|
|
Monday, November 12, 2012
By Michael Nichols
Categories: Josh Covert
A United States District Court in the Central District of Illinois recently released an opinion that has far reaching fourth amendment applications. The case US v Schlingloff, involved a computer search conducted using a program called Forensic Tool Kit (FTK). At issue was the Known File Filter (KFF) which was a component of the FTK that enabled forensic analysts to search a computer and automatically flag certain computer files that match files contained in library of files known to be indicative of criminal acts.
Christopher Schlingloff, the Defendant, was a resident of a home that was subject to a search warrant which was obtained for the purpose of discovering evidence of passport fraud and harboring an illegal alien. The affidavit supporting the search warrant provided probable cause that computer devices at the residence would contain evidence of the passport fraud. The search warrant was executed and 130 electronic devices were seized by the law enforcement officers who executed the search warrant.
Of the 130 electronic devices seized, 2 of them belonged to Mr. Schlingloff. Mr. Schlingloff’s computers were searched using the FTK and its KFF component. The forensic scientist who conducted the search used the KFF to search the computer’s files for any files that matched those in the library of files known to be indicative of criminal activity despite the fact that the search warrant only covered those files that pertained to passport fraud. The KFF was apparently set up through the FTK and the search could have been customized to discover only those items that were relevant to the purposes of a search warrant. The forensic analyst who conducted the search did not customize the KFF component and instead allowed the KFF to discover any files that were indicative of criminal activity.
Once the KFF search was completed, 2 computer files were brought to the analyst’s attention. The files were apparently a match to computer files depicting child pornography. Rather than stop the search and obtain a new search warrant that would have covered the child pornography the analyst opened the files to confirm his suspicion. According to the US District Court, this is where the analyst went beyond the scope of the search warrant and unconstitutionally searched the defendant’s computer files. As a result of the unlawful search, the US District Court suppressed the pornography found on the Defendant’s computer.
This opinion is important for a few reasons. First it reaffirms the requirement that search warrants must be issued “with sufficient particularity to prevent a general exploratory rummaging through one’s belongings.” United States v Mann, 592 F3d 779, 782 (7th Cir 2010), citing Marron v United States, 275 US 192, 196 (1927). Secondly, the Court held that “there is normally no fear of degradation or dissipation of evidence of a rapidly evolving situation requiring the need to ‘shoot from the hip’ in examining seized computer files without proper warrant. US v Schlingloff, citing US v Seiver, 692 F3d 774, 777 (7th Cir 2012). Third, the Court ruled that the plain view doctrine does not apply when using file filters such as the KFF. This was because the file filter is not an inadvertent search as is required by the plain view doctrine. Lastly, the court ruled that the rule of inevitable discovery does not apply because the analyst would have had too search each and every computer file to discover the pornography if he had not used the KFF. Because of this the pornography would not have been inevitably discovered because as the analyst testified that he did not have the time or resources to search each and every computer file. “It is important to remember that the Michigan State Police and other law enforcement officials are required to state with particularity which items they intend to search for and if the law enforcement officers step outside the scope of the warrant, the evidence seized as a result should be suppressed” says attorney Joshua M. Covert of the Nichols Law Firm.
If you are facing criminal charges that are a result of evidence found during a computer search, call the Nichols Law firm and speak with an attorney who strongly believes in making the government prove that the searches they conduct are constitutionally valid. Call (517) 432-9000.
Thanks to Larry Dalman for alerting the Nichols Law Firm to this important case.
More on this case can be found at Cybercrimereview.com: http://www.cybercrimereview.com/2012/11/federal-court-holds-police-exceed-scope.html?m=1
And the opinion can be found at: http://www.ilcd.uscourts.gov/sites/ilcd/files/opinions/11-40073_schlingloff.pdf