United States v. Hill

FOR PUBLICATION

UNITED STATES COURT OF APPEALS

FOR THE NINTH CIRCUIT

UNITED STATES OF AMERICA,  No. 05-50219

Plaintiff-Appellee, D.C. No.

v.  CR-02-01289-AK-

JUSTIN BARRETT HILL, 01

Defendant-Appellant.

 OPINION

Appeal from the United States District Court

for the Central District of California

Alex Kozinski, Circuit Judge, Presiding

Argued and Submitted

January 12, 2006—Pasadena, California

Filed August 11, 2006

Before: Mary M. Schroeder, Chief Judge, Alfred T. Goodwin

and Raymond C. Fisher, Circuit Judges.

Opinion by Judge Fisher

9373

9376 UNITED STATES v. HILL

COUNSEL

Carlton F. Gunn, Deputy Federal Public Defender, Los Ange-

les, California, for the defendant-appellant.

Michael R. Wilner (argued) and Thomas P. O’Brien, Assis-

tant United States Attorneys, and Los Angeles, California, for

the plaintiff-appellee.

UNITED STATES v. HILL 9377

OPINION

FISHER, Circuit Judge:

Justin Hill conditionally pled guilty to possession of child

pornography subject to his challenge to the admission of evi-

dence that he contends was seized in violation of the Fourth

Amendment. His appeal involves the validity of a warrant to

search his computer and storage media for evidence that he

possessed pornographic (i.e., lascivious) images of children.

We must also decide whether it was reasonable under the

Fourth Amendment for the police to take all of Hill’s com-

puter storage media from his home (they did not find his com-

puter) so they could conduct their search offsite in a police

laboratory, rather than carrying out the search onsite and tak-

ing only whatever evidence of child pornography they might

find. As we recently discussed in United States v. Adjani,

____ F.3d ____, 2006 WL 1889946 (9th Cir. July 11, 2006),

because computers typically contain so much information

beyond the scope of the criminal investigation, computer-

related searches can raise difficult Fourth Amendment issues

different from those encountered when searching paper files.

Judge Kozinski, sitting as the district court in this case,

thoughtfully addressed some of these issues in a published

opinion upholding the validity of the search warrant and its

execution. United States v. Hill, 322 F. Supp. 2d 1081, 1092

(C.D. Cal. 2004). We affirm the district court’s ruling in most

but not all respects for the reasons Judge Kozinski stated; to

the extent we do agree with that reasoning, we adopt it verba-

tim in this opinion. In sum, we affirm the district court’s

denial of the defendant’s motion to suppress evidence.

I. Background

As the district court explained:

A computer technician was repairing defendant’s

computer when she discovered what she believed to

9378 UNITED STATES v. HILL

be child pornography. She called Long Beach police,

and the detective who took the call obtained a search

warrant from a judge of the Long Beach Superior

Court. The warrant authorized a search of the com-

puter repair store and seizure of the computer, any

work orders relating to the computer, “all storage

media belonging to either the computer or the indi-

vidual identifying himself as defendant at the loca-

tion,” and “all sexually explicit images depicting

minors contained in the storage media.” By the time

the detective arrived at the store to execute the war-

rant, defendant had picked up his computer. . . .

[T]he detective [submitted an affidavit, which

included the computer technician’s sworn statement

describing the images. On the basis of this affidavit,

the officer obtained] a second warrant, this one

directed at defendant’s home, authorizing seizure of

the same items.

The affidavit on which the warrants were based

described “two images of child pornography”:

Image 1

Is a color picture of a female, white, approximately

15 years old, with long dark brown hair. The female

is in a room standing between a couch and a coffee

table. There is a framed picture on the wall above the

couch. She is wearing only a long blouse and pair of

socks. The blouse is open and she is exposing her

breast and pubic area to the camera, which she is

facing while leaning to her left.

Image 2

Is a color picture of a [sic in affidavit] two females,

white, approximately 7-9 years of age, both with

dirty blond hair. These females are standing on a

UNITED STATES v. HILL 9379

beach during the daytime. The shorter of the two

females is standing to the right of the picture while

the other female is standing behind her. Both

females are facing the camera askew and wearing

only a robe, which is open exposing the undeveloped

breast and pubic area of both girls. They both are

turning their faces away from the camera preventing

the viewer from seeing their faces.

Officers executed the search warrant but did not find

the computer in defendant’s apartment.1 In what

appeared to be defendant’s bedroom, they found and

seized computer storage media[, specifically: 22

5.25-inch floppy disks, two CD-ROMs, 124 3.5-inch

floppy disks and six zip disks.] [Two of the zip

disks] were eventually determined to contain images

of child pornography; [officers] also seized other

evidence consistent with the warrant. Defendant was

subsequently charged with one count of possession

of child pornography,2 in violation of 18 U.S.C.

1

Or anywhere else: The computer was never found.

2

18 U.S.C. § 2256(8) defines “child pornography” as

any visual depiction, including any photograph, film, video, pic-

ture, or computer or computer-generated image or picture,

whether made or produced by electronic, mechanical, or other

means, of sexually explicit conduct, where —

(A) the production of such visual depiction involves the use

of a minor engaging in sexually explicit conduct;

(B) such visual depiction is a digital image, computer image,

or computer-generated image that is, or is indistinguishable

from, that of a minor engaging in sexually explicit conduct;

or

(C) such visual depiction has been created, adapted, or modi-

fied to appear that an identifiable minor is engaging in sexu-

ally explicit conduct.

Section 2256(2)(B)(iii) defines “sexually explicit conduct” as

“graphic or simulated lascivious exhibition of the genitals or

pubic area of any person.” Thus, the lascivious exhibition of the

genitals or pubic area of a minor constitutes child pornography.

A portion of section 2256(8) that is irrelevant to the issues raised

in these motions was held unconstitutional in Ashcroft v. Free

Speech Coalition. See 535 U.S. 234 (2002).

9380 UNITED STATES v. HILL

§ 2252A(a)(5)(B).3

Hill, 322 F. Supp. 2d at 1083-84 (alterations in original).

In the district court, the defendant moved to suppress the

evidence recovered from the two zip disks on the grounds

that, (1) contrary to the magistrate’s finding, the warrant affi-

davit did not establish probable cause to believe the defendant

was guilty of criminal activity; and (2) the warrant was over-

broad in allowing seizure of all discovered computer storage

media with no regard to whether such media contained child

pornography, and in placing no limitation on the police offi-

cers’ search of the seized disks. Id. at 1084.4 The district court

denied the motion to suppress and the defendant conditionally

pled guilty to the charge, reserving the right to appeal the dis-

trict court’s evidentiary ruling.5 This timely appeal followed.

3

Section 2252A(a)(5)(B) prohibits:

knowingly possessing any book, magazine, periodical, film, vid-

eotape, computer disk, or any other material that contains an

image of child pornography that has been mailed, or shipped or

transported in interstate or foreign commerce by any means,

including by computer, or that was produced using materials that

have been mailed, or shipped or transported in interstate or for-

eign commerce by any means, including by computer.

4

The defendant did not challenge the warrant affidavit on the ground

that it included only a written description of the images and not the images

themselves. Cf. United States v. Battershell, ___ F.3d ___, ___, slip op.

at 9271 (9th Cir. Aug. 10, 2006) (“It would have been preferable if the

affiant in this case had included copies of the photographs [to which the

affiant had access] in the warrant application. But failing to include a pho-

tograph in a warrant application is not fatal to establishing probable cause.

(citing United States v. Smith, 795 F.2d 841, 847 (9th Cir. 1986))).

5

In the district court, the defendant also argued that in order to prepare

a defense his counsel and his expert were entitled to “mirror image” copies

of the computer media the government seized. The district court agreed

and ordered the government to provide defendant with copies. Hill, 322

F. Supp. 2d at 1091-92. That ruling is not contested here.

UNITED STATES v. HILL 9381

II. Standard of Review

We review de novo the district court’s denial of a motion

to suppress evidence. United States v. Meek, 366 F.3d 705,

711 (9th Cir. 2004). We review for clear error a magistrate’s

finding of probable cause to issue a search warrant and give

“great deference” to such a finding. United States v. Hay, 231

F.3d 630, 634 n.4 (9th Cir. 2000).

III. Discussion

A. Probable Cause

The defendant argues first that the affidavit submitted in

support of the search warrant was insufficient to establish

probable cause to believe the defendant was guilty of criminal

activity. We do not agree.

[1] “[N]o Warrants shall issue, but upon probable cause,

supported by Oath or affirmation, and particularly describing

the place to be searched, and the persons or things to be

seized.” U.S. Const. amend. IV. The Constitution is clear; a

magistrate may authorize a search of a location only if offi-

cers establish probable cause to believe evidence of a crime

may be found there. Probable cause means only a “fair proba-

bility,” not certainty, and requires consideration of the totality

of the circumstances. Illinois v. Gates, 462 U.S. 213, 238

(1983). Accordingly, we must determine whether the officer’s

affidavit, which described the two images from the defen-

dant’s computer as showing three different, minor girls with

their breasts and pubic areas exposed, established a fair proba-

bility that there was child pornography or evidence thereof to

be found in computer hardware or software at the defendant’s

home. We agree with the district court that the affidavit did

establish probable cause, but reach that conclusion somewhat

differently.

9382 UNITED STATES v. HILL

[2] Child pornography is a particularly repulsive crime, but

not all images of nude children are pornographic. For exam-

ple, “a family snapshot of a nude child bathing presumably

would not” be criminal. Hill, 322 F. Supp. 2d at 1086. More-

over, the law recognizes that some images of nudity may

merit First Amendment protection because they serve artistic

or other purposes, and possessing those images cannot be

criminal. See Osborne v. Ohio, 495 U.S. 103, 112-13 (1990)

(upholding Ohio’s child pornography law because it had been

interpreted to criminalize possession of images depicting not

just nudity, but “nudity constitut[ing] a lewd exhibition”);

New York v. Ferber, 458 U.S. 747, 765 n.18 (1982)

(“[N]udity, without more[,] is protected expression.”). Images

depicting “minor[s] engag[ed] in sexually explicit conduct”

are, however, prohibited. 18 U.S.C. § 2256(8)(A). “[S]exually

explicit conduct,” in turn, is defined to include “graphic or

simulated lascivious exhibition of the genitals or pubic area of

any person.” 18 U.S.C. § 2256(2)(A)(v) (emphasis added).

Thus the more precise question we must answer is whether

the officer’s affidavit established probable cause that the

images on the defendant’s computer were — as described —

lascivious.6 See Hill, 322 F. Supp. 2d at 1084. In answering

that question, it is important to remember that in issuing the

search warrant, the magistrate had to make a practical, com-

monsense decision, based on the totality of the circumstances

6

We stress that in this case the state court judge who issued the warrant

made his determination based upon a written description of the images.

The officer presenting that description of the images had a duty, of course,

to do so in good faith, providing all relevant information to the magistrate.

See United States v. Mendonsa, 989 F.2d 366, 369 (9th Cir. 1993)

(“Suppression remains an appropriate remedy, however, when a magis-

trate is misled by information in the affidavit, which the affiant knows, or

should know, is false.”); see also Baldwin v. Placer County, 405 F.3d 778,

782 (9th Cir.), amended by 418 F.3d 966 (9th Cir. 2005) (refusing to grant

an officer qualified immunity because “[t]he plaintiffs’ established civil

rights were violated by presentation of [a] false affidavit”). If the magis-

trate had been able to view the two images for himself, his analysis and

our subsequent review might be different.

UNITED STATES v. HILL 9383

presented to him in the affidavit, that there was a “fair proba-

bility” that the images were lascivious. See United States v.

Gourde, 440 F.3d 1065, 1069 (9th Cir. 2006) (en banc).7

[3] Various courts have attempted to articulate a test for

determining lasciviousness. Many have relied upon a six-

factor test originated in United States v. Dost:

(1) whether the focal point of the visual depiction

is on the child’s genitalia or pubic area;

(2) whether the setting of the visual depiction is

sexually suggestive, i.e., in a place or pose generally

associated with sexual activity;

(3) whether the child is depicted in an unnatural

pose, or in inappropriate attire, considering the age

of the child;

(4) whether the child is fully or partially clothed,

or nude;

(5) whether the visual depiction suggests sexual

coyness or a willingness to engage in sexual activity;

(6) whether the visual depiction is intended or

designed to elicit a sexual response in the viewer.

7

The defendant challenges only whether there was probable cause to

believe the images described were lascivious, i.e., whether there was a fair

probability that the defendant possessed evidence of a crime (child por-

nography). Assuming he loses the lasciviousness argument, he does not

argue there was no probable cause to believe that such evidence could be

found on his computer (or storage media). Cf. Gourde, 440 F.3d at 1069

(“We conclude that the affidavit contained sufficient facts to support the

magistrate judge’s finding that there was a ‘fair probability’ that Gourde’s

computer contained evidence that he violated 18 U.S.C. §§ 2252 or

2252A.” (emphasis added)).

9384 UNITED STATES v. HILL

636 F.Supp. 828, 832 (S.D. Cal. 1986), aff’d sub nom. United

States v. Wiegand, 812 F.2d 1239 (9th Cir. 1987); see also

United States v. Brunette, 256 F.3d 14, 18 (1st Cir. 2001)

(adopting and applying Dost factors); United States v. Villard,

885 F.2d 117, 122 (3d Cir. 1989) (same).

The district court, analyzing each of these six factors, found

Dost to be “not particularly helpful” in determining whether

a given image is lascivious — generally or as applied to the

images here. See Hill, 322 F.Supp.2d at 1086. Instead, the

court fashioned a new test that would create a presumption of

lasciviousness, and therefore probable cause, “[i]f an image of

a minor displays the minor’s naked genital area . . . [,] unless

there are strong indicators that [the image] is not lascivious.”8

Id. at 1086-87. Although we appreciate the district court’s

careful analysis and critique of Dost, we do not think it neces-

sary to adopt a new test or to deny the utility of Dost in the

context of this case.

[4] The Dost factors can be a starting point for judges to

use in determining whether a particular image is likely “so

presented by the photographer as to arouse or satisfy the sex-

ual cravings of a voyeur.” Wiegand, 812 F.2d at 1244. But the

factors are neither exclusive nor conclusive. Dost itself

acknowledged that it did not seek to offer “a comprehensive

definition of . . . lasciviousness,” because a determination of

8

The district court’s test might be an improvement over the Dost six-

factor inquiry, at least when the magistrate can see and evaluate the

images first hand. However, when (as here) the magistrate does not have

the images, the judge would have to determine whether “there are strong

indicators that [the image] is not lascivious” based on the information the

attesting officer (or, as in this case, a third-party witness) includes in the

description. It is not clear that officers would be as able to decide and

articulate what is relevant mitigating information (from the unrepresented

target’s viewpoint) as in making their affirmative showing of lascivious-

ness under existing doctrine. Cf. Hill, 322 F. Supp. 2d at 1085-86 (discuss-

ing the government’s and the defendant’s starkly differing views of the

images during the suppression hearing).

UNITED STATES v. HILL 9385

lasciviousness “ha[s] to be made based on the overall content

of the visual depiction.” 636 F. Supp. at 832. The factors are

merely “general principles as guides for analysis.” Id. For

instance, we have already recognized that, in some instances,

the factors may be “over generous” to defendants. Wiegand,

812 F.2d at 1244; see also United States v. Amirault, 173 F.3d

28, 32 (1st Cir. 1999) (“We believe that the Dost factors are

generally relevant and provide some guidance in evaluating

whether the display in question is lascivious. We emphasize,

however, that these factors are neither comprehensive nor

necessarily applicable in every situation. Although Dost pro-

vides some specific, workable criteria, there may be other fac-

tors that are equally if not more important in determining

whether a photograph contains a lascivious exhibition. The

inquiry will always be case-specific.”).

[5] Ultimately, probable cause is a fluid and nontechnical

conception not readily susceptible to multifactor tests or

rebuttable presumptions. See Maryland v. Pringle, 540 U.S.

366, 370-71 (2003) (“[T]he probable-cause standard is a . . .

nontechnical conception . . . . [and] a fluid concept — turning

on the assessment of probabilities in particular factual con-

texts — not readily, or even usefully, reduced to a neat set of

legal rules . . . . [It] is incapable of precise definition or quan-

tification . . . .” (internal quotation marks and citation omit-

ted).) The magistrate, relying on Dost as a guidepost or on

some other test for lasciviousness, need only make a “practi-

cal, common-sense decision” that the description presented in

the affidavit demonstrates a “fair probability” that the images

are lascivious. Gates, 462 U.S. at 238; see also Gourde, 440

F.3d at 1071; Wiegand, 812 F.2d at 1244 (“The definition of

‘lasciviousness’ is a matter of law . . . .”).

[6] Based on our independent review of the affidavit

describing the two images, we are satisfied that the state

judge’s finding of probable cause was well within his discre-

tion. There was a fair probability that the images were “so

presented by the photographer as to arouse or satisfy the sex-

9386 UNITED STATES v. HILL

ual cravings of a voyeur.” Wiegand, 812 F.3d at 1244; see

also id. (“Necessarily in deciding whether the district court

erred as to the facts [in determining that the images were las-

civious], we must view the pictures ourselves and must inter-

pret the statutory term.”). The affidavit described in some

detail the images of three partially nude children, who were

provocatively and unnaturally dressed in light of the photo-

graphs’ settings. The girls’ clothing was opened so as to

reveal their breasts and pubic areas, with the girls appearing

in sexually suggestive poses.9 Moreover the descriptions

themselves did not raise doubts that the images served some

purpose other than that proscribed in Wiegand.10 Cf. Batter-

shell, ___ F.3d at ___, slip op. at 9267 (holding that an affida-

vit describing “a young female (8-10 YOA) naked in a bath-

tub” is insufficient to establish probable cause to believe the

image is lascivious). The affidavit was sufficient to create “a

substantial basis for concluding that probable cause existed”

to believe that evidence of a violation of 18 U.S.C.

§ 2252A(a)(5)(B) could be found on the defendant’s com-

puter. See Gates, 462 U.S. at 238-39 (internal quotation marks

and alterations omitted).

B. Overbreadth

1. Seizure of All Computer Media

The defendant argues that the search warrant was over-

broad because it authorized the officers to seize and remove

from his home his computer and storage media without first

9

Although the defendant at trial might have been able to present evi-

dence supporting innocent explanations for the content of the pictures, that

does not negate the images’ prima facie appearance of lasciviousness —

which is the issue relevant to probable cause.

10

In contrast to the concerns we raised in footnote 8, supra, the defen-

dant does not argue that the affidavit’s description of the images was

incomplete in any way; nor does he claim that the attesting officer was

aware of but failed to disclose mitigating facts that would tend to show the

images were not lascivious.

UNITED STATES v. HILL 9387

determining whether they actually contained child pornogra-

phy. Given the nature of computers and storage media, this

argument sweeps too broadly, as the district court explained

in addressing the defendant’s suggested limitations on the

nature and scope of the search:

Search warrants must be specific. “Specificity has

two aspects: particularity and breadth. Particularity

is the requirement that the warrant must clearly state

what is sought. Breadth deals with the requirement

that the scope of the warrant be limited by the proba-

ble cause on which the warrant is based.” United

States v. Towne, 997 F.2d 537, 544 (9th Cir. 1993)

(internal quotation marks and citations omitted). A

warrant describing a category of items is not invalid

if a more specific description is impossible. United

States v. Spilotro, 800 F.2d 959, 963 (9th Cir. 1986).

The level of specificity required “varies depending

on the circumstances of the case and the type of

items involved.” Id.

The warrant here commanded the officers to search

for and seize: “1) An IBM ‘clone’ medium tower

personal computer . . . 3) All storage media belong-

ing to either item # 1 or the individual identifying

himself as defendant at the location. 4) All sexually

explicit images depicting minors contained in item #

3.” Defendant argues the warrant was overbroad

because it authorized seizure of storage media

whether or not they contained child pornography. He

suggests it should have authorized seizure only of

media containing child pornography. But it is impos-

sible to tell what a computer storage medium con-

tains just by looking at it. Rather, one has to examine

it electronically, using a computer that is running the

appropriate operating system, hardware and soft-

ware. The police had no assurance they would find

such a computer at the scene — nor did they, for that

9388 UNITED STATES v. HILL

matter — or that, if they found one, they could

bypass any security measures and operate it.

Defendant suggests that the police could have

brought their own laptop computer: Having probable

cause to seize only computer storage media that con-

tained certain types of files, the police should have

been required to bring with them the equipment nec-

essary to separate the sheep from the goats. Defen-

dant’s argument raises an important question about

how police must execute seizures pursuant to a war-

rant. Because seizable materials are seldom found

neatly separated from their non-seizable counter-

parts, how much separating must police do at the

scene to avoid taking items that are neither contra-

band nor evidence of criminal activity?

As always under the Fourth Amendment, the stan-

dard is reasonableness. To take an extreme example,

if police have probable cause to seize business

records, the warrant could not authorize seizure of

every piece of paper on the premises on the theory

that the police conducting the search might not know

how to read. . . .

[T]he court concludes that the police were not

required to bring with them equipment capable of

reading computer storage media and an officer com-

petent to operate it. Doing so would have posed sig-

nificant technical problems and made the search

more intrusive. To ensure that they could access any

electronic storage medium they might find at the

scene, police would have needed far more than an

ordinary laptop computer. Because computers in

common use run a variety of operating systems —

various versions or flavors of Windows, Mac OS and

Linux, to name only the most common — police

would have had to bring with them a computer (or

UNITED STATES v. HILL 9389

computers) equipped to read not only all of the

major media types, but also files encoded by all

major operating systems. Because operating systems,

media types, file systems and file types are continu-

ally evolving, police departments would frequently

have to modify their computers to keep them up-to-

date. This would not be an insuperable obstacle for

larger police departments and federal law enforce-

ment agencies, but it would pose a significant burden

on smaller agencies.

Even if the police were to bring with them a properly

equipped computer, and someone competent to oper-

ate it, using it would pose two significant problems.

First, there is a serious risk that the police might

damage the storage medium or compromise the

integrity of the evidence by attempting to access the

data at the scene. As everyone who has accidentally

erased a computer file knows, it is fairly easy to

make mistakes when operating computer equipment,

especially equipment one is not intimately familiar

with. The risk that the officer trying to read the sus-

pect’s storage medium on the police laptop will

make a wrong move and erase what is on the disk is

not trivial. Even if the officer executes his task flaw-

lessly, there might be a power failure or equipment

malfunction that could affect the contents of the

medium being searched. For that reason, experts will

make a back-up copy of the medium before they

start manipulating its contents. Various other techni-

cal problems might arise; without the necessary tools

and expertise to deal with them, any effort to read

computer files at the scene is fraught with difficulty

and risk.

Second, the process of searching the files at the

scene can take a long time. To be certain that the

medium in question does not contain any seizable

9390 UNITED STATES v. HILL

material, the officers would have to examine every

one of what may be thousands of files on a disk —

a process that could take many hours and perhaps

days. Taking that much time to conduct the search

would not only impose a significant and unjustified

burden on police resources, it would also make the

search more intrusive. Police would have to be pres-

ent on the suspect’s premises while the search was

in progress, and this would necessarily interfere with

the suspect’s access to his home or business. If the

search took hours or days, the intrusion would con-

tinue for that entire period, compromising the Fourth

Amendment value of making police searches as brief

and non-intrusive as possible.

Hill, 322 F. Supp. 2d at 1087-89 (alteration in original and

internal citation omitted).

[7] We agree with the district court that under the circum-

stances here, the warrant was not fatally defective in failing

to require an onsite search and isolation of child pornography

before removing storage media wholesale. That does not

mean, however, that the government has an automatic blank

check when seeking or executing warrants in computer-

related searches. Although computer technology may in the-

ory justify blanket seizures for the reasons discussed above,

the government must still demonstrate to the magistrate factu-

ally why such a broad search and seizure authority is reason-

able in the case at hand. There may well be situations where

the government has no basis for believing that a computer

search would involve the kind of technological problems that

would make an immediate onsite search and selective removal

of relevant evidence impracticable. Thus, there must be some

threshold showing before the government may “seize the hay-

stack to look for the needle.”

Our cases illustrate this principle. In United States v. Hay,

for example, we held permissible a “generic classification”

UNITED STATES v. HILL 9391

authorizing seizure of an “entire computer system and virtu-

ally every document in [the defendant’s] possession without

referencing child pornography or any particular offense con-

duct” because, although officers “knew that [a party] had sent

19 images [of child pornography] directly to [the defendant’s]

computer, [they] had no way of knowing where the images

were stored.” 231 F.3d 630, 637 (9th Cir. 2000). Similarly

United States v. Lacy allowed “blanket seizure” of the defen-

dant’s “entire computer system.” 119 F.3d 742, 746 (9th Cir.

1997). We reasoned that “no more specific description of the

computer equipment sought was possible,” because the agents

“did not know whether the images were stored on the hard

drive or on one or more of [the defendant’s] many computer

disks.” Id.; accord United States v. Upham, 168 F.3d 532, 535

(1st Cir. 1999) (holding, in a child pornography case, that “the

seizure and subsequent off-premises search of the computer

and all available disks was about the narrowest definable

search and seizure reasonably likely to obtain the images”).

Significantly, in both Hay and Lacy we carefully noted the

critical role played by the officers’ affidavits supporting the

warrants. See Hay, 231 F.3d at 637 (“[T]he affidavit

explained why it was necessary to seize the entire computer

system in order to examine the electronic data for contraband.

It also justified taking the entire system off site because of the

time, expertise, and controlled environment required for a

proper analysis.”); Lacy, 119 F.3d at 746-47 (“In the affidavit

supporting the search warrant application, a Customs agent

explained there was no way to specify what hardware and

software had to be seized to retrieve the images accurately.”).

[8] By contrast, although the warrant in this case authorized

a wholesale seizure, the supporting affidavit did not explain

why such a seizure was necessary. See United States v.

Adjani, ___ F.3d at ___ , 2006 WL 1889946 at *7 n.7 (noting

favorably an affidavit’s computer search and seizure protocol

explaining when a computer had to be searched offsite,

because “[s]uch specificity increases our confidence that the

magistrate judge was well aware of what he was authorizing

9392 UNITED STATES v. HILL

and that the agents knew the bounds of their authority in exe-

cuting the search”); U.S. Dep’t of Justice, Searching and Seiz-

ing Computers and Obtaining Electronic Evidence in

Criminal Investigations 43, 69 (July 2002) (recommending

that “if agents expect that they may need to seize a personal

computer and search it off-site to recover the relevant evi-

dence, the affidavit should explain this expectation and its

basis to the magistrate judge. The affidavit should inform the

court of the practical limitations of conducting an on-site

search, and should articulate the plan to remove the entire

computer from the site if it becomes necessary.”); cf. United

States v. Tamura, 694 F.2d 591, 596 (9th Cir. 1982) (“If the

need for transporting the documents is known to the officers

prior to the search, they may apply for specific authorization

for large-scale removal of material, which should be granted

by the magistrate issuing the warrant only where on site sort-

ing is infeasible and no other practical alternative exists.”).11

[9] We do not approve of issuing warrants authorizing

blanket removal of all computer storage media for later exam-

ination when there is no affidavit giving a reasonable explana-

tion, such as that provided in Hay and Lacy, as to why a

wholesale seizure is necessary.12 See Tamura, 694 F.2d at 595

(“[T]he wholesale seizure for later detailed examination of

records not described in a warrant is significantly more intru-

11

In retrospect, it is clear that not all the storage media needed to be

seized as evidence of criminal activity; of the 154 disks seized, only two

zip disks contained lascivious images of children. There is no evidence or

allegation that the officers knew of this result before they searched and

seized.

12

As the defendant pointed out during oral argument, the magistrate

must be made aware of what officers are contemplating and why they are

doing so. For some people, computer files are the exclusive means of man-

aging one’s life — such as maintaining a calendar of appointments or pay-

ing bills. Thus, there may be significant collateral consequences resulting

from a lengthy, indiscriminate seizure of all such files. As noted earlier,

however, in this case the district court granted the defendant the right to

“mirror copies” of the seized storage media. See supra n. 5.

UNITED STATES v. HILL 9393

sive, and has been characterized as ‘the kind of investigatory

dragnet that the fourth amendment was designed to prevent”

(quoting United States v. Abrams, 615 F.2d 541, 543 (1st Cir.

1980))). Without such individualized justification being pres-

ented to the magistrate, we cannot be sure that the judge was

aware of the officers’ intent and the technological limitations

meriting the indiscriminate seizure — and thus was intelli-

gently able to exercise the court’s oversight function. An

explanatory statement in the affidavit also assures us that the

officers could not reasonably describe the objects of their

search with more specificity. See United States v. Kow, 58

F.3d 423, 427 (9th Cir. 2005) (“Generic classifications in a

warrant are acceptable only when a more precise description

is not possible.” (internal quotation marks and citation omit-

ted)); see also Upham, 168 F.3d at 535 (“Of course, if the

[seized] images themselves could have been easily obtained

through an on-site inspection, there might have been no justi-

fication for allowing the seizure of all computer equipment,

a category potentially including equipment that contained no

images and had no connection to the crime.”). Accordingly,

we hold that the warrant here was overbroad in authorizing a

blanket seizure in the absence of an explanatory supporting

affidavit, which would have documented the informed

endorsement of the neutral magistrate. See Tamura, 694 F.2d

at 596 (“The essential safeguard required is that wholesale

removal must be monitored by the judgment of a neutral,

detached magistrate.”).13

[10] Nonetheless, as in Tamura, we conclude that suppres-

sion of the evidence of child pornography found on the defen-

dant’s seized zip disks is not an appropriate remedy. Tamura

involved an indiscriminate seizure of all files found in an

13

The district court found no violation because it assumed the state

judge must have known it was not technologically feasible to search

onsite, and therefore the affidavit did not need to so provide. See Hill, 322

F. Supp. 2d at 1090. We do not think the record is so clear, and our case

law requires more.

9394 UNITED STATES v. HILL

office even though the warrant authorized the officers to

search for only three categories of records for evidence of var-

ious alleged crimes. See id. at 594-95. Although we refused

to sanction the “wholesale seizure for later detailed examina-

tion of records not described in a warrant,” id. at 595, we held

that “the exclusionary rule does not require the suppression of

evidence within the scope of a warrant simply because other

items outside the scope of the warrant were unlawfully taken

as well,” id. at 597. See also id. (“Regardless of the illegality

of the Government’s seizure and retention of documents not

covered by the warrant, however, reversal is not compelled in

this case.”).

[11] Similarly, the pornographic images from the defen-

dant’s zip disks that he sought to exclude as evidence at trial

was “seized and retained lawfully because described in and

therefore taken pursuant to the valid search warrant.” Id. As

we have discussed above, the officers’ wholesale seizure was

flawed here because they failed to justify it to the magistrate,

not because they acted unreasonably or improperly in execut-

ing the warrant. Because the officers were “motivated by con-

siderations of practicality rather than by a desire to engage in

indiscriminate ‘fishing,’ we cannot say . . . that the officers so

abused the warrant’s authority that the otherwise valid war-

rant was transformed into a general one, thereby requiring all

fruits to be suppressed.” Id. See also Hudson v. Michigan, 547

U.S. ____, 126 S.Ct. 2159, 2163 (2006) (“Suppression of evi-

dence . . . has always been our last resort, not our first

impulse,”and is appropriate “only ‘where its remedial objec-

tives are thought most efficaciously served.’ ” (quoting

United States v. Calandra, 414 U.S. 338, 348 (1974)).

[12] Therefore, we hold that the district court properly

admitted the evidence of child pornography found on the

defendant’s computer storage media notwithstanding the lack

of a sufficiently detailed supporting affidavit describing the

need for wholesale seizure of such media.

UNITED STATES v. HILL 9395

2. Absence of Search Protocol

[13] The defendant also argues that the search warrant was

overbroad because it did not include a search protocol to limit

the officers’ discretion as to what they could examine when

searching the defendant’s computer media, nor did the affida-

vit explain why such a protocol was unnecessary. We, like the

district court, find no error in the search warrant on this

ground and adopt the district court’s analysis:

Defendant also argues that the warrant was over-

broad because it did not define a “search methodolo-

gy.” He claims that the search should have been

limited to certain files that are more likely to be

associated with child pornography, such as those

with a “.jpg” suffix (which usually identifies files

containing images) or those containing the word

“sex” or other key words.

Defendant’s proposed search methodology is unrea-

sonable. “Computer records are extremely suscepti-

ble to tampering, hiding, or destruction, whether

deliberate or inadvertent.” United States v. Hunter,

13 F. Supp. 2d 574, 583 (D. Vt. 1998). Images can

be hidden in all manner of files, even word process-

ing documents and spreadsheets. Criminals will do

all they can to conceal contraband, including the

simple expedient of changing the names and exten-

sions of files to disguise their content from the

casual observer.

Forcing police to limit their searches to files that the

suspect has labeled in a particular way would be

much like saying police may not seize a plastic bag

containing a powdery white substance if it is labeled

“flour” or “talcum powder.” There is no way to

know what is in a file without examining its con-

tents, just as there is no sure way of separating tal-

9396 UNITED STATES v. HILL

cum from cocaine except by testing it. The ease with

which child pornography images can be disguised —

whether by renaming sexyteenyboppersxxx.jpg as

sundayschoollesson.doc, or something more sophis-

ticated — forecloses defendant’s proposed search

methodology.

Hill, 322 F. Supp. 2d at 1090-1091; see also Adjani, ___ F.3d

at ___, 2006 WL 1889946 at *7 (rejecting defendants’ argu-

ment that officers should have looked at only specified areas

of certain email programs for enumerated keywords because

“[t]o require such a pinpointed computer search, restricting

the search to an email program or to specific search terms,

would likely have failed to cast a sufficiently wide net to cap-

ture the evidence sought”).

[14] Moreover, in contrast to our discussion of the over-

broad seizure claim above, there is no case law holding that

an officer must justify the lack of a search protocol in order

to support issuance of the warrant. As we have noted, we look

favorably upon the inclusion of a search protocol; but its

absence is not fatal. We have also held that even though a

warrant authorizing a computer search might not contain a

search protocol restricting the search to certain programs or

file names, the officer is always “limited by the longstanding

principle that a duly issued warrant, even one with a thorough

affidavit, may not be used to engage in a general, exploratory

search.” Id. The reasonableness of the officer’s acts both in

executing the warrant and in performing a subsequent search

of seized materials remains subject to judicial review. See

United States v. Rettig, 589 F.2d 418, 423 (9th Cir. 1978)

(“Where evidence is uncovered during a search pursuant to a

warrant, the threshold question must be whether the search

was confined to the warrant’s terms. . . . [T]he search must be

one directed in good faith toward the objects specified in the

warrant or for other means and instrumentalities by which the

UNITED STATES v. HILL 9397

crime charged had been committed. It must not be a general

exploratory search . . . .” (internal quotation marks omitted)).14

IV. Conclusion

We realize that judicial decisions regarding the application

of the Fourth Amendment to computer-related searches may

be of limited longevity. Technology is rapidly evolving and

the concept of what is reasonable for Fourth Amendment pur-

poses will likewise have to evolve. See Kyllo v. United States,

533 U.S. 27, 33-34 (2001) (“It would be foolish to contend

that the degree of privacy secured to citizens by the Fourth

Amendment has been entirely unaffected by the advance of

technology.”); cf. id. at 41, 51 (Stevens, J., dissenting)

(expressing concern with “the supposedly ‘bright-line rule’

the Court has created in response to its concerns about future

technological developments” as it “is unnecessary, unwise,

and inconsistent with the Fourth Amendment” and comment-

ing that “[i]t would be far wiser to give legislators an unim-

peded opportunity to grapple with these emerging issues [of

technology] rather than to shackle them with prematurely

devised constitutional constraints”). New technology may

become readily accessible, for example, to enable more effi-

cient or pinpointed searches of computer data, or to facilitate

onsite searches. If so, we may be called upon to reexamine the

14

As we noted in Adjani, ____ F.3d at ____, 2006 WL 1889946 at *9,

like the Tenth Circuit in United States v. Carey, 172 F.3d 1268 (10th Cir.

1999), we recognize that computer files are often intermingled and offi-

cers who have a warrant to seize evidence of a specific crime may come

across evidence that implicates the defendant in another crime. See also

United States v. Walser, 275 F.3d 981 (10th Cir. 2001). The proper steps

for the officer to take in such a situation — when dealing with computer

files — have not been clearly defined, and this case does not provide occa-

sion to do so. Cf. Tamura, 694 F.2d at 595-96 (“In the comparatively rare

instances where documents are so intermingled that they cannot feasibly

be sorted on site, we suggest that the Government and law enforcement

officials generally can avoid violating fourth amendment rights by sealing

and holding the documents pending approval by a magistrate of a further

search . . . .”).

9398 UNITED STATES v. HILL

technological rationales that underpin our Fourth Amendment

jurisprudence in this technology-sensitive area of the law.

That said, for the reasons set forth in this opinion, the

search here was supported by probable cause and, notwith-

standing the shortcomings of the search warrant affidavit, the

manner of its execution does not mandate suppression of the

fruits of that search. The district court’s denial of the defen-

dant’s motion to suppress is therefore AFFIRMED.