MEMORANDUM OPINION
Defendant Ali Saboonchi is alleged to have violated U.S. export restrictions on trade with the Islamic Republic of Iran. On July 18, 2013, Saboonchi moved to suppress the fruits of warrantless forensic searches of his smartphones and flash drive performed under the authority of the border search doctrine after they were seized at the U.S. — Canadian border. At a hearing on September 23, 2013, I issued an oral opinion denying the motion but stated that, in light of the difficult issues raised by a forensic search of digital devices seized at the border, I would be issuing a written opinion further explaining my reasoning. Supplemental briefing was requested and permitted. I now hold that, under the facts presented by this case, a forensic computer search cannot be performed under the border search doctrine in the absence of reasonable suspicion. Because the officials here reasonably suspected that Saboonchi was violating export restrictions, Defendant’s Motion to Suppress is denied.
I. BACKGROUND
Defendant Ali Saboonchi is a dual citizen of the United States and the Islamic Republic of Iran. Gov’t Opp’n 3, ECF No. 65. On March 4, 2013, Saboonchi was indicted by a grand jury on four counts of unlawful export to an embargoed country and one count of conspiracy to export to an embargoed country, in violation of the International Emergency Economic Powers Act (“IEEPA”), 50 U.S.C. §§ 1702 & 1705, and the Iranian Transactions and Sanctions Regulations . (“ITSR”), 31 C.F.R. § 560.203-204. See Indictment, ECF No. 1. On August 22, 2013, the grand jury returned a superseding indictment that added more alleged co-conspirators, an additional count, and additional acts in furtherance of the alleged conspiracy, and revised the alleged start of the conspiracy from November 2009 to September 2009. Superseding Indictment, ECF No. 66.
On July 18, 2013, Saboonchi filed several motions including a Motion to Suppress Evidence, ECF No. 58.
Most of the basic facts are undisputed. Saboonchi and his wife were stopped by United States Custom's and Border Protection (“CBP”) agents on March 31, 2012 at the Rainbow Bridge outside of Buffalo, New York when returning from a daytrip to the Canadian side of Niagara Falls. Del’s Mot. 2. Saboonchi and his wife were questioned separately, and Saboonchi was questioned in a locked room where he was “required to remain in the room and directed to answer questions by a federal agent.” Id. “Without Defendant’s knowledge and consent, all electronics were seized with intent to search.” Id. at 3. Eventually, Saboonchi and his wife were allowed to reenter the United States, but an Apple iPhone, a Sony Xperia phone, and a Kingston DT101 G2 USB flash drive (the “Devices”) were seized; Saboonchi claims that “no clear justification was given for” keeping the Devices. Id. Saboonchi was given a “Detention Notice and Custody Receipt for Detained Property,” CBP Form 6051D, listing the devices. CBP Form 6051D, Defs Mot. Ex. B, ECF No. 58-2.
On April 13, 2012, Saboonchi met with two HSI agents in Baltimore who returned the Devices to him. Def.’s Mot. 6; Gov’t Opp’n 25. At that time, a conversation occurred that Saboonchi characterized as an “interrogát[ion],” Def.’s Mot. 6, and that, at the very least, confirmed that Sa: boonehi owned two of the Devices and included questioning about an internship Saboonchi once had with an Iranian company and his knowledge of restrictions on doing business with Iran, Gov’t Opp’n 25.
Saboonchi moved to suppress any evidence obtained from the Devices, any statements that he made to CBP on March 31, 2012, and any statements that he made to HSI on April 13, 2012. See Def.’s Mot. Saboonchi’s motion relied on his argument that the warrantless search of the Devices at the border — and their later forensic search — violated the Fourth Amendment’s prohibition of unreasonable searches and seizures, id. at 7-8, that any statements made on March 31 were obtained in violation of the Fifth Amendment’s Self-Incrimination Clause, id. at 6-7, -and that any statements made on April 13 resulted from the improper search of Saboonchi’s Devices, id., and therefore are the “fruit of the poisonous tree,” Nardone v. United States,
A hearing was held before me on September 23, 2013, at which the Government presented testimony from two witnesses: CBP Officer Kenneth Burkhardt, see Hr’g Tr., Testimony of Kenneth Burkhardt (“Burkhardt Tr.”), ECF No. 85, and HSI Special Agent Kelly Baird, see Hr’g Tr., Testimony of Kelly Baird (“Baird Tr.”), ECF No. 84.
A. Testimony of Kenneth Burkhardt
Officer Burkhardt was one of the officers who performed a secondary screening on Saboonchi when he re-entered the United States via the Rainbow Bridge in Niagara Falls, New York on March 31, 2013, Burkhardt Tr. 6:4-9, and his testimony primarily relied on his recollection as refreshed by his report of the events of March 31, 2012, as well as his knowledge of standard practices at the Rainbow Bridge facility. According to Burkhardt, people traveling by car go through primary screening in one of about seventeen lanes. Id. at 6:17-21. Although Burkhardt lacked firsthand knowledge of, Saboonchi’s primary inspection, it was his understanding that Saboonchi arrived at
In general, once a car is diverted to secondary inspection, it is approached by one or more officers, with weapons holstered, to escort the car to secondary inspection. Id. at 7:13-8:15. When the car reaches the main CBP building, a “stop stick” tire deflation device is placed between the front and back tires of the car to prevent flight. Id. at 17:20-23. The passengers are escorted inside and a secondary inspection typically is conducted in a room off of the building’s lobby called the “medium secondary.” Id. at 9:11-16. The medium secondary is reached through a locked door, which is operated remotely to buzz people in or out. Id. at 15:17-16:5. The room contains several chairs and a metal table, id. at 15:7-16:5; Hr’g Ex. 1F-1H, and has windows that are tinted on their bottom portion. See Hr’g Ex. 1F-1H. Saboonchi and his wife were taken into the secondary inspection area and Officer Burkhardt took their passports and Saboonchi’s -wife’s visa. Burkhardt Tr. 18:8-19:24.
Burkhardt ran his own query of TECS and discovered two flags on Saboonchi, one out of Washington, D.C. and one out of Baltimore. Id. at 20:5-7. Because of those flags, at 9:52 p.m., Burkhardt contacted HSI Special Agent Kelly Baird about Saboonchi; Baird told him to detain Saboonchi’s Devices. Id. at 20:8-23; 22:11-12.
At 10:00 p.m., Burkhardt interviewed Saboonchi and his wife. Id. at 22:15. The interview consisted of routine questions regarding their citizenship, their reason for traveling to Canada, and other information relevant to their readmission to the United States. Id. at 23:21-24:10. The interview did not last more than thirty minutes, and may have been as short as ten to fifteen minutes. Id. at 29:3-20. Burkhardt did not give Miranda warnings to Saboonchi or his wife, id. at 31:7-9, and testified that they
are allowed to refuse to answer questions, but until we determine their admissibility, I mean, a thorough search of the car, a thorough search of them, I mean, we are going to, so to speak, get to the bottom of what we want to — I mean, 99.9 percent of people answer questions.
Id. at 68:2-6. Although Burkhardt did not recall the details of questioning Saboonchi and his wife, he stated that his standard practice would be to separate a car’s passengers and question them separately. Id. at 33:11-14. At this time they also would have been asked to empty their pockets, known as a “pocket dump,” id. at 21:14-18, 65:16-21, but they probably were not subjected to a pat-down or other more invasive search of their persons, id. at 30:16-22. At approximately 10:30 p.m., a “seven-point exam,” which is a detailed examination of Saboonchi’s car, was performed. Id. at 22:18-23:2. Saboonchi and his wife were not free to leave during this process. Id. at 46:17-47:14.
Although Saboonchi and his wife were allowed to re-enter the country, the Devices were not returned to them at that time and Saboonchi was given a CBP 6051D receipt for the detention of the Devices. CBP Form 6051D. Burkhardt said that it was not normal practice to look at the contents of electronic media found on a person during inspection, id. at 41:4^13:25, and neither he nor any other CBP officer attempted even a cursory inspection of the contents of the Devices at the Rainbow Bridge, id. at 59:13-60:1. “Duty Agent O’Rourke departed the station with the two cell phones and the thumb drive.” Id. at 24:19-20.
In Burkhardt’s view, what happened at the screening was “[absolutely routine.” Id. at 28:23.
B. Testimony of Kelly Baird
Special Agent Kelly Baird testified on three main issues: the factual basis underlying the flags on Saboonchi in the TECS database, the forensic searches of the Devices, and her April 13, 2012 meeting with Saboonchi to return the Devices.
Baird testified that Saboonchi first came to the attention of federal authorities in the Fall of 2010, when “the FBI received information that there had been an inquiry to a company in Vermont regarding specialized technology that has applications with industrial medical or military applications” by “a person named Ali,” whose telephone number eventually led to Saboonchi. Baird Tr. 10:21-11:2. Around December 2011, another HSI agent contacted Baird to inform her that Saboonchi’s name had come up again in the context of another investigation into export violations. Id. at 11:19-23. This led HSI to issue a number of subpoenas seeking credit card and shipping records that were returned in early March 2012. Id. at 11:24-12:2.
In response to HSI’s subpoenas, Baird received a Federal Express (“FedEx”) air-bill that showed that Ali Saboonchi, through a business called Ace Electric, had shipped a cyclone separator to an Arash Rashti at a company called General DSAZ in the United Arab Emirates. Id. at 12:2-7, 29:1-4, 30:22-24.
Shortly thereafter on March 29, 2012, Baird conducted interviews with individuals at a company called Geiger Pumps, which confirmed that it had sold two cyclone separators to Saboonchi based on his representation that “the end user was domestic use only.” Id. at 12:13-22. Baird also noted that the airbill had listed the value of the cyclone separators as $100 but that their actual value was over $2,100. Id. at 15:21-16:2. Although reporting requirements only apply to items worth at least $2,500, Baird testified, based upon her training and experience, that “when people tend to undervalue stuff, it’s to keep things below the radar.” Id. at 16:6— 8. On March 30, 2012, Baird conducted interviews with another supplier, RG Group, from which Saboonchi also had made purchases. Id. at 12:23-13:4, 31:9— 20. Somewhere around this time, Baird caused Saboonchi’s information to be entered into TECS as a person of interest. Id. at 4:7-ll.
With respect to the Devices, Baird testified that she received them in a FedEx package from Agent O’Rourke and immediately handed them over to her computer forensics agent, Agent Mycel. Baird Tr. 7:21-8:1. Baird told O’Rourke not to examine the Devices and had not examined them herself, so that she could give them to a specialist in the preservation of computer evidence. See id. at 8:22-9:10. Images were made of the hard drives of both phones and of the USB drive, but the image of the Sony phone later was deleted after it was determined that it was not Saboonchi’s. Id. at 24:7-25:6. Among the files that were searched, Baird found evidence of telephone contact with an employee of Geiger Pumps and a copy of Saboonchi’s résumé that showed that he had interned with an Iranian company. Id. at 15:11-20.
On April 13, 2012, after the Devices had been imaged, Baird arranged for Saboonchi to come to the U.S. Custom House in Baltimore so that she could return the Devices to him. Id. at 20:20-22. Saboonchi pulled his car up outside the Custom House, and Baird and another agent came out to meet him. Id. at 20:21-23. In addition to turning over the devices, Baird asked Saboonchi whether he was aware of the sanctions in place with respect to Iran and Saboonchi responded that he was aware that there were some restrictions in place, that he knew people who had had difficulties receiving money from family in Iran, and that he believed that United States residents were not permitted to use Iranian airlines. Id. at 21:2-15. Baird advised Saboonchi that he would need to get permission from the Office of Foreign Asset Control (“OFAC”) if he wished to conduct business with entities in Iran. Id. at 21:16-24. Baird also asked questions about Saboonchi’s internship with an Iranian company but did not ask if he was
The entire interaction between Baird and Saboonchi took place on the street, at Saboonchi’s car. Id. at 20:20-23. Although Baird was carrying a weapon, it was concealed, id. at 22:10-12, and Baird testified that Saboonchi was free to leave at any time, id. at 22:13-16.
C. Supplemental Briefing
At the conclusion of the hearing, I resolved the Fifth Amendment issue, finding that neither the initial questioning of Saboonchi by CBP nor his conversation with Special Agent Baird were custodial for the purposes of Miranda, relying in part upon United States v. FNU LNU,
With respect to the seizure
The Government requested, and I granted, the opportunity to provide supplemental briefing in light of the importance of the issue and the paucity of other opinions addressing it. See id. at 40:11-41:4. That briefing now has been completed, see Gov’t Supp. Mem., ECF No. 87; Def.’s Resp. Mem., ECF No. 90, and I can turn now to addressing the issues raised in Defendant’s motion.
II. THE BORDER SEARCH DOCTRINE
A. Types of Border Searches
Any analysis of a border search must begin from the proposition that
But even at the border, the Fourth Amendment continues to protect against unreasonable searches and seizures; the only difference is that, at the border, routine searches become reasonable because the interest of the Government is far stronger and the reasonable expectation of privacy of an individual seeking entry is considerably weaker. See Carroll v. United States,
The Supreme Court has not addressed the issue often, but it has laid out the broad strokes of what constitutes a routine, versus a nonroutine, search. On the one hand, in United States v. Flores-Montano, the Court held that “the Government’s authority to conduct suspicionless inspections at the border includes the authority to remove, disassemble, and reassemble a vehicle’s fuel tank.”
'On the other hand, United States v. Montoya de Hernandez presents an extreme factual situation that clearly exceeded a mere routine search or seizure, in which a defendant suspected of smuggling drugs in her alimentary canal was told that she would not be released into the United States until she submitted to an x-ray or “produced a monitored bowel movement that would confirm or rebut the inspectors’ suspicions.”
The principal case on border searches in the Fourth Circuit is United States v. Ickes,
B. Location of Border Searches
A border search need not take place at the border — indeed, here it appears that Saboonchi’s Devices were seized at a border but actually were searched in Baltimore, well within the territory of the United States. Courts have recognized two different ways that a search may fall within the border search doctrine even though it does not occur at a physical border. First, border searches “may in certain circumstances take place not only at the border itself, but at its functional equivalents as well.” Almeida-Sanchez v. United States,
Second, courts have permitted “ ‘extended border searches,’ under which ‘border’ is given a geographically flexible reading within limits of reason related to the underlying constitutional concerns to protect against unreasonable searches.” United States v. Bilir,
III. DISCUSSION
At the outset, it is important to understand what takes place during a forensic computer search, and what distinguishes it from what may usefully be regarded as a “conventional” search of a computer or digital device. Though every search is different, a forensic search has certain hallmarks by which it can be identified. First, “the computer forensics process always begins with the creation of a perfect ‘bitstream’ copy or ‘image’ of the original storage device saved as a ‘read only’ file.” Orín S. Kerr, Searches and Seizures in a Digital World, 119 Harv. L.Rev. 531, 540 (2005). Then, a computer forensics expert will use specialized software to comb through the data, often over the course of days, weeks, or even months, id. at 537-38, searching the full contents of the imaged hard drive, examining the properties of individual files, and probing the drive’s unallocated “slack space” to reveal deleted files, id. at 542-43. Although directed by a forensic examiner, an integral part of a forensic examination is the use of technology-assisted search methodology, where the computer searches vast amounts of data that would exceed the capacity of a human reviewer to examine in any reasonable amount of time. The techniques used during a forensic search can be distinguished from a conventional computer search, in which a Customs officer may operate or search an electronic device in much the same way that a typical user would use it.
As I will explain, a conventional computer search can be deeply probing and, much like any search of personal effects at the border, has the potential to be invasive. Yet these concerns do not bring a conventional computer search outside of the broad authority granted under the border search doctrine any more than a suitcase is immunized from search because it may contain a personal diary. Despite the vast amounts of data available in an electronic device, a conventional search is limited by the amount of time one Customs officer has to devote to reviewing the contents of digital evidence at the border while its owner awaits the outcome of the search. Even if that review may take a matter of hours, the amount of data searched will be a mere fraction of what is on the device, given the storage capacity of modern electronic devices. And in any event, though such a search may last hours, it will not last days. There is only so much time that a Customs officer has to devote to the border search of a computer. No matter how thorough or highly motivated the agent is, a manual search of a computer or digital device will never result in the human visualization of more than a fraction of the content of the device.
In contrast, a forensic examination of a computer or other electronic device using sophisticated technology-assisted search methodologies can exceed vastly the capacity of a human searching and viewing files. Moreover, this type of search exposes a class of data that raises novel privacy concerns, including files that a user had
A. Analytical Framework
The framework established by the Supreme Court and the Fourth Circuit allows for three possible ways to analyze the seizure and search of Saboonchi’s Devices. The Government has taken the position that the detention, seizure, imaging, and forensic search of the Devices should be viewed as a routine border search, so that no suspicion was required and the search clearly was permissible under any facts. Gov’t Opp’n 26. Saboonchi has argued that, because the actual search of the Devices took place at a field office in Baltimore, several hundred miles from where Saboonchi crossed the border, it is best viewed as an extended border search for which reasonable suspicion was required. Def.’s Reply 2. In the alternative, Saboonchi argues that, unlike a conventional search of a digital device such as viewing a video or booting up a computer at the border, the act of seizing and imaging an electronic device and thereafter — perhaps days or weeks later — performing a forensic search crosses the line from a routine search to a nonroutine search, and therefore requires reasonable suspicion irrespective of where it is performed. Id. at 2, 5-6.
The facts here are distinct from cases that found an extended border search had occurred. In United States v. Bilir, for example, DEA agents declined to act immediately on information that heroin was concealed on a Turkish ship that would be entering several American ports, and instead followed the ship from port to port in hopes of apprehending the suspects.
The searches of the Devices in this case cannot be an extended border search because Saboonchi was not allowed to bring them across the border. See United States v. Stewart,
Therefore, the level of suspicion required depends on whether the forensic search of the Devices was a routine search or a nonroutine search. Although I hold that a forensic search of a computer or electronic device should be considered a nonroutine search for which reasonable suspicion is required, I do so only after thorough analysis of the relevant law and factual considerations.
B. Routine Versus Nonroutine Searches Generally
Unsurprisingly, the overwhelming majority of searches that one would expect to encounter at the border fall into the category of conventional, routine border searches. This includes pat-downs, pocket-dumps, and even searches that require moving or adjusting clothing without disrobing, and also may include scanning, opening, and rifling through the contents of bags or other closed containers. But a routine search also may go beyond what a traveler otherwise may consider routine. For example, a routine search may extend to the inside of an automobile gas tank, United States v. Flores-Montano,
A wide range of searches of persons also have been upheld as routine even if they involve some level of indignity or intrusiveness, so long as they fall short of a strip search and do not expose the cavities of the body. See, e.g., Bradley v. United States,
On the other hand, United States v. Ramsey left open the possibility that “a border search might be deemed ‘unreasonable’ because of the particularly offensive manner in which it is carried out.”
Courts have struggled to define a clear dividing line between routine and nonroutine searches. In United States v. Braks,
(i) whether the search results in the exposure of intimate body parts or requires the suspect to disrobe;
(ii) whether physical contact between Customs officials and the suspect occurs during the search;
(in) whether force is used to effect the search;
(iv) whether the type of search exposes the suspect to pain or danger;
(v) the overall manner in which the search is conducted; and
(vi) whether the suspect’s reasonable expectations of privacy, if any, are abrogated by the search.
Other courts have focused specifically on familiar touchstones such as the exposure of intimate body parts and details, as well as a suspect’s reasonable expectations of privacy. In United States v. Vega-Barvo,
To determine the “intrusiveness” level of the internal body searches involved in today’s cases, it is necessary to decide whether intrusiveness is to be defined in terms of whether one search will reveal more than another, or whether intrusiveness is to be interpreted in terms of the indignity that will be suffered by the person being searched. For example, is an x-ray more intrusive than a cavity search because it will reveal more thanthe cavity search, or less intrusive because it does not infringe upon human dignity to the same extent as a search of private parts? A person can retain some degree of dignity during an x-ray, but it is virtually impossible during a rectal probe, despite the more limited scope of such a search.
Id. at 1345. Although the Eleventh Circuit held that the true touchstone is “personal indignity,” id. at 1346, the distinction did not seem to make much difference, as the Eleventh Circuit held that an x-ray search is “more intrusive than a frisk, [though] no more intrusive than a strip search,” and therefore required reasonable suspicion, but not more, id. at 1349. The Supreme Court and the Fourth Circuit also have assumed, but not decided, that an x-ray search is nonroutine. See Montoya de Hernandez,
Though most of these cases deal with searches of persons, some searches of property also have been found to be non-routine. In Flores-Montano, the Supreme Court noted — and declined to comment on — a series of cases finding that “exploratory drilling searches” required reasonable suspicion. See Flores-Montano,
There also is a line of cases that has held that searches of private quarters on ships arriving at U.S. ports from abroad resemble the search of a home too closely to be permitted absent reasonable suspicion. In United States v. Whitted, customs officials entered the defendant’s cabin after a query on a ship’s manifest against TECS returned a “one-day lookout” for the defendant.
C. Prior Case Law on Searches of Electronic Media
Ickes makes it clear that a routine border search may include a conventional inspection of electronic media and a review of the files on them just as it may include physical papers. See Ickes,
But courts have disagreed on whether the same principles apply to forensic searches of electronic devices. There have been two recent opinions addressing the issue in the past year, United States v. Cotterman,
United States v. Cotterman is the first (and as far as I have found, the only) circuit court case to address the issue, and it held that a forensic search of electronic media could not be a routine search.
Immigration and Customs Enforcement (“ICE”) agents arrived at the border crossing, Mirandized Cotterman and his wife, and interrogated them. Id. at 958. Cotterman offered to help them access the files on his computer, but the ICE agents declined out of concerns that he would delete the files or that his laptop was “ ‘booby trapped.’ ” Id. Eventually the Cottermans were allowed to leave but the ICE agents retained the laptop computers and a digital camera, which they transported 170 miles to an ICE Computer Forensic Examiner. Id. The examiner imaged and performed forensic searches of the hard drives of the electronic devices and found seventy-five images of child pornography hidden in the unallocated space on Cotter-man’s laptop. Id. He contacted the Cottermans shortly thereafter and informed
The Ninth Circuit found no problem with the initial search of Cottermaris devices at the border itself, id. at 960, but held that “the comprehensive and intrusive nature of a forensic examination ... trigger[s] the requirement of reasonable suspicion here,” id. at 962, because the material that can be gleaned from a forensic search of an electronic device differed not only in quantity, but in kind, from that which previously had been upheld. The Ninth Circuit explained:
The private information individuals store on digital devices — their personal “papers” in the words of the Constitution— stands in stark contrast to the generic and impersonal contents of a gas tank....
The amount of private information carried by international travelers was traditionally circumscribed by the size of the traveler’s luggage or automobile. That is no lopger the case. Electronic devices .are capable of storing warehouses full of information....
The nature of the contents of electronic devices differs from that of luggage as well. Laptop computers, iPads and the like are simultaneously offices and personal diaries. They contain the most intimate details of our lives: financial records, confidential business documents, medical records and private emails. This type of material implicates the Fourth Amendment’s specific guarantee of the people’s right to be secure in their “papers.” ...
Electronic devices often retain sensitive and confidential information far beyond the perceived point of erasure, notably in the form of browsing histories and records of deleted files. This quality makes it impractical, if not impossible, for individuals to make meaningful decisions regarding what digital content to expose to the scrutiny that accompanies international travel. A person’s digital life ought not be hijacked simply by crossing a border. When packing traditional luggage, one is accustomed to deciding what papers to take and what to leave behind. When carrying a laptop, tablet or other device, however, removing files unnecessary to an impending trip is an impractical solution given the volume and often intermingled nature of the files. It is also a time-consuming task that may not even effectively erase the files.
... Such a thorough and detailed search of the most intimate details of one’s life is a substantial intrusion upon personal privacy and dignity. [The Ninth Circuit therefore held] that the forensic examination of Cottermaris computer required a showing of reasonable suspicion, a modest requirement in light of the Fourth Amendment.
Id. at 964-65, 968 (internal citations omitted). But the court took pains to note that suspicionless conventional (that is to say, nonforensic) searches of electronics still would continue, and that “[Reasonable suspicion leaves ample room for agents to draw on their expertise and experience to pick up on subtle cues that criminal activity may be afoot.” Id. at 967 (citing United States v. Tiong,
It is difficult to rely on Cotterman as setting forth a rule of general applicability.
Further, it is difficult to figure out the precise basis on which the Ninth Circuit distinguished forensic searches from conventional ones. The court’s main rationale seemed to be that “the uniquely sensitive nature of data on electronic devices carries with it a significant expectation of privacy and thus renders an exhaustive exploratory search more intrusive than with other forms of property.” Cotterman,
If Cotterman raises complex and difficult questions as to its rationale and its consistency with Fourth Circuit law, Abidor v. Napolitano appears to lack precedential value — both because there are questions about the court’s jurisdiction where it stated legal conclusions regarding the constitutionality of the searches after having determined that none of the plaintiffs had standing to challenge them, and because certain aspects of its reasoning are unpersuasive. Abidor was a civil suit brought by an individual plaintiff named Pascal Abidor, the National Association of Criminal Defense Lawyers, and the National Press Photographers Association. Abidor v. Napolitano,
In Abidor, the court held that all plaintiffs lacked standing for the relief that they sought. Id. at 276-78, at *13-14.
At the outset of its discussion of computer searches, Abidor defines the relevant distinction as between a “quick look,” which is “only a cursory search that an officer may perform manually,” and a “comprehensive forensic evaluation,” which is “an exhaustive search of a computer’s entire hard drive.” Id. at 269-70, at *7 (citations omitted). This distinction purports to come out of Cotterman, but that is questionable. The phrase “quick look” appears only a single time in Cotterman, where the Ninth Circuit noted that it “ha[s] approved a quick look and unintrusive search of laptops,” Cotterman,
Further, Abidor’s reasoning seems to proceed from the view that, “it would be foolish, if not irresponsible, for plaintiffs to store truly private or confidential information on electronic devices that are carried and used overseas.” Abidor,
While this reasoning may make sense with respect to non-digital “effects” carried by international travelers, it misperceives the reality of the capacity and use of digital devices in today’s world: Portable electronic devices are ubiquitous. It neither is realistic nor reasonable to expect the average traveler to leave his digital devices at home when traveling. Over ninety percent of American adults own some kind of cellular phone and more than half of those own a smartphone — a category that includes, but is not limited to, iPhones, Android-based phones, and Blackberry devices. Aaron Smith, Smart-phone Ownership 2013, PewReseareh Internet Project (June 5, 2013), http://www. pewinternet.org/2013/06/05/smartphoneownership-2013. The public increasingly is attached to its phones: In 2010 the Pew Research Center found that sixty-five percent of adults — and seventy-two percent of parents — have slept with or near their phones. Amanda Lenhart, Cell Phones and American Adults, PewReseareh Internet Project (Sept. 2, 2010), http://www. pewinternet.org/2010/09/02/cell-phones- and-american-adults/. Although many undoubtedly carry their phones as a convenience or a luxury, for others it is a necessity. Last year’s ABA Legal Technology Resource Center’s Technology Survey “reveals that 91% of all attorneys use a smartphone, and that percentage increases with the size of the law firm.” 2013 ABA Tech Survey Once Again Shows Surge in Attorneys Using iPhone, iPad, www. iphonejd.com/iphone_jd/2013/07/2013-abatech-survey.html (July 30, 2013). In an increasingly global economy, professionals, businessmen, academics, and ordinary folk travel and maintain contact with family, friends, and colleagues at home while doing so. See, e.g., Compl. ¶¶ 79-82, Abidor v. Napolitano, No. 10-4059 (E.D.N.Y. Sept. 7, 2010),
Smartphones, in particular, have become so deeply embedded in day-to-day activities that travelers cannot reasonably be expected to travel without them, even if this were the only way to preserve their Fourth Amendment rights. For many users, smartphones completely have replaced alarm clocks and watches, cameras (both still and video), GPS devices, personal planners or datebooks, music players, newspapers, radios, and even books. See
Encouraging Americans to travel without their electronic devices also is imprudent and leaves them exposed in the event of disaster abroad. In one recent incident, skiers caught in an avalanche were able to call for help using their cell phones and were rescued with help from a GPS unit. Mike Clarke, 3 Skiers Rescued from Avalanche near Hope, B.C.; Two Skiers Were Caught in the Avalanche, One Was Injured, CBC News (Feb. 16, 2014 7:20 PM) (last updated Feb. 16, 2014 9:10 PM), http://www.cbc.ca/news/british-columbia- ■ 3-skiers-rescued-from-avalanche-near-hope-b-c-1.2539773. In another, an American family was able to use their cell phones to re-book hotels and flights (undoubtedly with substantial roaming fees) when they encountered problems with their reservations in the Dominican Republic. Douglass Dowty, Forced Home After First Day of $1,600 Caribbean Vacation, Family Sues Travel Site Hot-wire.com, Syracuse.com (N.Y.) (Feb. 7, 2014 9:12 AM) (updated Feb. 7, 2014 1:06 PM), http://www.syracuse.com/news/index. ssfl'2014/02/clay_family_forced_home_ after_Arst_day_of_4600_caribbean_ vacation_sues_booking.html. The Department of State expressly has recommended that travelers to certain regions enroll in the Smart Traveler Enrollment Program .to receive “safety and security updates” and to ensure that those travelers can be contacted in case of emergency — a goal that could not be accomplished if the travelers in question did not have electronic devices on which to receive updates and communications. See, e.g., Bureau of Consular Affairs, Russian Federation Travel Alert, Dep’t of State (updated March 14, 2014), http://travel.state.gov/content/ passports/english/alertswarnings/russiatravel-alert-events-in-ukraine.html (“strongly recommend[ing] that U.S. citizens traveling to or residing in Russia enroll in the Department of State’s Smart Traveler Enrollment Program”). And in the context of unrest in Ukraine, “the American Citizen Services Unit of the U.S. Embassy in Kyiv has implemented a text messaging network, whereby registered American citizens in Ukraine can receive short text messages ... providing important information in case of an emergency.” Travel Information by SMS Alerts, Embassy of the United States, Kyiv, Ukraine, http://ukraine.usembassy.gov/ announcements.html (last visited Apr. 4, 2014). It is likely that smartphones will become even more useful while traveling, as the ownership and use of smartphones abroad has been expanding rapidly. See, e.g., Josh Heggestuen, One in Every 5 People in the World Own a Smartphone, One in Every 17 Own a Tablet, Businesslnsider.com (Dec. 15, 2013 3:23 PM), http://www.businessinsider.com/ smartphone-and-tabletpenetration-201310 (between 2009 and 2013, global smart-phone ownership has expanded from 5% of the world’s population to 22%, an increase of 1.3 billion smartphones).
Indeed, mobile devices now serve as digital umbilical cords to what travelers
Finally, whereas Cotterman did not adequately explain why a forensic search differs from a conventional one, Abidor did not appear to recognize any meaningful distinction between the two at all.
There are a handful of additional cases that, though decided in the shadow of forensic searches, did not directly address their permissibility. One notable circuit court case is United States v. Stewart, in which defendant Stewart was selected for secondary screening after being “ ‘standoffish’ and ‘confrontational’ ” towards CBP officers.
Like the Fourth Circuit, the Sixth Circuit characterized the border search doctrine as “a broad exception to the Fourth Amendment’s requirement of probable cause.” Id. at 524. But because a warrant was obtained prior to any forensic search, the only question that was raised on appeal was whether the initial detention and conventional searches of Stewart’s computers prior to obtaining the search warrant constituted an extended border search, requiring reasonable suspicion, or a routine border search, for which suspicion is not required. See id. The Sixth Circuit held that this was a routine search, noting that the second conventional search, though performed without a warrant, was “the same search that they could have done the previous day had the proper equipment [ie., a computer charger] been present at the airport,” and that the search occurred only one day later and twenty miles away. Id. at 525-26.
In House v. Napolitano, No. 11-10852-DJC,
Relying on United States v. Braks,
Crucial to the court’s reasoning was the notion that “[i]t is the level of intrusiveness of the search that determines whether the search is routine, not the nature of the device or container to be searched.” Id. at *8. Thus the district court declined to recognize an exception to the border search doctrine that would give greater protection to electronically stored information than it would to information carried in other formats. Id. But the House court relied heavily on Arnold and Ickes and did not address whether forensic searches inherently may be more intrusive than other types of searches of an electronic device. Id. at *7. In any event, the district court found that the chance that House was targeted because of his political views created a sufficient possibility that the motivation underlying the search was unreasonable even if the search itself was not impermissible. Id. at *8. The court also found that there are some limits on how long the government may detain property, even if it legitimately was seized. See id. at *9. The possibility that a forty-nine-day detention was not reasonably related to the reasons for detaining the electronic devices also was sufficiently strong to defeat a motion to dismiss. Id. at *9-10.
Counsel also have cited several cases in which courts upheld searches of computers or other media as supported by reasonable suspicion, thereby obviating the need to determine whether the search was routine or nonroutine. See, e.g., United States v. Irving,
D. An Analytical Framework for Searches of Electronic Media
“There is no question that computers are capable of storing immense amounts of information and often contain a great deal of private information. Searches of computers therefore often involve a degree of intrusiveness much greater in quantity, if not different in kind, from searches of other containers.” United States v. Payton,
A conventional search at the border of a computer or device may include a Customs officer booting it up and operating it to review its contents, and seemingly, also would allow (but is not necessarily limited to) reviewing a computer’s directory tree or using its search functions to seek out and view the contents of specific files or file types. Because electronic storage is logical, not spatial or physical, even a cursory search can be tremendously powerful because it can target very specific files or file types. See Orin S. Kerr, Searches and Seizures in a Digital World, 119 Harv. L.Rev. 531, 540, 544-47 (2005). And, just as a luggage lock does not render the contents of a suitcase immune from search, a password protected file is not unsearcha
But seizing a digital device, imaging the entirety of its contents, and keeping the imaged file in the possession of the government after the device has been retened for the purpose of subjecting the imaged file to a forensic search, is another matter entirely. In a forensic search of electronic storage, a bitstream copy is created and then is searched by an expert using highly specialized analytical software — often over the course of several days, weeks, or months — to locate specific files or file types, recover hidden, deleted, or encrypted data, and analyze the structure of files and of a drive. See Kerr, supra, at 544-47. It is the potentially limitless duration and scope of a forensic search of the imaged contents of a digital device that distinguishes it from a conventional computer search. The latter may take hours and delve deeply into the contents of the device, but it is difficult to conceive of a conventional search of a computer or similar device at a border lasting days or weeks. A forensic examination of the imaged content, possibly at a location far from the border and using sophisticated electronic search methods designed to recover even deleted information, is of an altogether different scope and magnitude. And while courts may reach different conclusions about whether forensic searches of digital devices seized at the border require reasonable suspicion, they nevertheless should acknowledge the true character of the devices at issue, the amount of data they contain, the mix of personal and business information they store, and the magnitude of what their contents may reveal about the lives of their users. Facile analogies of forensic examination of a computer or smartphone to the search of a briefcase, suitcase, or trunk are no more helpful than analogizing a glass of water to an Olympic swimming pool because both involve water located in a physical container. “Judges and lawyers live on the slippery slope of analogies; they are not supposed to ski it to the bottom.” Robert H. Bork, The Tempting of America: The Political Seduction of the Law 169 (1990).
The courts that have confronted forensic searches have struggled to differentiate between general characteristics of searches of electronic devices and characteristics unique to forensic searches as such. See supra (explaining that neither Cotterman nor Abidor drew a clear distinction between a forensic search and a conventional one). This distinction seems absolutely necessary for analyzing the constitutional requirements for forensic searches.
1. Issues Raised by Electronic Devices Generally
The proliferation of electronic devices has allowed travelers to carry a tremendous amount of information with them, much of which is likely to be highly personal. The sheer quantity of data strains analogies between computers and other closed containers. For example, the standard size of a checked bag on an international flight is sixty-two linear inches (that is, the total of length plus width plus height) and fifty pounds. See, e.g., American Airlines Baggage Allowance Information, American Airlines, http://www.aa. com/il8n/travelInformation/baggage/ baggageAllowanee.jsp# !basic-info/ (last visited Apr. 4, 2014) (checked bags may be up to 62 linear inches and fifty pounds); Checked Bags & Fees, Delta, http://www. delta.com/content/www/en_US/travelingwith-us/baggage/before-your-trip/checked. html?icid=Policy_Ck_Baggage_Ongoing/ (last visited Apr. 4, 2014) (same); Baggage Policies, U.S. Airways, http://www. usairways.com/enUS/traveltools/baggage/ baggagepolicies.html (last visited Apr. 4,
There also is no question that a conventional search allows Customs officers to examine a wealth of information that
is, by and large, of a highly personal nature: photographs, videos, written and audio messages (text, email, and voicemail), contacts, calendar appointments, web search and browsing history, purchases, and financial and medical records. It is the kind of information one previously would have stored in one’s home that would have been off limits to officers performing [a border search].
United States v. Wurie,
But even though travelers routinely walk around carrying digital truckloads worth of data, a conventional search of an electronic device does not differ significantly in scope from the search of a suit-ease. There is a limited amount of time that can be devoted to this while the owner waits at the border for the search to conclude and, even if “[t]he private information individuals store on digital devices— their personal ‘papers’ in the words of the Constitution — stands in stark contrast to the generic and impersonal contents of a gas tank,” Cotterman,
Nor do the privacy concerns raised by such a search differ from where a traveler brings a suitcase full of personal items, files, or a diary. Although it surely is a discomforting concept, there is no principle beyond the shortness of life and the acknowledgement that there is only so much time available to conduct any particular border search that prevents a CBP officer from “reading a diary line by line looking for mention of criminal activity.” Cf. Cotterman,
All of this is not to say that there are not new issues on the horizon that may not fit into existing frameworks. Cloud computing allows users to store data on a remote server for easy access from a computer or cell phone, “givfing] users ‘anywhere access’ to applications and data stored on the Internet.” David A. Couillard, Note, Defogging the Cloud: Applying Fourth Amendment Principles to Evolving Privacy Expectations in Cloud Computing, 93 Minn. L.Rev. 2205, 2216 (2009). These files do not “cross the border, [but they] may appear as a seamless part of the digital device when presented at the border.” Cotterman,
Even more concerning, Judge Posner has noted that “[a]n iPhone application called iCam allows you to access your home computer’s webcam so that you can survey the inside of your home while
In sum, the reason why a conventional search of a computer can be analogized to a conventional search of a suitcase is less because a computer is analogous to a suitcase than it is because a conventional search has the same inherent limitations— and the same inherent risk of invasiveness — irrespective of what is being searched. There is only a finite amount of time available for a CBP agent to detain a traveler at the border to search the contents of his suitcase or laptop. If the collected works of Shakespeare comprise a mere five megabytes of text, see Data Powers of Ten, in How Much Information (2000), http://www2.sims.berkeley.edu/ research/projects/how-much-info/ datapowers.html, a conventional search of a hard drive containing several gigabytes of data cannot possibly encompass every bit of data on the device to be searched any more than a search of an English major’s bags would include a full reading of Hamlet. There simply is not enough time to do so while both traveler and Customs agent wait at the border.
2. Issues Unique to Forensic Searches
In contrast, a forensic search is a different search — not merely a search of a different object — and it fundamentally alters the playing field for all involved. A forensic search requires the creation of a bit-stream copy and its thorough analysis with specialized software over an extended period of time. See Kerr, supra, at 540, 544-47. This type of search raises issues that do not arise in conventional searches. First, because the item searched is a bit-stream copy of a device, it may take place long after the device itself has been returned to its owner and therefore a forensic search is unbounded in time. Second, a forensic search allows officers to recover a wealth of information even after it has been deleted. And third, a forensic search provides information about a person’s domestic activities away from the border that is not otherwise available even in a conventional search taking place at the border.
i. The Role of Imaging Software
The subject of a forensic search always is a bitstream copy of the data on a device — and copies of the copy — not the device itself. See Kerr, supra, at 540 (“The actual search occurs on the government’s computer, not the defendant’s.”); see also ICE Report 1 (noting that each device was “connected to an XRY imaging machine and a logical image ... was obtained,” following which the “device was then returned to evidence storage”). The primary purpose of working from an image is to “duplicate[ ] every bit and byte on the target drive including all files, the slack space, Master File Table, and metadata in exactly the order they appear on the original.” Kerr, supra, at 541. It also prevents the alteration or loss of data as a result of the operation of a computer itself. Cf. Corey J. Mantei, Note, Pornography and Privacy in Plain View: Applying the Plain View Doctrine to Computer Searches, 53 Ariz. L.Rev. 985, 1007 (2011) (“[A] manual search of an operating system may lead to evidentiary issues because
But creating an image of a drive has an added benefit to law enforcement: “Instead of detaining the electronic device, CBP or ICE may instead copy the contents of the electronic device for a more in-depth border search at a later time.” U.S. Dep’t of Homeland Sec., Privacy Impact Assessment for the Border Searches of Electronic Devices 8 (Aug. 25, 2009), http:// www.dhs.gov/xlibrary/assets/privacy/ privacy_pia_cbp_laptop.pdf [hereinafter Privacy Impact Assessment]. This allows for searches to extend far beyond the time that an actual physical search at the border would have been performed. Whereas the sixteen hour detention of Montoya de Hernandez “undoubtedly exceeded] any other detention ... approved under reasonable suspicion,” Montoya de Hernandez,
And “even if the initial seizure of a laptop and other electronic devices at the border requires no reasonable suspicion, the ‘[g]overnment cannot simply seize property under its border search power and hold it for weeks, months, or years on a whim.’ ” House v. Napolitano, No. 11-10852-DJC,
ii Access to Deleted Data
A forensic search also exposes an entirely different body of data from any conventional search: It is the only means by which deleted data can be recovered.
Marking a file as “deleted” normally does not actually delete the file; operating systems do not “zero out” the zeroes and ones associated with that file when it is marked for deletion. Rather, most operating systems merely go to the Master File Table and mark that particular file’s clusters available for future use by other files. If the operating system does not reuse that cluster for another file by the time the computer is analyzed, the file marked for deletion will remain undisturbed. Even if another file is assigned to that cluster, a tremendous amount of data often can be recovered from the hard drive’s “slack space,” space within a cluster left temporarily unused. It can be accessed by an analyst just like any other file.
Computer operating systems and programs also generate and store a wealth of information about how the computer and its contents have been used. As more programs are used, that information, called metadata, becomes broader and more comprehensive. For example, the popular Windows operating system generates a great deal of important metadata about exactly how and when a computer has been used. Common word processing programs such as WordPerfect and Microsoft Word generate temporary files that permit analysts to reconstruct the development of a file. Word processing documents can also store data about who created the file, as well as the history of the file. Similarly, browsers used to surf the World Wide Web can store a great deal of detailed information about the user’s interests, habits, identity, and online'whereabouts, often unbeknownst to the user. Browsers typically are programmed to automatically retain information about the websites users have visited in recent weeks; users may use this history to retrace their steps or find webpages they previously visited. Some . of this information may be very specific; for example, the address produced by an Internet search engine query generally includes the actual search terms the user entered.
Id. at 542-43 (footnotes omitted).
Indeed, even reformatting a hard drive — which long has been described as
And even if a user never saves any data, there still is no guarantee of protection because a forensic search can recover even some unsaved data. This goes beyond a mere search of one’s “papers” to a review of their thoughts and ideas left unspoken.
Hi. Access to Protected Information
A forensic search of a mobile device also can reveal a wealth of data about a user’s day-to-day life. “Security researchers have discovered that Apple’s iPhone keeps track of where you go — and saves every detail of it to a secret file on the device,” including latitude and longitude data and timestamps, for up to a year. Charles Arthur, iPhone Keeps Record of Everywhere You Go, The Guardian (U.K.) (Apr.
And this is to say nothing about the reams of data that, though readily available on a smartphone or computer, nevertheless are unlikely to be reviewed and analyzed at length in a conventional search. The forensic searches of Saboonchi’s Devices recovered contacts, call logs, calendar entries, text messages, email, chat logs, web browser information, photos, documents, and video files. ICE Reports 2; see also supra (explaining that forensic searches essentially are unbounded in time).
iv. A Forensic Search Is Sui Generis
Taking all of this into account, I cannot help but find that even if a computer or cell phone is analogized to a closed container, a forensic search cannot be analogized to a conventional search of luggage or even of a person. A forensic search is far more invasive than any other property search that I have come across and, although it lacks the discomfort or embarrassment that accompanies a body-cavity search, it has the potential to be even more revealing.
A conventional computer search allows Customs officers to choose, within the finite amount of time available to them while they detain the traveler, to decide where, within a veritable mountain of personal data, to focus their attention while searching for contraband, threats, or criminality. And at the end of a conventional search, as with the conventional search of a suitcase, a traveler regains custody of his possessions and information and proceeds about his business with a minimum of lingering inconvenience. A forensic search, on the other hand, allows a Customs officer to give uniquely probing review not only to the files on one’s computer, but also any files that ever may have been on that computer. And even after a traveler is cleared to enter the country, the search may continue for months or even years afterwards.
Applying the Braks factors, there is no doubt that such a search results in the exposure of intimate details and abrogates a traveler’s reasonable expectations of privacy in his or her most personal and confidential affairs — including in information that, from the user’s perspective, no longer even exists. United States v. Braks, 842,
My conclusion becomes even more clear if I focus on the potential for personal indignity and intrusiveness — as did the Eleventh Circuit in Vega-Barvo — because a computer forensic search is at least as invasive as an x-ray, takes longer, and reveals considerably more information. See United States v. Vega-Barvo,
It is true that there are not many existing cases in which property searches were found to be nonroutine, but the Supreme Court has not foreclosed the possibility that such a category of search may exist. See Flores-Montano,
v. The Scope of this Ruling
I also must clarify what I do not hold today. First, nothing in this opinion departs from the Fourth Circuit’s holding in Ickes. It would be unworkable to develop a different set of rules for conventional border searches of computers, not to mention for anything capable of containing expressive material. See Ickes,
I also do not define a forensic search in terms of the amount of data that is recovered, thereby leaving the status of a given search to be resolved later by Customs officers. Cf. Cotterman,
Moreover, as explained, forensic searches are not prohibited — or even subject to a difficult or exacting level of constitutional scrutiny. All that is required is that a Customs officer has reasonable suspicion — that is, a “‘particularized and objective basis for suspecting the particular’ ” device to be searched contains contraband or evidence of criminal activity. See Montoya de Hernandez,
Nor is my ruling likely meaningfully to change anything that actually happens at the border. The Department of Homeland Security has advised CBP officers that “[i]n the course of a border search, with or without individualized suspicion, an Officer may examine electronic devices and may review and analyze the information encountered at the border.” CBP Directive § 5.1.2, Privacy Impact Assessment Attachment 1. This has not changed. CBP Officers also might detain an electronic device “to perform a thorough border search.” CBP Directive § 5.3.1. So long as that search is conventional, and not forensic — and so long as the time for which the device is detained is reasonably related in scope to the circumstances requiring the search, see House,
Finally, I am not aware of a single case that would have reached a different outcome on the basis of the reasoning in my ruling here. Put simply, Customs officials do not have the time or resources — or, most likely, the inclination — to perform random or suspicionless forensic searches. See, e.g., United States v. Chaudhry,
E. The Search of Saboonchi’s Devices Was Supported by Reasonable Suspicion
When Saboonchi arrived at the Rainbow Bridge on March 31, 2012, he already was the subject of an investigation. His name had come up in connection with two different investigations of export violations. Baird Tr. 10:21-11:23. Several subpoenas seeking evidence about Saboonchi’s dealings already had been issued and were returned in early March 2012. Id. at 11:24-12:2. The information that was received in response to those subpoenas showed that Saboonchi had purchased two cyclone separators after representing that they would be used domestically, id. at 12:13-22, and then shipped them overseas, id. at 12:2-7, understating the value of the cyclone separators in a manner consistent with an attempt to avoid scrutiny, id. at 16:6-8. Special Agent Baird also had determined that the recipient of the cyclone separators, General DSAZ, was linked to an industrial parts company in Iran. Id. at 12:8-12.
All of this is more than sufficient to give rise to reasonable, particularized suspicion — if not probable cause — that Saboonchi was involved in violations of export restrictions on Iran. Accordingly, CBP and HSI officers did not violate the Fourth Amendment when they seized Saboonchi’s Devices and subjected them to a forensic search.
IV. CONCLUSION
In sum, for the reasons stated above, Defendant’s Motion to Suppress, ECF No. 58, is DENIED, as was ordered on the record in open Court.
Notes
. On December 12, 2013, subsequent to the hearing on this motion, a second superseding indictment was returned that added an additional count against Saboonchi. See Second Superseding Indictment, ECF No. 95.
. Imaging a hard drive is the first step of a forensic search and involves making a copy of a storage device that is known as an "image,” "bitstream” copy, or “forensic” copy. See Orín S. Kerr, Searches and Seizures in a Digital World, 119 Harv. L.Rev. 531, 540-41 (2005). "A Bit Stream Backup is an exact copy of a hard drive, preserving all latent data in addition to the files and directory structures.” The Sedona Conference Glossary: E-Discovery & Digital Information Management 6 (3d ed.2010).
. TECS (not an acronym) is the updated and modified version of the former Treasury Enforcement Communications System. TECS is owned and managed by the U.S. Department of Homeland Security’s (DHS) component U.S. Customs and Border Protection (CBP). TECS is the principal system used by officers at the border to assist with screening and determinations regarding admissibility of arriving persons.
U.S. Dep't of Homeland Sec., Privacy Impact Assessment Update for the TECS System: CBP Primary and Secondary Processing (TECS) National SAR Initiative 2 (Aug. 5, 2011), available at https://www.dhs.gov/xlibrary/assets/ privacy/privacy-pia-cbp-tecs-sar-update.pdf.
. Saboonchi does not appear to have challenged the investigation up to this point; nor is it clear that he would have standing to challenge subpoenas issued to unrelated third parties in any event. See United States v. Payner, 447 U.S. 727, 732,
. Rashti has been indicted as a coconspirator in this case under the name Arash Rashti Mohammad, see Second Superseding Indictment, ECF No. 95, but because Rashti is an Iranian national currently located in Iran, id. ¶ 5, the United States has not been able to acquire jurisdiction over him or to bring him before a judicial officer of this Court.
. Although it is not entirely clear that the reason why Saboonchi was flagged in the TECS database is relevant to determining whether CBP agents acted permissibly in relying on the database, see Herring v. United States,
. Saboonchi now has changed counsel and his new attorney has filed a Motion to Suppress Statements, ECF No. 110, asserting, inter alia, Fifth Amendment violations arising out of the April 13, 2013 encounter. Id. ¶ 2(b). Though similar issues were addressed at the motions hearing, nothing herein is intended to relate to the resolution of the merits of Saboonchi's new motion to suppress.
. CBP and HSI attempt to distinguish between a “detention” and a “seizure.” See Burkhardt Tr. 57:16-17 ("I don’t mean to get technical, but CBP does not seize, we detain.”); see also U.S. Dep’t of Homeland Sec., Privacy Impact Assessment for the Border Searches of Electronic Devices 5 (Aug. 25, 2009), available at http://www.dhs.gov/ xlibrary/assets/privacy/privacy_pia_cbp_ laptop.pdf (defining a “detention” as "a temporary detention of the device during an ongoing border search” and "seizure” as occurring only "when CBP or ICE determines there is probable cause to believe a violation of law ... has occurred”). As explained on the record, however CBP and HSI may choose to characterize their actions, it was a constitutional seizure "the minute [the Devices were] taken,” so that this distinction is not relevant for purposes of the Fourth Amendment. See Ruling Tr. 30:10-19.
. The mere act of marking a file as "deleted” does not actually delete it from a computer; rather, it merely removes references to the file from the computer's Master File Table, which marks the data clusters where the file is located as available for future use. The file itself will remain until those clusters actually are overwritten or are “zeroed out” so as to remove the file itself from the computer. Kerr, supra, at 542-43.
. The court in Abidor held that "declaratory relief is not appropriate because it is unlikely that a member of the association plaintiffs will have his electronic device searched at the border, and it is far less likely that a comprehensive forensic search would occur without reasonable suspicion.”
. The Supreme Court expressly has rejected the practice of " 'assuming' jurisdiction for the purpose of deciding the merits — the doctrine of 'hypothetical jurisdiction.’ ” Steel Co. v. Citizens for a Better Env’t,
. It is worth noting that Abidor relied heavily on Camara v. Municipal Court,
. In June 2010, House and others organized political support for the defense of Bradley Manning, a United States serviceman deployed in Iraq who was arrested in May 2010 on suspicion of having disclosed restricted material to WikiLeaks....
The Bradley Manning Support Network [ ], formed by House and others, is an unincorporated association of individuals and organizations. The Support Network is an "international grassroots effort to help accused whistle blower Pfc. Bradley Manning.”
House,
. One ream of twenty pound paper weighs five pounds and contains five hundred pages; one case of paper contains ten reams and, according to Amazon.com, has the approximate dimensions of 17.6" x 115" x 10.8". Xerox 4200 Business Multipurpose White Paper, 92 Bright, 8-1/2 x 11, 10 Reams/Carton (XBR3R2047), Amazon.com, http://www. amazon.com/Xerox-BusinessMultipurposeBright-XER3R2047/dp/B000093I04/ref=sr_ l_7?ie=UTF8&qid= 139292216 l&sr=8-7 (last visited Apr. 4, 2014).
. The USB drive likely is only the tip of the iceberg. The iPhone 4s that Saboonchi was carrying, see ICE Report 1, is available with a storage capacity ranging from eight to sixty-four gigabytes. Identifying iPhone Models, Apple.com, http://support.apple.com/lcb/ht 3939 (scroll to iPhone 4s) (last visited Apr. 4, 2014). The Sony Ericsson Xperia phone that Saboonchi was carrying contained a microSD card with a sixteen gigabyte capacity. See Ice Report 1. A microSD card provides removable storage for up to 128 gigabytes, see, e.g., Sandisk microSD Cards, SanDisk, http://www. sandisk.com/products/memoiy-cards/microsd/ (last visited Apr. 4, 2014), and is about the size of a thumbnail, see, e.g., SanDisk Ultra 128 GB microSDXC UHS-I Card with Adapter (SDSDQUA 128G-G46A), Amazon.com, http:// www.amazon.com/SanDisk-Ultra-micro SDXC-Adapter-SDSDQUA-128G-G46A/dp/B 00IIJ6W4S/ref=sr_l_28?sic&ie=UTF8& qid= 1393515338&sr=l-28&keywords= micro + sd+ 128gb (listing the dimensions of a microSD card as 0.6" x 0.4") (last visited Apr. 4, All of this pales in comparison to laptop computers currently being sold with a hard drive capacity of up to one terabyte (1,024 gigabytes). See, e.g., Compare Mac Models, Apple.com, http://www.apple.com/mac/ compare/ notebooks.html (listing standard hard drive size for a MacBook Pro as up to one terabyte) (last visited Apr. 4, 2014).
. It is not entirely clear whether retaining an image of electronic data constitutes a ‘'seizure.” In the physical world, it has been established that so long as an action does not " ‘meaningfully interfere’ with [the owner's] possessory interest,” a seizure has not oc
. And tmhke when physical trash is discarded> information deleted from an electronic device is not otherwise exposed to the public. Cf. California v. Greenwood,
. Though there are tools, such as Apple’s "Secure Empty Trash” feature, see OS X Mountain Lion: Prevent Deleted Piles from Being Read, Apple.com, http://support.apple. com/kb/PH11124 (last visited Apr. 4, 2014), that may enable a user permanently to erase data from a computer, these are special features or applications that a typical user may not even be aware of, and their existence does not affect the reality that the overwhelming majority of users of electronic devices operate under the reasonable belief that once they have deleted an item permanently, it is gone.
. This problem was even more prevalent under older file systems, in which unfilled clusters would be "padded” with whatever happened to be in the computer’s Random Access Memory at that moment — which would include whatever the user had done recently irrespective of whether it ever was saved to disk. See Ball, supra, at 27.