EFTA01207766.pdf

U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) of the sovereign to protect itself by stopping and ' KeyCite Yellow Flag • Negative Treatment examining persons and property crossing into Declined to Extend by United States v. Hassanshahi, D.D.C., the country, are reasonable, within meaning of December 1, 2014 the Fourth Amendment, simply by virtue of the 990 F.Supp.2d 536 fact that they occur at the border. U.S.C.A. United States District Court, Const.Amend. 4. D. Maryland, Southern Division. Cases that cite this headnote UNITED STATES of America v. Ali SABOONCHI, et al. Criminal Case No. PWG-13—too. J Signed April 7, 121 Customs Duties 2014. aaGrounds or cause for stop, search, or seizure Routine searches of the persons and effects of entrants at a border are not subject to any Synopsis requirement of reasonable suspicion, probable Background: Defendant, indicted for multiple counts of cause, or warrant. U.S.C.A. Const.Amend. 4. unlawful export to an embargoed country and one count of conspiracy to export to an embargoed country, in violation of the International Emergency Economic Cases that cite this headnote Powers Act (IEEPA) and the Iranian Transactions and Sanctions Regulations (ITSR), moved to suppress evidence obtained during warrantless forensic searches of his smartphones and flash drive. PI Customs Duties i• Searches and Seizures Holdings: The District Court, Paul W. Grimm, J., held Even at the border, Fourth Amendment that: continues to protect against unreasonable searches and seizures. U.S.C.A. Const.Amend. (I) reasonable suspicion was required for performance of 4. forensic searches of digital devices taken from defendant at border, and Cases that cite this headnote (2) reasonable suspicion existed to support such search. Motion denied. Customs Duties ii Searches and Seizures At the border, routine searches become West Headnotes (19) reasonable within meaning of the Fourth Amendment because the interest of the Government is far stronger and the reasonable Ill Customs Duties expectation of privacy of an individual seeking oiSearches and Seizures entry is considerably weaker. U.S.C.A. Const.Amend. 4. Government's interest in preventing the entry of unwanted persons and effects is at its zenith at the international border, and thus searches made Cases that cite this headnote at the border, pursuant to the long-standing right WestlawNext" © 2015 Thomson Reuters. No claim to original U.S. Government Works. 1 EFTA01207766 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) equivalents as well; the functional equivalent of a border may include an established station near the border, at a point marking the confluence of two or more roads that extend from the border, PI Customs Duties or the search of passengers and cargo arriving at p-Grounds or cause for stop, search, or seizure an airport within the United States after a nonstop flight from abroad. U.S.C.A. When a border search stretches beyond the Const.Amend. 4. routine, it must rest on reasonable, particularized suspicion, which is significantly less demanding than the showing of probable cause required to Cases that cite this headnote secure a warrant for a domestic search. U.S.C.A. Const.Amend. 4. Cases that cite this headnote Pi Customs Duties 411'ime and distance factors; checkpoints Extended border search doctrine has been applied to entry border searches conducted some Searches and Seizures time after the border was crossed. 6Scope, Conduct, and Duration of Warrantless Search Cases that cite this headnote Under the Fourth Amendment, mere fact that a search includes computer files does not transform it from routine to nonroutine. U.S.C.A. Const.Amend. 4. Customs Duties faTime and distance factors; checkpoints Cases that cite this headnote Unlike searches that actually occur at a border or the functional equivalent thereof, an extended border search requires reasonable suspicion with respect to the criminal nature of the person or Customs Duties thing searched as well as reasonable suspicion Jaime and distance factors; checkpoints that the subject of the search has crossed a border within a reasonably recent time. U.S.C.A. Under the Fourth Amendment, a border search Const.Amend. 4. need not take place at the border. U.S.C.A. Const.Amend. 4. I Cases that cite this headnote Cases that cite this headnote Irrt Customs Duties f'-Time and distance factors; checkpoints lel Customs Duties p-rime and distance factors; checkpoints Government agents' search of defendant's Customs Duties electronic devices was not an extended border 4, Airports and airplanes search within meaning of the Fourth Amendment; the devices did not enter the Under the Fourth Amendment, border searches country with defendant, but were returned to may in certain circumstances take place not only him at a later date. U.S.C.A. Const.Amend. 4. at the border itself, but at its functional WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 2 EFTA01207767 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) searches. U.S.C.A. Const.Amend. 4. Cases that cite this headnote Cases that cite this headnote 1121 Customs Duties v-Time and distance factors; checkpoints 116) Searches and Seizures A border search of a computer is not 4-Scope, Conduct, and Duration of Warrantless transformed into an extended border search Search under the Fourth Amendment simply because the device is transported and examined beyond Even if a search is not destructive or damaging, the border. U.S.C.A. Const.Amend. 4. if it is sufficiently invasive or intrusive, or butts up against other Fourth Amendment values, it may be nonroutine. U.S.C.A. Const.Amend. 4. 2 Cases that cite this headnote Cases that cite this headnote Customs Duties -4Grounds or cause for stop, search, or seizure Customs Duties A forensic border search of a computer or oilScope and Nature; Successive or Secondary electronic device should be considered a Searches nonroutine search for which reasonable suspicion is required under the Fourth Under the Fourth Amendment, a routine border Amendment. U.S.C.A. Const.Amend. 4. search may include a conventional inspection of electronic media and a review of the files on them just as it may include physical papers. 3 Cases that cite this headnote U.S.C.A. Const.Amend. 4. 2 Cases that cite this headnote Customs Duties iaPersonal, skin, or strip searches; pat•down Even the border search power cannot justify a filet Customs Duties strip search without any particularized 0-Time and distance factors; checkpoints suspicion. U.S.C.A. Const.Amend. 4. Reasonable suspicion was required for forensic search of imaged hard drives of digital devices Cases that cite this headnote taken from defendant at the border and subjected to forensic examination at later time; search would result in exposure of intimate details and abrogate defendant's reasonable expectations of privacy in his most personal and confidential I151 Customs Duties affairs. U.S.C.A. Const.Amend. 4. Ii0Grounds or cause for stop, search, or seizure A border search that goes beyond the routine is 1 Cases that cite this headnote justified merely by reasonable suspicion, a lesser standard than required for analogous non-border WestlawNexi © 2015 Thomson Reuters. No claim to original U.S. Government Works. 3 EFTA01207768 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) reasoning. Supplemental briefing was requested and Customs Duties permitted. I now hold that, under the facts presented by e'-Grounds or cause for stop, search, or seizure this case, a forensic computer search cannot be performed under the border search doctrine in the absence of Reasonable suspicion supported forensic search reasonable suspicion. Because the officials here of smartphone and flash drive taken from reasonably suspected that Saboonchi was violating export defendant as he crossed border; defendant's restrictions, Defendant's Motion to Suppress is denied. name had come up in connection with two different investigations of export violations, information received in response to previously-issued subpoenas showed that he had I. BACKGROUND purchased two cyclone separators after Defendant Ali Saboonchi is a dual citizen of the United representing that they would be used States and the Islamic Republic of Iran. Gov't Opp'n 3, domestically, and then shipped them overseas, ECF No. 65. On March 4, 2013, Saboonchi was indicted understating their value in a manner consistent by a grand jury on four counts of unlawful export to an with an attempt to avoid scrutiny, and embargoed country and one count of conspiracy to export investigation had determined that the recipient to an embargoed country, in violation of the International of the separators was linked to a company in Emergency Economic Powers Act ("IEEPA"), 50 U.S.C. Iran. U.S.C.A. Const.Amend. 4. §§ 1702 & 1705, and the Iranian Transactions and Sanctions Regulations ("ITSR"), 31 C.F.R. § 560.203-204. See Indictment, ECF No. 1. On August 22, Cases that cite this headnote 2013, the grand jury returned a superseding indictment that added more alleged co-conspirators, an additional count, and additional acts in furtherance of the alleged conspiracy, and revised the alleged start of the conspiracy from November 2009 to September 2009. Superseding Indictment, ECF No. 66.E Attorneys and Law Firms On July IS, 2013, Saboonchi filed several motions *538 Christine Manueliart, Rod J. Rosenstein, Office of including a Motion to Suppress Evidence, ECF No. 58. the United States Attorney, Baltimore, MD, for United States of America. Most of the basic facts are undisputed. Saboonchi and his *539 Elizabeth Genevieve Oyer, Office of the Federal wife were stopped by United States Customs and Border Public Defender, Baltimore, MD, for Ali Saboonchi, et al. Protection ("CBP") agents on March 31, 2012 at the Rainbow Bridge outside of Buffalo, New York when returning from a daytrip to the Canadian side of Niagara Falls. Def.'s Mot. 2. Saboonchi and his wife were questioned separately, and Saboonchi was questioned in a locked room where he was "required to remain in the MEMORANDUM OPINION room and directed to answer questions by a federal agent." Id. "Without Defendant's knowledge and consent, all electronics were seized with intent to search." Id. at 3. PAUL W. GRIMM, District Judge. Eventually, Saboonchi and his wife were allowed to reenter the United States, but an Apple iPhone, a Sony Defendant Ali Saboonchi is alleged to have violated U.S. Xperia phone, and a Kingston DT101 G2 USB flash drive export restrictions on trade with the Islamic Republic of (the "Devices") were seized; Saboonchi claims that "no Iran. On July I 8, 2013, Saboonchi moved to suppress the clear justification was given for" keeping the Devices. Id. fruits of warrantless forensic searches of his smartphones Saboonchi was given a "Detention Notice and Custody and flash drive performed under the authority of the Receipt for Detained Property," CBP Form 605ID, listing border search doctrine after they were seized at the the devices. CBP Form 6051D, Defs Mot. Ex. B, ECF U.S.—Canadian border. At a hearing on September 23, No. 58-2. 2013, I issued an oral opinion denying the motion but stated that, in light of the difficult issues raised by a *540 On April 4, 2012, a Homeland Security forensic search of digital devices seized at the border, I Investigations ("HSI") special agent imaged each of the would be issuing a written opinion further explaining my Devices, see ICE Report of Investigation Continuation WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 4 EFTA01207769 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) (the "ICE Reports"), Def.'s Mot. Ex. A, ECF No. 58-1.2 Falls, New York on March 31, 2013, Burkhardt Tr. 6:4-9, Thereafter, the image of each device was forensically and his testimony primarily relied on his recollection as searched using specialized software. Id. refreshed by his report of the events of March 31, 2012, as well as his knowledge of standard practices at the On April 13, 2012, Saboonchi met with two HSI agents in Rainbow Bridge facility. According to Burkhardt, people Baltimore who returned the Devices to him. Def.'s Mot. traveling by car go through primary screening in one of 6; Gov't Opp'n 25. At that time, a conversation occurred about seventeen lanes. Id. at 6:17-21. Although Burkhardt that Saboonchi characterized as an "interrogat[ion]," lacked firsthand knowledge of Saboonchi's primary Def.'s Mot. 6, and that, at the very least, confirmed that inspection, it was his understanding that Saboonchi Saboonchi owned two of the Devices and included arrived at *541 the Rainbow Bridge facility at 9:47 p.m., questioning about an internship Saboonchi once had with id. at 22:11, and was referred to secondary inspection an Iranian company and his knowledge of restrictions on because his name had produced a "hit" in the TECS doing business with Iran, Gov't Opp'n 25. database during primary screening, id. at 38:11-17.2 Saboonchi moved to suppress any evidence obtained from In general, once a car is diverted to secondary inspection, the Devices, any statements that he made to CBP on it is approached by one or more officers, with weapons March 31, 2012, and any statements that he made to HSI holstered, to escort the car to secondary inspection. Id. at on April 13, 2012. See Def.'s Mot. Saboonchi's motion 7:13-8:15. When the car reaches the main CBP building, relied on his argument that the warrantless search of the a "stop stick" tire deflation device is placed between the Devices at the border—and their later forensic front and back tires of the car to prevent flight. Id. at search—violated the Fourth Amendment's prohibition of 17:20-23. The passengers are escorted inside and a unreasonable searches and seizures, hi. at 7—8, that any secondary inspection typically is conducted in a room off statements made on March 31 were obtained in violation of the building's lobby called the "medium secondary." of the Fifth Amendment's Self—Incrimination Clause, id. Id. at 9:11-16. The medium secondary is reached through at 6-7, and that any statements made on April 13 resulted a locked door, which is operated remotely to buzz people from the improper search of Saboonchi's Devices, id., and in or out. Id. at 15:17-16:5. The room contains several therefore are the "fruit of the poisonous tree," Nardone v. chairs and a metal table, id. at 15:7-16:5; Hr'g Ex. United States, 308 U.S. 338, 341, 60 S.Ct. 266, 84 L.Ed. 1F-1H, and has windows that are tinted on their bottom 307 (1939). The Government responded, taking the portion. See Hr'g Ex. 1F-1H. Saboonchi and his wife position that the search of the Devices was a routine were taken into the secondary inspection area and Officer border search that required neither a warrant nor Burkhardt took their passports and Saboonchi's wife's particularized suspicion and that Saboonchi's statements visa. Burkhardt Tr. 18:8-19:24. did not result from custodial interrogation. Gov't Opp'n 28-29. Shortly before the hearing on the motion to Burkhardt ran his own query of TECS and discovered two suppress, I sent a letter to the parties seeking additional flags on Saboonchi, one out of Washington, D.C. and one briefing as to certain matters, Letter to Counsel (Sept. 13, out of Baltimore. Id. at 20:5-7. Because of those flags, at 2013), ECF No. 73, and the parties responded shortly 9:52 p.m., Burkhardt contacted HSI Special Agent Kelly thereafter, see Gov't Supp. Mots. Resp., ECF No. 75; Baird about Saboonchi; Baird told him to detain Def.'s Supp. Briefing Submission, ECF No. 76. Saboonchi's Devices. Id. at 20:8-23; 22:11-12. A hearing was held before me on September 23, 2013, at At 10:00 p.m., Burkhardt interviewed Saboonchi and his which the Government presented testimony from two wife. Id. at 22:15. The interview consisted of routine witnesses: CBP Officer Kenneth Burkhardt, see Hr'g Tr., questions regarding their citizenship, their reason for Testimony of Kenneth Burkhardt ("Burkhardt Tr."), ECF traveling to Canada, and other information relevant to No. 85, and HSI Special Agent Kelly Baird, see Hr'g Tr., their readmission to the United States. Id. at 23:21-24:10. Testimony of Kelly Baird ("Baird Tr."), ECF No. 84. The interview did not last more than thirty minutes, and may have been as short as ten to fifteen minutes. Id. at 29:3-20. Burkhardt did not give Miranda warnings to Saboonchi or his wife, id. at 31:7-9, and testified that they A. Testimony of Kenneth Burkhardt are allowed to refuse to answer Officer Burkhardt was one of the officers who performed questions, but until we determine a secondary screening on Saboonchi when he re-entered their admissibility, I mean, a the United States via the Rainbow Bridge in Niagara WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 5 EFTA01207770 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) thorough search of the car, a Special Agent Kelly Baird testified on three main issues: thorough search of them, I mean, the factual basis underlying the flags on Saboonchi in the we arc going to, so to speak, get to TECS database, the forensic searches of the Devices, and the bottom of what we want to—I her April 13, 2012 meeting with Saboonchi to return the mean, 99.9 percent of people Devices. answer questions. Baird testified that Saboonchi first came to the attention Id. at 68:2-6. Although Burkhardt did not recall the of federal authorities in the Fall of 2010, when "the FBI details of questioning Saboonchi and his wife, he stated received information that there had been an inquiry to a that his standard practice would be to separate a car's company in Vermont regarding specialized technology passengers and question them separately. Id. at 33:11-14. that has applications with industrial medical or military At this time they also would have been asked to empty applications" by "a person named Ali," whose telephone their pockets, known as a "pocket dump," id. at 21:14-18, number eventually led to Saboonchi. Baird Tr. 65:16-21, but they probably were not subjected to a 10:21-11:2. Around December 2011, another HSI agent pat-down or other more invasive search of their persons, contacted Baird to inform her that Saboonchi's name had id. at 30:16-22. At approximately 10:30 p.m., a come up again in the context of another investigation into "seven-point exam," which is a detailed examination of export violations. Id. at 11:19-23. This led HSI to issue a Saboonchi's car, was performed. Id. at 22:18-23:2. number of subpoenas seeking credit card and shipping Saboonchi and his wife were not free to leave during this records that were returned in early March 2012. Id. at process. Id. at 46:17-47:14. 11:24-12:2.4 *542 The HSI duty agent at the Rainbow Bridge, In response to HSI's subpoenas, Baird received a Federal Cornelius O'Rourke, was contacted at 10:55 p.m. and Express ("FedEx") airbill that showed that Ali Saboonchi, responded at 11:20 p.m. Id. at 23:9-12. At 11:55 p.m., through a business called Ace Electric, had shipped a HSI Special Agent Kelly Baird requested that all of the cyclone separator to an Arash Rashti at a company called Saboonchis' information be turned over to the local Joint General DSAZ in the United Arab Emirates. Id. at 12:2-7, Terrorism Task Force ("JTTF") agent, Jeff Alrich. Id. at 29:1-4, 30:22-24.s An investigation into General DSAZ, 23:12-15. The local chief was informed of all that had using the contact information gleaned from the airbill, transpired at 12:15 a.m. on April I, 2013, and Saboonchi revealed that *543 it was linked to another company in and his wife were released at 12:25 a.m. on April I. Id. at Iran dealing with "industrial parts and things of that 23:16-17. From when they were stopped until they were nature." Id. at 12:8-12. cleared to enter the United States, over two and one-half hours had elapsed. Shortly thereafter on March 29, 2012, Baird conducted interviews with individuals at a company called Geiger Although Saboonchi and his wife were allowed to re-enter Pumps, which confirmed that it had sold two cyclone the country, the Devices were not returned to them at that separators to Saboonchi based on his representation that time and Saboonchi was given a CBP 605 ID receipt for "the end user was domestic use only." Id. at 12:13-22. the detention of the Devices. CBP Form 605ID. Baird also noted that the airbill had listed the value of the Burkhardt said that it was not normal practice to look at cyclone separators as $100 but that their actual value was the contents of electronic media found on a person during over $2,100. Id. at 15:21-16:2. Although reporting inspection, id. at 41:4-43:25, and neither he nor any other requirements only apply to items worth at least $2,500, CBP officer attempted even a cursory inspection of the Baird testified, based upon her training and experience, contents of the Devices at the Rainbow Bridge, id. at that "when people tend to undervalue stuff, it's to keep 59:13-60:1. "Duty Agent O'Rourke departed the station things below the radar." Id. at 16:6—8. On March 30, with the two cell phones and the thumb drive." Id. at 2012, Baird conducted interviews with another supplier, 24:19-20. RG Group, from which Saboonchi also had made purchases. Id. at 12:23-13:4, 31:9-20. Somewhere around In Burkhardt's view, what happened at the screening was this time, Baird caused Saboonchi's information to be "[a]bsolutely routine." Id. at 28:23. entered into TECS as a person of interest. Id. at 4:7-11.6 Also based on her investigation, Baird testified that when she was contacted by Burkhardt, she asked him to detain Saboonchi's electronic media and to search his vehicle to take advantage of the Government's border search B. Testimony of Kelly Baird authority. See id. at 5:6-9; 33:4-14. WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 6 EFTA01207771 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) With respect to the Devices, Baird testified that she of Miranda, relying in part upon United States v. FNU received them in a Fed& package from Agent O'RourIce LNU, 653 F.3d 144, 153-54 (2d Cir.201 I) (noting that the and immediately handed them over to her computer likelihood that those entering the country expect some forensics agent, Agent Mycel. Baird Tr. 7:21-8:1. Baird degree of confinement and questioning reduces the told O'Rourke not to examine the Devices and had not likelihood that such restrictions would be perceived as examined them herself, so that she could give them to a custodial); see also Hr'g Tr., Argument and Rulings (the specialist in the preservation of computer evidence. See "Ruling Tr."), 14:19-19:1.7 id. at 8:22-9:10. Images were made of the hard drives of both phones and of the USB drive, but the image of the With respect to the seizure' and subsequent search of the Sony phone later was deleted after it was determined that Devices, I found that current state of the law provides it was not Saboonchi's. Id. at 24:7-25:6. Among the files considerably less clarity. Although it seemed that the that were searched, Baird found evidence of telephone seizure of Saboonchi and the Devices was supported by contact with an employee of Geiger Pumps and a copy of reasonable suspicion, the Government had taken the Saboonchi's résumé that showed that he had interned with position that its actions constituted a routine border search an Iranian company. Id. at 15:11-20. for which no suspicion was required, Gov't Opp'n 26-29, and I noted that the nature and extent of the authority to On April 13, 2012, after the Devices had been imaged, image and forensically search those devices was unclear. Baird arranged for Saboonchi to come to the U.S. Custom See Ruling Tr. 31:4-20. Because this is an unsettled area House in Baltimore so that she could return the Devices to of the law, and one that increasingly is important as ever him. Id. at 20:20-22. Saboonchi pulled his car up outside greater aspects of our lives involve the use of digital the Custom House, and Baird and another agent came out devices, I stated my intention to issue a written opinion to meet him. Id. at 20:21-23. In addition to turning over setting forth the reasons for my decision. Id. at the devices, Baird asked Saboonchi whether he was aware 36:25-37:14. of the sanctions in place with respect to Iran and Saboonchi responded that he was aware that there were The Government requested, and I granted, the opportunity some restrictions in place, that he knew people who had to provide supplemental briefing in light of the had difficulties receiving money from family in Iran, and importance of the issue and the paucity of other opinions that he believed that United States residents were not addressing it. See id. at 40:11-41:4. That briefing now has permitted to use Iranian airlines. Id. at 21:2-15. Baird been completed, see Gov't Supp. Mem., ECF No. 87; advised Saboonchi that he would need to get permission Def.'s Rap. Mem., ECF No. 90, and I can turn now to from the Office of Foreign Asset Control ("OFAC") if he addressing the issues raised in Defendant's motion. wished to conduct business with entities in Iran. Id. at 21:16-24. Baird also asked questions about Saboonchi's internship with an Iranian company but did not ask if he was *544 exporting products to Iran. Id. at 38:14-40:7. II. THE BORDER SEARCH DOCTRINE Saboonchi asked Baird why his wife had not received her Permanent Resident Card and Baird offered to look into it, taking down Saboonchi's wife's information to aid in A. Types of Border Searches her inquiry. Id. at 22:23-23:1. I I I 121 Any analysis of a border search must begin from the proposition that •545 "[t]he Government's interest in The entire interaction between Baird and Saboonchi took preventing the entry of unwanted persons and effects is at place on the street, at Saboonchi's car. Id. at 20:20-23. its zenith at the international border." United States v. Although Baird was carrying a weapon, it was concealed, Flores—Montano, 541 U.S. 149, 152, 124 S.Ct. 1582, 158 id. at 22:10-12, and Baird testified that Saboonchi was L.Ed.2d 311 (2004). It therefore is well-established "[t]hat free to leave at any time, id. at 22:13-16. searches made at the border, pursuant to the long-standing right of the sovereign to protect itself by stopping and examining persons and property crossing into this country, are reasonable simply by virtue of the fact that C. Supplemental Briefing they occur at the border." United States v. Ramsey, 431 U.S. 606, 616, 97 S.Ct. 1972, 52 L.Ed.2d 617 (1977). At the conclusion of the hearing, I resolved the Fifth "Routine searches of the persons and effects of entrants Amendment issue, finding that neither the initial are not subject to any requirement of reasonable questioning of Saboonchi by CBP nor his conversation suspicion, probable cause, or warrant ...." United States v. with Special Agent Baird were custodial for the purposes Montoya de Hernandez, 473 U.S. 531, 538, 105 S.Ct. WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 7 EFTA01207772 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) 3304, 87 L.Ed.2d 381 (1985). 534-35, 105 S.Ct. 3304. As a result, she "was detained incommunicado *546 for almost 16 hours before PI Hi PI But even at the border, the Fourth Amendment inspectors sought a warrant." Id. at 542, 105 S.Ct. 3304. continues to protect against unreasonable searches and In holding that the detention required, and in that seizures; the only difference is that, at the border, routine particular case was justified by, reasonable suspicion, id. searches become reasonable because the interest of the at 541, 105 S.Ct. 3304, the Court expressly refrained from Government is far stronger and the reasonable expectation defining "what level of suspicion, if any, is required for of privacy of an individual seeking entry is considerably nonroutine border searches such as strip, body cavity, or weaker. See Carroll it United States, 267 U.S. 132, 154, involuntary x-ray searches," id. at 541 n. 4, 105 S.Ct. 45 S.Ct. 280, 69 L.Ed. 543 (1925) ("Travelers may be [ ] 3304. stopped in crossing an international boundary because of national self-protection reasonably requiring one entering 161 The principal case on border searches in the Fourth the country to identify himself as entitled to come in, and Circuit is United States v. Ickes, 393 F.3d 501 (4th his belongings as effects which may lawfully be brought Cir.2005), which, like this case, dealt with a computer in."). But cf. United States v. Verdugo-Urquidez, 494 search—although not a forensic examination of an U.S. 259, 274-75, 110 S.Ct. 1056, 108 L.Ed.2d 222 identical image of the entire contents of the computer's (1990) (holding that the Fourth Amendment does not hardware. In Ickes, the defendant was selected for apply to non-citizens searched or seized outside of the secondary inspection at the U.S.—Canadian border United States). When a search stretches beyond the because the large amount of property he had in his van routine, it must rest on reasonable, particularized seemed inconsistent with his claim that he was returning suspicion, Montoya de Hernandez, 473 U.S. at 541, 105 from a vacation. Id. at 502. In a routine secondary S.Ct. 3304, which is significantly less demanding than the inspection, the inspector found a video camera with "a showing of probable cause required to secure a warrant tape of a tennis match which focused excessively on a for a domestic search, see U.S. Const. amend. IV. It is not young ball boy." Id. The agents searched the van more so easy to divine precisely where a border search falls thoroughly and turned up marijuana seeds and pipes, a along the continuum from reasonable to unreasonable, copy of a Virginia warrant for Ickes's arrest, and "several particularly when the search involves imaging the entire albums containing photographs of provocatively-posed contents of two smartphones and a flash drive. prepubescent boys, most nude or semi-nude." Id. at 503. The Customs agents placed Ickes under arrest but The Supreme Court has not addressed the issue often, but continued to search the van, discovering a computer and it has laid out the broad strokes of what constitutes a approximately seventy-five disks containing child routine, versus a nonroutine, search. On the one hand, in pornography. Id. The Fourth Circuit concluded that the United States v. Flores—Montano, the Court held that "the search was a routine border search that did not require a Government's authority to conduct suspicionless showing of reasonable suspicion, id. at 505-06, even inspections at the border includes the authority to remove, though the officers likely had reasonable suspicion before disassemble, and reassemble a vehicle's fuel tank." 541 they viewed the contents of the disks. Thus under Ickes, U.S. at 155, 124 S.Ct. 1582. In so holding, the Court the mere fact that a search includes computer files does found that the privacy interest in the contents of a not transform it from routine to nonroutine. person's gas tank was less than that in the contents of a passenger compartment, that such searches were relatively brief, and that the possibility of permanent damage to a car was so remote that it did not implicate a legitimate property interest, particularly because an owner B. Location of Border Searches of a damaged car might be entitled to recover damages. 171 PI A border search need not take place at the Id. at 154-55, 124 S.Ct. 1582 (citing Carroll, 267 U.S. at 154, 45 S.Ct. 280). border—indeed, here it appears that Saboonchi's Devices were seized at a border but actually were searched in On the other hand, United States v. Montoya de Baltimore, well within the territory of the United States. Hernandez presents an extreme factual situation that Courts have recognized two different ways that a search clearly exceeded a mere routine search or seizure, in may fall within the border search doctrine even though it which a defendant suspected of smuggling drugs in her does not occur at a physical border. First, border searches alimentary canal was told that she would not be released "may in certain circumstances take place not only at the into the United States until she submitted to an x-ray or border itself, but at its functional equivalents as well." "produced a monitored bowel movement that would Almeida-Sanchez v. United States, 413 U.S. 266, 272, 93 confirm or rebut the inspectors' suspicions." 473 U.S. at S.Ct. 2535, 37 L.Ed.2d 596 (1973). The "functional WestlawNext" © 2015 Thomson Reuters. No claim to original U.S Government Works. 8 EFTA01207773 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) equivalent" of a border may include "an established methodology, where the computer searches vast amounts station near the border, at a point marking the confluence of data that would exceed the capacity of a human of two or more roads that extend from the border," or the reviewer to examine in any reasonable amount of time. search of passengers and cargo arriving at an airport The techniques used during a forensic search can be within the United States after a nonstop flight from distinguished from a conventional computer search, in abroad. Id. at 273, 93 S.Ct. 2535. As these locations are which a Customs officer may operate or search an the functional equivalent of a border, the analysis is no electronic device in much the same way that a typical user different from a search at an actual, physical border and would use it. no additional suspicion is required. See id. As I will explain, a conventional computer search can be Isl " Second, courts have permitted " `extended border deeply probing and, much like any search of personal searches,' under which `border' is given a geographically effects at the border, has the potential to be invasive. Yet flexible reading within limits of reason related to the these concerns do not bring a conventional computer underlying constitutional concerns to protect against search outside of the broad authority granted under the unreasonable searches." United States v. Bilir, 592 F.2d border search doctrine any more than a suitcase is 735, 740 (4th Cir.1979). "[T]he `extended border search' immunized from search because it may contain a personal doctrine has been applied to entry border searches diary. Despite the vast amounts of data available in an conducted some time after the border was crossed." electronic device, a conventional search is limited by the United States v. Cardona, 769 F.2d 625, 628 (9th amount of time one Customs officer has to devote to Cir.I985) (citing United States v. Caicerlo-Guarnizo, 723 reviewing the contents of digital evidence at the border F.2d 1420, 1422 (9th Cir.1984)). An extended border while its owner awaits the outcome of the search. Even if search may be necessary *547 because the first contact that review may take a matter of hours, the amount of data with a customs official occurs away from the border, or searched will be a mere fraction of what is on the device, because officers have elected to allow a suspect to pass given the storage capacity of modem electronic devices. through the border in order to perform a search at a later And in any event, though such a search may last hours, it time. Bilir. 592 F.2d at 740. Unlike searches that actually will not last days. There is only so much time that a occur at a border or the functional equivalent thereof, an Customs officer has to devote to the border search of a extended border search requires reasonable suspicion with computer. No matter how thorough or highly motivated respect to the criminal nature of the person or thing the agent is, a manual search of a computer or digital searched as well as reasonable suspicion that the subject device will never result in the human visualization of of the search has crossed a border "within a reasonably more than a fraction of the content of the device. recent time." Id. In contrast, a forensic examination of a computer or other electronic device using sophisticated technology-assisted search methodologies can exceed vastly the capacity of a III. DISCUSSION human searching and viewing files. Moreover, this type of At the outset, it is important to understand what takes search exposes a class of data that raises novel privacy place during a forensic computer search, and what concerns, including files that a user had *548 marked as distinguishes it from what may usefully be regarded as a "deleted"' and location data that may provide information "conventional" search of a computer or digital device. about activities in the home and away from the border. Though every search is different, a forensic search has For this reason, a forensic search of an electronic device certain hallmarks by which it can be identified. First, "the differs significantly from a conventional search not computer forensics process always begins with the merely in degree, but in kind. Accordingly, as explained creation of a perfect 'bitstream' copy or `image' of the below, a forensic search of an electronic device seized at original storage device saved as a 'read only' file." Orin