There are different strategies for challenging a device search, depending on how the device was seized and how the search was conducted. Here is a guide to thinking about how you might seek to challenge or otherwise limit the search of a client's digital device.
For a shorter overview, please see EFF's one-pager handout, "Digital Device Searches: A Guide for Criminal Defense Attorneys."
- I. Ways to Challenge Seizure
- II. Ways to Challenge Search
- III. Best Practices for Judicial Oversight
- IV. Subsequent Searches
- V. Border Searches
- VI. Privacy Law
I. Ways to Challenge the Seizure, Before the Search
An important threshold question is: how did law enforcement first obtain the device? Potential strategies for challenging the seizure or subsequent search may vary based on how law enforcement came to possess the device in the first place.
If the device was seized incident to a lawful arrest, consider objecting on the record at arraignment to any subsequent digital search of the seized device(s), before law enforcement attempts to secure a search warrant, and asking the court to order the prosecutor to inform their investigating officers that any warrant application must be presented to the same judge for judicial oversight. You may also consider requesting close judicial oversight of any digital search. See, e.g., U.S. v. Comprehensive Drug Testing, Inc (CDT), 621 F.3d 1162, 1180 (9th Cir. 2010) (en banc); and Ways to Challenge the Search below.
Unfortunately, most of the time you will not be given the opportunity to contest a warrant prior to its execution. Thus, most litigation will be via a motion to quash or traverse the warrant and to suppress the information seized by the government.
If the device was seized pursuant to a search warrant, there are a number of ways to challenge the validity of the initial seizure. Warrants used to seize devices are often generalized and unspecific and devices are swept up along with other possible evidence of a crime. But some courts have held that, given the wealth of information these devices contain, each element of the warrant requirement should be specifically satisfied with regard to each particular device seized.
Absence of Probable Cause
To seize a device pursuant to a search warrant, the police should have specific probable cause that the defendant "possessed a [device], but also that the device would be located [in a specific place] and would contain incriminating evidence about his suspected offense.” U.S. v. Griffith, 867 F.3d 1265, 1273, (D.C. Cir. 2017).
Lack of Specificity/Particularity
Courts have held that the warrant affidavit should identify (i) a specific device, (ii) facts showing that the defendant owned or used that device; and (iii) that the device will be found in a particular place at a particular time. See U.S. v. Griffith, 867 F.3d at 1272-1273. A warrant to seize “[a]ll computers” is not sufficiently particular where the warrant description “did not indicate the specific crimes for which the equipment was sought, nor were the supporting affidavits or the limits contained in the searching instructions incorporated by reference." U.S. v. Hunter, 13 F. Supp. 2d 574, 584 (D. Vt. 1998). When a warrant fails "to describe with any particularity the items to be seized, the warrant is indistinguishable from the general warrants repeatedly held  to be unconstitutional." U.S. v. Kow, 58 F.3d 423, 427-29 (9th Cir. 1995).
Warrants often contain long lists of electronic devices—lists that are included in advance so that law enforcement can seize any device found during the execution of the search, even when officers have no specific knowledge that any specific device exists. For example, a warrant might authorize seizure of "any and all electronic devices to include, but not limited to, devices like cellular telephone(s), computer(s), electronic tablet(s), devices capable of storing digital images (to include, but not limited to, PDAs, CDs, DVD's [and] jump/zip drives." But some courts have found such "any and all" language to be overbroad. See, e.g., U.S. v. Hunter, 13 F. Supp. 2d 574, 584 (D. Vt. 1998) (finding warrant authorizing seizure of “[a]ll computers ... [a]ll computer storage devices ... [and a]ll computer software systems,” “is a catch-all paragraph, which lacks sufficient limitation”); Griffith, supra, 867 F.3d at 1276 ("Yet the warrant did not stop with any devices owned by Griffith, which already would have gone too far. It broadly authorized seizure of all cell phones and electronic devices, without regard to ownership.").
Because of the practical difficulties inherent in identifying seizable materials stored on computers, law enforcement often seeks authorization to seize the entire device, even though the device doubtless contains information that is not evidence of a crime. Where law enforcement seeks to seize an entire computer or computer system, courts have held that the search warrant affidavit should explain why practical constraints require the seizure of the entire device for off-site examination and “demonstrate to the magistrate factually why such a broad search and seizure authority is reasonable in the case at hand.” U.S. v. Hill, 459 F.3d 966, 975-76 (9th Cir. 2006). See also, In re [REDACTED]@gmail.com, 62 F. Supp. 3d 1100, 1103 (N.D. Cal. 2014) ("there must be some threshold showing before the government may seize the haystack to look for the needle.")(internal quotations omitted).
Where a third party turns a device in to an officer, or the device is deemed lost or abandoned at the scene of a crime, some limited inspection of the device may be justified to ascertain ownership for the return or the identification of the property owner. But a warrant is still required for any search of the device's contents. See Riley v. California, 134 S. Ct. 2473 (2014) and Ways to Challenge the Search.
Almost without exception, law enforcement must get a warrant to search a digital device. See Riley v. California, 134 S. Ct. 2473 (2014). You should consider challenging any warrantless search of a device. You should also consider intervening early—preferably before the search is executed—to limit law enforcement's access to your client’s data.
Judicial authorization to search is not the same as judicial authorization to seize the device, so consider objecting any time that law enforcement fails to secure specific judicial authorization to search a particular digital device in the warrant. In cases where the search warrant fails to specify the devices to be searched and does not explicitly incorporate devices described in the supporting affidavit, court have held that the warrant fails. See U.S. v. Payton, 573 F.3d 859, 861-62 (9th Cir. 2009)("Searches of computers therefore often involve a degree of intrusiveness much greater in quantity, if not different in kind, from searches of other containers. Such considerations commonly support the need specifically to authorize the search of computers in a search warrant.").
There are many different ways to challenge the facts alleged to give rise to probable cause. Some common issues, discussed below, often arise in the context of digital device searches.
An IP Address Alone Does Not Establish Probable Cause to Search
Law enforcement often uses an IP address associated with some type of criminal activity as the sole basis to establish probable cause to obtain a search warrant for a particular place. For a variety of reasons, an IP address alone—without additional information or investigation done to establish that the alleged activity occurred at a specific place or with a specific device or intent—should not be sufficient to establish probable cause to believe evidence of a crime will be found at that place or on that device.
The Second Circuit has held that where an IP address connects or attempts to connect to a suspect URL where the text of the URL appears to link to contraband on a child pornography website, there is no substantial basis for probable cause in a warrant that alleged only that it “appear[ed]” that the defendant “gained access or attempted to gain access” to the site. U.S. v. Falso, 544 F.3d 110, 121 (2d Cir. 2008). EFF filed an amicus brief in U.S. v. Bosyk urging the Fourth Circuit to follow the Second Circuit's lead by explaining why an IP address's access or attempt to access a randomized URL from a file-sharing website that was alleged to host contraband material is not enough to support probable cause to search a suspect's home or devices.
We discuss the issue of law enforcement reliance on IP addresses at length in our report: "Unreliable Informants: IP Addresses, Digital Tips and Police Raids" [PDF]. In this resource we explain:
- How the limitations of what you can infer from IP addresses should restrict how police use them in investigations;
- The dangers of using IP addresses to locate or identify suspects;
- Why IP addresses alone are not always location proxies;
- The problem with relying on IP Addresses as identity equivalents or why IP addresses are not identity proxies;
- Why IP address information is a lot like anonymous informants’ tips to police;
- How to apply the anonymous informant rules to IP addresses, and;
- What cops and courts should do differently when using IP address information.
Membership in or Attempt to Access an Online Group Suspected of Illegal Conduct Alone Is Not Probable Cause to Search
Courts have held that membership in an online group, without additional information about an individual's activities, is not sufficient to establish probable cause, even where the group is alleged to have engaged in illegal activity. For example, the simple allegation that a defendant “by clicking a button, responded affirmatively to a three-sentence invitation ... to join [a child pornography] e-group ... does not remotely satisfy Fourth Amendment standards” because “a ‘person’s mere propinquity to others independently suspected of criminal activity does not, without more, give rise to probable cause to search that person.’” U.S. v. Coreas, 419 F.3d 151, 156 (2d Cir. 2005)(citing Ybarra v. Illinois, 444 U.S. 85, 91 (1979)(invalidating the search of a tavern patron who was present when law enforcement executed a search warrant at the tavern)). Further, the Second Circuit has held that an attempt to access a group or site that might contain illegal content, without more, did not establish probable cause. See U.S. v. Falso, 544 F.3d 110, 121 (2d Cir. 2008) (no probable cause where it was alleged only that it “appear[ed]” that the defendant “gained access or attempted to gain access” to a website that contained some child pornography).
A warrant should demonstrate a sufficient nexus between the incident being investigated and the target(s) of the warrant. Some district courts have invalidated warrants where the “warrant lacked probable cause to support a connection between the investigation and four of the individuals/identifiers listed in the warrant.” In the Matter of Search of Info. Associated with Email Addresses Stored at Premises Controlled by the Microsoft Corp., 212 F. Supp.3d 1023, 1038 (D. Kan. 2016).
Where law enforcement exceeds the scope of probable cause articulated in the warrant, move to suppress. For example, if the search warrant only authorizes search of information on the device, object where law enforcement uses the device to access content not stored on the device and not identified or justified in the search warrant and supporting affidavit. Even if there may have been probable cause to search local device data, it does not necessarily follow that the justification is co-extensive to authorize a search of data stored remotely, outside the device. See, e.g., In re Grand Jury Investigation Concerning Solid State Devices, Inc., 130 F.3d 853, 856-57 (9th Cir. 1997)(finding broad scope of warrant not justified by probable cause).
Many search warrant affidavits are boilerplate and fail to provide sufficient specificity and particularity about the object of the search and place to be searched. A computer's ability to store “a huge array” of information “makes the particularity requirement that much more important” in the Fourth Amendment analysis. U.S. v. Otero, 563 F.3d 1127, 1132 (10th Cir. 2009).
Accordingly, consider challenging a warrant that does not specify the files to be searched and/or where those files are likely to be located within the device. The “underlying information must be identified with particularity and its seizure independently supported by probable cause.” U.S. v. Vilar, 2007 WL 1075041, at *36 (S.D.N.Y. Apr. 4, 2007). A warrant authorizing a free ranging search that is “not limited to any particular files” violates the Fourth Amendment. U.S. v. Riccardi, 405 F.3d 852, 862 (10th Cir. 2005).
A warrant to search evidence stored on a computer should specify “which type of files are sought” and “law enforcement must engage in the intermediate step of sorting various types of documents and then only search the ones specified in the warrant.” U.S. v. Carey, 172 F.3d 1268, 1275 (10th Cir. 1999). But see Davis v. Gracey, 111 F.3d 1472, 1478 (10th Cir. 1997) (“Even a warrant that describes the items to be seized in broad or generic terms may be valid when the description is as specific as the circumstances and the nature of the activity under investigation permit.”).
Consider comparing language used in your warrant and affidavit language against the boilerplate model warrant language set forth in the DOJ's 2009 CCIPS Manual (at page 241) to support a lack of specificity/particularity argument. Some search warrants will fail to distinguish between digital device and cloud searches, so also consider challenging the government’s failure to distinguish between locally and remotely stored data as a deficiency in particularity, in addition to probable cause.
"Any and All Records," and Other Catchall Phrases, Can Render a Warrant Overbroad.
Courts have held that agents cannot simply request permission to search and seize “any and all records” on a device unless they have probable cause to believe that the criminal activity under investigation pervades the entire device. As the Tenth Circuit has recognized, "a warrant authorizing a search of 'any and all information and/or data' stored on a computer [is nothing] but the sort of wide-ranging search that fails to satisfy the particularity requirement.” U.S. v. Otero, 563 F.3d 1127, 1132 (10th Cir. 2009).
Other catchall phrases, like "including, but not limited to," can also render a warrant overly broad. See, e.g., U.S. v. Fleet Management Ltd., 521 F. Supp. 2d 436, 443-44 (E.D. Pa. 2007) (warrant authorizing seizure of “any and all data... including but not limited to” a list of items from a ship's computers was held to be an invalid general warrant). But see U.S. v. Hill, 459 F.3d 966 (9th Cir. 2006).
In one decision from the District of Kansas, a judge denied a search warrant application because the court found that a request for all email communications and all records and other information regarding the account was overbroad and too general to satisfy Constitutional requirements. In the Matter of Applications for Search Warrants for Information Associated with Target Email Accounts/Skype Accounts, 2013 WL 4647554 at *8 (D. Kan. Aug 27, 2013).
Flagrant Disregard for Search Warrant’s Terms
An otherwise valid warrant may be exceeded in its execution where government agents flagrantly disregard the warrant's terms. U.S. v. Medlin, 842 F.2d 1194, 1196-99 (10th Cir. 1988). In Medlin, the Tenth Circuit ordered suppression of all items seized pursuant to a warrant after local officers seized “667 items of property none of which were identified in the warrant authorizing the search.” The court held that the officers' actions exhibited a “flagrant disregard” for the terms of the warrant by seizing so many items not mentioned in the warrant and actually “transformed” the otherwise valid warrant “into a general warrant.” See also U.S. v. Rettig, 589 F.2d 418, 421-23 (9th Cir. 1978) (seizure of over 2000 items led warrant to become "an instrument for conducting a general search”); U.S. v. Foster, 100 F.3d 846, 850-51, nn. 5-6 (10th Cir. 1996).
But there are limits to the application of the flagrant disregard doctrine. “Only those items which fall outside the scope of the warrant need be suppressed.” U.S. v. Crozier, 777 F.2d 1376, 1381 (9th Cir. 1985). While “[t]otal suppression may be appropriate where the executing officer's conduct exceeds any reasonable interpretation of the warrant's provisions. … Courts have consistently held, however, that absent a 'flagrant disregard' of the terms of the warrant, the seizure of items outside the scope of a warrant will not affect admissibility of items properly seized.” U.S. v. Wuagneux, 683 F.2d 1343, 1354 (11th Cir. 1982). The District of New Jersey doesn't require government agents to decide which documents may be copied within the scope of the warrant onsite. U.S. v. Gawrysiak, 972 F. Supp. 853, 865 (D.N.J. 1997), aff’d, 178 F.3d 1281 (3d Cir. 1999). And it's enough in the Eleventh Circuit for government agents to be instructed and testify that they had made efforts not to seize records outside the scope of the warrant. U.S. v. Khanani, 502 F.3d 1281, 1289-90 (11th Cir. 2007).
As the Supreme Court has noted, “responsible officials, including judicial officials, must take care to assure that [searches] are conducted in a manner that minimizes unwarranted intrusions upon privacy.” Andresen v. Maryland, 427 U.S. 463, 482, n.11 (1976). Because of the vast array of information digital devices contain, there are a number of limitations that can and should be placed on the techniques used by the government to execute a digital search.
In this section, we outline several recommendations from the concurrence in U.S. v. Comprehensive Drug Testing, Inc (CDT), 621 F.3d 1162, 1170–71, 1177–78 (9th Cir. 2010) (en banc), but these recommendations have yet to be widely adopted. Although no court has held that all these measures are mandatory, attempting to intervene early, before the execution of the search warrant, will better safeguard your client's privacy. These are some suggestions that you can make for best practices in judicial oversight.
The government should not be allowed to rely on the so-called "plain view" doctrine when conducting a search of a digital device. That is, if the government is allowed to overseize information stored on the device so that it can conduct an effective search, it should not be allowed to bootstrap that overseizure into a method for obtaining evidence outside the scope of the warrant. Otherwise, all digital searches can be used as a pretext for a general search.
The initial filtering, segregation, and redaction of electronic data should be done either by an independent third party appointed by the court or specialized personnel firewalled off from government investigators. If the segregation is to be done by government computer personnel, the government must agree in the warrant application that the computer personnel will not disclose to investigators any information other than that which is determined to be the target of the warrant.
Some courts have ordered the appointment of a special master—at government expense—to determine whether documents and data were responsive to the search warrant or fell within some valid exception to the warrant requirement, whether documents or data were protected from disclosure because of attorney-client, work product, or other applicable privileges, and whether any valid exception to applicable privilege, such as the crime-fraud exception, defeated any asserted privilege. See, e.g., U.S. v. Abbell, 914 F. Supp. 519 (S.D. Fla. 1995). Courts recognize that review by a magistrate judge or special master “may be preferable” to reliance on a filter team. U.S. v. Hunter, 13 F. Supp. 2d 574, 583 n.2 (D. Vt. 1998)(citing In re Search Warrant, 153 F.R.D. 55, 59 (S.D.N.Y. 1994)).
Some courts have even gone so far as to reject the government's proposed reliance on internal "taint teams" as insufficient to guard against unconstitutional intrusion into individual privacy and privilege. See In re Grand Jury Subpoenas, 454 F.3d 511, 523-24 (6th Cir. 2006) (mandating appointment of a special master to perform first segregation of documents, and rejecting the government's proposal for a taint team because “we do not see any check in the proposed taint team review procedure against the possibility that the government's team might make some false negative conclusions, finding validly privileged documents to be otherwise”); U.S. v. Neill, 952 F. Supp. 834, 840-411 (D.D.C. 1997). But see Manno v. Christie, 2008 WL 4058016, at *4 (D.N.J. Aug. 22, 2008) (finding it “reasonable for [a government agent] to briefly review each electronic document to determine if it is among the materials authorized by the warrant, just as he could if the search was only of paper files”).
Warrants and subpoenas must disclose the actual risks of destruction of information as well as prior efforts to seize similar information in other judicial fora. U.S. v. CDT, at 1178–79 supra; see majority opinion at 1167–68, 1175–76. Cooperation with investigators, pledges to retain information, and attempts to obtain information through subpoena or through other less intrusive means—all bear on whether a warrant should be issued for the search of a device and, if so, its appropriate scope.
The government's search protocol must be designed to uncover only the information for which it has probable cause, and only that information may be examined by the case agents. U.S. v. CDT, at 1178–79 supra; see majority opinion at 1170–72. Whenever possible, advocate for a set of limiting protocols. Possible limiting factors for ex-ante search protocols might include:
- Date range
- Time range
- Specific user accounts
- Specific applications
- Communications to/from specific actors
- File type
- File size
Some courts have rejected warrant applications that fail to include ex-ante search limitations. When the government fails to articulate an ex-ante search protocol, “what the government seeks is a license to roam through everything in the computer without limitation and without standards. Such a request fails to satisfy the particularity requirement of the Fourth Amendment.” In re Search of 3817 W. West End, 321 F. Supp. 2d 953, 962-63 (N.D. Ill. 2004). See also, In re Cellular Telephones, 2014 WL 7793690, at *2 (D. Kan. Dec. 21, 2015)(court denied search warrant application for failure to provide ex-ante search protocol: “the government's application lacks a search protocol. Thus, the Court cannot grant the government's application”); In the Matter of Applications for Search Warrants for Information Associated with Target Email Accounts/Skype Accounts, 2013 WL 4647554 at *8 (D. Kan. Aug 27, 2013) (rejecting warrant application where warrants failed "to set out any limits on the government's review of the potentially large amount of electronic communications and information" and did "not identify any sorting or filtering procedures for electronic communications and information that are not relevant"); In re Search of 3817 W. West End, 321 F. Supp. 2d 953, 961 (N.D. Ill. 2004) (“We conclude that, as a practical matter, the government can provide the Court with a protocol that would supply particularity to the search of the computers. And, we conclude that as a matter of constitutional law, the government must do so in order to satisfy the particularity requirement of the Fourth Amendment.”)
Judges may impose ex-ante search protocols on their own where the government fails to set sufficient limits. For example, courts may narrow search warrants by imposing date and time limits for which there exists probable cause of criminal activity and require the searches to “be conducted through keyword searches and other appropriate protocols so as to limit the universe of data to be reviewed to that which is more likely to be pertinent” in order to prevent the warrants from becoming “the internet-era version of a ‘general warrant.’” U.S. v. Matter of Search of Info. Associated With Fifteen Email Addresses Stored at Premises Owned, No. 2:17-CM-3152-WC, 2017 WL 4322826, at *4 (M.D. Ala. Sept. 28, 2017)(citing U.S. v. Blake, 868 F.3d 960, 974 (11th Cir. 2017) (quoting Coolidge v. New Hampshire, 403 U.S. 433, 467 (1971))) (But the search limits—except the time period limits—were rescinded upon reconsideration in U.S. v. Matter of Search of Info. Associated with Fifteen Email Addresses Stored at Premises Owned, Maintained, Controlled or Operated by 1&1 Media, Inc., 2:17-CM-3152-WKW, 2017 WL 8751915, at *2 (M.D. Ala. Dec. 1, 2017)).
Be sure to specifically object where the government fails to specify the date or time limits under investigation. The Ninth Circuit has invalidated a warrant for failure to name the crime or limit the seizure to documents authored during the time frame under investigation. U.S. v. Kow, 58 F.3d 423, 427 (9th Cir. 1995). Similarly, the Sixth Circuit has found that “[f]ailure to limit broad descriptive terms by relevant dates, when such dates are available to the police, will render a warrant overbroad.” U.S. v. Ford, 184 F.3d 566, 576 (6th Cir. 1999).
The government must destroy or, if the recipient may lawfully possess it, return non-responsive data, keeping the issuing judge informed about when it has done so and what it has kept. U.S. v. CDT, at 1179 supra; see majority opinion at 1172–74.
There should be a fixed time limit during which the government must conduct its digital search. The First Circuit found suppression appropriate where the government failed to comply with time limits for reviewing seized computers when a 30-day time limit was required by the terms of the warrant. U.S. v. Brunette, 76 F. Supp. 2d 30, 42 (D. Maine 1999), aff’d, 256 F.3d 14 (1st Cir. 2001). But see U.S. v. Syphers, 426 F.3d 461 (1st Cir. 2005)(stating that the Fourth Amendment “contains no requirements about when the search or seizure is to occur or the duration,” but cautioned that “unreasonable delay in the execution of a warrant that results in the lapse of probable cause will invalidate a warrant.")
Consider challenging any subsequent search of a digital device that exceeds or otherwise varies from the scope of the probable cause established for the original search. For example, the Tenth Circuit suppressed child pornography where the subsequent search of electronic information exceeded the scope of the original warrant for records of narcotics sales; and since the images were in closed files, the court found that they were not in plain view, but were seized pursuant to a general, warrantless search. See U.S. v. Carey, 172 F.3d 1268, 1276 (10th Cir. 1999); U.S. v. Grimmett, 439 F.3d 1263, 1268 (10th Cir. 2006) (finding Carey stands for the proposition that “law enforcement may not expand the scope of a search beyond its original justification.”) But see U.S. v. Walser, 275 F.3d 981, 986-87 (10th Cir. 2001) (upholding a search where an officer with a warrant to search for electronic records of drug transactions discovered child pornography on the computer, suspended the search, and then returned to the magistrate for a second warrant application to search for child pornography); U.S. v. Gray, 78 F.Supp.2d 524, 530-31 (upholding a search where the agent discovered child pornography in the course of looking for evidence of computer hacking pursuant to a warrant, and then obtained a second warrant before searching the computer for child pornography).
Digital device searches at the U.S border present unique wrinkles in the application of Fourth Amendment protections. We've written an extensive whitepaper, entitled "Digital Privacy at the U.S. Border: Protecting the Data On Your Devices," which examines the law governing digital privacy at the U.S. border, as well as a pocket guide for travelers on how to protect their data at the border and a short guide to Constitutional rights at the border. We've also written a series of blogs entitled the "Bill of Rights at the Border," examining the application of the First, Fourth, and Fifth Amendments in the border context.
The issue of digital border searches by law enforcement requires a deeper review of cases than we can cover in this guide. However, we recommend defense attorneys review our Border Search project page for an inventory of our latest work in this area.
Consider looking to more privacy-protective federal and state laws for additional grounds to challenge or limit searches of digital devices.
Federal Privacy Protection Act
The Privacy Protection Act of 1980 ("PPA"), 42 U.S.C. § 2000aa et seq., protects journalists from being required to turn over any work product and documentary materials, including sources, to law enforcement before it is disseminated to the public. The PPA may be useful if the device search at issue involves journalists or those disseminating information to the public, like political activists.
Federal Protection for Privileged Communications
There are specific federal regulations for Searches of Disinterested Third Party Lawyers, Physicians, and Clergymen. See 42 U.S.C. § 2000aa-11(a); 28 C.F.R. § 59.4(b). These special privileges are specifically acknowledged in the 2009 DOJ CCIPS manual. At Congress’s direction, the Attorney General issued guidelines for federal officers who want to obtain documentary materials from certain disinterested third parties. Under these rules, federal law enforcement officers should not use a search warrant to obtain documentary materials believed to be in the private possession of a disinterested third party physician, lawyer, or clergyman where the material sought or likely to be reviewed during the execution of the warrant contains confidential information on patients, clients, or parishioners. 28 C.F.R. § 59.4(b). (See 2009 DOJ CCIPS Manual, p. 109-111).
Privacy Protective State Laws
Some state laws may provide additional protection for suppressing information or otherwise limiting the scope of government searches of digital devices. The ACLU maintains a website that tracks the status of Internet privacy legislation by state, and these laws may provide fertile ground for challenging or otherwise limiting devices searches.
Significantly, the California Electronic Communications Privacy Act (CalECPA) contains a number of special privacy protections that provide additional grounds for suppression. For example, CA Penal Code § 1546.1 requires a search warrant for (1) electronic communication information from a service provider; and (2) electronic device information from any person or entity other than the authorized possessor. This includes "any information stored on or generated through the operation of an electronic device, including the current and prior locations of the device." CA Penal Code § 1546(g). CalECPA also requires specific ex-ante search protocols like particularly specifying time period(s) covered and target individual(s), and mandating that the search warrant seal irrelevant information from government review without further court order. CA Penal Code § 1546.1(d).
CA Penal Code § 1546.2 requires that notice be given to the target of the warrant contemporaneous with the search warrant's execution. The notice must indicate what information is sought about the recipient and must state with “reasonable specificity the nature of the government investigation.” And in emergency situations, notice must be provided to the recipient within 3 days of data collection with a written statement detailing the facts that support the declaration of an emergency situation.
Most importantly, CA Penal Code § 1546.4 provides a statutory suppression remedy for failure to comply with CalECPA's requirements.