In
United States v. Ganias, ___ F.3d ___, 2016 U.S. App. LEXIS 9706 (2d Cir. 2016) (en banc),
here, the Second Circuit held (from the opening of the opinion):
Defendant-Appellant Stavros Ganias appeals from a judgment of the United States District Court for the District of Connecticut (Thompson, J.) convicting him, after a jury trial, of two counts of tax evasion in violation of 26 U.S.C. § 7201. He challenges his conviction on the ground that the Government violated his Fourth Amendment rights when, after lawfully copying three of his hard drives for off-site review pursuant to a 2003 search warrant, it retained these full forensic copies (or “mirrors”), which included data both responsive and non-responsive to the 2003 warrant, while its investigation continued, and ultimately searched the non-responsive data pursuant to a second warrant in 2006. Ganias contends that the Government had successfully sorted the data on the mirrors responsive to the 2003 warrant from the non-responsive data by January 2005, and that the retention of the mirrors thereafter (and, by extension, the 2006 search, which would not have been possible but for that retention) violated the Fourth Amendment. He argues that evidence obtained in executing the 2006 search warrant should therefore have been suppressed.
We conclude that the Government relied in good faith on the 2006 warrant, and that this reliance was objectively reasonable. Accordingly, we need not decide whether retention of the forensic mirrors violated the Fourth Amendment, and we AFFIRM the judgment of the district court.
Although the issue arose in a tax evasion case, it is an issue that pervades the criminal law given that computers are ubiquitous and can be a mother lode in a criminal investigation. The opinion is very long and, with respect to computer data, somewhat complex. So, I will try to summarize, in my own words, the trajectory of reasoning. In some of my summary, I add some minor spin of my own to connect the reasoning.
First, at the outset, this is an en banc opinion of the Second Circuit. Two judges concurred with the holding in the case.
Second, the only holding in the case was that any Fourth Amendment violation was irrelevant because the Government agents had acted reasonably in obtaining and executing the search warrants and then in access the computer data.
Third, the Court did not decide the Fourth Amendment issue as to whether the computer data had been illegally seized and retained in violation of the Fourth Amendment. The computer data in question had been seized from the office of Ganias, a CPA, incident to a nontax investigation of two of Ganias' clients. The data was seized pursuant to search warrant by taking a "mirror image" of Ganias' computers. That mirror image was an exact copy of the computer hard drives. As had the hard drives, the mirror image contained information within the scope of the search warrant (related to the two clients being investigated) and information outside the scope of the search warrant (for Ganias personally and other clients). Since it is generally not practical in seizing such computer data to separate immediately the data within the scope of the search warrant and data outside its scope, all of the data is seized via the mirroring; the separation process occurs later. In separating out the data outside the scope of the search warrant, a rough index will be prepared stating generally the type of the information separated out. More detailed review of the data within the scope of the search warrant can then occur as the needs of the investigation require, with such indices and analyses as appropriate. But the information outside the scope of the search warrant is not supposed to be reviewed beyond the requirement of preparing a broad index.
To use a hard copy document analogy, say that the search warrant authorizes seizure of documents in the CPA's possession related to clients A and B and, because of impracticality of making the separation of documents upon the initial seizure, the officers executing the search warrant seize too much. Assume that, under the circumstances, the seizure of too much was reasonable and in good faith simply because the officers did not have time to separate while on the premises. After the separation occurs, the usual drill is to return the documents outside the scope of the search warrant to the person whose premises were searched. There will often be some generic description of the documents to show why outside the scope of the search warrant -- e.g., documents related to other clients or to the CPA himself -- but review of the documents is not permitted. Then, if the Government's criminal attention turns to the CPA, it will have the generic description of the documents outside the scope of the search warrant but will not have those documents and will have to obtain those documents through the normal means -- subpoena the CPA or search premises of the CPA where the documents might be. This is standard fare for Fourth Amendment analysis of overseizures.
The problem is that the hard copy document and document file analogy is an imperfect analogy for computer data. From the computer user's standpoint, the data may look like it is separated into directories on computers, often called files, because, to the computer user, they seem to function much like hardcopy files containing documents. But, as the majority notes at length the hardcopy file analogy is inexact in the case of computers. The problem is that computer data may appear to the computer user to be in discrete segments of the hard drive, but that is not how the computer actually stores the data. (See the excerpt below.)