211 F.R.D. 31 | D. Conn. | 2002
RULING ON MOTION TO SUPPRESS
Three of the five defendants charged in the superseding indictment in this public corruption case moved to suppress
In support of their motion for wholesale suppression of all evidence obtained pursuant to the warrant authorizing a search and seizure of the laptop computer, the defendants assert that: (1) the government improperly coerced them to deliver the laptop computer pursuant to a forthwith subpoena that was issued without exigent circumstances; (2) the warrant subsequently issued by a magistrate judge violated the Fourth Amendment’s particularity and probable cause requirements; (3) the executing agent acted in flagrant disregard of the warrant’s terms and grossly exceeded the scope of the warrant; (4) the government did not follow appropriate procedures to protect attorney-client privileged material; and (5) the government violated the requirements of Fed.R.Crim.P. 41.
The government disputes all of the defendants’ claims and maintains that the drastic remedy of blanket suppression is not warranted or justified. It also maintains that: (1) there existed good faith and reasonable concerns that evidence could be altered or destroyed and this provided exigent circumstances that justified the use of a forthwith subpoena and the defendants’ compliance with it was voluntary; (2) the warrant satisfied the requirements of the Fourth Amendment; (3) the search was reasonable, did not resemble a general search and the executing agent did not flagrantly disregard the warrant; (4) the agreed-upon procedures to protect privileged documents provided adequate safeguards and the defendants were not prejudiced; (5) the requirements of Rule 41 are purely ministerial and were adequately complied with; and (6) McCarthy does not have standing to challenge the search.
THE INDICTMENT
The multi-count indictment in this case alleges, inter alia, a RICO violation and a RICO conspiracy, as well as bribery, obstruction of justice, witness tampering, mail fraud/ theft of honest services and theft or bribery concerning programs receiving federal funds.
The two RICO counts in the superseding indictment allege that from March, 1997, to October, 2000, Triumph, McCarthy, Spadoni, co-defendant Lisa A. Thiesfield (“Thiesfield”) and co-defendant Benjamin Andrews (“Andrews”), together with Paul J. Silvester (“Sil-vester”), the former Connecticut State Treasurer, and Christopher A. Stack (“Stack”), an associate of Silvester, conspired to and conducted the affairs of an association-in-fact enterprise through a pattern of racketeering activity.
Triumph is an investment firm with its principal place of business in Boston, Massachusetts. McCarthy is Triumph’s Chairman and controlling shareholder. Spadoni is a Vice President and General Counsel of Triumph. Thiesfield was an employee of the Connecticut State Treasurer’s Office from September, 1997, to May, 1998, at which time she became campaign manager for the Sil-vester for State Treasurer Campaign. Andrews was employed as managing director of a company that provided investment services to the Connecticut State Treasurer’s Office and was the Republican candidate for Connecticut Secretary of State in 1998. From January, 1995, to October, 1996, Silvester was the Chief of Staff at the Connecticut State Treasurer’s Office. In October, 1996, he became the Deputy Treasurer, and in July, 1997, he was appointed State Treasurer when the elected state treasurer resigned.
As state treasurer, Silvester had sole authority for managing and investing hundreds of millions of dollars of assets of the Connecticut Retirement Plans and Trust Fund (“CRPTF”). In 1998, Silvester ran as the Republican candidate for Connecticut State Treasurer. He was defeated in the November, 1998, election and left office on January 6,1999.
The indictment alleges that the purposes of the enterprise’s racketeering activity were to enrich the defendants and others through ongoing criminal activity including bribery and fraud; to conceal the defendants’ participation in the criminal activity through obstruction of justice and witness tampering; and to conceal Silvester’s participation in and enrichment from the criminal activity.
More specifically, the indictment charges that Triumph illegally funneled campaign contributions to the Silvester for State Treasurer Campaign in exchange for the investment of state pension assets in a Triumph-related fund. It also outlines a scheme whereby Triumph solicited and paid bribes, rewards and gratuities to Silvester in exchange for pension fund investments and disguised these illegal payments by entering into consulting contracts with Stack, Thies-field and Andrews, who agreed to “kick back” a portion of their consulting fees to Silvester.
The indictment also charges that Triumph and Spadoni obstructed justice by attempting to conceal the corrupt arrangements with Stack, Thiesfield and Andrews. Specifically, between May 25, 1999, and April, 2000, Spa-doni and Triumph allegedly obstructed a grand jury investigation by deleting, overwriting or destroying documents and information stored on a laptop computer owned by Triumph and assigned to Spadoni. In addition, the indictment charges that Spadoni and Triumph obstructed justice by deleting, destroying or failing to produce diskettes that contained documents and' information which was relevant to a grand jury investigation.
In addition to the RICO and RICO conspiracy, the indictment also charges that the defendants violated the mail fraud/theft of honest services statute by devising a scheme to defraud and deprive the citizens of Connecticut of their right to Silvester’s honest services as state treasurer, i.e., performance of his duties free from deceit, favoritism, bias, conflict of interest and self-enrichment.
Finally, the indictment charges each defendant with willfully, knowingly, and corruptly giving, offering, and agreeing to give finan
During the investigation that led to the indictment, the grand jury issued a forthwith subpoena to obtain possession of a laptop computer that was owned by Triumph and used by Spadoni. After obtaining possession of the laptop computer, the government obtained a warrant to search and seize its hard drive and obtained certain incriminating evidence. Triumph, Spadoni and McCarthy moved for blanket suppression of all documents, data and evidence the government seized from the laptop computer.
Based on the evidence presented at a five-day suppression hearing, the court makes the following findings of fact.
FINDINGS OF FACT
I. The Steps Leading to the Issuance of the Forthwith Subpoena
In late October, 1999, Silvester told FBI Special Agent Charles Urso (“SA URSO”), the case agent assigned to the grand jury investigation, about a conversation he had with Spadoni on May 25, 1999, shortly after Triumph had received its first grand jury subpoena for documents relating to the investigation.
Silvester told SA Urso that Spadoni told him that in response to the subpoena, Triumph had not produced the consulting contracts it Had entered with Thiesfield and Stack. He further said that Spadoni told him that Triumph’s lawyer had advised him that more subpoenas were likely and documents that could be incriminating and that had no business purpose should be “purged.”
In addition, Silvester said that Spadoni mentioned that he or someone from Triumph had purchased a software program to purge or “blow out” a computer. Silvester indicated that he did not know the specific computer to which Spadoni was referring and did not know if any computers were actually purged. But Silvester said that Spadoni told him that he had deleted contracts with Park Strategies, the company that Silvester went to work for after he left the treasurer’s office.
In an attempt to corroborate this information, the government issued a subpoena to Triumph on December 29, 1999, seeking back-up tapes for Triumph’s computers and records relating to Triumph’s computer network or systems used by its employees.
On January 19, 2000, Triumph responded to that subpoena by producing seven back-up tapes and certain documents. The government did not immediately review this information.
One of the documents Triumph produced was dated July 28, 1999. It showed that the company owned a laptop computer, specifically, a Compaq Notebook Pentium 150 MZ 16 MB Ram, 1.6 GB hard drive (the “laptop computer”) which was used by Spadoni.
On about February 1, 2000, SA Urso sent an electronic communication to Special Agent Jeff Rovelli (“SA Rovelli”), an FBI Computer Analysis Response Team (“CART”) Field Examiner, asking for assistance in analyzing and reviewing Triumph’s back-up tapes to determine if memory had been destroyed.
SA Rovelli is a FBI-certified and skilled CART agent with extensive experience in searching and seizing computer-related evidence, computer hardware, operating systems and forensic techniques and methods for computer searches.
Before S.A. Rovelli began his review of the back-up tapes, he met with SA Urso to discuss the investigation and obtain certain background information.
In this regard, he reviewed two consulting contracts dated January 15, 1999, between Triumph and Thiesfield and Triumph and Stack, a consulting contract dated May 1, 1998, between Triumph and Thiesfield, a marketing contract dated November 24, 1998, between Triumph and Capital Marketing Investment Corp., Andrews’s company, and the face sheet of the partnership agreement for Triumph Connecticui>-II, the collat-eralized bond obligation (“CBO”) fund in which Silvester had invested $200 million of CRPTF assets.
On March 28, 2000, S.A. Rovelli and S.A. Urso reviewed three back-up tapes from Triumph’s Boston office: one tape was dated December 28, 1998, one tape was dated May 18, 1999, and the third was dated August 27, 1999. These tapes showed that on May 31, 1999, six days after Triumph had received its first grand jury subpoena, between 9:41 a.m. and 1:56 P.M., forty files were reviewed and then transferred to Triumph’s Boston computer system into a directory named “Spado-ni.” The tapes also showed that certain documents relating to Park Strategies which were on the computer on May 18, 1999, were not on the computer on May 31, 1999. This corroborated the information that Silvester had provided concerning Spadoni’s deletion of documents.
The agents did not, and could not, fully analyze the information from the back up tapes immediately. They needed time to digest that information and put it into context with other information obtained during the investigation, particularly the information provided by Silvester about Spadoni’s alleged plan to “blow out” or purge documents from a computer.
After the agents completed their analysis of this information, they concluded that the May 31, 1999, transfer of documents to the Spadoni directory on Triumph’s Boston computer system was probably done to preserve or protect them and that this transfer was consistent with what Silvester had said about Spadoni’s plan to purge or blow out a computer.
The tapes and documents that Triumph produced in response to the subpoena did not provide any specific information about the laptop computer except that as of October, 1999, Spadoni was its primary user. The agents did not know if the computer still existed or where it was located.
A laptop computer is a completely self-contained portable computer containing a hard disk drive, a keyboard, a screen, in-puVoutput ports, and a modem. By using input/output ports and the modem, a computer user can transfer documents from one ’ hard drive to a computer network in another location over telephone lines.
As far as the agents knew, if the computer still existed, it could be in Triumph’s Boston office, its Hartford office, Spadoni’s home, Spadoni’s car, or the place where Spadoni stayed when he worked at Triumph’s Boston office.
The agents did not seek warrants to search all of those locations because they were not certain if the laptop computer still existed. Instead, they opted to go before the grand jury that was investigating the matter and ask for a subpoena. This was a reasonable decision, even though the next session of that grand jury was not scheduled until April 11, 2000, and even though other grand juries were sitting before that date.
On April 11, 2000, S.A. Urso appeared before the grand jury and requested a forthwith subpoena directing Triumph to produce the laptop computer by 4:30 p.m. that day. In support of his request, S.A. Urso told the grand' jury that a forthwith subpoena was necessary because a real danger existed that more evidence, or even the laptop computer itself could be destroyed if Triumph had advance notice that the government wanted to search it. He based this assertion on the information he and SA Rovelli learned from the back-up tapes together with the information obtained from Silvester about Spadoni’s plan to purge documents or blow out a computer in anticipation of additional subpoenas, and the portable nature of the laptop computer itself.
The nature of the exigency that SA Urso believed existed on April 11, 2000, was, in his words, a “notification kind of exigency.” SA Urso was concerned that if Triumph or Spa-doni were given advance notice of the government’s intent to search the laptop computer, the hard drive could be destroyed and along with it any evidence it contained pertaining to prior deletions or alterations of documents, or the computer itself could be intentionally “lost” or destroyed.
SA Urso assured the grand jury that the government would not open or search the computer until Triumph had an opportunity to file a motion, that the laptop computer would be kept in a secure location in the magistrate judge’s chambers, and that a warrant would be obtained to search it. He also advised the grand jury that because the laptop computer was used by an attorney, the government would take steps to ensure that privileged documents would not be given to the prosecution team.
The U.S. Attorney’s Manual authorizes the use of a forthwith subpoena when an immediate response is justified. The facts and circumstances known to the .government on April 11, 2000, support a finding that exigent circumstances existed and justified an immediate response.
Based on the totality of the evidence, it is clear that the government did not intend to obtain the contents of the laptop computer through use of the forthwith subpoena, but only sought to preserve its contents while it obtained a warrant.
II. Service of the Subpoena and Delivery of the Laptop Computer
After the grand jury issued the forthwith subpoena, AUSA Nora Dannehy (“Dan-nehy”), the AUSA who was in charge of the investigation, handed it to Tracy Miner, Esq. (“Miner”), one of Triumph’s attorneys and a member of the firm of Mintz, Levin, Ferris, Glovsky & Popeo, P.C. (“Mintz Levin”). Ms Miner was at the federal courthouse in Hartford, Connecticut waiting outside the grand jury room with a Triumph employee who had been subpoenaed to testify that day.
As Ms. Miner testified at the suppression hearing, Ms. Dannehy told her that someone from Triumph’s Hartford office should deliver the laptop computer immediately.
Ms. Miner said that she called Triumph’s Hartford office and learned that neither Spa-doni nor the laptop computer were there. She then called Spadoni’s attorney and McCarthy and learned that the laptop computer was at Triumph’s Boston office. She asked Triumph to deliver the laptop computer to Mintz Levin’s Boston office.
Ms. Miner said that she asked Ms. Dan-nehy for additional time to comply with the subpoena, and requested that the government not search the laptop computer until she had an opportunity to file an appropriate motion with the court.
Ms. Dannehy denied Ms. Miner’s request for more time and instructed her to produce the laptop computer by 5:00 p.m. that day. Ms. Dannehy did, however, agree that the government would not open or search the laptop computer until Ms. Miner had a chance to file a motion.
Ms. Miner is an experienced criminal defense lawyer. She is a member of Mintz Levin, a large Boston law firm, and its criminal practice group. Her practice is limited to white collar criminal defense, and 70% of her work involves federal matters. She is president of the Massachusetts Association of Criminal Defense Lawyers and is a long-time member of the Massachusetts District Court’s CJA panel. She has lectured extensively on criminal law issues pertaining to white collar grand jury investigations.
Ms. Miner testified that she believed that it would be contemptuous to not comply with the subpoena and that she did not have sufficient time or opportunity to consult with her client or Spadoni’s counsel to discuss what was on the laptop computer and prepare a motion before the 5:00 p.m. deadline. She was also told that the judge who was supervising the grand jury was not available that day.
However, the fact that Ms. Miner delivered the laptop computer and did not file a motion contesting the validity of the forthwith subpoena was not the result of threats, coercion or aggressive tactics by the government. Indeed, Ms. Dannehy had assured her that the government would not do anything to the laptop computer until she had a chance to file a motion.
Mintz Levin then gave the laptop computer to a courier service to deliver to Hartford.
At 4:30 p.m. S.A. Urso advised the grand jury that the laptop computer had been located at Triumph’s Boston office and was being driven to Hartford by a courier.
The courier service delivered the laptop computer to S.A. Urso at approximately 4:45 p.m. S.A. Urso immediately delivered it to the magistrate judge’s chambers.
Two days later, on April 13, 2000, Ms. Miner spoke to Ms. Dannehy to discuss how Triumph intended to proceed. Ms. Miner’s notes indicate that Ms. Dannehy asked her if she intended to file a motion to quash the subpoena and that Ms. Miner responded that “if she had something to file, she would file it.”
During the eight days between the time the forthwith subpoena was served and the commencement of the search, Triumph did not file a motion to quash the subpoena, a motion for release of property or otherwise challenge the scope or propriety of the forthwith subpoena. The fact that no such motion was filed was a voluntary, tactical decision on the part of Triumph and its competent, experienced counsel, and was not the result of coercion, promises or misleading conduct by the government.
The totality of the circumstances support a finding that the defendants’ compliance with the forthwith subpoena was voluntary, not coerced.
III. The Search Warrant
On April 13, 2000, the magistrate judge issued a warrant to search and seize the laptop computer.
The warrant consisted of the application, the affidavit of SA Urso, and attachments A, B, C and D, the provisions of which were implicitly or explicitly incorporated into and made a part of the warrant.
The warrant authorized the agent to search and seize evidence relating to the crimes of conspiracy, bribery concerning programs receiving federal funds, mail and wire fraud/theft of honest services, and obstruction of justice.
A. Property to be Searched and Seized
Attachment A to the warrant described the property to be searched as the laptop computer. The warrant did not limit the search to any particular area of the hard drive, or to any specific files or directories.
Attachment B to the warrant, entitled “List of Property to be Searched and Seized”, identified the following property:
“1. Computer logs and file records on the storage media of the laptop computer’s hard drive, including time and date or records associated with individual files which can indicate deletion or destruction of individual files on the storage media of [the laptop computer’s] hard drive or a deletion and restoration of the entire file system on the storage media, at a particular time[;]”
“2. Computerized records of a contract with a type written date of May 1, 1998, between Lisa Thiesfield, acting through LAT, LLC and Triumph Capital, including all computer generated information relating to the creation, modification and/or deletion of the contract;”
“3. Computerized records of a contract with a type written date of January 15, 1999 between Lisa Thiesfield, acting through LAT, LLC and Triumph Capital, including all computer generated information relating to the creation, modification and/or deletion of the contract;”
“4. Computerized records of a contract with typewritten date of January 15, 1999, between Christopher Stack, acting through KCATS, LLC and Triumph Capital, including all computer generated information relating to the creation, modification and/or deletion of the contract;”
*41 “5. Computerized records relating to contracts between Triumph Capital and Benjamin ‘Beri Andrews, Triumph Capital and Park Strategies and/or Benjamin ‘Beri Andrews and Park Strategies, including all computer generated information relating to the creation, modification and/or deletion of contracts between Triumph Capital and Benjamin ‘Beri Andrews, Triumph Capital and Park Strategies and/or Benjamin ‘Beri Andrews and Park Strategies.”
B. Facts Establishing Probable Cause
The Affidavit of S.A. Urso that was submitted in support of the warrant set forth, inter alia, the following facts to establish probable cause for the search of the laptop computer’s hard disk drive:
One of Silvester’s pension fund investments under investigation was a $200 million investment on approximately November 12, 1998, with Triumph CT-II, a Triumph-related fund.
The laptop computer would be searched for evidence of deletion of computer files and the creation, modification and/or deletion of contracts between Triumph and Thiesfield’s company, LAT, LLC; Triumph and Stack’s company, KCATS, LLC; and contracts between Triumph and Park Strategies, Triumph and Benjamin “Ben” Andrews and/or Benjamin “Ben” Andrews and Park Strategies.
Silvester pleaded guilty to RICO and money laundering on September 23,1999. At his guilty plea, he admitted that between March, 1997, and January 6, 1999, he breached his fiduciary responsibilities and corrupted the investment process by soliciting and accepting bribes and rewards for himself and others in return for making investments with certain private equity funds, including Triumph.
Silvester and Stack were cooperating in the ongoing investigation. Stack had been granted testimonial immunity.
On November 11, 1998, Silvester signed the closing documents for an investment of $200 million of Connecticut pension funds with Triumph CT-II. Silvester admitted that in return for the investment he asked Triumph to enter into consulting contracts with Stack and Thiesfield and that they had agreed to “kickback” to him a portion of the fees paid under the contracts, and that McCarthy and Spadoni agreed to enter into contracts with Stack and Thiesfield. Both of their contracts were dated January 15, 1999, were not success based or connected to a particular fund and provided for the payment of a $1 million fee over three years. However, Stack advised that he signed his contract earlier on November 11, 1998, the same day Silvester signed the papers investing $200 million in Triumph CT-II, that Silvester arranged for the contract, that he did no work under the contract and that Silvester expected him to kickback a portion of the fees he received from Triumph. Stack had given a copy of his contract with Triumph to the government.
On May 25, 1999, the grand jury served a subpoena on Triumph CT-II for all documents related to the Connecticut pension fund investment. Triumph did not produce the Thiesfield/Stack contracts in response to that subpoena. On July 13, 1999, the grand jury served another subpoena on Triumph requesting documents relating to contracts and/or agreements between Triumph and Stack and Triumph and Thiesfield. In response, Triumph produced a contract between Triumph and LAT, LLC dated May 1, 1998. The contract provided for a $25,000 payment to Thiesfield for services to Triumph in connection with the Mashantueket Pequot Tribe. The Mashantueket Pequot Tribe, however, never made an investment with Triumph. Silvester stated that the contract was a means to pay Thiesfield to work as his campaign manager in 1998. Triumph also produced two contracts dated January 15, 1999, between Triumph and LAT, LLC and Triumph and KCATS, LLC.
Silvester stated that a few days after Triumph received its first grand jury subpoena, he had a conversation with Spadoni. Spado-ni told him that Triumph had not provided the Thiesfield and Stack contracts because it did not believe they were responsive. Spa-doni also stated that Triumph’s lawyer said that more subpoenas were likely and that documents that might be incriminating and
According to Silvester, Spadoni did not specifically mention that the Thiesfield and Stack contracts had been deleted or purged, but he specifically mentioned that contracts showing a relationship between or among Triumph, Andrews and Park Strategies had been deleted. As part of his guilty plea, Silvester admitted that he invested $50 million in a Caryle Asia fund in return for his job at Park Strategies.
Silvester stated that while he was employed at Park Strategies, he wanted Triumph to hire Park Strategies. But, because McCarthy did not want to hire Silvester directly, Silvester suggested that Triumph enter a contract with Andrews who could then enter contracts with Park Strategies and Sil-vester.
On December 29, 1999, the grand jury served another subpoena on Triumph seeking back-up tapes for its server and/or any other computers or computer systems used by any employee of Triumph, and records relating to Triumph’s network configuration. In response to the subpoena, Triumph produced back-up tapes and a document that showed Spadoni used a Triumph-owned laptop computer.
A CART agent reviewed the back-up tapes. He discovered that the Stack and Thiesfield contracts were not on the back-up tapes from Triumph’s Boston office dated December 28, 1998, May 18, 1999, and August 27, 1999. He also discovered that a contract between Park Strategies and a firm named Empire Office, Inc. was on the May 18, 1999, back-up tape, but was not on the" August 27, 1999, back-up tape. The CART agent was not able to determine how or when it was taken off the system.
The August 27, 1999, back-up tape showed that between 9:41 a.m. and 1:56 p.m. on Memorial Day, May 31, 1999, six days after Triumph received its first grand jury subpoena, a substantial number of documents were transferred from an unknown computer to Triumph’s Boston computer system^ into a directory named “Spadoni.” The agent believed that this transfer was consistent with Silvester’s information that Spadoni was planning to “blow out” a computer and that he moved the documents he wanted to save.
C. Information Pertaining to the Scope of the Search
The affidavit in support of the warrant provided the following information pertaining to the scope of the requested search:
The laptop computer could store the equivalent of thousands of pages of information.
Data-search protocols were exacting scientific procedures that were designed to protect the integrity of the evidence and to recover hidden, erased, compressed, password-protected or encrypted files.
To properly, completely and accurately retrieve and analyze all of the data on the computer and to prevent the loss or overwriting of data from inadvertent or intentional modification or destruction (both from external sources or from destructive codes imbedded in the system as a “booby trap”) the search should be conducted in a properly controlled, off-site laboratory.
Examination of the evidence could take weeks or months.
The search and seizure would be conducted in accordance with the United States Attorney’s Office Instructions to Agents and Instructions to Attorney which were set forth in Attachments C and D and made part of the warrant.
D. Procedures To Protect Privileged Communications
Because the laptop computer was used by a lawyer, the warrant contained a search methodology and procedures governing the review of seized data to ensure that no attorney-client privileged communications would be inadvertently seen or reviewed by the prosecution team.
The use of a taint team is a proper, fair and acceptable method of protecting privileged communications when a search involves property of an attorney.
Attachment D instructed the taint team to be available to the agent conducting the search and to review all documents to be seized to determine if they contained any privileged information. It provided that: (1) documents covered by the attorney-client privilege would not be seized; (2) documents which were arguably privileged or which were privileged but could fall within an exception to the privilege, would be sealed and delivered to a United States Magistrate Judge; (3) documents which were not privileged were to be separately sealed and delivered to the magistrate judge; (4) if the magistrate judge determined that a seized document was not privileged, it would be turned over to the agents and the prosecution team.
The taint team procedures set out in Attachment D were filed under seal and were not served on defendants.
E. Service of the Warrant and Attachments
On April 13, 2000, Ms. Dannehy informed Ms. Miner that the government had obtained a warrant to search the laptop computer and provided her with a copy of the warrant. Ms. Dannehy did not give Ms. Miner a copy of Attachment C, Attachment D or the Affidavit because they were under seal.
The Application, Affidavit and Attachments C and D were provided to the defendants on October 24, 2000, after the indictment was returned and the documents were unsealed.
IV. Agreed-Upon Procedures to Protect Privileged Material
On April 13, 2000, the day the warrant was served, Ms. Dannehy advised Ms. Miner that a taint team would conduct the search to insure that privileged documents would not be inadvertently turned over to the prosecution team. Ms. Dannehy did not describe the precise procedures set out in Attachment D because it was sealed.
Ms. Miner understood Ms. Dannehy’s explanation of the taint team procedures to mean that a Chinese Wall would be created to prevent any privileged material on the laptop computer from being disclosed or reviewed by the prosecution team before Triumph could assert a claim of privilege. Despite her testimony to the contrary, Triumph’s counsel, a competent and experienced criminal defense attorney, could not have reasonably believed that no procedures were in place to prevent privileged materials from being reviewed, seized or given to the prosecution team before a privilege claim could be asserted and decided.
Ms. Dannehy told Ms. Miner that the government would not commence the search of the laptop computer until Triumph had an opportunity to file a motion regarding its examination and procedures to protect attorney-client privileged material.
On April 14, 2000, Triumph’s counsel filed a motion to preclude the government from reviewing or copying attorney-client privileged materials in the course of executing the search. The motion requested the court implement various procedures to protect privileged material.
On April 17, 2000, Ms. Dannehy and Mr. Silva discussed the issues raised in the April 14, 2000, motion in an attempt to reach an agreement on procedures that would protect privileged material.
Mr. Silva testified that during his conversation with Ms. Dannehy, he believed that
Mr. Silva and Ms. Dannehy reached an agreement on the procedures that would be followed during the search to protect privileged material. The agreement, as memorialized in a letter dated April 18, 2000 (the “letter agreement”), contained different procedures than those contained in Attachment D. According to the letter agreement, “[i]f the [CART agent] seeks to review any documents) currently on the hard drive and contained in either the directory labeled ‘Triumph’ or ‘Employment’, he will first provide [Triumph’s counsel] with the name of the doeument(s) or, if necessary, a copy of the document(s) on a computer disc; [i]f Triumph claims that the document(s) should not be disclosed because of the attorney/client privilege, the CART Agent will copy the document(s), without opening it, to a disc and file the disc with the court[;] Triumph[ ] will then file the appropriate motion seeking an in camera review ... and will simultaneously provide the CART Agent and the AUSA with a privilege log which sets forth the author, the recipient(s), the date and the general nature of the document(s); the government will have the opportunity to brief the Court on its position prior to the Court’s determination as to whether the document(s) is protected by the attorney/client privilege.”
Based on this agreed-to procedure, Triumph said that its motion to preclude could be denied as moot.
Although Mr. Silva testified that he would not have agreed to withdraw the motion to preclude if he had realized that the government intended to search the entire hard drive, his erroneous belief as to the scope of the search was not caused by any action or inaction of the government and is not supported by a reasonable reading of the warrant. The warrant does not limit or even suggest that the search would be limited to any particular directory, subdirectories or files. To the contrary, it specifically states that the entire hard drive would be searched. Further, there is no merit to the defendants’ claim that the procedures were inadequate and they were not harmed or prejudiced in any way by the agreed-upon procedures, which actually provided greater protection to the defendants by giving their counsel a role in the screening process. Moreover, Triumph was given an opportunity to review and raise a privilege claim for all documents and material, not just the documents in the “Triumph” and “Employment” subdirecto-ries, before any of it was given to the prosecution team.
V. The Taint Team
The taint team was comprised of AUSA Mark Califano (“Califano”). SA Rovelli, the CART Agent who conducted the search of the hard drive, was not a member of the taint team.
On April 24, 2000, Mr. Califano notified Mr. Silva by telephone that SA Rovelli wanted to review six documents from the two subdirectories that were specified in the letter agreement. That same day, Mr. Silva received a letter with a list of the documents SA Rovelli sought to review along with a disk containing copies of the documents.
The document entitled “Tri-Conn Minutes Advisory” was not on the list of documents that SA Rovelli wanted to review, nor was it on the disk. There is no evidence that SA Rovelli, Mr. Califano or any member of the prosecution team reviewed that document.
On April 24, 2000, Mr. Califano also spoke to Ms. Miner about the list of documents that SA Rovelli wanted to review. Mr. Califano had not received a copy of the list of documents and was looking for the names of the documents.
Ms. Miner’s handwritten notes of that conversation contain a vague reference to “Tri Conn — Minutes Advisory Comm.” The “TriConn Minutes Advisory Comm.” document
After Mr. Silva reviewed the six documents produced by the taint team, he notified Mr. Califano that Triumph was asserting a privilege claim for one document entitled “All Hands Meeting.doc”.
Although the letter agreement specifically pertained only to material in the “Triumph” and “Employment” subdirectories, on May 24, 2000, Mr. Califano gave Triumph’s counsel 1,292 pages of printed material, including data from free and slack space and a compact disc (“CD”) containing 23 active files, including 18 document files and 5 Microsoft Outlook files (4 .pst files and one .pab file), 39 recovered deleted documents, 6 recovered deleted link files and a listing of active link files. He advised the defendants that SA Rovelli intended to search and/or seize this data.
Mr. Califano asked defendants’ counsel to raise any privilege claim for this material by May 31, 2000. He further advised that “all seized documents and data for which no claim of privilege is raised by that date will be turned over to the [prosecution team].”
Mr. Califano also advised defendants’ counsel that the government intended to use as evidence other software properties, directory structures, file attributes and file links from the laptop hard drive.
Mr. Silva testified that after he received this letter he realized that the scope of the search went beyond the “Triumph” and “Employment” subdirectories. But even with this knowledge he took no action to question or limit the search and seizure.
On June 1, 2000, hard copies of all seized documents, including the identified active files, free and slack space, and recovered deleted files, but not the documents for which Triumph asserted a privilege claim, were turned over to the prosecution team.
The prosecution team was not given a copy of the CD that was given to Triumph’s counsel on May 24, 2000.
VI. Execution of the Search Warrant
SA Rovelli executed the warrant.
SA Rovelli began his forensic examination of the laptop computer’s hard disk drive (“hard drive”)
The methodology SA Rovelli used to search the hard drive was consistent with the methodology that a well-trained CART agent would use. The evidence establishes that SA Rovelli acted in good faith and conducted an extensive, careful and thorough examination of the entire hard drive and attempted to stay within, as far as practicable and possible under the circumstances, the methodology ánd limits set out in the warrant. SA Rovelli had a reasonable, logical and credible explanation for the vast majority of documents and data he seized, scanned or reviewed without seizing, even for the data and documents that did not fall within the scope of the warrant.
SA Rovelli is a well-trained, experienced CART agent. He testified at length as to the steps he took to thoroughly search the hard drive, explained his search strategy and methodology, and gave specific reasons why he seized documents and data. His testimony showed that he understood the criminal conduct alleged and the rationale for the search as explained in the warrant. He described a careful, informed and deliberate search. His testimony was credible, candid and comprehensive.
The laptop computer remained in the magistrate judge’s custody until SA Rovelli began the search and until then, the government did not have access to it. The warrant was drafted without any knowledge of its contents and did not, and was not intended to, limit the search to any specific areas of the hard drive. In addition, the warrant did not limit the search to only documents created by Spadoni.
The storage capacity of the hard drive is I. 6 GB or approximately 453,000 pages of text. The hard drive actually contained approximately 1 GB, or 250,000 pages of data, including 18,768 active files and 1,800 recovered deleted files.
The defendants do not seek to suppress any of this or any other specific evidence, nor do they identify any particular documents or data that should be suppressed as beyond the scope of the warrant. Rather, they seek blanket suppression of all data and documents seized, even evidence that is clearly within the scope of the warrant as well as innocuous documents and data that the government does not intend to introduce at trial. They claim that blanket suppression is required because the amount of evidence seized and the manner in which the search was executed was not reasonable and violated the defendants’ Fourth Amendment rights.
Computer searches, especially those seeking evidence of deletion, are technical and complex and cannot be limited to precise, specific steps or only one permissible method. Directories and files can be encrypted, hidden or misleadingly titled, stored in unusual formats, and commingled with unrelated and innocuous files that have no relation to the crimes under investigation. Descriptive file names or file extensions such as “.jpg” cannot be relied on to determine the type of file because a computer user can save a file with any name or extension he chooses. Thus, a person who wanted to hide textual data could save it in a manner that indicated it was a graphics or image file. For these reasons and as a practical matter, SA Rovelli acted reasonably and within the scope of the warrant by opening, screening and manually reviewing data and files in all areas of the hard drive, including image files.
There is no evidence that SA Rovelli was instructed to look for documents without regard to the warrant.
The warrant provided SA Rovelli with reasonable flexibility and authorized a thorough search of the programs, directories, active files and deleted data that most likely contained evidence and information relating to the alleged crimes and contracts under investigation. The warrant permitted him to conduct the search by file names, keywords, file dates and other indicia of relevance. It also permitted him to manually review directories, programs, and files that were not labeled or labeled in a way that did not indicate who was associated with them to determine if they pertained to the names or transactions listed in the warrant.
SA Rovelli acted as a reasonably well-trained computer expert by construing the term “file records” in paragraph one of Attachment B as including the text or content of a file, not just information related to a file such as creation date, time, properties, size, last accessed date or directory information. Construing the term “file records” to mean only information about a file and not the text or content of a file would require a cramped and hypertechnical reading of the warrant.
A. Restoration of the Hard Drive
SA Rovelli commenced his search of the hard drive on April 19, 2000. He first used a program called SafeBack to create an identical copy, or “mirror image” of the data on the hard drive. SA Rovelli did not boot up the computer before making the mirror image because doing so could have altered the data on the hard drive.
Making a mirror image of the hard drive is central to the examination process and is a routine, technical step taken by well-trained CART agents. It is done to maintain the integrity and security of the original evidence. A mirror image is an exact duplicate of the entire hard drive, and includes all the scattered clusters of the active and deleted files and the slack and free space. Having such a mirror image of the hard drive also allows the examiner to reconstruct the steps of his examination at a later time.
Once SA Rovelli made the mirror image, he never went back to the original hard drive or the laptop computer itself. He made only one mirror image. He saved the mirror image to a magneto optical disk (“MO”). It is a reasonable and routine procedure for a computer examiner to save or back up the mirror image to another medium such as an MO for examination purposes. The fact that he created an MO does not mean that he seized the entire hard drive.
During his forensic examination, SA Rovel-li restored the mirror image approximately four to six times. He did this so that he would have clean copies of the mirror image on which he could perform searches and to conduct tests, including “destructive” tests that could alter the original image. Also, because an MO has a write-protect safeguard, the data it contains cannot be modified or altered during the review process. A mirror image does not have such a feature. SA Rovelli believed that conducting the search on MOs was the best and most accurate method and would not compromise the original image.
SA Rovelli did not violate the warrant or act unreasonably by not running the Safe-Back audit log when he made the mirror image of the hard drive. SA Rovelli made handwritten notes of the imaging process and they contain the same relevant information that would be found on an audit log, including when the image was made and other steps in the restoration process. This is consistent with what a reasonably well trained CART Agent would have done in the circumstances.
Reasonably well trained CART agents are not required to keep detailed, minute-by-minute records of every step they take dim-ing a search and SA Rovelli acted reasonably in not keeping such records. The MOs and CDs which SA Rovelli created, along with his handwritten notes, hard copies of documents and data, and print outs constitute an adequate record and inventory as required by the warrant, and sufficiently identify most of the steps he took in his examination.
B. The MOs
On April 20, 2000, SA Rovelli copied all the active files, all the recovered deleted files and directory structure information to an MO.
On April 21, 2000, SA Rovelli extracted the free and slack space and divided the data into active files which he created and named “slack.txt” and “free.txt” and stored this on another MO. .He created these files because the program he intended to use to search the data could only search active files. This also enabled SA Rovelli to search surrounding clusters of slack space without having to view the active files associated with such slack space. After these preliminary steps, SA Rovelli used a special forensic software pro
C. The CDs
During the course of his examination, SA Rovelli created two CDs.
One CD contained 23 active files, consisting of 18 document files and 5 Microsoft Outlook
SA Rovelli produced this CD to the defendants on May 24, 2000. The prosecution team was not given a copy of this CD.
SA Rovelli created another CD on July 18, 2001. This CD was given to defendants on July 20, 2001, as part of the government’s discovery. The CD contained lists of keywords, an active file called esdrvmap ,
By putting all of this data, including all of the link files, the extracted free and slack space, and the .pab and .pst files on the CDs and/or labeling the CDs “seized files”, SA Rovelli did not intend to signify that he searched and/or seized that data pursuant to the warrant. Rather, he put the files and data on the CDs to give the defendants’ counsel a record of what he intended to review so that they could assert a privilege claim, to make it easier to access the information and to maintain the integrity of the files and evidence. He did not need the approval of the magistrate judge to do so.
D. Use of Keywords
SA Rovelli acted as a reasonably well trained CART agent and in good faith in not limiting his search methodology to just keywords.
The warrant provided that the searching agent would “make every effort to review the text or content of only those programs, directories, files and material” that responded to keywords. But this language did not authorize keywords as the exclusive method of conducting the search, prohibit other search methods or limit manual review to only data that responded to keywords.
In fact, because of the limitations of keyword searches, the warrant authorized searches based on file names, file dates or
Keyword searches are limited because they are literal and search only for an exact sequence of characters. Thus, they do not pick up variations or misspellings of words or names.
Keyword searches are also limited because they cannot be conducted on all files, such as image files that contain scanned documents or faxes.
Searching deleted files and free and slack space using keywords can be particularly problematic because when a file is deleted, its name is altered by the FAT thereby rendering it unresponsive to a keyword search. In addition, a keyword search may locate a portion of a deleted file, but not other portions of the file unless they also contain keywords.
Keyword searches also do not work on files that are in binary format such as “.pst” files that store data used by Microsoft Outlook. Such files can be searched with keywords only if they are opened in the Microsoft Outlook program and the program’s internal find function is used.
Keyword searches will not uncover link files that point to files that contain keywords unless the title of the file contains a keyword.
Keyword searches do not work on documents that are prepared in Unicode rather than ASCII unless the non-ASCII characters are first filtered out.
The warrant gave the searching agent latitude to form keyword searches from the contracts between Triumph . and Thiesfield and Triumph and Stack and to specifically use the terms Park Strategies, Benjamin Andrews and/or Ben Andrews. But this specification did not mean that these terms were .unalterable or were the only “authorized” or exclusive terms that could be used to the exclusion of all other relevant terms or variations of names and terms.
SA Rovelli reasonably and appropriately formed twenty-five keywords from the contracts, names and information contained in the contracts and the affidavit.
His first two lists of keywords did not contain the term “minutes.” The word “minutes” was added to the list after SA Rovelli searched the slack space using the keyword “Thiesfield” and found a string that read “My Documents*Consultant Contract — lisa thiesfield.dococ-V.dococ Ltr.docsultant Contract.document.doc Minutes.does*”. Because this string contained the words “Thiesfield” and “Consultant Contract” in close proximity to the word “Minutes” and did not have a separate directory path, SA Rovelli reasonably and in good faith believed that “minutes” was an appropriate word to add to his list of keywords.
SA Rovelli’s explanation of why he added “minutes” to his list of keywords is logical and consistent with what a reasonably well trained CART agent would have done. There is no evidence that he was improperly instructed by anyone to add the word “minutes” to his list of keywords or that he acted in bad faith in doing so. Using minutes as a keyword did not constitute flagrant disregard of the warrant, even if it produced numerous irrelevant hits.
Using “Stack” as a keyword was expressly authorized by the warrant and SA Rovelli acted reasonably and in good faith in using it as a keyword regardless of the fact that it is a term commonly used in computer programming and appears frequently in error messages and thus could produce numerous irrelevant hits.
SA Rovelli also acted reasonably and within the express terms of the warrant in using “ben” as a keyword even if doing so could produce numerous irrelevant hits, ie., hits on documents that contained the word “benefit.”
SA Rovelli did not unreasonably broaden the search by using “Stack” or “ben” as keywords. Both “Stack” and “ben” were keywords authorized by the warrant.
SA Rovelli also acted reasonably and within the scope of the warrant by using “Silves-ter” and “capital marketing investments” as keywords. These keyword search terms were formed from the contracts and constituted other indicia of relevance.
SA Rovelli used a utility program called DL to search the 18,768 active files on the hard drive by keywords. He seized 23 active files, consisting of 18 document files, and 5 Microsoft Outlook files containing 4 .pst files and 1 .pab file.
One of the 18 document files did not contain a keyword. SA Rovelli manually reviewed that file because its name was similar to another file in the same directory which referred to Thiesfield, Spadoni and McCarthy. He seized" it because it mentioned Thiesfield and Spadoni by their initials.
SA Rovelli also searched the 4 .pst files and 1 .pab file by using keywords and manual review. Three of the four .pst files contained keywords. The other .pst file contained directory structure information. The .pst files were in binary format and had to be imported into Microsoft Outlook before they could be viewed or searched with keywords. SA Rovelli imported them and searched with keywords using the find function in the journal portion of the program. He seized the .pab file because he thought he needed it to examine the .pst files.
SA Rovelli did not review or seize the email messages, contact information or notes. The only information he manually reviewed in the .pst files was journal entries. The journal entries showed evidence that a directory named “Silvester” was on the hard drive between April 6, 1999 and May 31, 1999, was last accessed on May 31, 1999, but was subsequently deleted.
F. Search of Recovered Deleted Files
SA Rovelli used a utility to recover 1,800 deleted files. He used another utility to search these files by keywords. The search produced 105 hits. He manually screened all 105 files and others that he deemed relevant based on their location, directory, name or lack of descriptive name. Such manual screening was authorized by the warrant.
Manual review is necessary because, when the utility recovers deleted files, it tries to put all pieces of the file back together. But this does not mean that all of the actual data that was originally associated with the file will be found — the document may have been stored in separate clusters, and data on one or more of the original clusters assigned to the file may have been overwritten after the file was deleted.
SA Rovelli seized 45 recovered deleted files, including 39 deleted text files and 6 deleted link files. Keywords appeared in 28 of the 39 deleted text files and in 2 of the 6 deleted link files. SA Rovelli seized the deleted text files that did not contain keywords because their file names did not provide identifying information that would enable him to tell the person associated with them, what they contained or the type of document. SA Rovelli had a reasonable, logical and credible explanation for seizing all but two of these files, even though they did not contain keywords or were not obviously related to the contracts specified in paragraphs 2 through 5 of the warrant. For instance, the files contained other indicia of relevance such as: (1) references to Connecticut Statutes pertaining to political contributions, post-employment agreements discussing the ability of terminated employees to disclose information about the relevant contracts, references to Connecticut Treasurer or Triumph Connecticut investments; (2) dates coinciding with the investments, contracts and events under investigation; (3) Unicode formatting similar to the Stack and Andrews contracts; and (4) references to “Triumph CBO”, a term that was related to files that had been deleted from the Silvester directory.
Although two of the documents did not contain such indicia of relevance and were not within the scope of the warrant, they contained fragmented, innocuous text which the government does not intend to offer at trial.
G. Search of Slack and Free Space
There were approximately 52,000 pages of free space on the hard drive. SA Rovelli seized 120 pages of it. The majority of this data contained directory structures, including traces of previously existing subdirectories entitled “Silvester” and “Andrews”, portions of a contract between Capital Marketing Investment and Triumph, portions of letters referring to payments to Silvester and con
There were approximately 5,000 pages of slack space on the hard drive, of which SA Rovelli seized 378 printed pages. Two hundred forty eight pages of the seized slack space was directory structure information. This data was within the scope of the warrant because it showed files that had been deleted from the hard drive. The balance, which also was properly seized, consisted of evidence of the directory path used for “Recent Links”, evidence of the CleanSweep program, the Stack contract, portions of other consultant contracts, references to the Andrews contract and memos in the Andrews directory, portions of Triumph employee nondisclosure agreements, references to TriConn, TriumphConnecticut and Tri-Conn II Advisors, references to CBO investments, files deleted from the Silvester directory, fragments of contracts referencing Triumph Connecticut II or relating to rights of Triumph limited partners, state ethics and elections laws, and news stories about Thiesfield and Andrews and the investigation.
After SA Rovelli filtered the free and slack space he was able to search the space with keywords. The utility he used produced a report that showed files contained keywords hits, but did not identify where in'the files the hits were located. He used the “find” function of Microsoft Word to search those keywords and locate the clusters that contained the keywords and then manually reviewed those clusters and the surrounding clusters. This process enabled him to find, for instance, the cluster that contained portions of the Stack contract intermingled with another deleted contract. Because he had extracted the slack space to a separate file, he was able to manually review it without having to view the active files associated with the clusters that contained slack space.
SA Rovelli acted reasonably and within the scope of the warrant by manually reviewing surrounding clusters in the filtered slack and free space to see if he could find other parts of deleted files or documents that he had located with a keyword search.
SA Rovelli’s method of searching the slack and free space was reasonable and did not violate the terms or scope of the warrant.
H. Search of Link Files
SA Rovelli put all 204 link files on the CD that he gave to the defendants on May 24, 2000, because he did not have the software he needed to view the contents of these files, which is inaccessible to users without a special utility. But this did not constitute a seizure of those link files, even though the CD was labeled “seized files.”
Thereafter, SA Rovelli obtained a utility that displayed the information in link files. He screened and reviewed the content of twelve of them. Eleven of the twelve contained keywords in either the link file itself or the file to which it pointed. The other link file pointed to a file called “LAT Contract”. LAT are Thiesfield’s initials. He seized 6 link files.
I. Search of Other Areas of Hard Drive
SA Rovelli manually screened the internet cache files for evidence of deletions. It was reasonable for him to do so because these files could contain faxed or scanned documents that would not respond to a keyword search or could contain evidence that a program such as Destroy-it had been downloaded or purchased from the internet.
SA- Rovelli saw evidence of a different crime while he was screening the deleted cache files for the evidence listed in the warrant. He conducted a cursory review of a number of them to be certain they contained evidence of another crime and then contacted the U.S. Attorney’s Office to obtain a second warrant to search and seize evidence of that crime. The fact that he did not search this material without a separate warrant supports a finding that he was not indiscriminately rummaging through the hard drive for evidence of any crime.
SA Rovelli also searched and seized all directory structure information. This information could identify documents or files that at one time were on the hard drive.
SA Rovelli seized all software properties, including information relating to Microsoft Word, the Destroy-it program, the Microsoft Outlook program and a software program called CleanSweep. SA Rovelli’s keyword search of the csdrvmap.dat file identified the programs and files that were on the computer system on the date the program was run and provided links to data files that were then on the system.
Finally, SA Rovelli seized user configurations which provided evidence of users who had access to the computer.
V. Rovelli’s Activities After the Warrant Was Returned,
On October 17, 2000, SA Rovelli filed the search warrant return. The inventory indicated that he seized “a mirror image of the hard drive to review for evidence as noted on Attachment B.” This language did not, and was not intended to mean that he seized the entire contents of the hard drive.
The warrant authorized him to take weeks or months to conduct the search and the defendants were not prejudiced by the fact that the return was not filed before October 17, 2000.
The defendants were given a record or inventory, in either hard copy or electronic form on CDs, of everything seized pursuant to Attachment B of the warrant.
SA Rovelli understood that by filing the warrant he indicated he had completed what the warrant authorized him to do.
After he filed the return, SA Rovelli continued his forensic examination of the hard drive by running software programs and utilities, opening and viewing files that he had seized, and restoring the image. He did not keep detailed notes of his activities after October 17, 2000, but his print-outs show approximate dates of when he restored the image.
SA Rovelli restored the mirror image after the warrant was returned so that he could look at data and documents in their original form and context and continue his forensic examination of the seized evidence.
For instance, in December 2000, he executed the Destroy-it program to conduct further analysis of its functionality, characteristics, and footprints.
On December 14, 2000, and in July, 2001 he used a program called Norton Disk Editor to review the directory structures of items identified as seized and the unfiltered slack space.
In September, 2001, he ran a program that allowed him to view the internals of the active file links that were seized.
SA Rovelli complied with the court’s July 10, 2001, order to preserve existing and future “working copies.” Prior to this court order, SA Rovelli was not required to maintain any restored images.
VI. Standing
The laptop computer was owned by Triumph. It was assigned to Spadoni for his exclusive use.
Spadoni kept the laptop computer in his sole custody and under his sole control. Spa-doni states in an affidavit that he used the laptop computer in his private Triumph offices in Boston and Hartford and carried it with him when he traveled between offices. When he left the Hartford office for the day he either took it with him or stored it in a locked file cabinet. When he left the Boston office for the day he either took it with him or locked it in his private office.
There is no evidence that McCarthy had any personal expectation of privacy in the laptop computer.
CONCLUSIONS OF LAW
Based on the foregoing findings of fact, the court makes the following conclusions of law.
The protections of the Fourth Amendment attach to people, not places. See Rakas v. Illinois, 439 U.S. 128, 99 S.Ct. 421, 58 L.Ed.2d 387 (1978).
To challenge a search and seizure of property, a person must have an actual, subjective expectation of privacy that society is prepared to recognize as reasonable. See id. at 143 n. 12, 99 S.Ct. 421. Such a showing is made when the individual shows ownership, lawful possession or lawful control of the place searched. See id; United States v. Paulino, 850 F.2d 93, 96 (2d Cir.1988).
The burden of establishing standing is on the person seeking suppression. See United States v. Galante, 547 F.2d 733, 739 (2d Cir.1976).
The evidence shows that the laptop computer was owned by Triumph and was assigned to Spadoni for his exclusive use. McCarthy did not present any evidence to establish an actual or objectively reasonable expectation of privacy in the laptop computer.
There is no evidence that McCarthy had any personal or proprietary interest in the laptop computer or evidence that it contained any material covered by McCarthy’s personal attorney-client privilege. To the contrary, uncontradieted evidence presented by Spado-ni establishes that the laptop computer was assigned to him for his exclusive use and that it was always in his exclusive custody and/or control.
McCarthy does not have standing merely because he is a codefendant. See Rakas v. Illinois, 439 U.S. at 134, 99 S.Ct. 421. McCarthy also does not have standing by virtue of his ownership interest in or managerial position at Triumph. Shareholders of a corporation do not have standing merely because they are shareholders, nor can they vicariously assert the corporation’s Fourth Amendment rights. They must establish some personal expectation of privacy in the corporate records at issue. See United States v. Mohney, 949 F.2d 1397, 1403-04 (6th Cir.1991); Williams v. Kunze, 806 F.2d 594, 599 (5th Cir.1986); Lagow v. United States, 159 F.2d 245 (2d Cir.1946).
Because he has shown no personal or proprietary interest in the laptop computer, McCarthy lacks standing to challenge the search of the hard drive.
II. The Forthwith Subpoena
A grand jury subpoena is presumed to have a proper purpose. See United States v. Salameh, 152 F.3d 88, 109 (2d Cir.1998), cert. denied sub nom. Abouhalima v. United States, 525 U.S. 1112, 119 S.Ct. 885, 142 L.Ed.2d 785 (1999).
The burden is on the defendants to show that the grand jury exceeded its legal powers. See United States v. R. Enters., Inc., 498 U.S. 292, 301, 111 S.Ct. 722, 112 L.Ed.2d 795 (1991) (holding that a grand jury subpoena issued through normal procedures is presumptively reasonable and that the burden of showing unreasonableness is on the party asking to avoid compliance). To sustain that burden, a defendant must present particularized proof of an improper purpose. See United States v. Salameh, 152 F.3d at 109 (citing United States v. Mechanik, 475 U.S. 66, 75, 106 S.Ct. 938, 89 L.Ed.2d 50 (1986)).
The defendants have failed to show that the government had an improper purpose in using the forthwith subpoena. See United States v. Re, 313 F.Supp. 442, 449 (S.D.N.Y. 1970).
A grand jury subpoena must also not be used in such a way as to impinge on Fourth Amendment rights. See Boyd v. United States, 116 U.S. 616, 6 S.Ct. 524, 29 L.Ed. 746 (1886). To determine if a subpoena impinges on a defendant’s Fourth Amendment rights, the focus is on the level of compulsion used when the subpoena was served, and whether the government’s actions constitute an abuse of process. See United States v. Lartey, 716 F.2d 955, 966 (2d Cir.1983) (upholding the use of a forthwith subpoena where there was no threat or compulsion); United States v. Barr, 605 F.Supp. 114, 117 (S.D.N.Y.1985); United States v. Re, 313 F.Supp. at 449.
The totality of the circumstances show that the defendants’ compliance with the forthwith subpoena was voluntary, not coerced.
The facts that the subpoena was served on Triumph’s defense attorney, who is experienced in criminal matters, and that she did not file a motion challenging its validity, support the conclusion that defendants voluntarily complied and that the use of the subpoena did not amount to an unlawful seizure. See United States v. Susskind, 965 F.2d 80, 87 (6th Cir.1992), United States v. Lartey, 716 F.2d at 966. Triumph’s counsel could not reasonably have been unaware of the options that were available to resist the subpoena.
Indeed, the defendants were aware of their options and had ample opportunity to challenge the subpoena. Such knowledge is an essential element of effective consent and supports a finding that compliance was voluntary. See Schneckloth v. Bustamonte, 412 U.S. 218, 227, 93 S.Ct. 2041, 36 L.Ed.2d 854 (1973); United States v. Susskind, 965 F.2d at 87. The defendants had eight days between the time the subpoena was served and the date the warrant was issued. They either knew or could have learned from Spado-ni what information, files and records were on the laptop and thus could have raised any challenge they deemed appropriate. See United States v. Barr, 605 F.Supp. at 118. Moreover, the government agreed that it would not open or look at the laptop computer until Triumph’s attorney had an opportunity to file a motion.
The defendants had sufficient time and opportunity to file a motion and, in fact, did file one seeking protection for attorney-client privileged documents on the computer. The government did not commence its search and seizure until the issues raised in the motion were resolved.
Thus, it cannot be found that the defendants were deprived of any meaningful opportunity under Fed.R.Crim.P. 17(c) to challenge the validity of the forthwith subpoena. Cf. In re Nwamu, 421 F.Supp. at 1365.
The government has sustained its burden of showing that compliance with the subpoena was voluntary. See Bumper v. North Carolina, 391 U.S. 543, 88 S.Ct. 1788, 20 L.Ed. 797 (1968).
In addition, there were exigent circumstances justifying the use of a forthwith subpoena.
Exigent circumstances exist where there is a reasonable good faith concern that evidence might be destroyed or altered in any way. See United States v. Lartey, 716 F.2d at 961— 62 (holding that the use of a forthwith grand jury subpoena was entirely lawful in light of the risk of an obstruction of the investigation by falsifying records or destroying evidence); United States v. Re, 313 F.Supp. at 449.
The government had reasonable and good faith concerns that computer data and evidence could be destroyed, altered or tampered with to obstruct justice if the defendants were given advance notice. See United States v. Lartey, 716 F.2d at 961-62. The reasonableness of the government’s concern was based on information from Silvester that: (1) contracts between Triumph and Thiesfield and Triumph and Stack had not been produced in response to the first grand jury subpoena; (2) Triumph’s counsel had advised that more subpoenas were likely and that documents for which there was no business purpose and were incriminating should be purged; (3) documents relating to Park Strategies, the company that Silvester worked for after leaving office, had been deleted; and (4) Spadoni or someone at Triumph had purchased a program to purge or blow out a computer.
Moreover, the information that Silvester provided was corroborated by information
Finally, the portable nature of the laptop computer and the fact that information and data on a computer can easily be overwritten or corrupted by ordinary use, justified the government’s belief that the computer could be lost or evidence it contained could be destroyed or altered if Triumph was given advance notice. Thus, the government acted reasonably in using a forthwith subpoena to immobilize the laptop computer and preserve its contents.
There is no evidence that the forthwith subpoena was improperly used to circumvent the warrant requirement. The government even assured the grand jury that it would not open or look at the laptop computer until Triumph had an opportunity to file relevant motions. The evidence shows that the government used the forthwith subpoena as a temporary measure to prevent it from being tampered with and to freeze its contents until a warrant could be obtained to search it. See United States v. Giovanelli, 747 F.Supp. 891, 896 (S.D.N.Y.1989).
The fact that the government did not act immediately after SA Rovelli reviewed the back-up tapes on March 26, 2000, does not negate the exigent circumstances. The government had a valid reason for the delay— SA Rovelli needed time to analyze the information he obtained from the back-up tapes and put it in context with the information the government had earlier obtained from Silves-ter regarding Spadoni’s intention to purge the computer. Thus, the delay does not support the claim that the government used the subpoena process to effect a warrantless search and seizure. See United States v. Lartey, 716 F.2d at 962-63.
In sum, the government did not transform the subpoena procedure into an unlawful search and seizure or otherwise abuse the grand jury process by obtaining possession of the laptop computer through a forthwith subpoena. See id.
However, even if the use of the forthwith subpoena was not justified, and assuming the exclusionary rule applies to subpoenas, cf. United States v. Payner, 447 U.S. 727, 734, 100 S.Ct. 2439, 65 L.Ed.2d 468 (1980), the good faith exception applies because the agents had an objective good faith belief that the laptop was lawfully obtained pursuant to the subpoena. See United States v. Leon, 468 U.S. 897, 922, 104 S.Ct. 3405, 82 L.Ed.2d 677 (1984). This is especially true because the defendants did not challenge the lawfulness of the subpoena during the eight days between the date the laptop computer was delivered to the court and the date the agent began executing the warrant.
III. The Warrant
The defendants claim that the search and seizure warrant violates the Fourth Amendment because it is not sufficiently particular and is not supported by probable cause. Their claims are specifically directed to paragraphs one and five of Attachment B, the list of items to be searched and seized.
Paragraph one of Attachment B lists as items to be seized: “[cjomputer logs and file records on the storage media of the [hard drive], including time and date or records associated with individual files which can indicate deletion or destruction of individual files on the storage media of the [hard drive] or a deletion and restoration of the entire file system on the storage media, at a particular time[.]”
Paragraph five identifies “Computerized records relating to contracts between Triumph Capital and Benjamin ‘Ben’ Andrews, Triumph Capital and Park Strategies and/or Benjamin ‘Ben’ Andrews and Park Strategies, including all computer generated information relating to the creation, modification and/or deletion of contracts between Tri
The defendants maintain that paragraph one authorizes a “generic items” or “all records” search without probable cause. They also claim that paragraph one does not describe with sufficient particularity the items to be seized. They contend that paragraph five is also not supported by probable cause.
The defendants’ arguments concerning the invalidity of paragraphs one and five are not supported by the law or the facts of this case. To the contrary, paragraph one is sufficiently particular and it, as well as paragraph five are amply supported by probable cause.
A. Particularity
The Fourth Amendment requires warrants to describe with particularity the place to be searched and things to be seized. But, it is the general rule that the particularity requirement must be applied with a practical measure of flexibility and only requires reasonable specificity. See United States v. Shoffner, 826 F.2d 619, 631 (7th Cir.1987). Indeed, “no tenet of the Fourth Amendment prohibits a search merely because it cannot be performed with surgical precision.” United States v. Conley, 4 F.3d 1200, 1208 (3d Cir.1993) (quoting United States v. Christine, 687 F.2d 749, 752 (3d Cir.1982)).
Warrants must be read in a common sense and practical fashion and not in an overly-technical manner. See United States v. Ven-tresca, 380 U.S. 102, 108, 85 S.Ct. 741, 13 L.Ed.2d 684 (1965) (noting that in complex cases, reading a warrant with practical flexibility entails an awareness of the difficulty of piecing together a paper puzzle); United States v. Bianco, 998 F.2d 1112, 1117 (2d Cir.1993).
A common sense and practical reading of the warrant in this case requires the court to construe it as incorporating and referencing all of the attachments and the supporting affidavit, even if the warrant does not expressly do so. See United States v. Bianco, 998 F.2d at 1117 (rejecting rigid adherence to formal requirement that affidavit be expressly incorporated into a warrant and reading a warrant in light of an affidavit that was not expressly incorporated). This is particularly appropriate where the affidavit is available to the searching agent and explains in detail the motivation behind the search and the nature of the evidence sought. See id. Here, SA Rovelli read the affidavit and relied on it during his search of the hard drive. The affidavit explains in detail the motivation behind the search and the nature of the evidence sought.
A warrant only needs to be specific enough to permit the executing officer to exercise reasonable, rational and informed discretion and judgement in selecting what should be seized. See United States v. Hill, 19 F.3d 984, 987 (5th Cir.1994); United States v. Longo, 70 F.Supp.2d 225, 249 (W.D.N.Y.1999); United States v. Lloyd, No. 98cr529, 1998 WL 846822, 1998 U.S. Dist. Lexis 17889 (E.D.N.Y Oct. 5, 1998) (citing United States v. Riley, 906 F.2d 841, 845 (2d Cir.1990)). The warrant does not need to specifically identify every document to be seized. See United States v. LaChance, 788 F.2d 856, 874 (2d Cir.1986); United States v. Prewitt, 553 F.2d 1082, 1086 (7th Cir.1977). The Second Circuit has held that a warrant is sufficiently particular if it sets forth generic classifications of the items to be seized together with an illustrative listing which enables the executing officer to ascertain and identify with reasonable certainty the items that the magistrate has authorized him to seize. See United States v. George, 975 F.2d 72, 75 (2d Cir.1992).
In determining whether the particularity requirement is satisfied, the court is entitled to place a great deal of weight on whether the warrant is as particular as reasonably could be expected under the circumstances. See Andresen v. Maryland, 427 U.S. 463, 480 n. 10, 96 S.Ct. 2737, 49 L.Ed.2d 627 (1976). The complexity of the crimes under investigation is a factor the court may consider in making this determination. See United States v. Blumberg, No. 3:97cr119 (EBB), 1998 WL 136174, at *2, 1998 U.S. Dist. Lexis 22411, at *12 (D.Conn. Mar. 11, 1998) (noting that the degree of specificity
Here, the warrant was as particular as reasonably could be expected given the complexity of the search, the crimes under investigation, and the nature of the evidence sought. The government had no way of knowing what information would be found on the laptop computer and thus could not have described more precisely the form of the evidence and the exact location on the hard drive where it was located. See United States v. Spilotro, 800 F.2d 959, 963 (9th Cir.1986) (noting that one of the factors in determining the sufficiency of a warrant is whether the government was able to describe the items more particularly in light of the information available to it when the warrant was issued); United States v. Lamb, 945 F.Supp. 441, 458-59 (N.D.N.Y.1996). In addition, searching a hard drive for evidence of deleted data and files is inherently difficult and complex. Indeed, given the technical nature of the search in this case, “a more particular description could [have] precluded effective investigation of the crimes at issue.” United States v. Shoffner, 826 F.2d at 631.
Paragraph one provided sufficient and ascertainable guidelines to assist SA Rovelli’s exercise of judgement and discretion during the search. See United States v. Riley, 906 F.2d 841, 844 (2d Cir.1990). It did not authorize a general, unfettered or indiscriminate search of all computer logs and “records”. To the contrary, by virtue of the information in the supporting affidavit, it authorized a search and seizure that was limited to evidence of the specific crimes under investigation and a specific time period. See United States v. Lloyd, 1998 WL 846822, 1998 U.S. Dist. Lexis 17889. This is so even though paragraph one does not contain an express time limit.
A temporal limitation in a warrant is not an absolute necessity, but is only one indicia of particularity. See United States v. Bucu-valas, 970 F.2d 937, 942 n. 7 (1st Cir.1992) (holding that time limitations “are but one method of tailoring a warrant description to suit the scope of the probable cause showing”). Thus, the absence of a temporal limitation does not render the warrant a prohibited general warrant.
Interpreting or construing the generic term “file records” in paragraph one as including text, remnants or fragments of deleted files as well as information about such files did not render the warrant insufficiently particular or permit an expansive general search of the hard drive. See United States v. Marti, 421 F.2d 1263, 1268 (2d Cir.1970) (recognizing that executing agents must have discretion to interpret the words of every warrant no matter how particular the items are described). A restrictive, hyper-technical and cramped interpretation of the term is not warranted or required. See United States v. Martin, 157 F.3d 46, 52 (2d Cir. 1998) (noting that warrants should be read in a common sense as opposed to a hypertechnical and cramped manner); United States v. Canfield, 212 F.3d 713, 719 (2d Cir.2000) (same).
SA Urso, who drafted the warrant, was not a computer expert and could not have intended to use the term in the restrictive, technical manner advanced by the defendants. Agents frequently use the generic term “records” in warrants as a general description of a broad range of information that might be found during a search. See United States v. Riley, 906 F.2d at 843 (upholding warrant that authorized seizure of “records of the distribution of cocaine”); United States v. Matias, 836 F.2d 744, 748 (2d Cir.1988) (upholding warrant authorizing seizure of “books and other records”).
It would also require a cramped and hy-pertechnical reading of paragraph one to construe it as not authorizing the search and seizure of software programs that had the ability to cause destruction of files, directories and programs.
In sum, paragraph one contained a reasonably particular description of the items to be seized in the context of the criminality under investigation and thereby satisfies the Fourth Amendment’s particularity requirement.
Probable cause is “a fluid concept — turning on the assessment of probabilities in particular factual contexts — not readily or even usefully reduced to a neat set of rules.” Illinois v. Gates, 462 U.S. at 232, 103 S.Ct. 2317.
Probable cause exists where the totality of facts presented would lead a man of reasonable caution to believe that a crime has been committed and that evidence of that crime would be found in the place to be searched. See Davis v. Gracey, 111 F.3d 1472, 1478; see also Texas v. Brown, 460 U.S. 730, 742, 103 S.Ct. 1535, 75 L.Ed.2d 502 (1983). A warrant is overbroad if it includes items for which there is no probable cause. See Davis v. Gracey, 111 F.3d at 1478.
A magistrate’s finding of probable cause should be given great deference by reviewing courts. See Illinois v. Gates, 462 U.S. at 236, 103 S.Ct. 2317. A defendant “who argues that a warrant was issued on less than probable cause faces a heavy burden.” Rivera v. United States, 928 F.2d 592, 602 (2d Cir. 1991). Even the resolution of marginal cases should be determined with regard to the preference accorded to warrants. See Jones v. United States, 362 U.S. 257, 270, 80 S.Ct. 725, 4 L.Ed.2d 697 (1960).
The supporting affidavit in this case sets forth sufficient facts and information to establish probable cause for searching the hard drive for evidence of the alleged criminal activity such as deletions of data and documents relating to Triumph’s dealings with Silvester, Thiesfield, Stack and Andrews, not just files and data relating to the specific contracts identified in paragraphs two through five.
Specifically, SA Urso’s affidavit contains, inter alia, information about: (1) Spadoni’s intent to purge either the entire hard drive or incriminating documents on a computer in anticipation of additional grand jury subpoenas; (2) details of Silvester’s and the defendants’ alleged illegal campaign finance activities; (3) details of other illegal acts of bribery that Silvester, Stack and the defendants had engaged in; and (4) efforts to disguise the alleged criminal activity.
Moreover, in addition to evidence that the contracts identified in paragraphs two through five had been deleted, it was also permissible to seize evidence of other related deletions because that would be relevant and admissible under Fed.R.Evid. 404(b) as probative of the defendants’ intent to commit the alleged crime of obstruction of justice or the absence of mistake. See Andresen v. Maryland, 427 U.S. at 483-84, 96 S.Ct. 2737 (upholding seizure of documents relating to parcels of land other than the parcels specifically mentioned in the warrant because such evidence could be “other acts” evidence that would be probative of the defendant’s intent to commit the crime described in the warrant).
The affidavit also supported a search and seizure of records relating to the creation, modification and/or deletion of contracts between Triumph and Andrews and/or Park Strategies as described in paragraph five, and was not limited to evidence that a contract showing a relationship between Triumph and Park Strategies had been deleted between January and May, 1999.
SA Urso’s affidavit states that Silvester began working for Park Strategies after he left office in January, 1999, that Silvester obtained that job in return for a $50 million investment, and that Spadoni told Silvester on May 31, 2000, that draft contracts between Triumph and Andrews, Triumph and Park Strategies and/or Park Strategies and Andrews had been deleted in anticipation of more grand jury subpoenas. Silvester also informed SA Urso that he wanted Triumph to hire Park Strategies but McCarthy was unwilling to do so directly, so he agreed that Triumph would contract with Andrews who in turn would contract with Park Strategies.
The fact that the affidavit does not contain other information that may have been known to the government pertaining to Andrews’s other dealings with Triumph, or Spadoni’s belief that Triumph’s contemplated contract with Park Strategies would not violate state ethics laws, does not affect the conclusion that sufficient probable cause was shown in support of paragraph five. These omissions did not deprive the magistrate judge of infor
III. Good Faith Exception
Even if the warrant were impermissibly overbroad, the evidence would be admissible under the good faith exception recognized by the Supreme Court in United States v. Leon, 468 U.S. 897, 104 S.Ct. 3405 (1984).
The good faith exception permits the admission of evidence obtained pursuant to a facially valid warrant that is subsequently found to be invalid so long as the executing officer acted in good faith and in objectively reasonable reliance on the warrant. See id. at 919, 104 S.Ct. 3405 (holding that the good faith exception applies unless the agents obtained the warrant by deliberately misleading the judge, the judge abdicated his duty, or the warrant was so facially deficient that the agent was unreasonable in relying on it); see also United States v. Jasorka, 153 F.3d 58, 60 (2d Cir.1998).
Thus, under the good faith exception, evidence should not be suppressed unless the court determines that a reasonably well-trained officer should have known that the search was illegal despite the judge’s authorization. See United States v. Leon, 468 U.S. at 922 n. 23, 104 S.Ct. 3405; United States v. Moore, 968 F.2d 216, 222 (2d Cir. 1992). An officer is not “required to disbelieve a judge who has just advised him, by word and by action, that the warrant he possessed authorizes him to conduct the search he has requested.” United States v. Buck, 813 F.2d 588, 592 (2d Cir.1987).
SA Rovelli was justified in relying on the magistrate judge’s conclusion that the warrant was sufficiently particular and was supported by probable cause because it was facially valid. No reasonable agent would have thought that paragraphs one and five authorized a wide-ranging, unlimited exploratory search for evidence of any crime. Nor did probable cause evaporate when SA Rovelli discovered that there had not been wholesale deletion of data on the hard drive.
SA Rovelli executed the warrant in good faith and in objectively reasonable reliance on a belief that the warrant was sufficiently particular and facially valid. See United States v. Leon, 468 U.S. at 922, 104 S.Ct. 3405; United States v. Hunter, 13 F.Supp.2d 574, 584-85 (D.Vt.1998).
Thus, even if the warrant was not supported by probable cause, the evidence seized pursuant to it is admissible under the good faith exception. See United States v. Jasorka, 153 F.3d at 60; United States v. Cancelmo, 64 F.3d 804, 807 (2d Cir.1995).
IV. Execution of the Warrant!Blanket Suppression
The defendants have moved for blanket suppression of all items seized from the laptop computer. They claim that this drastic remedy is required because the warrant was executed in a manner that resembled a general exploratory search and in flagrant disregard of the warrant and thus violated the Fourth Amendment.
There is no merit to the defendants’ challenge to the manner in which the search was executed. Under the totality of the circumstances, the warrant was executed in a-reasonable manner and in good faith. The search bears none of the hallmarks of a general exploratory search.
Where a search exceeds the scope of a warrant, the general rule is that “only the improperly seized evidence will be suppressed, the properly seized evidence remains admissible.” United States v. Squillacote, 221 F.3d 542, 556 (4th Cir.2000); see also United States v. George, 975 F.2d 72, 75 (2d Cir.1992); United States v. Hamie, 165 F.3d 80, 84 (1st Cir.1999).
The drastic remedy of blanket suppression of all seized evidence is not justified unless the agent executing the warrant effected a widespread seizure of items not within the scope of the warrant and did not act in good faith. See United States v. Liu, 239 F.3d 138,140 (2d Cir.2000) (citing United States v. Matias, 836 F.2d 744, 747 (2d Cir. 1988)); United States v. George, 975 F.2d at 79; United States v. Lambert, 771 F.2d 83, 93 (6th Cir.1985); Marvin v. United States, 732 F.2d 669, 675 (8th Cir.1984); United States v. Tamura, 694 F.2d 591, 597 (9th
Flagrant disregard is found only in extraordinary cases such as those where the government effects a widespread seizure of items clearly not within the scope of a warrant and does not act in good faith, or when the lawful basis of a warrant was a pretext for the otherwise unlawful aspects of a search. See United States v. Hamie, 165 F.3d at 83-84; United States v. Foster, 100 F.3d at 852 (finding flagrant disregard where officers disregarded the warrant and searched for “anything of value”); United States v. Dzialak, 441 F.2d 212, 217 (2d Cir.1971) (describing a general search as one where agents spent hours ransacking a house for any possible incriminating evidence and the number of items seized outside the scope of the warrant far outnumbered those described in the warrant).
But a search is not rendered invalid merely because agents seize items that are outside the scope of the warrant. The search “must actually resemble a general search.” United States v. Liu, 239 F.3d at 141 (emphasis in original). This is particularly true where such items are not admitted as evidence against the defendant. See United States v. Hargus, 128 F.3d 1358, 1361 (10th Cir.1997); United States v. Henson, 848 F.2d 1374, 1380 (6th Cir.1988). Even “the improper wholesale seizure of many items outside a warrant’s scope does not alone render the whole search invalid and require the suppression and return of all documents seized.” United States v. Hamie, 165 F.3d at 84 (quoting United States v. Young, 877 F.2d 1099, 1105 (1st Cir.1989)); see also United States v. Dzialak, 441 F.2d at 212; United States v. Principie, 531 F.2d 1132 (2d Cir.1976); United States v. Dunloy, 584 F.2d 6 (2d Cir.1978).
The search in this case did not actually resemble a general search and there is nothing extraordinary in the facts that justifies blanket suppression. See United States v. Liu, 239 F.3d at 140; United States v. Dzialak, 441 F.2d at 217. Indeed, the search here was no more inherently intrusive than a search of an entire house for weapons or drugs. See United States v. Upham, 168 F.3d 532, 535 (1st Cir.), cert. denied 527 U.S. 1011, 119 S.Ct. 2353, 144 L.Ed.2d 249 (1999).
Further, the magnitude of a search is insufficient, by itself, to establish a constitutional violation. The relevant inquiry is whether the search and seizure was reasonable under the circumstances. See United States v. Wuagneux, 683 F.2d 1343, 1352 (11th Cir.1982). Here, given the magnitude of the information and data contained on the hard drive, the complexity and technical nature of the computer search itself, and the fact that the focus was on evidence of deletions, an extensive and thorough search was expected and authorized in this case.
Despite the defendants’ statistical argument, the evidence simply does not establish indiscriminate rummaging through the hard drive or a widespread, grossly excessive seizure of data and documents clearly outside the scope of the warrant. See United States v. Regan, 706 F.Supp. 1102 (S.D.N.Y.1989) (rejecting claim of indiscriminate rummaging based on statistical claim that 69 of the 259 boxes seized contained documents entirely outside warrant and noting that defendant’s figure would be different if the government’s definition of what fell within the warrant were used). Such statistical arguments are inherently unreliable, inaccurate and misleading in that they are often based on a self-serving selection of data and present results in a way most advantageous to the claim being advanced.
Actually, SA Rovelli reviewed and ultimately seized only a comparatively small amount of the 1 GB or 264,000 pages of data that was on the hard drive. Moreover, with the exception of a limited number of deleted files which the government does not intend to introduce at trial, the majority of the seized items were responsive to the warrant. In addition, SA Rovelli had a reasonable, logical and credible explanation for the vast majority of documents and data he seized, scanned or reviewed without seizing, even for the data and documents that did not fall within the scope of the warrant.
The seizure of any documents not named in the warrant resulted from a good faith response to the inherent practical difficulties of. searching a computer’s hard drive for evidence of deleted data and files. “It is no easy task to search a well-laden hard drive by going through all of the information it contains, let alone to search through it ... for information that may have been deleted.” United States v. Upham, 168 F.3d at 535.
The evidence establishes that SA Rovelli acted in good faith'
The defendants have also not sustained their burden of establishing that blanket suppression of all evidence seized under the warrant is justified in this case based on the manner in which SA Rovelli conducted the search. See United States v. Squillacote, 221 F.3d at 556. The warrant did not prescribe any specific search methodology. Indeed, “the warrant process is primarily concerned with identifying what may be searched or seized — not how .... ” United States v. Upham, 168 F.3d at 537.
The warrant did not limit the search to any specific area of the hard drive. Thus, SA Rovelli was permitted under the Fourth Amendment to look in any area of the premises described by the warrant that might contain the objects of the search, including active files, recovered deleted files, free space, slack space, internet cache files, image files, directory structures and link files. See United States v. Ross, 456 U.S. 798, 821, 102 S.Ct. 2157, 72 L.Ed.2d 572 (1982); United States v. Sissler, No. 91-2113, 1992 WL 126974, 1992 U.S.App. Lexis 14041 (6th Cir. June 10,1992).
The warrant also did not limit SA Rovelli’s search solely to keywords. To the contrary, it stated that the analysis would “focus on particular programs, directories, and files (including deleted data) that are most likely to contain the evidence and information of the violations under investigation based upon file names, keywor[d] searches, file dates, or other indicia or relevance.”
The warrant expressly authorized SA Rov-elli to manually review “any and all files and documents which are either unlabeled, or labeled in a manner that does not readily identify what persons are associated with those files” to determine whether they pertain to the names or transactions listed in Attachment B. Because a computer user can mislabel or deliberately label files to avoid detection, SA Rovelli was not required to assume that document and file names and suffixes accurately described their contents, and he acted reasonably in manually reviewing documents and files to ascertain their
A manual review was also necessary because certain areas of the hard drive, such as free space, slack space and deleted files, do not have file names and are not susceptible to accurate keyword searches. For instance, if SA Rovelli found a keyword in a cluster of slack or free space he would have to manually review other clusters, even non-contiguous clusters, in order to find other parts of that document that did not contain a keyword.
However, the evidence shows that SA Rov-elli primarily used keywords as a method, but not the sole means to focus and narrow his search for evidence of the contracts and violations under investigation. SA Rovelli’s choice of keywords did not constitute flagrant disregard of the warrant or impermis-sibly broaden the search. Indeed, the defendants only contest the propriety of three of the twenty-five keywords that SA Rovelli used. Despite their challenge to his selection of those keywords, it was reasonable for him to read the warrant as authorizing them based on the contracts, transactions and individuals specified in the warrant and other indicia of relevance. It would require a cramped, hypertechnical reading to construe the warrant as containing an exclusive or authorized list of keywords that could not be added to or altered.
SA Rovelli did not act unreasonably by adding “minutes” as a keyword term. He added it after he saw a directory listing in slack space which read “My Doeuments*Con-sultantContract-lisa thiesfield.dococ-V-dococ-Ltr.docsultant Contract.docment.doc Minutes .does*.” Because the term “minutes” appeared in close proximity to a listing for a Thiesfield consultant contract, SA Rovelli reasonably and logically believed that the term was related to the Thiesfield contract and therefore within the scope of the warrant. His explanation was credible, and there is no evidence that he added the word “minutes” as a pretext to conduct a fishing expedition or to find documents not listed in the warrant. See United States v. Liu, 239 F.3d 138 (2d Cir.2000).
SA Rovelli also reasonably and appropriately used “Silvester” and “capital marketing investments corp.” as keywords. These terms were related to the contracts identified in the affidavit and to the crimes under investigation. Capital Marketing Investments was the name of Ben Andrews’s company. Silvester was a central figure in the alleged criminal activity and he arranged the contracts between Triumph and Thiesfield, Triumph and Stack and Triumph and Park Strategies as a means of funneling money to him.
SA Rovelli did not go beyond the scope of the warrant or impermissibly broaden its scope by seizing text, fragments or remnants of files that had been deleted. He properly and reasonably interpreted the term “file records” in paragraph one to include the text and content of files as well as all data associated with files. See United States v. Marti, 421 F.2d 1263, 1268 (2d Cir.1970).
SA Rovelli acted in good faith and within the scope of the warrant in searching internet cache files and image files. Both types of files can contain scanned, downloaded documents or faxes that are not susceptible to keyword searches. Also, evidence of online searches for, or purchases of, programs that could be used to delete data from the hard drive such as Destroy-it could have been found in internet cache files.
SA Rovelli did not seize the entire hard drive when he created the image file, restored it to MOs for examination purposes or
SA Rovelli did not conduct excessive or separate searches requiring separate warrants each time he reviewed the data on an MO. The defendants were not prejudiced by this because the evidence was “frozen in time” when the mirror image was made. Copying data to an MO before examining it and write protecting the MO were reasonable and proper procedures to protect the integrity of the evidence and to ensure that tests would not alter the data. There is no evidence that SA Rovelli had an improper purpose in taking these steps.
SA Rovelli also acted properly by extracting free and slack space and putting the data into active files that he created. He did so to minimize the intrusiveness of the search and to enable him to run a keyword search with the software program he was using, which only permitted keyword searches on active files.
■ SA Rovelli kept adequate records of his search consisting of an MO containing the active and recovered deleted files and directory structures seized, an MO containing the extracted slack and free space and filtered slack and free space divided into files, a CD containing keyword lists, the results of keyword searches, all recovered deleted files, and a master CD containing all active and deleted files and all extracted free and slack space, printouts of data that documented the steps he took in his search and handwritten notes of the original imaging process. It is of no consequence that he did not create an audit log to track the dates and time he made the images or any errors in the imaging process. His notes from the original imaging process contain essentially the same information that the computerized audit log would have tracked. Thus, his failure to create an audit log did not invalidate the search.
The fact that defendants’ expert witness, Douglas Anderson, testified about certain technical defects in SA Rovelli’s search methodology and that a more advanced search method or software should have been employed does not affect the court’s conclusion that the search was reasonable under the Fourth Amendment. See United States v. Gray, 78 F.Supp.2d at 529 n. 8.
SA Rovelli’s decisions as to the manner in which he would conduct the search and the documents and files he would scan, review and/or seize are consistent with what a well-trained CART agent would have done under the circumstances. Any of SA Rovelli’s actions that were arguably beyond the scope of the warrant were the result of the inherent practical difficulties of searching a computer for evidence of deleted data and files. See Davis v. Gracey, 111 F.3d 1472 (10th Cir. 1997); United States v. Upham, 168 F.3d at 535; United States v. Hunter, 13 F.Supp.2d 574, 584 (D.Vt.1998). Moreover, any such action was minor, technical and “motivated by considerations of practicality rather than by a desire to engage in indiscriminate fishing.” United States v. Tamura, 694 F.2d 591, 597 (9th Cir.1982). The evidence shows that SA Rovelli conducted a difficult and
The fact that Rovelli sought a second warrant after he discovered evidence on the hard drive of another, unrelated crime supports a finding that he showed restraint and was not indiscriminately rummaging through the hard drive for any possible incriminating evidence of any crime. See United States v. Walser, 275 F.3d 981 (10th Cir.2001) (finding agent did not impermissibly broaden the warrant by opening image files containing evidence of an unrelated crime during a search for evidence of drug dealing because the agent did not extensively rummage though such files, but showed restraint in requesting a second warrant to search them).
Finally, the actions that SA Rovelli took to examine the seized data after the warrant was returned are not analogous to returning to a crime scene to search for additional evidence and do not establish an impermissible, warrantless second or continuing search of the hard drive. When SA Rovelli restored the mirror image to a hard drive, ran software programs, printed out directory structures and viewed documents that he had previously seized, he was merely continuing his forensic examination. There is no evidence that he seized additional documents or data after he filed the return.
V. Protection for Privileged Material
It was proper and appropriate for SA Rov-elli to use the procedures contained in the April 18, 2000, letter agreement to screen for privileged material rather than the procedures set forth in Attachment D. The procedures in Attachment D were not followed because the government and defendants’ counsel agreed to different procedures. In fact, the agreed-upon screening procedures provided greater protection to the defendants because all of the material that was to be searched was first disclosed to counsel for review and assertion of a privilege claim, not to a magistrate judge as provided in Attachment D. The screening procedures that were used in this case provided more than adequate protection to the defendants. The prosecution team did not view any privileged material and the defendants did not suffer any prejudice. See In re Grand Jury Subpoenas Dated Dec. 10, 1987, 926 F.2d 847 (9th Cir.1991).
The defendants cannot reasonably claim they did not believe there was any protection in place to protect privileged material merely because Attachments C and D were filed under seal and were not given to them when the warrant was served. Defendants’ counsel and Ms. Dannehy negotiated a procedure for review of privileged material. The negotiated procedure actually provided more protection than was provided in Attachment D because defendants’ counsel was allowed to review the material and raise privilege claims before it was turned over to the prosecution team. Moreover, even though the negotiated procedure only provided for defendants’ review of documents in two subdirectories, all documents were given to the defendants for privileged review.
These safeguards, the absence of any demonstrated prejudice to the defendants, and the absence of evidence showing that privileged material was disclosed to the prosecution team compels a conclusion that there was no Sixth Amendment violation. See United States v. Neill, 952 F.Supp. 834, (D.D.C.1997) (holding that the Sixth Amendment is violated only if privileged information is intentionally obtained and used to the defendants’ detriment at trial).
VI. Compliance With Fed.R.Crim.P. II
The requirements of Rule 41 are basically ministerial in nature and violations of the rule only require suppression where the defendant is legally prejudiced. See United States v. Bonner, 808 F.2d 864, 869 (1st Cir.1986); cf. United States v. Gantt, 194 F.3d 987 (9th Cir.1999) (holding that a deliberate disregard for Rule 41(d) is grounds for suppressing evidence).
To show prejudice, the defendants must show the violation subjected them to a search that otherwise would not have occurred or one that would not have been as abrasive. See United States v. Bonner, 808 F.2d at 869.
The purpose of Fed.R.Crim.P. 41(e)(l)’s time limitation is to prevent a stale warrant. Delay in executing a warrant beyond the time set forth in the rule is not unreasonable unless, at the time it is executed, probable cause no longer exists and the defendant demonstrates legal prejudice as a result of the delay. See Commonwealth v. Ellis, No. 97-192, 1999 Mass Super. Lexis 368 (Mass.Superior. Aug. 1,1999).
Here, when the mirror image was made within the ten-day period the evidence was frozen in time. Thus, there was no danger that probable cause ceased to exist during the search of the hard drive. See United States v. Bedford, 519 F.2d 650, 655-56 (3d Cir.1975) (noting that the reasonableness of a search is also determined by whether probable cause had dissipated at the time the warrant was executed); United States v. Gerald, 5 F.3d 563, 567 (D.C.Cir.1993) (declining to suppress evidence where warrant was returned five months after the search and where there was no showing of harm to defendant).
Here, the warrant authorized an off-site search that could take weeks or months. As long as the time was reasonable under the circumstances, a search of such duration does not violate the Fourth Amendment. See Berger v. New York, 388 U.S. 41, 58-61, 87 S.Ct. 1873, 18 L.Ed.2d 1040 (1967); United States v. Snow, 919 F.2d 1458, 1461 (10th Cir.1990); U.S. Postal Serv. v. C.E.C. Serv., 869 F.2d 184, 187 (2d Cir.1989); United States v. Henson, 848 F.2d 1374 (6th Cir. 1988).
The amount of time that SA Rovelli took to complete the complex and technical search in this case was not unreasonable. Indeed, as one court recently observed, computer searches are not, and cannot be subject to any rigid time limit because they may involve much more information than an ordinary document search, more preparation and a greater degree of care in their execution. See Commonwealth v. Ellis, 1999 Mass. Super Lexis 368.
Moreover, neither Rule 41 nor the Forth Amendment impose any time limitation on the government’s forensic examination of the evidence seized. See United States v. Sanchez, 689 F.2d 508, 512 n. 5 (5th Cir.1982); United States v. Hernandez, 183 F.Supp.2d 468, 480-81 (D.P.R.2002). Thus, SA Rovelli was not required to complete the forensic examination of the hard drive within the time period required by Rule 41 for return of the warrant.
The inventory required by Rule 41 is also a ministerial act and failure to properly provide one does not, absent prejudice, affect the validity of the underlying search. See United States v. Haskins, 345 F.2d 111, 117 (6th Cir.1965); United States v. Birrell, 269 F.Supp. 716, 719 (S.D.N.Y.1967).
The defendants were given copies of everything seized. This obviates the need for a detailed inventory. See In re Searches of Semtex Indus. Corp., 876 F.Supp. 426 (E.D.N.Y.1995). Thus, despite the broad description in the warrant return, the defendants’ failure to show prejudice is fatal to their claim. See United States v. Guevera, 589 F.Supp. 760 (E.D.N.Y.1984) (finding no prejudice where defendant knew that specific property was seized and had not been precluded from moving for return of property).
Moreover, the rules do not dictate a required level of specificity for inventories of seized items. A detailed description of each item seized is not called for even under an extreme construction of Rule 41(d). See United States v. Birrell, 269 F.Supp. at 719.
The defendants have not shown deliberate disregard for the requirements of Fed. R.Crim. P. 41 or that the search would not have occurred or have been as abrasive if there had been no alleged violations of the rule. Any technical violation of the rule does not require the court to invalidate an otherwise properly executed warrant or suppress evidence acquired under it. See United. States v. Dudek, 530 F.2d 684 (6th Cir.1976).
CONCLUSION
For the foregoing reasons, the defendants’ motion to suppress [doc. # 189] is DENIED.
. On June 12, 2002, the court denied the motion on the record and stated that this ruling would follow.
. This ruling only addresses the defendants’ motion for blanket suppression. After the motion was fully briefed, heard and argued, the defendants moved for leave to file a supplemental memorandum [doc. #412] seeking to suppress two specific documents, referred to as CB02 and CB03. The defendants did not specifically seek to suppress these two documents in the original motion because they had asserted a privilege claim that was then pending before the magistrate judge. The magistrate judge subsequently determined that the documents were not privileged and ordered them disclosed to the prosecution. The court has construed the motion to file a supplemental memorandum as a supplemental motion to suppress and will consider the claims separately from those raised in the original motion to suppress and will issue a separate ruling addressing those two documents.
. The procedures set forth in Attachment D conform to the U.S. Department of Justice’s policy on searching the premises of attorneys. See U.S. DOJ Guidelines issued October 11, 1995, reprinted in 58 Crim. L. Rep. (BNA) 2007 (Nov. 1, 1995).
. A hard drive is the primary means of data storage on a personal computer. Its surface is divided into concentric circles that are further divided into sectors. A group of sectors is called a cluster. A cluster is the minimum amount of space a file can occupy, regardless of the size of the file. The computer’s operating system assigns a number to each cluster and keeps track of which clusters a file occupies. Occupied clusters are called "allocated.” Clusters that are available for use (even if they contain data from previous files) are unallocated or free.
. A file is made up of a whole number of clusters that are not necessarily contiguous. When a computer user creates a file to be saved, the computer’s "file allocation table” ("FAT”) assigns or allocates a cluster or clusters to store that file. The clusters are not necessarily contiguous because the FAT assigns data to whatever available clusters it finds on the hard drive. Saved files that occupy allocated clusters are called "active files.”
The FAT is similar to a road map or a table of contents. The computer’s operating system uses the FAT to track the specific cluster or clusters that are allocated to each active file and the clusters that are free, or available for storage of new data. When a document or data is stored in an active file, the FAT assigns a number to each cluster that is allocated to that document or file. When the user opens that document or file, the FAT tells the operating system the numbers of the clusters that contain, or store the document or file and gathers the clusters into one contiguous file that the user can open.
. "Unallocated” or "free space" is comprised of clusters that are available for storage of active files. Free space may contain remnants of, or entire files that were previously deleted.
. "Slack space” is the unused space at the logical end of an active file’s data and the physical end of the cluster or clusters that are assigned to an active file.
Deleted data, or remnants of deleted data can be found in the slack space at the end of an active file and may consist of relatively small, non-contiguous and unrelated fragments that may have come from any number of previously deleted files. A normal computer user does not see slack space when he opens an active file. Forensic tools are required to extract and view slack space.
. "Deleted files” are part of the free space. When a user deletes a file, the data in the file is not erased, but remains intact in the cluster or clusters where it was stored until the operating system places other data over it. When a file is deleted, the computer's operating system tells the FAT to release the clusters that were assigned to it so that the clusters can be used to store new files and data. To indicate that a file has been deleted, the operating system alters the first character of the file’s name in the directory structure.
The data in a deleted file remains in a cluster's slack space until it is overwritten by new data. Unless there is sufficient data in a new document or file to overwrite all of the deleted data in the cluster, the cluster will contain remnants of formerly deleted data in the cluster's "slack space” — the space between the end of the new data and the end of the cluster. When all the clusters of a deleted file remain unused by the computer's operating system, it is possible to recover the deleted file in its entirety. Portions of deleted files may be recovered even if portions of the clusters the file occupied are being used by new files.
. A hard drive is divided into several logical drives, i.e., C:*, D:*, E:*. These drives are further divided into directories. The directories contain the user’s files and folders. A directory listing contains the name, size, modification time and starting cluster of each of its files or subdirecto-ries. The term directory structure means a list or inventory of files on the hard drive.
. "Link files” are directory entries that contain binary information such as the path or route to the named file or document as well as the file’s creation time and date, the date and time the file was last accessed, the date and time the file was last written to or modified, and the size of the file. The text of a link file is in ASCII characters. By clicking on a link, the user can usually open the named file.
. An "image file” refers to the format of any file that contains basically a picture of data or text such as a fax or a scanned document. An image file is not susceptible to a keyword search and cannot be written to, but with certain software, it can be viewed and printed.
. Internet cache files hold the contents of web sites that the computer has visited. These files are usually saved with a ".jpeg” or ".jpg” extension to the file name. They can contain images as well as text. They are not susceptible to keyword searches.
. Specifically, SA Rovelli seized the following data: data from active files, deleted files, free space and slack space that was provided in hard copy to the defendants’ counsel on May 24, 2000; data on the May 11, 2000, CD that was provided to the defendants’ counsel, including the active and deleted files that were also provided in hard copy, four .pst files, one .pab file and all link files; all directory structures, software programs including Destroy-it, Microsoft Word, Microsoft Outlook, Clean Sweep, user configurations and registration in the operating system.
. Destroy-it is a program that is used to permanently delete or overwrite files and the data associated with them, including directory data. It can also be used to “wipe” free and slack space and files in the recycle bin.
. Microsoft Outlook is a personal information management and communications software program that assists users with e-mail and schedules. The proprietary nature of the file prevents examination of individual entries, such as journal entries, and the use of keywords for searched. Thus an examiner must process the entire file and convert it to a format that can be processed, when a user creates messages, appointments, tasks and journal entries, the program saves the information in binary format in data files called personal folders with a ".pst” file extension. A .pab file extension is used to indicate a Microsoft Outlook personal address book.
. A “csdrvmap.dat” file is created when a software program called Clean Sweep is run on a computer. Clean Sweep is a software utility that cleans unwanted programs and duplicate files from a hard drive and monitors system changes such as the addition and deletion of programs. The csrdvmap.dat file contains information about the files and data on the system. It is basically a picture of the hard drive, including the programs and files that it contained at the time the program was run, and other information such as the date each document was last written to, modified or accessed.
. For instance, the defendants calculate the percentage of files in the free and slack space seized outside the warrant by counting each page as a separate file. An entirely different percentage can be calculated if all related clusters are counted as a separate file. The defendants also base their percentage calculations on the total amount of data that SA Rovelli copied to the CDs. However, as previously noted, the fact that SA Rovelli copied data onto CDs which were labeled “seized files” did not signify that all such files had been seized.
. As the Second Circuit noted in United States v. Liu, where the court concludes that the first prong of the applicable test — a widespread seizure of items not within the scope of the warrant — has not been satisfied, there is no need to determine whether the agent acted in objective or subjective good faith. See 239 F.3d at 142. Nonetheless, there is no evidence that SA Rovelli acted in either objective or subjective bad faith.
