EFTA01207793.pdf

United States v. Kim, — F.Supp.3d (2015) 2015 WL 2148070 Only the Westlaw citation is currently available. West Headnotes (14) United States District Court, District of Columbia. Arrest United States of America 4 -Reasonableness; reason or founded v. suspicion, etc Jae Shik Kim, Karham Eng. Corp., Defendants. Law enforcement officer has reasonable Crim. Action No. 13—oloo (ABJ) J Signed May 8, suspicion of criminal activity, of kind sufficient 2015 to support investigatory stop, if officer can point to specific and articulable facts which, when considered together with rational inferences that Synopsis can be drawn from those facts, indicate that Background: Defendant charged with violating export criminal activity may be afoot. U.S. Const. control laws moved to suppress evidence discovered Amend. 4. during warrantless search of laptop computer that was seized as he was departing from the United States for his Cases that cite this headnote home country of Korea. Holdings: The District Court, Amy Berman Jackson, J., Arrest held that: oiFReasonableness; reason or founded suspicion, etc In mere fact that alien may have previously participated in unlawful export of controlled articles to Iran in violation Court's determination of whether officer had of export control laws did not provide special agent of the reasonable suspicion of criminal activity, of kind Department of Homeland Security (DHS) with reasonable required to support investigatory stop, must be suspicion of any ongoing or imminent criminal activity, based on totality of the circumstances. U.S. of kind sufficient to support seizure and search of Const. Amend. 4. contents of alien's laptop computer as he was departing for his home country of Korea following his most recent visit to the United States; Cases that cite this headnote (2)in assessing reasonableness of search„ it was not appropriate for court to simply categorize the laptop as "container," of kind which may be subjected to warrantless search at border; and PI Arrest (iReasonableness; reason or founded P) search was supported by so little suspicion of ongoing suspicion, etc or imminent criminal activity, and was so invasive of defendant's privacy and so disconnected from not only Reasonable suspicion of criminal activity, of the considerations underlying the breadth of government's kind required to support investigatory stop, is authority to search at border, but also the actual border reasonable suspicion of ongoing or imminent itself, that it was unreasonable and violative of Fourth crime. U.S. Const. Amend. 4. Amendment. Cases that cite this headnote Motion granted. WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 1 EFTA01207793 United States v. Kim, — F.Supp.3d (2015) Customs Duties international border. U.S. Const. Amend. 4. ii-Particular Objects or Products Mere fact that alien may have previously Cases that cite this headnote participated in unlawful export of controlled articles to Iran in violation of export control laws did not provide special agent of the Department of Homeland Security (DHS) with 171 Customs Duties reasonable suspicion of any ongoing or imminent criminal activity, of kind sufficient to 6-Grounds or cause for stop, search, or seizure support seizure and search of contents of alien's laptop computer as he was departing for his Routine searches of the persons and effects of home country of Korea following his most entrants at international border are not subject to recent visit to the United States, where alien had any requirement of reasonable suspicion, business interests in the United States sufficient probable cause, or warrant. U.S. Const. Amend. to explain his frequent visits, where prior 4. incident in which alien allegedly participated in unlawful export of controlled articles to Iran did Cases that cite this headnote not involve his travel to the United States, and where special agent conducted no surveillance of alien while he was in the United States on his latest trip and uncovered nothing during his encounter with alien in airport to suggest any IBI Searches and Seizures ongoing or imminent violation of export laws. it-Fourth Amendment and reasonableness in U.S. Const. Amend. 4. general Ultimate touchstone of validity of search under Cases that cite this headnote the Fourth Amendment is reasonableness. U.S. Const. Amend. 4. Cases that cite this headnote Arrest -4Reasonableness; mason or founded suspicion, etc Evidence of prior criminal conduct alone is 191 Searches and Seizures insufficient to give rise to reasonable suspicion P-Necessity of and preference for warrant, and of ongoing or imminent criminal activity, of exceptions in general kind required to support investigatory stop. U.S. Const. Amend. 4. When search is undertaken by law enforcement officials to discover evidence of criminal wrongdoing, reasonableness generally requires Cases that cite this headnote the obtaining of judicial warrant. U.S. Const. Amend. 4. Cases that cite this headnote 1'1 Aliens, Immigration, and Citizenship 6.-Border Stops and Inspections Customs Duties -4Searches and Seizures Ira Searches and Seizures Government's interest in preventing the entry of -4Necessity of and preference for warrant, and unwanted persons and effects is at its zenith at exceptions in general WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 2 EFTA01207794 United States v. Kim, — F.Supp.3d (2015) longstanding right of the sovereign to protect In the absence of warrant, search is reasonable itself by stopping and examining persons only if it falls within a specific exception to crossing into the country, are reasonable simply warrant requirement. U.S. Const. Amend. 4. by virtue of fact that they occur at the border. U.S. Const. Amend. 4. Cases that cite this headnote Cases that cite this headnote Ittl Customs Duties ti-Particular Objects or Products Itrl Customs Duties iTime and distance factors; checkpoints In assessing the reasonableness, for Fourth Customs Duties Amendment purposes, of law enforcement ti.Scope and Nature; Successive or Secondary agent's conduct in seizing laptop computer of Searches alien suspected of having violated export laws in the past before alien boarded aircraft to return to Law enforcement agent's imaging and search of his home country of Korea, and in having hard entire contents of alien's laptop computer, aided drive copied so that it could be subjected to by specialized forensic software, over period of search of indefinite duration using specialized unlimited duration and conducting examination computer software, it was not appropriate for of unlimited scope, for the purpose of gathering court to simply categorize the laptop as evidence of pre-existing export violation, was "container," of kind which may be subjected to supported by so little suspicion of ongoing or warrantless search at border, especially given imminent criminal activity, and was so invasive the wealth of personal information that could be of alien's privacy and so disconnected from not stored on laptop and fact that actual examination only the considerations underlying the breadth and analysis of contents of laptop's hard drive of government's authority to search at border, occurred over period of weeks at location far but also the actual border itself, that it was removed from border; rather, to determine unreasonable and violative of alien's Fourth constitutionality of agent's conduct, district Amendment rights. U.S. Const. Amend. 4. court had to proceed by assessing, on the one hand, the degree to which search intruded on alien's privacy and, on the other, the degree to Cases that cite this headnote which it was necessary for promotion of legitimate governmental interests. U.S. Const. Amend. 4. Ildj Aliens, Immigration, and Citizenship Cases that cite this hcadnotc tii heckpoints Customs Duties i•Time and distance factors; checkpoints Concept of "border" search, for Fourth 1121 Aliens, Immigration, and Citizenship Amendment purposes, extends beyond the eBorder Stops and Inspections physical boundary itself to the functional Customs Duties equivalent of border, which may include an ti•Searches and Seizures established station near the border or other nearby convenient locations. U.S. Const. Government's power to conduct warrantless Amend. 4. searches at the border arises out of the sovereign's right and need to protect its territorial integrity and national security; Cases that cite this headnote searches made at the border, pursuant to WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 3 EFTA01207795 United States v. Kim, — F.Supp.3d (2015) border to protect the homeland is the beginning and end of the matter. Attorneys and Law Firms But to apply those principles under the facts of this case would mean that the border search doctrine has no Frederick Walton Yette, U.S. Attorney's Office, borders. The search of the laptop began well after Kim Washington, DC, for United States of America. had already departed, and it was conducted approximately 150 miles away from the airport. The government engaged in an extensive examination of the entire contents of Kim's hard drive after it had already been secured, and it accorded itself unlimited time to do so. MEMORANDUM OPINIONAND ORDER There was little or no reason to suspect that criminal activity was afoot at the time Kim was about to cross the border, and there was little about this search—neither its AMY BERMAN JACKSON, United States District Judge location nor its scope and duration—that resembled a routine search at the border. The fundamental inquiry *I In this case involving the enforcement of export required under the Fourth Amendment is whether the control laws and the trade embargo with Iran, defendant invasion of the defendant's right to privacy in his papers Jae Shik Kim has moved to suppress the evidence the and effects was reasonable under the totality of the United States harvested from a laptop computer it seized circumstances, and the Court finds that it was not. from him when he was departing the country through Los Angeles International Airport. Kim is a Korean businessman with business operations in both Korea and California, and in October of 2012, investigators with the Department of Homeland Security obtained information PROCEDURAL HISTORY that he was involved in a previous shipment of controlled articles to a Chinese businessman in Korea, who then On March 28, 2013, Kim and his company, Karham Eng. forwarded them to customers in Iran. The Special Agent Corp. ("Karham"), were indicted for violations of a handling the investigation decided to search Kim's laptop number of statutes, including the International Emergency computer for evidence the next time Kim came to the Economic Powers Act ("IEEPA"), 50 U.S.0 § 1701 et United States, and in December 2012, he obtained the seq., the Arms Export Control Act ("AECA"), 22 U.S.C. computer from Kim before permitting him to board his § 2778, and the International Traffic in Arms Regulation flight home. The next day, the laptop was shipped to an ("ITAR"), 22 C.F.R. pts. 120-30. Indictment [Dkt. N I]. agency forensic specialist in San Diego, who created an These laws and regulations govern economic sanctions identical copy of the hard drive, which was then searched imposed by the United States against certain countries, using specialized software and a list of keywords. The such as Iran, and the export of certain "defense articles" thousands of files that were extracted from the keyword from the United States. The United States alleges that search were then burned onto a DVD and returned to the from around December 2007 through March 2010, case agent for further review. defendants conspired to export defense articles without the required export licenses for sale to intermediaries in After incriminating emails were uncovered through that China and Korea and ultimate customers in Iran. process, the agent sought and obtained a warrant based Indictment ¶ 17. The defense articles at issue—six upon the content of the emails to conduct the search of the Q—Flex Accelerometers, Models QA-2000-10, hard drive that had already been completed and to seize QA-2000-20, or QA-3000—are aircraft parts the emails that had already been reviewed. Those emails manufactured by Honeywell Aerospace which are used in now form a part of the basis of this prosecution, and Kim aircraft and missile navigation systems. Indictment TT 3, moves to suppress that evidence, arguing that his rights 16(1), 17(3). They appear on the export control list, and under the Fourth Amendment of the Constitution have an export license is required before they may be exported been violated. legally from the United States. 22 U.S.C. § 2778(bX2); 22 C.F.R. pt. 123.1(a). The government points to its plenary authority to conduct warrantless searches at the border. It posits that a laptop *2 On March 2, 2015, defendants filed the instant motion computer is simply a "container" that was examined to suppress. Dots.' Mot to Suppress Evidence [Dkt. # 35] pursuant to this authority, and it submits that the ("Defs.' Mot."). The parties briefed the motion, Gov't's government's unfettered right to search cargo at the Opp. to Defs.' Mot. [Dkt. # 37] ("Gov't Opp."); Defs.' WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 4 EFTA01207796 United States v. Kim, — F.Supp.3d (2015) Reply in Supp. of Defs.' Mot. [Dkt. # 38] ("Defs.' at 3; see also 4/7 Tr. at 17. The emails included several Reply"), and the Court held an evidentiary hearing on communications with "Uncle Kim" atJS®karham.co.kr: April 7 and 8, 2015, at which the following facts were established. • an email dated June 24, 2010 from Yang to Kim that stated, "There is an inquiry from a domestic client for Honeywell products. It is not for military application and I confirm the end user is not Iranian," to which Kim responded on the same day, FACTUAL BACKGROUND "Thanks! Raymond, I will also check the Honeywell parts whether [w]e can buy them." A. The Government's Investigation of Bin Yang • emails between Yang and Kim from July 2010 In 2011, Special Agent Kevin Hamako of the Department relating to the purchase of various items not subject of Homeland Security ("DHS") Homeland Security to export controls Investigations office was investigating a Chinese national, Bin Yang, also known as Raymond Yang, for export • an email from almost a year later, dated March 28, control violations, specifically the unlawful export of 2011, in which Yang asked Kim if he could identify accelerometers to China and Iran. Mots. Hr'g Tr., April 7, a source for other parts that are not subject to 2015 ("4/7 Tr.") at 7. As part of the investigation, Special controls: "Dear Uncle Kim Hi. I have the inquiry for Agent Hamako worked with an undercover agent who Honeywell QAT 185/160 model, about 150pcs for communicated with Yang by email and telephone. 4/7 Tr. each model per year. 3pcs is a completed unit. First at 14. trial order, the client will buy 9pcs for each model as a start. Do you have any good sources to supply On April I, 2011, Yang sent the undercover agent an them." On the same date, Kim responded, "Now, Mr email asking to obtain Honeywell QA-3000-30's from Ji are checking it with ow USA office. And also, him, and he offered: "Because my uncle has a sudden Tomorrow, I will go to USA with Mr. Ji and stopped schedule to USA, he may could meet you and pay you." in USA office. We will check it again and feed back Report of Investigation, No. 107, May 20, 2011, Gov't you soon." Ex. 3 ("May 2011 ROI") at 3. *3 • an email from Yang to Kim dated April I, 2011, On April 4, 2011, Yang sent the undercover agent another stating: "I see that you will go to U.S.A, it is very email stating, "My uncle just has his sudden trip to US, he good. For your reference, I get a message that there may meet you and only see the goods and maybe pay is supplier could supply us some stocks of QA3000. you." May 2011 ROI at 3. But I don't have successful business with him before, but we could buy his goods if his stocks are In an April 5, 2011 telephone conversation between Yang ok. Dear Uncle Kim, can you please have a check if and the undercover agent, Yang again volunteered that he you agree. We could pay you, so you can buy it in had a contact who would be traveling to the United States USA.... QAT 185 and 160 are not sensitive products, who could inspect the QA-3000 accelerometers that Yang and if you can supply, we could buy from you, and hoped to buy. May 2011 ROI at 3; 4/7 Tr. at 15-16. Yang there is no worry to pay the deposit, because I trust proposed to have his "uncle" travel to the United States, my uncle." inspect the accelerometers, and provide payment for them. 4/7 Tr. at 15-16. He also stated he did not want his May 2011 ROI at 4-6. "uncle" to physically carry the items out of the country because he was afraid that U.S. customs officials would On April 5, 2011, Yang had the recorded telephone call discover them. 4/7 Tr. at 16; see also Report of with the undercover agent described above in which he Investigation, No. 114, Jun. 22, 2011, Gov't Ex. 2 ("Jun. proposed that his "uncle" could inspect the parts Yang 2011 ROI") at 3 (detailing information about the April 5, hoped to buy. As of May 2011, though, the agents were 2011 telephone call). At that point, the unidentified aware that Yang's inquiry to Kim had borne no fruit and "uncle" became a further subject of the investigation. 4/7 the undercover operation was over. 4/7 Tr. at 72 (stating Tr. at 16. the agents knew "fairly soon after, within maybe a couple of weeks" that the operation was not going ahead). On April 27, 2011, Special Agent Hamako obtained and executed a warrant to search and seize Yang's emails, and on May 12, 2011, he received the emails. May 2011 ROI WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 5 EFTA01207797 United States v. Kim, — F.Supp.3d (2015) B. The Identification of "Uncle Kim" and his On October IS, 2012, Special Agent Hamako interviewed Companies Yang. 4/7 Tr. at 9; see also Report of Investigation No. On June 21, 2011, Special Agent Hamako was able to 146, Nov. 15, 2012, Gov't Ex. 1 ("Nov. 2012 ROI") at identify "Uncle Kim" as defendant Jae Shik Kim by 3-5 (reporting results of the Yang debrief). Yang told searching a government database for theJS investigators that at some point in 2008 or 2009, he ®karham.co.kr email address. 4/7 Tr. at 21-22; Jun. 2011 purchased six QA-2000 accelerometers from Kim, which ROI at 3-4. The email address appeared in U.S. State were shipped to him in China without an export license. Department records on a non-immigrant visa application 4/7 Tr. at 10. Yang said that once he received the submitted by Kim. 4/7 Tr. at 21-22; Jun. 2011 ROI at 3. accelerometers, two of his Iranian customers traveled The application provided Special Agent Hamako with from Iran to China to receive them directly. Id. Yang told other information about Kim, including his date of birth, Special Agent Hamako that Kim purchased the passport number, and nationality. Jun. 2011 ROI at 3-4; accelerometers through his connections in the United 4/7 Tr. at 22. States, and they were shipped from the United States to China. 4/7 Tr. at 11; Nov. 2012 ROI at 3. While this is not From the visa application, Special Agent Hamako also reflected in the report of the interview, Special Agent determined that Kim was president of corporate defendant Hamako testified that Yang also told him that Kim knew Karham. 4/7 Tr. at 22. Through further research, he the accelerometers were destined for customers in Iran. learned that Karham was located in South Korea and 4/7 Tr. at II. Stevenson Ranch, California, and that Karham shared its Stevenson Ranch, California address with a company *4 As a result of the Yang interview, Special Agent called Apex Components. 4/7 Tr. at 22-23; see also Jun. Hamako decided to conduct what he characterized as a 2011 ROI at 3-5 (providing information about the border search of Kim's electronic devices "as he was identification of Kim). leaving the U.S. on his next travel." 4/7 Tr. at 110. Special Agent Hamako researched Karham and Apex I wanted to know when [Kim] was Components and found that Karham was involved in the returning to further my export and sale of equipment used in the oil industry and investigation in the sense that I petrochemical industries, including types of meters. 4/7 wanted to be ready to conduct more Tr. at 24. On a web-based government database, Special proactive steps if he was in the Agent Hamako found approximately thirty-nine shipper's U.S., specifically, to include a export declarations ("SEDs") from Karham for the export border search, surveillance, or other of meters from the United States to Australia and South activities to determine if he was Korea. 417 Tr. at 24. He found eight shipper's export engaged in any potential criminal declarations from Apex Components, which also showed activity while in the United States. exports of various industrial equipment from the United States to South Korea. 4/7 Tr. at 25. 4/7 Tr. at 33. At that time, it was the agent's understanding that no suspicion was required to conduct a Finally, Special Agent Hamako found travel records border search of any items Kim might be carrying, showing that defendant Kim arrived in Los Angeles including electronic devices. 4/7 Tr. at 32. International Airport ("LAX") on April 2, 2011, and departed LAX for Narita, Japan on April 14, 2011. Jun. Because of the ongoing investigation, Kim's name was in 2011 ROI at 4; see also 4/7 Tr. at 26. DHS's case management system, which meant Special Agent Hamako would receive an automatic email if Kim was booked on a flight to or from the United States. 4/7 Tr. at 32-33. Some time later, the agent received an email C. Yang's Arrest and Debrief notifying him that Kim was going to return to the United Early the following year, in January 2012, Yang was States in November 2012, and that he would be departing arrested and, in May 2012, he was extradited from LAX for South Korea on December 5, 2012. 4/7 Tr. at 33. Bulgaria to the United States. 4/7 Tr. at 9. He agreed to be debriefed by U.S. authorities in an effort to ameliorate his sentence. 4/7 Tr. at 9; see also Search Warrant, Ex. B to Defs.' Mot. [Dkt. # 35-2] ("Search Warrant"); Aff. in D. The December 5, 2012 Search of Kim Supp. of Appl. for Search Warrant, Ex. B to Defs.' Mot. Special Agent Hamako testified that while he understood [Dkt. # 35-2] ("SW Aff."), at 7 n.1. that he had the authority to conduct a border search of WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 6 EFTA01207798 United States v. Kim, — F.Supp.3d (2015) Kim without any level of suspicion that Kim was engaged *5 4/7 Tr. at 34-35. He added that based on Yang's in criminal activity, 4/7 Tr. at 34, he had grounds for that statements and Karham's general business activities, he suspicion in any event. was "concerned that [Kim] could be involved in further activity in the [Spates regarding illegal exports." 4/7 Tr. At that time my suspicion was at 39. But he testified that he did not know at the based on the debriefing of Yang in time—and he does not know now—what Kim did while which Yang stated he had he was in the United States between November 25 and previously successfully procured December 5, 2012, and that he did not conduct any ITAR controlled accelerometers surveillance or take any steps to find out before carrying from Mr. Kim, as well as the fact out his plan to obtain the laptop. 4/7 Tr. at 81. that Mr. Kim's company appeared to be engaging in exports from the On December 5, 2012, working with a LAX duty agent U.S. to South Korea and other and Customs and Border Protection officers, Special foreign locations, as well as the fact Agent Hamako conducted the planned search of Kim as that, more recently, Mr. Yang had he departed the country. 4/7 Tr. at 40. First, he searched asked Mr. Kim to view products in Kim's checked luggage, which was located behind the the U.S., inspect them and pay for check-in counter with Korean Airlines. Id. He found no them. accelerometers or contraband. 4/7 Tr. at 82-83. He did find a small plastic bag containing plastic o-rings, some 4/7 Tr. at 35. Special Agent Hamako stated that although unidentified industrial metal objects, and some product he knew Yang was incarcerated, he "wasn't sure if Mr. brochures. 4/7 Tr. at 40-41, 90. The agent was not able to Kim was in contact with other individuals who might be identify the applications of these particular o-rings seeking to illegally procure U.S. goods," and that his goal because he was not an aircraft parts expert, but said that was to ascertain whether Kim had other customers. 4/7 he knew "in other cases the Iranian Air Force had been Tr. at 35-36. Under questioning by the prosecutor at the seeking o-rings for their aircraft," and so he thought that hearing, the agent agreed that he also thought it was these small plastic ones "could be" on the munitions list, reasonable to believe that records of the 2008 and he kept them to determine their application. 4/7 Tr. at transactions, including emails, could still be saved on the 41-42. He later spoke with the manufacturer, and computer. 4/7 Tr. at 38-39. determined "it was very unlikely that they were export controlled items," and shipped them back to Kim. 4/7 Tr. Special Agent Hamako said he intended to conduct a at 43. Special Agent Hamako also testified that the metal border search of Kim as he departed the country rather objects in the luggage did not appear to have any moving than as he entered the country, parts or sensors or electronics and may have been a tripod, and the product brochures "didn't seem to be because if I believed at that time pertinent at the time." 4/7 Tr. at 87-88, 90. So he did not that he was traveling to the U.S. retain either the metal objects or the brochures and did not and might be conducting criminal photograph or document what they were. 4/7 Tr. at 88-89. activity while he was in the U.S., such as procuring products or Next, Special Agent Hamako stopped Kim on the jetway attempting to set up subsequent between the gate and the airplane as Kim was boarding deals, I would want to capture that his flight. 4/7 Tr. at 40, 43. He identified himself and information after he had done so, asked Kim if he had any electronics, to which Kim rather than before he had conducted responded that he had a laptop. 4/7 Tr. at 44. Special any such activity. So, conducting a Agent Hamako told Kim that he would be detaining the border search on the inbound side laptop pursuant to a border search and that he would could cause him to decide not to return it once the search was complete. Id. He also told conduct whatever activities or Kim that he would be detaining the o-rings until their operations he might have been export control status was determined. Id. Special Agent planning. Whereas, conducting the Hamako testified that he did not have an interpreter border search as he was leaving, in during the encounter with Kim because he did not our view, would be more likely to anticipate that he was likely to say anything obtain evidence of any criminal incriminating. 4/7 Tr. at 94. activity he had conducted during his trip. My goal at that time wasn't to WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 7 EFTA01207799 United States v. Kim, — F.Supp.3d (2015) conduct an in-depth interview or Special Agent Marshall explained as follows: subject interview of Mr. Kim, reading him his rights or anything Allocated space, in general, means like that, since my main goal was to space in your hard drive where ... obtain his electronics and then let files are living, files that you see on him go on his way. your desktop, maybe a photo of a family vacation or Word 4/7 Tr. at 95. This is precisely what took place, and Kim documents. Unallocated space boarded his flight. 4/7 Tr. at 45. refers to space that's not currently being used by—let's say it's Special Agent Hamako did not turn the laptop on or Windows, by Windows for any review its contents in any way during his search of Kim at files. And when you delete a file, it LAX. 4/7 Tr. at 45. He explained that "it would be goes into unallocated space.... inappropriate to search his laptop without—without an [U]nallocated space is space that's individual who's qualified to preserve the contents of the not currently being used by the laptop. Because if I were to turn on the laptop and just computer. begin searching it there, that would be altering the information on the laptop and could render any evidence I 4/8 Tr. at 9. found on it tainted or otherwise questionable, since I would be modifying the contents of the laptop by Special Agent Marshall placed the hard drive back into conducting searches on it. And also, because based on the Kim's laptop and returned the laptop to Special Agent time available, it could have taken who knows how long." Hamako on December 7, 2012. 4/8 Tr. at 8.: 4/7 Tr. at 45; see also 4/7 Tr. at I 15 (stating that "conducting a live search on his computer would have Also on December 7, 2012, Special Agent Marshall necessarily changed and altered the contents of the laptop, employed a software program called EnCase to export so I would not have conducted such a search"). Special files from Kim's computer. 4/8 Tr. at 10; see also Dec. Agent Hamako testified, "[M]y main goal was to obtain 2012 ROI at 4 (stating that he used commercially any electronics that he had on his person at that time." 4/7 available email analysis software to export files). He used Tr. at 94. EnCase to export six Microsoft Outlook email containers,' 8,184 Microsoft Excel spreadsheets, 11,315 Adobe PDF files, 2,062 Microsoft Word files, and 879 Microsoft PowerPoint files from the image. Dec. 2012 ROI at 4; see E. The Search of Kim's Computer also 4/8 Tr. at II. *6 On December 6, 2012, Special Agent Hamako submitted Kim's laptop to Special Agent David Marshall Special Agent Marshall used another program, Intella, to of the Homeland Security Investigation San Diego process the files. 4/8 Tr. at 10; see also Dec. 2012 ROI at Computer Forensics Group. Report of Investigation, No. 4. He testified that Intella is a powerful piece of software 147, Dec. 11, 2012, Gov't Ex. 5 ("Dec. 2012 Ron at 1, with a variety of capabilities, including the ability to 3; Mots. Hr'g Tr., April 8, 2015 ("4/8 Tr.") at 7-8;' see search the text of emails that are not otherwise searchable. also 4/7 Tr. at 99-100. Special Agent Hamako "requested 4/8 Tr. at 31. It also indexes and categorizes emails: a border search of the laptop" from Special Agent Marshall. 4/8 Tr. at 8. [A]n e-mail container can contain thousands of e-mails. So Intella To carry out Special Agent Hamako's request, Special will go through and open up the Agent Marshall removed the hard drive from Kim's e-mail, and what we call index and laptop and created a forensic image, or a duplicate copy, categorize the e-mail. So it looks at of it. 4/8 Tr. at 8. To do this, Special Agent Marshall all the e-mail information, the to connected a piece of hardware "about the size of a and the from, the dates, things like shoebox" to the laptop hard drive: the hardware creates that, the attachments, and it "an exact copy, reading every single bit, as we call it, processes those and categorizes all every single piece of data on the hard drive and making a that information so that the user can copy of that for me to analyze later on." 4/8 Tr. at 8-9. then go in and see all the e-mails from a certain person, you know, or The imaged copy included all files from both the to a certain person or on a date. allocated and unallocated space on the computer, which WestlawNexi © 2015 Thomson Reuters. No claim to original U.S Government Works. 8 EFTA01207800 United States v. Kim, — F.Supp.3d (2015) *7 4/8 Tr. at 31-32. And according to Special Agent the Iranian Transactions Regulations, and other statutes Hamako, it would have been "impractical" to use the would be contained in the files on Kim's laptop. SW Aff. search function in Outlook instead; given the 10. The affidavit states that the laptop was detained investigators' search methodologies, "Intella is more during a border search, that the government had imaged efficient." 4/7 Tr. at 105. the laptop, and that Special Agent Hamako reviewed emails obtained from the laptop for ten days. SW Aff. 11 These files were copied to a "case agent review" laptop 16-17. The affidavit then describes the contents of emails for Special Agent Hamako to review. 4/8 Tr. at II. When between Kim and Yang from December 2007 through Special Agent Marshall saw the number of files on the April 2008, showing that Kim helped Yang purchase six laptop, he asked Special Agent Hamako to give him a accelerometers without the required export control keyword list to use to "filter down the amount of license, and that the items were to be forwarded to Iran. information for him to review." 4/8 Tr. at II. SW Aft ¶¶ 18-40. On December 10, 2012, Special Agent Hamako gave The application stated further that, "[w]ith the approval of Special Agent Marshall a list of twenty-two keywords: the Court in signing this warrant, agents executing this QA-2000, QA-3000, G-2000, 7270A, accelerometers, search warrant will employ the following procedures" to gyroscope, angular, sensor, Honeywell, Endevco, search Kim's computer: forensic imaging, which the Northrop, Grumman, ITAR, sensitive, export, shipment, affidavit acknowledged had already occurred, and military, aircraft, missile, satellite, ballistic, and nuclear. identification and extraction of relevant data. SW Aff. 4/8 Tr. at 12-13. Using these keywords to screen the files 43-50. Special Agent Hamako explained: on Kim's laptop, Special Agent Marshall found approximately 5,900 files that had a keyword match. 4/8 *8 Analysis of the data following the creation of the Tr. at 13. He burned the files to a DVD and gave the forensic image can be a highly technical process DVD to Special Agent Hamako, along with the case agent requiring specific expertise, equipment and software. review laptop. Dec. 2012 ROI at 4; 4/8 Tr. at 13. There are literally thousands of different hardware items and software programs, and different versions of The next day, on December 11, 2012, Special Agent the same program, that can be commercially purchased, Marshall exported all of the picture files, which can installed and custom-configured on a user's computer include images of documents and not simply photographs, system. that were located in the allocated space of the sss computer—approximately 24,900 .jpg files. 4/8 Tr. at 13-14; Dec. 2012 ROI at 4. He copied all of those onto another DVD and gave the DVD to Special Agent Analyzing the contents of a computer or other Hamako. 4/8 Tr. at 13-14; Dec. 2012 ROI at 4. electronic storage device, even without significant technical challenges, can be very challenging. Special Agent Hamako then spent "[s]everal days" Searching by keywords, for example, often yields many reviewing the files obtained from Kim's computer, thousands of hits.... Merely finding a relevant hit does conducting keyword searches of the emails and not end the review process. The computer may have documents. 4/7 Tr. at 47; Search Warrant 1 17 (stating stored information about the data at issue: who created that Special Agent Hamako received the emails on it, when and how it was created or downloaded or December 10, 2012 and reviewed them until December copied, when was it last accessed, when was it last 19, 2012). He found emails consistent with the 2008 modified, when was it last printed and when it was transaction Yang described during the interview, and deleted.... Moreover, certain file formats do not lend those form the basis for the criminal charges in this case. themselves to keyword searches.... Many common 4/7 Tr. at 47-48. electronic mail, database and spreadsheet applications do not store data as searchable text. SW Aft. ¶¶ 45-46. F. The Search Warrant On January 13, 2013, Special Agent Hamako filed an According to the agent's affidavit, the "mind-boggling" application for a search warrant in the U.S. District Court amount of data stored on computers makes analyzing the for the Southern District of California. Search Warrant. data "increasingly time-consuming." SW Aff. ¶ 48. He provided an affidavit with the application, in which he Therefore, Special Agent Hamako predicted that "[t]he stated his belief that there was "probable cause to believe identification and extraction process ... may take weeks or that evidence relating to violations" of the ACEA, IEEPA, months." SW Aff. 1j 49. He also averred that the WestlawNext © 2015 Thomson Reuters. No claim to origin