2nd Circuit limits government searches of electronic records

December 18, 2014

Westlaw Journals Commentary thumbThe 2nd U.S. Circuit Court of Appeals’ recent decision in United States v. Ganias, 755 F.3d 125 (2d Cir. 2014), has opened a new line of defense against government searches of computers or email accounts.  Under Ganias, seized data that is unresponsive to a judicially authorized search must be deleted, or at least protected from a new search, even when the new search is done pursuant to a new warrant.

The exact contours of this right against a new search are unclear, but the 2nd Circuit’s language is fairly broad.  Moreover, while the government has petitioned for rehearing in Ganias, it is challenging only the remedy (suppression of the evidence), and not the court’s finding that the defendant’s Fourth Amendment rights were violated.

The prohibition against searching old seizures for new crimes is, therefore, the law of the 2nd Circuit and may become the law nationwide.  Accordingly, it is worth taking a closer look at Ganias to consider how later cases may apply its logic.

The government’s practice before Ganias

The Justice Department’s typical practice in executing search warrants on computers and email accounts has been to “over seize.”  This process usually has two stages and sometimes has three.

First, the government seizes or copies an entire computer (or the entire contents of an email account) and brings the data to a government office.  Second, the government searches for evidence of the particular crimes detailed in the warrant.  Third, if the government’s investigation later uncovers evidence of other crimes not specified in the warrant, the government can obtain a new warrant and search the previously seized data for evidence of the new crime.

After Ganias, the third step may have to change in the 2nd Circuit.  Even with a new warrant, the government may not be able to search the previously seized data.

The facts of Ganias

Stavros Ganias owned and operated an accounting business.  Two of his clients were firms hired by the U.S. Army to provide maintenance and security at a facility in Connecticut.

In late 2003, Army investigators obtained a warrant to search the offices of Ganias’ accounting business for evidence that his clients had improperly billed the government.  When the investigators arrived, they “copied every file on three computers — including files beyond the scope of the warrant, such as files containing Ganias’ personal financial records.” Ganias was present in his office when the computers were copied, “and he expressed concern about the scope of the seizure.”  One of the agents responded by assuring Ganias that the Army was only looking for files related to Ganias’ clients and that everything else would be purged once they completed their search for relevant files.  While investigators said they were careful to review only data covered by the November 2003 warrant, the investigators did not, in fact, “purge or delete the non-responsive files.”

The investigation continued and, in 2004, was “officially expanded … to include possible tax violations by Ganias.”  In April 2006, almost two-and-a-half years after the Army investigators copied Ganias’ computers, the government obtained a new warrant “to search the preserved images of Ganias’ personal financial records taken in 2003 for evidence of tax crimes.”

In October 2008, nearly five years after the original search, a grand jury indicted Ganias for conspiracy and tax evasion.  Following the denial of his motion to suppress on Fourth Amendment grounds, Ganias was convicted after a jury trial.  The U.S. District Court for the District of Connecticut denied his motion for judgment of acquittal.

The right against new searches of old seizures

The 2nd Circuit reversed the trial court and vacated Ganias’ conviction.  Despite the fact that the government had obtained a second search warrant, the 2nd Circuit ruled that the government had violated the Fourth Amendment and had not acted in good faith.

Specifically, the court determined that the Fourth Amendment does not “permit[] officials executing a warrant for the seizure of particular data on a computer to seize and indefinitely retain every file on that computer for use in future criminal investigations.”

“If the government could seize and retain non-responsive electronic records indefinitely, so [that] it could search them whenever it later developed probable cause, every warrant to search for particular electronic data would become, in essence, a general warrant.”9

Such a result would be directly contrary to the Fourth Amendment, which “was intended to prevent the government from entering individuals’ homes and indiscriminately seizing all their papers in the hopes of discovering evidence about previously unknown crimes.”  Indeed, such searches, conducted under “general warrants,” were “[t]he chief evil that prompted the framing and adoption of the Fourth Amendment.”

Just “[l]ike 18th century ‘papers,’ computer files may contain intimate details regarding an individual’s thoughts, beliefs and lifestyle, and they should be similarly guarded against unwarranted government intrusion.” Accordingly, the court ruled that the government should not retain non-responsive electronic records indefinitely.

Some commentators have taken this discussion of the problems with indefinite detention to mean that the government should delete non-responsive data.  In fact, some have even used the phrase “right to delete,” as a shorthand for the court’s decision.

The 2nd Circuit seems less concerned, however, with whether non-responsive documents are deleted than with whether the documents are used in a new criminal case.  After all, the court did not rule in Ganias that the government had to abandon the practice of over-seizing data and searching that data off-site.

Further, the court left open the possibility that the government could retain the entire computer in order to authenticate its original seizure.  The court simply ruled that “this accommodation does not somehow authorize the government to retain all non-responsive documents indefinitely, for possible use in future criminal investigations.”  Retention is less of a problem than use.

Given this focus on use, it is curious that Ganias placed so much weight on the amount of time the data was retained.  To be sure, the practice of over-seizing is tolerated in large part because of time constraints.  Requiring that a computer be searched at the time and place it is taken would impose excessive costs on both the government and the subject of the warrant.  The subject would have to suffer the government’s presence during a search that could take weeks or months.

If the concern is off-site retention for “possible use in future criminal investigations,” then many of the problems cited by the 2nd Circuit would remain even if the original search had been only a week before.  The government would still be exploiting data that was over-seized and there would still be a danger that the government would use initial over-seizure to gain possession of non-responsive data.

Thus, when lower courts have to apply Ganias, they may have to look behind the case’s particular holding to ask what evil the 2nd Circuit sought to remedy.  As professor Orin Kerr has phrased the question, “Is the real problem here that the government has [over-seized] and is taking unfair advantage of having extra stuff available to it, or is the real problem only that too much time has elapsed before the government is taking that advantage?” 

Future considerations

As a result of the 2nd Circuit’s extensive discussion of timing, future cases will most likely keep the amount of retention time as a central part of the analysis.  Perhaps other factors will also be considered.

For example, a court might consider whether the person whose documents were searched with the first warrant was ever charged.  If the first search led to a charge against that person, it is less likely the government was, like the king’s ministers who inspired the Fourth Amendment, “indiscriminately seizing papers in the hopes of discovering evidence about previously unknown crimes.”

Also, if that person is charged after the first search, and the second warrant is designed to obtain evidence of a different crime, courts might consider the relationship between the charged crime and the crime in the second warrant.  If the two charges are closely related and logically fit in the same indictment, then there is a stronger argument for allowing the search.

Conversely, if the two charges are different enough that they would have to be heard by separate juries, it would seem less fair to allow the government to profit from its initial over-seizure.  That is, a court might consider a certain time period acceptable if a defendant is charged with mail fraud and the second search warrant seeks evidence of bank fraud.

The same reasoning would lead the court to reject the same time period as unacceptable if the second warrant seeks evidence that the mail fraud defendant also distributed child pornography.  In the latter example, the two charges would be unrelated enough that the 2nd Circuit’s concern about general warrants would gain additional force.

The 2nd Circuit has, at least, made clear that two and a half years between the first and second warrant is too long.  The question is what happens in cases with shorter time periods.