of a cellphone incident to lawful arrest required a warrant, the Court's dicta concerning the intersection of technology and privacy vis-à-vis the Fourth Amendment nevertheless reinforces this Court's interpretation of the Fourth Amendment's probable cause and particularity requirements and underscores why a search protocol is necessary.

Almost every statement made in Riley with respect to cell phones applies equally to email accounts. "One of the most notable distinguishing features of modern cell phones is their immense storage capacity . . . [of which] the current top-selling smart phone has a standard capacity of 16 gigabytes (and is available with up to 64 gigabytes)"83 A free email account from a major provider such as Google, Yahoo!, or Microsoft comes with at least 15 gigabytes of storage.84 "Cell phones couple that capacity with the ability to store many different types of information . . . [such as] photographs, picture messages, text messages, Internet browsing history, a calendar, a thousand-entry phone book, and so on."85 Email is no different. As with "apps" on cellular phones, "[t]here are [emails] for Democratic Party news and Republican Party news; [emails] for alcohol, drug, and gambling addictions; [emails] for sharing prayer requests; [emails] for tracking pregnancy symptoms; [emails] for planning your budget; [emails] for every conceivable hobby or pastime; [emails] for improving your romantic life."86 Needless to say, a person's email account may reveal their "privacies of life."87

Like cell phones, an email account is often the home of a person's identity—both on- and off-line, but especially on-line. An email address is required for almost every online service, including Facebook, Twitter, Instagram, Amazon, Foursquare, LinkedIn, and TurboTax. Because of this, an email account may contain such an aggregate of information from each online service so as to constructively contain an image of those outside accounts. Consider Facebook. Jane Doe may allow Facebook to send her an email for each friend request, invitation to an event, "like" or comment on their status, private message, or transfer of money to a friend. If the government is allowed to seize and search Jane's entire email account, it could potentially reconstruct Jane's entire Facebook account. Or consider Foursquare, which allows users to "check-in" at a location. Once an Email Provider discloses all ESI associated with a target account, the government may have that individual's whereabouts for the past day, week, month, or even several years, which is precisely what concerned Justice Sotomayor in United States v. Jones.88 The search of an email account "would typically expose to the government far more than the most exhaustive search of a house: [An email account] not only contains in digital form many sensitive records previously found in the home; it also contains a broad array of private information never found in a home in any form."89 The Court is therefore concerned that targeting email addresses may be used as a way to gain a two-for-one warrant special—wherein the government gains both the email account and a reconstruction of the account holder's other social media accounts without obtaining a separate warrant for those accounts.

With those general concerns in mind, the Court will turn to its specific concerns with the instant Application. Paragraph 4 of the application authorizes the government to review of the information provided by Microsoft. It is sufficiently particular in that it links the information to be seized to the alleged crimes—18 U.S.C. §§ 371 (conspiracy), 1029 (access device fraud), 1030 (computer intrusion), 1343 (wire fraud), and 2319 (copyright infringement). It is also sufficiently particular in that it limits the seizure of evidence to that occurring since September 7, 2008. To its credit, the government attempts to be even more particular by limiting its seizure to information "involving [redacted], and others known and unknown." The government has established probable cause as to [redacted]. However, the government has not established probable cause as to [redacted] because those identifiers do not appear in the rest of the application. The Court could infer a connection between those identifiers and other pieces of evidence discussed in the rest of the application.90 But the Court cannot find probable cause based solely on such inferences. This is especially true when dealing with internet accounts, where email addresses and usernames do not necessarily correspond with anything in particular. The government may suspect a John Smith and it may have identified a John1@hotmail.com email account. But without any direct connection between the John1 email account and the particular John Smith the government suspects, the Court cannot find probable cause. After all, there will likely be many Hotmail email accounts using a first or last name and a number (John1, John2, John3, etc.). And the John Smith the government suspects may be the owner of John15@hotmail.com—not John1@hotmail.com. Given that a single character may separate the accounts of a suspect and an innocent person, and because of the massive amounts of data an email account can—and likely does—contain, courts should require a higher showing of particularity. Unlike in search warrants for physical searches, practical accuracy91 may not suffice in the digital world, for the risk of searching and/or seizing innocent peoples' communications is high.92 Accordingly, the government has not shown probable cause to seize ESI related to named people, who are never mentioned in rest of the application and are only connected by inference to some other part of a piece of evidence that is referenced in the rest of the application. The same goes for the username that goes wholly unmentioned, and more importantly lacks any inferential connection to a part of a piece of evidence. For these reasons, the Court finds the government's application lacks probable cause to search for or seize items related to [redacted].

The Court is also concerned with the inclusion of the phrase "and others known and unknown," which follows the list of people, usernames, and the domain name. The Court believes the government included this phrase to cover the seizure of evidence that it may come across during the course of searching the target email accounts. In other words, the Court construes the phrase to mean that, should the government, in its search of the target email accounts, connect the username "Megatron135"93 with either the named statutes or named people for which the government has established probable cause, it be allowed to seize that content even though "Megatron135" was not expressly named in the warrant. Or, as SDNY Email puts it:

This Court believes that phrase runs afoul of the particularity requirement of the Fourth Amendment because of the difference between the physical world and the digital world. As discussed earlier, a single letter or digit could be the difference between an individual for which the government has probable cause and a person for which the government does not have probable cause. For instance, in this case, say the government observes that "pipeline" refers to a particular computer vulnerability. On those facts, this Court might agree that evidence may be seized. In contrast, "Megatron135" may in fact be an innocent third party, whose communications have now been seized even though the government has not shown probable cause that Megatron135 is related to the scheme. Put another way, words referring to drugs present little, if any, risk of constitutional infringement, whereas people's names or usernames— obtained through a search of someone else's email account—present a high risk of constitutional infringement regarding the third party's right to privacy.

Similarly, if the government already suspects other names or usernames, why are they left unnamed in the application? The Court believes this is because the government may not have enough to establish probable cause as to those identifiers—indeed, the government has not shown probable cause as to some of the people or usernames they specifically mention. While SDNY Email and DC District Email may believe this is permissible because Dalia gives law enforcement broad discretion in executing a warrant and such execution is later subject to judicial review as to its reasonableness, this Court is not prepared to authorize a warrant that includes a clause covering every third-party that interacted with a target email account. After all, "[a]s to what is to be taken, nothing is left to the discretion of the officer executing the warrant."95 Here, assuming the Court granted the Application, an executing officer has unlimited discretion. There is a simple fix that alleviates the Courts concerns: get another warrant that outlines the probable cause to seize the communications of these previously unknown but now-suspected third parties. Riley emphasized that technology has increased the speed and efficiency with which law enforcement may obtain a warrant.96

Given the vast amount of information potentially contained in an individual's email account, the Court finds the current Application violates the Fourth Amendment's probable cause and particularity requirements. But, as will be explained later, the Court believes these concerns may be alleviated through the use of ex ante instructions. Before discussing some of those instructions, the Court addresses its concern regarding particularity with respect to the place to be searched.

2. Application Paragraphs 2 & 3—Step One, or the Place to be Searched

Application paragraphs 2 and 3 implement Step One of Rule 41's Two-Step Procedure, which, in turn, addresses the "place to be searched" as used in the Fourth Amendment. "To determine if the place to be searched is particularly described, courts ask whether the description is sufficient `to enable the executing officer to locate and identify the premises with reasonable effort, and whether there is any reasonable probability that another premise might be mistakenly searched.'"97 The Court finds this Application is not sufficiently particular with respect to the place to be searched. SDNY Email and DC District Email both conclude that the identification of the target email address itself—here, [redacted]@hotmail.com—is a sufficiently particular description.98 That view is tempting because, after all, Microsoft will only disclose the ESI of the target email address listed in the warrant, making it virtually impossible that an executing officer might mistakenly search another "premises." But this Court disagrees for two interrelated reasons, and it is for these reasons the Court believes that these types of warrants should include ex ante instructions.

First, as scary as this may sound to those who value privacy, the Court is unaware of any court ever holding that the government lacked probable cause to investigate an email address (or IP address) because it was described as the place to be searched in the warrant.99 Allowing the government to define the "place to be searched" as the target email address— [redacted]@hotmail.com—is problematic. As Georgetown Law Professor Paul Ohm explains,

The Court agrees with the italicized conclusion, as it strains to imagine a scenario where police would lack probable cause to search an email account.101 All a magistrate judge must find for probable cause is a fair probability that contraband or evidence of a crime will be found in a particular place. If that place is an email account, there is almost always a fair probability that evidence of some sort might be found there. Indeed, a person who committed some statutory offense—knowingly or not—may have sent an email to someone that may be of use to the government's investigation. Perhaps the owner sent an email about the act that violated the law, about the victim, or about some other piece of evidence; perhaps one of the account owner's web-based services emailed back registration information that is pertinent to the investigation; or perhaps the email account will identify co-conspirators. Moreover, "steps in online investigations never lead to fragments of IP addresses or pieces of suspicious e-mail addresses."102 "An e-mail address cannot point to short men, or experienced computer users or men with moustaches" nor can it "narrow down the suspect pool without pointing the finger directly at the target, as real-world evidence often does."103 This has led commentators to conclude that the probable cause requirement of the Warrant Clause is essentially meaningless in the digital world.104 This Court agrees, but believes it may be remedied by strengthening the particularity requirement through ex ante instructions.

Second, by describing the place to be searched as the target email address, the government "overseiz[es] data and then using the process of identifying and segregating seizable electronic data `to bring constitutionally protected data . . . into plain view.'"105 Many commentators are concerned with the plain view doctrine in the context of searches for ESI.106 So was the NDCal Email court.107 Riley implicitly shares this concern, observing that the search of a cell phone may be more revelatory than the search of a home.108 Courts have often required109—and the government has often provided110—highly particularized descriptions of the place to be searched in warrants to search a home. "Even in traditional contexts, a judicial officer may restrict a search to only a portion of what was requested—a room rather than an entire house, or boxes with certain labels rather than an entire warehouse."111 In other words, some ex ante constraints—of the form "here, not there"—are perfectly acceptable. The Court wants the same degree of particularization with respect to digital searches. That is why the Court has previously requested the government provide a search protocol that explains how the government intends to search the hard drive(s). As the Supreme Court of Vermont adeptly noted: "In the digital universe, particular information is not accessed through corridors and drawers, but through commands and queries. As a result, in many cases, the only feasible way to specify a particular `region' of the computer will be by specifying how to search."112 By providing a search protocol explaining how the government will separate what is permitted to be seized from what is not, the government can more easily and satisfactorily explain to the court how it will decide where it is going to search. In doing so, the government should not compromise the thoroughness of its description by trying to avoid the use of technical language. In fact, the court wants a "sophisticated technical explanation of how the government intends to conduct the search so that [it] may conclude that the government is making a genuine effort to limit itself to a particularized search."113

Both SDNY Email and DC District Email brush aside the concern about overseizing data in Rule 41's Step One because "[a]mple case authority sanctions some perusal, generally fairly brief, of . . . documents (seized during an otherwise valid search) . . . in order for the police to perceive the relevance of the documents to crime."114 In other words, courts have always allowed overseizure of documents so that the government may sift through them to decide which documents fall within the scope of the warrant and which do not. However, this Court believes that Riley is clear: continuing to apply that physical search precedent to digital searches is ill-suited for today's increasingly digital world because digital searches may reveal far more than a search of a home, which "when it comes to the Fourth Amendment, the home is first among equals."115 Moreover, the precedent upon which SDNY Email and DC District Email rely held so because an on-site search of a computer for the evidence sought by a warrant is not practical or even possible in some instances because of "the technical difficulties of conducting a computer search in a suspect's home."116 Conducting a computer search on-site—at the suspect's home—is often more intrusive to an individual's privacy117 because the search of the vast amount of ESI found on a hard drive may take "months to complete. It would be impractical for agents to occupy an individual's home or office, or seize an individual's computer, for such long periods of time."118 Accordingly, courts have sanctioned Rule 41(e)(2)(B)'s "seize first, search later" Two-Step Procedure.119 To reflect that case law, Federal Rule of Criminal Procedure 41 was amended in 2009, explicitly providing:

As the text makes clear, Rule 41(e)(2) is a codification of courts' recognition that on-site searches of computer hard drives are infeasible and that courts should authorize later, off-site searches (often in the government's forensic laboratories). The Advisory Committee's notes to the 2009 amendments make this explicitly clear: "Computers and other electronic storage media commonly contain such large amounts of information that it is often impractical for law enforcement to review all of the information during execution of the warrant at the search location."121 Finally, the Advisory Committee specifically instructed that "[t]he amended rule does not address the specificity of description that the Fourth Amendment may require in a warrant for electronically stored information, leaving the application of this and other constitutional standards concerning both the seizure and the search to ongoing case law development."122 Thus, SDNY Email and DC District Email's reliance on Rule 41 itself as a basis to find sufficient particularity is misplaced.

In the email context, however, these concerns are completely absent. Law enforcement is never "on-site." No officer steps foot in a suspect's home, and no officer conducts the imaging of the email account. Simply put, Rule 41—both textually and practically—was not intended to apply to searches of email accounts. The obvious counter-argument to this is that, if Rule 41's Two-Step Procedure does not apply, the government is required to be on-site—at Microsoft's server facility.123 It follows that it would be impractical for agents to occupy Microsoft's facility during a search that may take months to complete. While that may be true, the Court is supposed to strike the proper balance "between protecting an individual's right to privacy and ensuring that the government is able to prosecute suspected criminals effectively."124 The individual to whom the Ninth Circuit refers in that quote is the citizen under investigation—not a third party whose only relation to the case is that it stores that particular citizen's ESI. If an individual's use of email—a technology that society has unquestionably embraced—allows the government to circumvent the individual's right to privacy in her ESI by obtaining that ESI through the Email Provider, the individual has—probably unknowingly—outsourced her constitutional right to privacy to providers of remote computing or communications software or tools.125 Americans may be unwilling to make that trade. While the issue of how courts should grapple with that Fourth Amendment oddity is outside the scope of this opinion, the Court discusses the concern because the easy compromise is allowing the government to obtain the full image of the email account from the Email Provider but subjecting it to ex ante instructions. Such a solution strikes the proper balance between an individual's right to privacy and the government's ability to prosecute suspected criminals effectively. Moreover, "the premise of the 2009 amendment—that law enforcement had to open every file and folder to search effectively—may simply no longer be true."126

For these reasons, the Court believes the place to be searched is not sufficiently particular. The Court may sanction the use of the email address as a description of the place to be searched, but only once the government provides a search protocol explaining to the Court how it intends search the overseized-ESI and what it will do with the non-responsive data once the search has been completed. Only then can the Court properly weigh the balance between the government's effective investigation and sanction the wholesale seizure of all ESI in an individual's email account.

For these reasons, the Court finds the instant Application violates the particularity requirement of the Fourth Amendment. Even though the Court finds the instant Application violates the Fourth Amendment's probable cause and particularity requirements, the Court believes many, if not all, of the violations could be cured with court-issued ex ante instructions.

C. Ex Ante Instructions that Help Strike the Proper Balance of Interests

In its previous email opinions, the Court suggested some possible ex ante instructions, including (1) asking the Email Provider to provide specific limited information such as emails containing certain key words or emails sent to/from certain recipients, (2) appointing a special master with authority to hire an independent vendor to use computerized search techniques127 to review the information for relevance and privilege, or (3) setting up a filter group to review the information for relevance and privilege.

The Court notes that the Tenth Circuit has not required a particularized computer search strategy—at least in warrants authorizing searches of computers. The Tenth Circuit has not spoken on the issue of whether email warrants—authorizing an Email Provider to disclose the content of all ESI in or associated with the account—require ex ante instructions, such as a search protocol or some limitations on the government's search of that information. But the Tenth Circuit has suggested an approach for "intermingled documents," in which law enforcement engages in an intermediate step of sorting various types of documents and then only searching the ones specified in a warrant.128 Under this approach, "the magistrate judge should then require officers to specify in a warrant [the] type of files [that are being] sought."129

As noted at the beginning of this opinion, all courts agree that magistrate judges have the authority to impose ex ante instructions but that ex ante instructions have never been required.130 The Court also agrees that some ex ante instructions are unwise or impractical. The Court agrees with the Supreme Court of Vermont that eliminating the plain view doctrine is inappropriate;131 and the Court agrees with SDNY Email and DC District Email that requiring the Email Provider to conduct the entire investigatory search is impractical and burdensome.132 In its previous email opinions, the Court left the suggestion of ex ante instructions—or as it referred to them then, "appropriate procedural safeguard(s)"—up to the government, but the government has yet to suggest any. Instead, the government continues to insist it should be entitled to all ESI in or associated with an individual's email account without limitation. Below are some ex ante instruction options.

1. Categorical or Keyword Limitations

The Court previously suggested that the government could ask the Email Provider to provide specific responsive information based on certain keywords or other criteria.133 This has the advantage of limiting the amount of non-responsive ESI obtained by the government in its initial disclosure/seizure from the Email Provider. Such limitations come in two flavors: categorical and keyword. Categorical limitations limit the breadth of the ESI requested. For example, a date range—here, September 7, 2008 to the present—immediately cuts but does not eliminate the risk that the government is seizing data for which it lacks probable cause. There are other categorical limitations, such as only searching sent mail or excluding emails from certain websites like Facebook or Twitter.134 Categorical limitations are well within the capability of Email Providers and require no investigatory expertise to perform. Neither the Email Provider nor the government is burdened by a categorical limitation like this. Indeed, even SDNY Email concedes that having the Email Provider limit the disclosure to the time period containing the evidence the government wishes to seize—here, that would be September 7, 2008 to the present—may be acceptable.135 The Court believes this type of limitation should be required—indeed, it should be part of a sufficiently particularized warrant.

Keyword limitations limit the responsive ESI to certain terms specified by the government. These terms may include people's names, usernames, email addresses, credit card numbers, dates, social security numbers, email addresses, etc. They might also include generic words like "dolls" or "potatoes."136 Keyword limitations are a step beyond categorical limitations because they are fact specific. As such, they present problems, such as whether the government must apply for a new warrant if its investigation uncovers new keywords for which the government wishes to search. Other courts would argue these problems can be avoided by the district court evaluating the reasonableness of the government's search as a whole ex post. While it is true that is a possible remedy, this Court believes the government should include a list of keywords in its search protocol but that the Email Provider should not be obligated to search for those keywords. Thus, the Email Provider is in no danger of becoming an agent of the government performing the investigatory search. It also gives the district court an idea of what the government believes it will find before it has access to the tranche of data. In this way, it balances the interests between the individual's right to privacy and the government's interest in effectively investigating crime. Put another way: the government gets to overseize and execute its search on its own while the individual gets a document outlining what the government thought it may find before it had access to the tranche of personal data in order to make more concrete arguments at the suppression stage concerning the warrant's scope and the reasonableness of the search.

2. Search Protocol

A search protocol is a document submitted by the government to the Court that explains how the government intends to search the ESI it has obtained after the warrant is approved.137 The Court is not requesting a search protocol in order to dictate how the government executes its warrant.138 Nor is the Court requesting that a search protocol accompany every warrant for ESI to comply with the Fourth Amendment—for instance, a warrant to search a two-gigabyte USB drive will not need a search protocol because of the limited amount of ESI the government can obtain. The Court acknowledges that the government cannot identify the specific region or blocks139 of the email account or hard drive that it needs to search ahead of time. That is why this Court has requested a search protocol, explaining how the government is going to conduct its search to minimize the risk that files outside the scope of the warrant will be discovered. The protocol should explain "how it will perform the search and ensure that it is only searching sectors or blocks of the drives that are most likely to contain the data for which there is probable cause."140 In requesting a search protocol, the Court is not dictating how to execute the warrant. The government is free to determine the best procedures and techniques to use, so long as the government provides notice as to what those procedures are. Indeed, this is perhaps the least intrusive ex ante instruction the Court could impose. All the government must do is educate the Court as to how it intends to minimize the discovery of ESI outside the scope of the warrant.

3. Third Party Search of ESI—Special Masters, Filter Teams, or Court-Appointed Experts

The Court has also suggested that third parties perform the search. The Court could appoint a special master or require filter teams, which are trained computer personnel separate from the investigators and operating behind a firewall. This Court believes the use of special masters or filter teams is the best way to balance the interests between the individual and government. Both are routinely used in civil cases to protect against confidential (e.g. trade secret, patent), privileged (e.g. attorney-client, HIPPA), or irrelevant materials.141 Courts and commentators have advocated using these tools to ensure Fourth Amendment protection is not meaningless in the digital world.142

Court-appointed special masters can hire independent vendors to help sift through the tranche of data disclosed by an Email Provider. Because the special master only turns over responsive data to the government, the individual's right to privacy is protected. While it is true that an individual's right to privacy is intruded upon by the special master, this Court believes the individual would prefer a special master view such private information when the alternative is the government viewing that information. Moreover, this method prevents the government from attempting a Ganias-like prosecution.

Filter teams are similar, except the government gets to supply the search-conducting agents. The caveat is that there must be a complete firewall between the search-conducting agents and the investigating agents that helped secure the warrant. The search-conducting agents would supply the first round of responsive information to the investigating agents. Should the investigating agents need help, they can ask the search-conducting agents to perform another search and will be presented only with the responsive data in that search.

One of the main arguments against special masters and filter teams is cost—both in time and in money. However, this Court does not believe those arguments hold water because criminal investigations always cost the government time and money. In the old days, if police wanted to conduct surveillance, they had to use manpower, costing time and money. To tail a car twenty-four hours a day, police had to pay a police officer(s) to tail the suspect's car. Today, GPS technology has eliminated that cost. Similarly, investigators had to sift through truckloads of paper documents; now, investigators can use computers to search through that same data— faster and more efficiently.143 But that does not mean any cost to the government is unreasonable. Moreover, the SCA specifically provides compensation for Email Providers for their reasonable costs in connection with a § 2703 disclosure.144 If Congress anticipated paying the Email Providers for their trouble, the Court believes paying a special master or filter team is no different. Simply put, under the Fourth Amendment, it is the government's cost of doing business.

Moreover, special masters or filter teams have been routinely authorized by courts in other contexts. For example, third-party filtering or screening teams are frequently used to protect against the disclosure of privileged documents.

An alternative to special masters or filter teams is the use of court-appointed experts under Federal Rule of Evidence 706.145 Assuming the expert consented to appointment, the expert could conduct the search similar to a special master or filter team. While the use of Rule 706 is not commonplace,146 use of Rule 706 "should be reserved for exceptional cases in which the ordinary adversarial process does not suffice."147 The italics emphasize the precise point this Court is making and why it suggests this ex ante instruction: at the warrant stage there is no case and no adversarial process—only ex parte interactions with the government.148 The use of a court-appointed expert, even at this early stage, helps balance the interests and balances the individual's right to privacy and the government's interest in effective prosecution—with respect to the seizure and search authorized by the warrant. The firewall between the court-appointed expert and the government mitigates the potential for Fourth Amendment violations in the first place. And employment of a court-appointed expert balances the adversarial process once it has commenced because the expert's work and process is testimonial, allowing the parties' to examine the expert as a witness at trial. Because the witness is not a government agent, the expert's testimony appears more credible. It also removes any motivation to be dishonest or untruthful about the search in order to protect an investigation or ensure a conviction. For these reasons, the Court believes this is a viable way to ensure the proper balance of interests.

5. Use Restrictions—Returning or Destroying Non-Responsive Data

Courts can also require, ex ante, that the government return or destroy the non-responsive data after a certain time. The government should not be permitted to indefinitely seize non-responsive data, especially if it is permitted to overseize ESI in the first place. As discussed earlier, the facts of Ganias illustrate the serious risks of what can happen when a court fails to use minimization procedures and/or procedural safeguards to limit the amount of ESI to be seized and to provide for the appropriate treatment of non-responsive data.149 Retention limitations are another easily enforceable tool that helps ensure Americans' rights under the Fourth Amendment.

SDNY Email believes there are already adequate remedies in place such as suppression, a civil damages action, and a motion under Rule 41(g); DC District Email notes that destroying or returning the evidence received from an email provider could either expose the government to accusations that it destroyed exculpatory evidence in violation of Brady v. Maryland or hinder the government's ability to lay a foundation for evidence and establish authenticity under Federal Rules of Evidence Rules 901 and 1001-1006.150 These observations, while valid, are simply not the best options because the individual's privacy has already been violated.

Courts have a duty to uphold the Constitution. This duty is not simply to punish those who violate an individual's Constitutional rights (ex post); rather, it is to protect those rights from violation in the first place (ex ante). Courts routinely protect, ex ante, Americans' Constitutional rights through various means, such as protective orders, temporary restraining orders, injunctions, etc. Courts have a duty to protect Americans' right to privacy—not simply punish the government for violating that privacy. Once privacy has been lost, it is a total loss. Privacy is a bell that, once rung, cannot be un-rung. Ex ante instructions help ensure that a bell that should not be rung is not rung. While ex ante instructions may not prevent every governmental intrusion of privacy, courts violate their duty to uphold the Constitution—and thereby protect Americans—by insisting that ex post remedies are good enough. Ganias is evidence of that. Ex post remedies are of little help or consolation to the hypothetical school principal whose livelihood was lost despite never being charged with a crime.

In sum, the Court believes ex ante instructions, in any of the forms discussed above, strike the proper balance between an individual's right to privacy and the government's interest in prosecuting crime. Riley supports search protocols. Ganias illustrates the consequences of giving the government large quantities of ESI, most of which is non-responsive. The trend among commentators is clear: courts should use ex ante instructions. For now, the Court is allowing the government to choose which procedural safeguards it will use.

V. Conclusion

If the Court were to authorize this warrant, it would be contradicting the manifest purpose of the Fourth Amendment's particularity requirement, which is to prevent general searches. Given the substantial amount of data collected by the government upon seizing and searching an individual's entire email account, to issue this warrant would swing the balance between an individual's right to privacy and the government's ability to effectively investigate and prosecute crimes too far in favor of the government. As Justice Scalia wrote: "[T]here is nothing new in the realization that the Constitution sometimes insulates the criminality of a few in order to protect the privacy of us all."151 The proper question is "where the proper balance should be struck."152

Accordingly, the Court again finds that, at the very least, an explanation of the government's search techniques is required in order to determine whether the government is executing its search both in good faith and in compliance with the Fourth Amendment. The Court does not believe that this request will overburden the government. In fact, in Riley, the government advocated—and it can be concluded that the Supreme Court endorsed—the implementation of search protocols:

It is this Court's belief that a search protocol is the most effective mechanism for determining whether the warrant and the search proposed therein are constitutional. The alternative is the Court imposing an ex ante instruction that does dictate the execution of the warrant, such as appointing a special master or filter-team.

In light of this and the Court's previous opinions, the government's present search warrant application must be denied. The government continues to insist it is entitled to all of an individual's email communications, despite only establishing probable cause for part of it and despite admitting it is only interested in seizing evidence after September 7, 2008. The government may resubmit its Application for consideration once it includes a search protocol that addresses the concerns expressed in this opinion or agrees to one of the other ex ante instructions.

IT IS THEREFORE ORDERED BY THE COURT that the application for Search Warrant is DENIED without prejudice. The government may resubmit applications for the requested search warrants, but any such applications should be limited as set forth in this Memorandum and Order.

IT IS SO ORDERED.