State v. Mansor, 421 P.3d 323

Background

Police investigated severe injuries and death of infant B; detective Rookhuyzen's affidavit recounted defendant's account that he searched the internet on a computer for first-aid advice shortly before calling 9-1-1.
The affidavit described two laptops and two desktop towers in the residence and listed 11 categories of items to seize, including the computers; a magistrate signed a warrant authorizing seizure and forensic examination of those items.
Seized drives were imaged and sent to an FBI regional computer forensics lab; examiners compiled extensive internet history (over 360,000 records dating back years) and ran numerous search terms provided by detectives and some they added.
Forensic reports produced wide-ranging results beyond the narrow June 12 internet-history that the affidavit specifically tied to probable cause; prosecutors used older and broader search-history material at trial.
Defendant moved to suppress, arguing the warrant was overbroad and lacked computer search protocols; the trial court denied suppression and defendant was convicted; the Court of Appeals held the warrant overbroad and reversed in part, and the Oregon Supreme Court granted review.

Issues

Issue	State's Argument	Mansor's Argument	Held
May the supporting affidavit be considered as part of the warrant?	Warrant referenced Attachment A and affidavit was attached; court may consider affidavit with the warrant.	Affidavit should not be considered unless the warrant explicitly incorporates it.	Defendant failed to rebut the inference affidavit accompanied the warrant; the Court considered the affidavit part of the warrant and advised better practice to expressly incorporate affidavits.
Does lawful seizure of computers permit unlimited forensic examination/use of all data?	A computer is a "thing"; once lawfully seized, officers may examine it and use any discovered information.	Computers implicate unique privacy interests; seizure alone does not authorize exhaustive forensic analysis or use of all data.	Rejected state's position; computers/digital content require greater protection—seizure alone does not justify unlimited forensic searching or unrestrained use of non-authorized data.
What particularity is required for a warrant to search a computer? (the "what/where/when")	Identifying the crime under investigation is sufficient; no need for detailed search protocols.	Warrant must specify the data sought (what), the location on the device (where), and temporal bounds (when).	Warrant must describe, as specifically as reasonably possible, the information to be searched for (the "what") and include relevant temporal limits if available; precise internal "places" on a device need not be enumerated.
Were forensic results beyond the warrant admissible at trial?	Evidence discovered during a reasonable search may be used; no separate use-restriction required.	Evidence outside the warrant scope should be suppressed absent an exception.	Evidence beyond the scope of the warrant (i.e., nonresponsive data) should not be used at trial unless an independent warrant exception applies; here non-June-12 material must have been suppressed.

Key Cases Cited

Riley v. California, 134 S. Ct. 2473 (U.S. 2014) (digital devices implicate far greater privacy interests than physical items and require heightened protection)
Wheeler v. State, 135 A.3d 282 (Del. 2016) (warrants should describe what investigators believe will be found on electronic devices with as much specificity as possible)
United States v. Stabile, 633 F.3d 219 (3d Cir. 2011) (discussing two-step model for computer searches: data acquisition and data reduction)
Comprehensive Drug Testing, Inc. v. United States, 621 F.3d 1162 (9th Cir. 2010) (on en banc rehearing; debate over protocols and limits on computer searches)
State v. Munro, 339 Or. 545 (Or. 2005) (holding a seized videotape’s contents could later be examined under the original warrant, distinguished from computers)