Documenti di Didattica
Documenti di Professioni
Documenti di Cultura
Document 1129
Filed 08/29/16
Page 1 of 17
3:16-CR-00051-BR
GOVERNMENTS AMENDED RESPONSE
TO DEFENDANTS MOTIONS TO
SUPPRESS EVIDENCE
(FACEBOOK ACCOUNTS) (ECF No. 741)
AND TO REOPEN MOTION TO
SUPPRESS (ECF No. 1040)
The United States of America, by Billy J. Williams, United States Attorney for the
District of Oregon, and through Scott E. Bradford, Assistant United States Attorney, hereby
responds to defendants Motion to Suppress Evidence (Facebook Accounts) (ECF No. 741) and
Motion to Reopen Motion to Suppress (ECF No. 1040), filed by defendant Fry on behalf of all
similarly situated defendants.
Papak was not overbroad and because the warrant was properly executed, this Court should deny
the Motion to Suppress, including the new argument raised in the Motion to Reopen.
Case 3:16-cr-00051-BR
I.
Document 1129
Filed 08/29/16
Page 2 of 17
Background
A.
On April 8, 2016, U.S. Magistrate Judge Paul Papak issued a search and seizure warrant
for 23 Facebook accounts associated with several defendants in this case.
Id.
Records, including photographs and videos or the sharing of any photographs and videos,
of individuals in possession of firearms or with others in possession of firearms, while at
the MNWR or in Harney County, Oregon;
Evidence indicating how and when the Facebook account was accessed or used, to
determine the chronological and geographic context of account access, use, and events
relating to the crime under investigation and to the Facebook account owner;
Records relating to who created, used, or communicated with the user ID, including
records about their identities and whereabouts; Evidence indicating the Facebook account
owners or users state of mind as it relates to the crimes under investigation; and
The identity of the person(s) who communicated with the user ID about matters relating
to the armed occupation of MNWR, including records that help reveal their whereabouts.
The warrant also had temporal confines, limiting the search to information from
November 1, 2015, through defendant-specific dates in late January 2016 to February 2016.
See id.
Governments Amended Response to Defendants Motion to Suppress Evidence
(Facebook Accounts) (ECF No. 741) and Motion to Reopen Motion to Suppress
(ECF No. 1040)
Page 2
Case 3:16-cr-00051-BR
Document 1129
Filed 08/29/16
Page 3 of 17
Aside from the aforementioned limitations on the search for information, the warrant
included a specific search procedurethat is:
[L]aw enforcement will segregate the information into two groups: (i) information
that is responsive to the warrant and that the government may therefore seize; and
(ii) information that is not responsive to the warrant.
Information that is responsive to the warrant will be copied onto a separate storage
device or medium. Responsive information may be used by law enforcement in
the same manner as any other seized evidence. Information that is not responsive
to the warrant will be sealed and stored on a secure medium or in a secure location.
Nonresponsive information will not be reviewed again without further order of the
Court (e.g., subsequent search warrant or order to unseal by the district court). 1
Id.
The warrant also permitted law enforcement to retain a complete copy of the information
provided by Facebook for a number of reasons, including proving the authenticity of evidence
to be used at trial, responding to questions regarding the corruption of data, establishing the
chain of custody of data, refuting claims of fabricating, tampering, or destroying data, and
addressing potential exculpatory evidence claims where, for example, a defendant claims that the
government avoided its obligations by destroying data or returning it to a third party. Id.
On April 11, 2016, Special Agent Peter Summers with the Federal Bureau of
Investigation (FBI) served Facebook with a copy of the warrant, and, in response to the warrant,
Facebook produced information for the 23 Facebook accounts on different dates and in different
ways. (Summers Decl. 3). On May 2, 2016, Special Agent Summers downloaded
Under the terms of the warrant, law enforcement officers have 180 days to segregate
responsive materials from nonresponsive materials and that time limit has not yet expired. See
Defs. Sealed Ex. B.
Governments Amended Response to Defendants Motion to Suppress Evidence
(Facebook Accounts) (ECF No. 741) and Motion to Reopen Motion to Suppress
(ECF No. 1040)
Page 3
Case 3:16-cr-00051-BR
Document 1129
Filed 08/29/16
Page 4 of 17
It included text and pictures, and he entered that information into evidence as 1B1079. 2
Videos were not included in the download because the files were too large.
Id.
Id.
On May 4,
2016, Special Agent Summers received Facebooks second response, five disks that contained
videos and the text and pictures that Facebook had previously provided on May 2, 2016.
(Summers Decl. 5).
Id.
On May 5, 2016, Special Agent Summers transferred possession of the disks to Special Agent
Claudia Bonilla, who organized the information and disseminated it so that it could be reviewed
pursuant to the warrant.
On May 13, 2016, Special Agent Bonilla received a third response from Facebook, two
disks containing data through February 11, 2016, as requested in the warrant.
5).
Id.
(Bonilla Decl.
Summers received Facebooks fourth response, another download from Facebooks law
enforcement portal. (Summers Decl. 7) and (Bonilla Decl. 6).
was reproducing all of the prior responses to the warrant in a user-friendlier format.
Id.
Special Agent Summers entered the May 19, 2016, response from Facebook into evidence as
1B1107.
Id.
After Special Agents Summers and Bonilla received Facebooks responses to the warrant,
FBI personnel began to review the information according to the search procedure set forth in the
Items of evidence are stored in the FBI evidence control room and are labeled with a 1B
number. (Baltzersen Decl. 3).
Governments Amended Response to Defendants Motion to Suppress Evidence
(Facebook Accounts) (ECF No. 741) and Motion to Reopen Motion to Suppress
(ECF No. 1040)
Page 4
Case 3:16-cr-00051-BR
warrant.
Document 1129
Filed 08/29/16
Page 5 of 17
On or about May 6, 2016, Special Agent Bonilla provided Special Agent Matthew
Heimstra several disks with Facebooks responses to the warrant for review.
and (Heimstra Decl. 3).
(Bonilla Decl. 4)
Summers provided FBI Special Agent Matthew Heimstra with the link to Facebooks law
enforcement portal for the May 19, 2016, response from Facebook.
(Heimstra Decl. 3). Special Agents Summers and Bonilla also gave Special Agent Heimstra a
copy of the search warrant, its attachments, and search terms to assist with the review of the
information provided by Facebook under the warrant. 3
Decl. 3).
Special Agent Heimstra downloaded the information from Facebook and, with the
assistance of others in his unit, uploaded it into a software program, Palantir Mint, in order to
review the information.
search terms to search the information that Facebook provided under the warrant for items that
were responsive to the warrant.
responsive under the warrant, it was flagged, a report was generated, also known as a Mint
report, and the report with the corresponding item was sent to personnel at the FBI in Portland,
Oregon, for further review to determine whether the item was indeed responsive to the warrant.
(Heimstra Decl. 3).
Page 5
Case 3:16-cr-00051-BR
Document 1129
Filed 08/29/16
Page 6 of 17
Portland, Oregon, determined that the identified items were either responsive or not responsive
to the warrant.
the information Facebook provided under the warrant was deleted from the DTOUs system and
from the software program that was used.
Federal Bureau of Investigation personnel in Portland, Oregon, also reviewed the videos
that Facebook provided under the warrant on May 4, 2016, and that were entered into evidence
as 1B1083 to determine whether they fell within the ambit of the warrant.
(Baltzersen Decl.
5). Once they completed their review of 1B1079, 1B1083, and 1B1107, they segregated the
responsive items, removed the unresponsive items from the system, and sealed the original
information from Facebook in the FBI evidence control room.
(Baltzersen Decl. 3, 5). The information can only be accessed by signing the chain of
custody, checking the item out of the FBI evidence control room, and with a court order
authorizing access to the information. (Baltzersen Decl. 3, 5).
It is important to note that the Facebook accounts for Ammon Bundy and the Bundy
ranch were only reviewed under the terms of the warrant after they had been reviewed by a filter
team for potentially privileged information, as explained below.
///
///
A list of the law enforcement officers who reviewed the reports and corresponding items for
responsiveness under the warrant are identified in Special Agents Summers, Bonillas and
Baltzersens Declarations. It also notes the dates of completions for the reviews.
4
Page 6
Case 3:16-cr-00051-BR
B.
Document 1129
Filed 08/29/16
Page 7 of 17
In February 2016, a filter team, led by Assistant United States Attorney Michelle Holman
Kerin, was established. The filter team included FBI personnel unaffiliated with the prosecution
effort and Automated Litigation Support (ALS) Specialist Doug Angel of the United States
Attorneys Office. The purpose of the filter team was to review information obtained during the
criminal investigation in this matter that could contain privileged or protected communications or
information of the defendants and, if it did, to remove the information and return it to the
appropriate defendant/privilege-holder. In this capacity, the filter team sought to ensure that
defendants Constitutional rights in these communications were protected and that members of
the prosecution team did not inadvertently review them, including during the review process
under the warrant. (Kerin Decl. 2-3).
Assistant United States Attorney Holman Kerin provided all defense counsel with the
filter protocols and invited their assistance to assure that no protected material was shared with
the prosecution team.
occasions.
The filter team confirmed, through Ammon Bundys defense counsel, that his
accounts, the Ammon Bundy and Bundy Ranch Facebook accounts, might contain protected
material.
Based on that assertion, the tilter team executed the filter protocols on his accounts
These Facebook accounts were not subject to the search procedures of the warrant until the filter
procedures had been completed.
///
Governments Amended Response to Defendants Motion to Suppress Evidence
(Facebook Accounts) (ECF No. 741) and Motion to Reopen Motion to Suppress
(ECF No. 1040)
Page 7
Case 3:16-cr-00051-BR
Document 1129
Filed 08/29/16
Page 8 of 17
Doug Angel was involved in the Facebook filter process as the individual who physically
separated privileged materials from non-privileged materials.
production, Angel did this by copying all of the material onto his local (non-network) hard drive
and by creating separate folders for each defendants Facebook account.
did not have access to this material. He created privileged and non-privileged folders for the
Ammon Bundy and Bundy Ranch accounts and, thereafter, burned the potentially privileged
material to a disk to give to defense counsel. The remaining non-privileged account data was
moved to a network folder.
production.
Angel followed the same filter process for the second Facebook
believed that he copied all 23 Facebook accounts onto a thumb drive and provided it to ALS
Specialist Rena Rallis, a member of the prosecution team.
Angel found that he only copied 11 of the 23 accounts to the external drive he provided to Rallis
(Angel Decl. 7). No member of the prosecution team reviewed any privileged information.
C.
In order to efficiently distribute discovery to defense counsel, on May 16, 2016, the
government provided each defendant with a complete copy of each defendants respective
Facebook account that the government received from Facebook under the warrant.
This was
done before the completion of the search under the warrant so that defense counsel could begin
Governments Amended Response to Defendants Motion to Suppress Evidence
(Facebook Accounts) (ECF No. 741) and Motion to Reopen Motion to Suppress
(ECF No. 1040)
Page 8
Case 3:16-cr-00051-BR
Document 1129
Filed 08/29/16
Page 9 of 17
provided under the warrant and segregated the responsive items from the unresponsive items, the
government provided the responsive items to all defendants in Volume 39 of discovery on
June 24, 2016.
Facebook accounts for Ammon Bundy, the Bundy ranch, or any other defendant whose case is
currently set for trial on September 7, 2016.
complete on the Facebook accounts for Ammon Bundy and the Bundy ranch, the government
provided the non-protected, segregated information in discovery on July 1, 2016, in Volume 41.
(Rallis Decl. 2). Complete copies of the information provided by Facebook under the warrant
have been removed from the USAOs systems, and only responsive items to the warrant remain.
(Angel Decl. 7) and (Rallis Decl. 3).
information provided by Facebook under the warrant are sealed in the FBIs evidence control
room and may not be accessed absent a court order.
information provided by Facebook under the warrant in the United States Attorneys Office are
sealed and may not be accessed absent a court order.
II.
Argument
Essentially, defendants argue this Court should suppress the Facebook evidence because
the warrant was overbroad and because the execution of the warrant was fatally flawed.
These
///
Governments Amended Response to Defendants Motion to Suppress Evidence
(Facebook Accounts) (ECF No. 741) and Motion to Reopen Motion to Suppress
(ECF No. 1040)
Page 9
Case 3:16-cr-00051-BR
Document 1129
Filed 08/29/16
Page 10 of 17
claims lack merit. Regardless, the government acted in good faith and wholesale suppression is
not required.
A.
Defendants contend the warrant was overbroad because it lacked probable cause to justify
a search of all Facebook functions, including private messaging, for responsive items to the
warrant.
This contention misses the mark. The Ninth Circuit considers three factors in
(See Defs.
Page 10
Case 3:16-cr-00051-BR
Document 1129
Filed 08/29/16
Page 11 of 17
seize only evidence of violations of 18 U.S.C. 372, Conspiracy to Impede a Federal Officer by
Threat, Violence, or Intimidation, with narrow temporal limitations; it also required a search
procedure to segregate and seal nonresponsive items.
Id.
defendants use of their Facebook accounts as it related to their alleged criminal conduct and the
items to be searched for and seized, the affidavit in support of the warrant explicitly identified
the items of which defendants complain:
As explained herein, information stored in connection with a Facebook account
may provide crucial evidence of the who, what, why, when, where, and how of
the criminal conduct under investigation, thus enabling the United States to
establish and prove each element or alternatively, to exclude the innocent from
further suspicion. In my training and experience, a Facebook users Neoprint,
IP log, stored electronic communications, and other data retained by Facebook, can
indicate who has used or controlled the Facebook account. This user attribution
evidence is analogous to the search for indicia of occupancy while executing a
search warrant at a residence. For example, profile contact information, private
messaging logs, status updates, and tagged photos (and the data associated with the
foregoing, such as date and time) may be evidence of who used or controlled the
Facebook account at a relevant time.
Defs. Sealed Ex. A.
The affidavit further notes that Facebook users can exchange private
are sent to the recipients Inbox on Facebook, which also stores copies of messages sent by the
recipient as well as other information. Id.
particular.
///
///
Page 11
Case 3:16-cr-00051-BR
B.
Document 1129
Filed 08/29/16
Page 12 of 17
Citing United States v. Chen, 979 F.2d 714 (9th Cir. 1992), defendants argue the
governments execution of the warrant was so flawed that this Court should suppress all of the
Facebook evidence. Their argument is misplaced.
was reasonable and comported to the procedures set forth in the warrant.
Rule 41(e)(2)(B) provides that a warrant may authorize the seizure of electronic storage
media or the seizure or copying of electronically stored information.
Unless otherwise
specified, the warrant authorizes a later review of the media or information consistent with the
warrant.
The time for executing the warrant in Rule 41(e)(2)(A) and (f)(1)(A) refers to the
seizure or on-site copying of the media or information, and not to any later off-site copying or
review.
The Advisory Committee Notes recognize that electronic storage media commonly
contain such large amounts of information that it is often impractical for law enforcement to
review all of the information during execution of the warrant at the search location. Fed. R.
Crim. P. 41, comm. n. (e)(2) (2009 amend.).
acknowledges the need for a two-step process: officers may seize or copy the entire storage
medium and review it later to determine what electronically stored information falls within the
scope of the warrant. Id.
Facebook to disclose information to law enforcement, and the FBI then reviewed that
information off-site, consistent with the warrants search procedure.
In Flores, the Ninth Circuit expressly approved this two-step process for electronic
evidence from Facebook:
Governments Amended Response to Defendants Motion to Suppress Evidence
(Facebook Accounts) (ECF No. 741) and Motion to Reopen Motion to Suppress
(ECF No. 1040)
Page 12
Case 3:16-cr-00051-BR
Document 1129
Filed 08/29/16
Page 13 of 17
[Defendant] further argues that the Facebook evidence presented at trial should
have been suppressed because the government exceeded its scope by seizing all
11,000 pages of data in [defendants] account. Pursuant to the terms of the
warrant, however, Facebook was authorized to provide agents with a copy of the
entire contents of [defendants] account. Agents then segregated 100 pages of
responsive material from the entire account into a separate file within the 90-day
period authorized by the warrant. Again pursuant to the warrant, the original copy
of [defendants] account was sealed in an evidence bag and is inaccessible absent a
new warrant. In short, the government executed the warrant exactly as it was
written.
Flores, 802 F.3d at 1046.
analyzed relevant case law and analogized the search of an email account (which is similar to
search warrants for Facebook accounts) to the search of computer hard drives:
We perceive no constitutionally significant difference between the searches of hard
drives . . . and searches of email accounts. Indeed, in many cases, the data in an
email account will be less expansive than the information that is typically contained
on a hard drive. Therefore, we believe that the case law we have cited concerning
searches of hard drives and other storage media supports the Governments ability
to access an entire email account in order to conduct a search for emails within the
limited categories contained in the warrant. Notably, every case of which we are
aware that has entertained a suppression motion relating to the search of an email
account has upheld the Governments ability to obtain the entire contents of the
email account to determine which particular emails come within the search
warrant. See United States v. Bach, 310 F.3d 1063, 1065 (8th Cir.2002)
(upholding as constitutionally reasonable the seizure of all of the information
from defendants email account where the service provider did not selectively
choose or review the contents of the named account); United States v. Ayache,
2014 WL 923340, at *2-3 (M.D.Tenn. March 10, 2014) (denying motion to
suppress seizure of all emails in a defendants account [ ] where there was probable
cause to believe that the email account contained evidence of a crime); United
States v. Deppish, 994 F.Supp.2d 1211, 1219-21 & n. 37 (D.Kan.2014) (noting that
nothing in 2703 precludes the Government from requesting the full content of a
specified email account, and concluding that such a search is not a general
search); United States v. Taylor, 764 F.Supp.2d 230, 232, 237 (D.Me.2011)
(upholding search of all information associated with an identified Microsoft
hotmail account); United States v. Bowen, 689 F.Supp.2d 675, 682 (S.D.N.Y.
2010) (Fourth Amendment does not require authorities to ascertain which e-mails
Governments Amended Response to Defendants Motion to Suppress Evidence
(Facebook Accounts) (ECF No. 741) and Motion to Reopen Motion to Suppress
(ECF No. 1040)
Page 13
Case 3:16-cr-00051-BR
Document 1129
Filed 08/29/16
Page 14 of 17
are relevant before copies are obtained from the internet service provider for
subsequent searching); United States v. McDarrah, 2006 WL 1997638, at *9-10
(S.D.N.Y. July 17, 2006) (denying motion to suppress seizure of [a]ll stored
electronic mail and other stored content information presently contained in a
specified email account, affd, 351 Fed.Appx. 558 (2d Cir.2009).
In re Warrant for All Content and Other Info. Associated with the Email Account
xxxxxxx@gmail.com Maintained at Premises Controlled by Google, Inc., 33 F. Supp. 3d 386,
394 (S.D.N.Y. 2014) (emphasis added).
In defendants Memorandum, defendants unpersuasively rely on opinions from
magistrate judges that have been vacated or overruled. 5
Defendants rely heavily on the magistrate opinion of In re Search of Info. Associated with
[redacted]@mac.com that is Stored at Premises Controlled by Apple, Inc., 25 F. Supp. 3d 1
(D.D.C. 2014). See Defs. Mem. 13-14, 16. However, the Chief Judge for the U.S. District
Court for the District of Columbia vacated the magistrates ruling in a published opinion. See
13 F. Supp. 3d 157 (D.D.C. 2014) (holding that the governments application for a search
warrant complies with the requirements under the Fourth Amendment and the procedures for
executing the warrant are authorized under Rule 41 of the Federal Rules of Criminal Procedure.
Accordingly, the magistrate judges second memorandum opinion and order will be vacated and
the governments application for a search warrant will be granted.).
Defendants also cite the magistrate opinion of In re Applications for Search Warrants for Info.
Associated with Target Email Accounts/Skype Accounts, 2013 WL 4647554 (D. Kan., Jan. 31,
2014). See Defs. Mem. 16. This case was overruled by a district court judge in the District of
Kansas in United States v. Deppish, 994 F. Supp. 2d 1211, 1221 & n. 45 (D. Kan. 2014).
Governments Amended Response to Defendants Motion to Suppress Evidence
(Facebook Accounts) (ECF No. 741) and Motion to Reopen Motion to Suppress
(ECF No. 1040)
Page 14
Case 3:16-cr-00051-BR
Document 1129
Filed 08/29/16
Page 15 of 17
was a fair probability that evidence would be found on the defendants personal
computer and other electronic devices); United States v. Evers, 669 F.3d 645, 652
(6th Cir.2012) (The federal courts are in agreement that a warrant authorizing the
seizure of a defendants home computer equipment and digital media for a
subsequent off-site electronic search is not unreasonable or overbroad, as long as
the probable-cause showing in the warrant application and affidavit demonstrate a
sufficient chance of finding some needles in the computer haystack. (quoting
United States v. Upham, 168 F.3d 532, 535 (1st Cir.1999))).
(Footnote omitted).
Here, the warrant complied with Rule 41 and satisfied the Fourth Amendments
reasonableness requirement. As noted above, FBI personnel followed the search procedure
outlined in the warrant, segregating nonresponsive information and sealing it in the FBI evidence
control room.
that wholesale suppression is only appropriate when law enforcement officers transform a
search into a general search by ignoring the terms of the warrant and engaging in indiscriminate
fishing. Chen, 979 F.2d at 717.
Law enforcement
personnel used a key-word search to identify responsive items, further reviewed those items to
ensure they were responsive, reviewed videos to determine their responsiveness, segregated the
nonresponsive items and sealed them in the FBI evidence control room.
to remove any potentially privileged information from the two Facebook accounts that were
identified by defense counsel for the filter review before law enforcement reviewed them for
responsive items under the warrant, and the prosecution team was not exposed to any potentially
privileged material.
Attorneys Office is sealed and may not be accessed absent a court order.
Page 15
Case 3:16-cr-00051-BR
Document 1129
Filed 08/29/16
Page 16 of 17
As to the 11 Facebook accounts, the Fourth Amendment, the terms of the warrant in this
case, or any order from this Court do not prohibit the governments disclosure of the 11
Facebook accounts to all defendants.
information from all of the Facebook accounts to all defendants, with some defense counsel
wanting all of the information.
this inadvertent disclosure violates the Fourth Amendment, the terms of the warrant, or any order
of this court is nonsensical. Moreover, under the terms of the warrant, the government,
although it has not, could still access all of the information Facebook produced under the
warrant, because the 180-day time limit to segregate the information has not expired.
While
inadvertent, the disclosure of the 11 Facebook accounts to all defendants did not violate the
Fourth Amendment, the terms of the warrant, or any order from this Court.
Accordingly, the
As noted above, the Facebook warrant was supported by probable cause and is
nonetheless be protected by the good faith exception:
Even if the warrant were deficient, the officers reliance on it was objectively
reasonable and the good faith exception to the exclusionary rule applies. United
States v. Leon, 468 U.S. 897, 104 S.Ct. 3405, 82 L.Ed. 2d 677 (1984) ([T]he
marginal benefit or nonexistent benefits produced by suppressing evidence
obtained in objectively reasonable reliance on a subsequently invalidated search
warrant cannot justify the substantial costs of exclusion.). The . . . judge was not
misled by information in the affidavit, he did not wholly abandon his judicial role,
and the affidavit certainly was not so lacking in indicia of probable cause as to
render official belief in its existence entirely unreasonable. Id. at 923, 104 S.Ct.
3405 (quoting Brown v. Illinois, 422 U.S. 590, 611, 95 S.Ct. 2254, 45 L.Ed. 2d 416
(1975) (Powell, J., concurring in part)).
Governments Amended Response to Defendants Motion to Suppress Evidence
(Facebook Accounts) (ECF No. 741) and Motion to Reopen Motion to Suppress
(ECF No. 1040)
Page 16
Case 3:16-cr-00051-BR
Document 1129
Filed 08/29/16
United States v. Schesso, 730 F.3d 1040, 1050 (9th Cir. 2013).
warrant is not wholesale suppression; it is severance.
Page 17 of 17
severance, which allows us to strike from a warrant those portions that are invalid and preserve
those portions that satisfy the Fourth Amendment.
invalid portions need be suppressed. Flores, 802 F.3d at 1045 (citation and internal quotation
marks omitted).
If the Court is inclined to suppress any portion of the Facebook warrant issued
by U.S. Magistrate Judge Paul Papak, the government respectfully requests the opportunity to
submit supplemental briefing regarding the appropriate scope of severance.
III.
Conclusion
For the foregoing reasons, the government recommends that the Court deny defendants
Motion to Suppress Evidence (ECF No. 741) and reject defendants new argument raised in the
Motion to Reopen Motion to Suppress (ECF No. 1040).
Dated this 29th day of August 2016.
Respectfully submitted,
BILLY J. WILLIAMS
United States Attorney
s/ Scott E. Bradford
SCOTT E. BRADFORD, OSB #062824
Assistant United States Attorneyl
Page 17