10-50403

UNITED STATES COURT OF APPEALS

FOR THE NINTH CIRCUIT

UNITED STATES OF AMERICA,

Plaintiff-Appellee,

vs.

DAVID GRUMMER

Defendant-Appellant.

Appeal from the United States District Courtfor the Southern District of California

Dana M. Sabraw, District Judge, Presiding

APPELLANT’S OPENING BRIEF

DAVID J. ZUGMAN GABRIEL L. COHANAttorney at Law Attorney at Law964 5th Ave. Suite 300 444 West C Street, #444San Diego, CA 92101 San Diego, CA 92101Telephone: (619) 699-5931 Telephone: (619) 236-0244Facsimile: (619) 699-5932 Facsimile: (619) 768-0333

Counsel for Mr. Grummer

UNITED STATES COURT OF APPEALS

FOR THE NINTH CIRCUIT

UNITED STATES OF AMERICA, ) No. 10-50403)

Plaintiff-Appellee, ) D.C. No. CR-08-4402-DMS)

v. ))

DAVID GRUMMER ) Southern District) of California,

Defendant-Appellant. ) San Diego)

)

QUESTIONS PRESENTED FOR REVIEW

1. Was the search of Mr. Grummer’s computersunreasonable because it occurred outside thewarrant’s 90-day limit and after Mr. Grummer hadpled guilty with a cooperation plea agreement?

2. Did Agent Adkison’s June 9, 2008, searchpurportedly based on the January 16, 2008,warrant violate the Fourth Amendment becauseAdkison intentionally ignored the warrant whilehe searched and the search went beyond the scopeof the warrant, requiring suppression?

3. Did Agent Gorman’s Search Warrant Applicationand Affidavit violate the Fourth Amendment byauthorizing a search of personal records forwhich there was no probable cause to search?

4. Does double jeopardy preclude Mr. Grummer’sconviction for both possession and receipt ofthe child pornography where neither theindictment, jury instruction, nor verdict formtold the jury that the possession and receipthad to be premised on distinct conduct?

TABLE OF CONTENTS

QUESTIONS PRESENTED FOR REVIEW. . . . . . . . . prefix

TABLE OF AUTHORITIES. . . . . . . . . . . . . . . . . v

I. STATEMENT OF JURISDICTION. . . . . . . . . . 6

A. DISTRICT COURT JURISDICTION. . . . . . . 6B. THE JUDGMENT IS FINAL. . . . . . . . . . 7C. COURT OF APPEALS JURISDICTION. . . . . . 7D. THE APPEAL IS TIMELY.. . . . . . . . . . 7

II. BAIL STATUS. . . . . . . . . . . . . . . . . 7

III. STATEMENT OF THE ISSUES. . . . . . . . . . . 8

A. THE WARRANT HAD EXPIRED AT THE TIME OF THESEARCH.. . . . . . . . . . . . . . . . . 9

B. THE SEARCH PARAMETER OF “THE AGENT CANLOOK AT EVERYTHING” IS NECESSARILY OVER-BROAD AND INVALID UNDER THE FOURTHAMENDMENT... . . . . . . . . . . . . . 11

C. IF THE WARRANT ALLOWED AN ALL-RECORDSSEARCH, IT WAS OVER-BROAD IN VIOLATIONOF THE FOURTH AMENDMENT AND GOOD-FAITHDOES NOT APPLY.. . . . . . . . . . . . 13

D. POSSESSION IS A LESSER INCLUDED OFFENSEOF RECEIPT OF CHILD PORNOGRAPHY. . . . 14

IV. STATEMENT OF THE CASE. . . . . . . . . . . 15

A. THE EPA CASE: SOURCE OF THE CHILDPORNOGRAPHY CHARGES. . . . . . . . . . 15

B. THE CHILD PORNOGRAPHY CHARGES. . . . . 18C. MOTION TO SUPPRESS EVIDENCE .. . . . . 18

1. Motions and Responses. . . . . . . 182. The Disputed Warrant. . . . . . . 23

a. The Application. . . . . . . . 23b. The Computer Search Protocol At ¶59

. . . . . . . . . . . . . . . 25c. The Agent’s Testimony

. . . . . . . . . . . . . . . 29

d. The District Court’s Findings. 35

D. TRIAL AND SENTENCING.. . . . . . . . . 36

V. SUMMARY OF ARGUMENTS. . . . . . . . . . . . 37

VI. STANDARD OF REVIEW. . . . . . . . . . . . . 39

VII. ARGUMENTS. . . . . . . . . . . . . . . . . 40A. THE WARRANT WAS MORE THAN A MONTH

EXPIRED AT THE TIME OF THE SEARCH. . . 42B. LOOKING THROUGH THE FILES TO SEE WHICH ONES

ARE RELEVANT IS NOT “CULLING”, IT ISSEARCHING AND IT VIOLATES THE SCOPE OF THESEARCH.. . . . . . . . . . . . . . . . 451. Attachment B. . . . . . . . . . . 482. Computer Search Protocol: ¶59 Of The

Affidavit. . . . . . . . . . . . . 51C. GOOD-FAITH DOES NOT APPLY. . . . . . . 64D. THE WARRANT WAS OVER-BROAD.. . . . . . 66E. MR. GRUMMER’S CONVICTION FOR BOTH THE

POSSESSION AND RECEIPT OF CHILDPORNOGRAPHY VIOLATED DOUBLE JEOPARDY.. 74

VIII. CONCLUSION. . . . . . . . . . . . . . . . . 78

APPENDIX OF STATUTES. . . . . . . . . . . . . . . . 79

CERTIFICATE OF RELATED CASES. . . . . . . . . . . . 86

Certificate of Compliance Pursuant to Fed. R. App.32(a)(7)(c)and Circuit Rule 32-1 for Case Number 10-50403.. . . . . . . . . . . . . . . . . . . . . . . . . . 87

PROOF OF SERVICE. . . . . . . . . . . . . . . . . . 89

iv

TABLE OF AUTHORITIES

SUPREME COURT CASES

Arizona v. Hicks, 480 U.S. 321 (1987).. . . . . . . 54

Blockburger v. United States, 284 U.S. 299 (1932).. 14

Coolidge v. New Hampshire, 403 U.S. 443 (1971). . . 73

Herring v. United States, 555 U.S. 135 (2009).. 65, 66

Tennessee Valley Authority v. Hill, 437 U.S. 153 (1978).. . . . . . . . . . . . . . . . . . . . . . . . . . 56

United States v. Grubbs, 547 U.S. 90 (2006).. . . . 46

United States v. Leon, 468 U.S. 897 (1984). . . . . 65

CONSTITUTIONAL PROVISIONS

Amend. IV.. . . ii, 11, 13, 41, 43, 46, 56, 65, 72, 74

FEDERAL CASES

Berman v. United States, 302 U.S. 211 (1937). . . . . 7

Garcia-Aguilar v. U.S. Dist. Ct. for S. Dist. of Cal.,535 F.3d 1021 (9th Cir. 2008).. . . . . . . . . . . 31

United States v. Abrams, 615 F.2d 541 (1st Cir. 1980).. . . . . . . . . . . . . . . . . . . . . . . . . 9, 41

United States v. Adjani, 452 F.3d 1140 (9th Cir. 2006).. . . . . . . . . . . . . . . . . . . . . . . . . . 41

United States v. Carey, 172 F.3d 1268 (10th Cir. 1999).. . . . . . . . . . . . . . . . . . . . . . 67, 72, 73

United States v. Comprehensive Drug Testing, Inc. 621F.3d 1162 (9th Cir. 2010) (en banc).. . . . . . . . . .

v

.. . . . . . . . . . . 11, 12, 14, 39, 55-57, 65, 69, 70

United States v. Davenport, 519 F.3d 940 (9th Cir. 2008).. . . . . . . . . . . . . . . . . . . . 14, 39, 75, 76

United States v. Foster, 100 F.3d 846 (10th Cir. 1996).. . . . . . . . . . . . . . . . . . . . . . . . . . 72

United States v. Furrow, 229 F.3d 805 (9th Cir. 2000)overruled on other grounds by United States v. Johnson,256 F.3d 895 (9th Cir. 2001) (en banc). . . . . . . 10

United States v. Giberson, 527 F.3d 882 (9th Cir. 2008).. . . . . . . . . . . . . . . . . . 11, 39, 67, 68, 76

United States v. Hernandez-Guardado, 228 F.3d 1017 (9thCir. 2000). . . . . . . . . . . . . . . . . . . . . 40

United States v. Hill, 459 F.3d 966 (9th Cir. 2006).. . . . . . . . . . . . . . . . . . . . . . . . . . 42

United States v. Hitchcock, 2002 U.S. App. LEXIS 15726(9th Cir. 2002).. . . . . . . . . . . . . . . . . 9, 43

United States v. Krupa, 633 F.3d 1148 (9th Cir. 2011).. . . . . . . . . . . . . . . . . . . . . . . . . . 39

United States v. Lynn, 2011 U.S. App. LEXIS 11254 (9thCir. 2011).. . . . . . . . . . . . . . . . . . 15, 77

United States v. Payton, 573 F.3d 859 (9th Cir. 2009).. . . . . . . . . . . . . . . . . . . . . . . . 19, 37

United States v. Rettig, 589 F.2d 418 (9th Cir. 1978).. . . . . . . . . . . . . . . . . . . . . . . . . . 42

United States v. Rude, 88 F.3d 1538 (9th Cir. 1996).. . . . . . . . . . . . . . . . . . . . . . . . . . 10

United States v. Schales, 546 F.3d 965 (9th Cir. 2008).. . . . . . . . . . . . . . . . . . . . . . . 15, 75-77

vi

United States v. Stanert, 762 F.2d 775 (9th Cir. 1985).. . . . . . . . . . . . . . . . . . . . . . . . . . 10

United States v. Stanert, 762 F.2d 775 (9th Cir. 1985).. . . . . . . . . . . . . . . . . . . . . . . . . . 64

United States v. Summers, 268 F.3d 683 (9th Cir. 2001).. . . . . . . . . . . . . . . . . . . . . . . . . . 40

United States v. Syphers, 426 F.3d 461 (1st Cir. 2005).. . . . . . . . . . . . . . . . . . . . . . . . . . 44

United States v. Tamura, 694 F.2d 591 (9th Cir. 1982).. . . . . . . . . . . . . . . . . . . . . . . . . 9, 41

United States v. Walser, 275 F.3d 981 (10th Cir. 2001).. . . . . . . . . . . . . . . . . . . . . . . . . . 68

FEDERAL STATUTES

18 U.S.C. § 2251. . . . . . . . . . . . . . . . . . 79

18 U.S.C. § 2252. . . . . . . . . . . . . . . . 18, 82

18 U.S.C. § 3231. . . . . . . . . . . . . . . . . . . 7

18 U.S.C. § 3742. . . . . . . . . . . . . . . . . . . 7

18 U.S.C. §§ 2251.. . . . . . . . . . . . . . . . . 18

28 U.S.C. § 1291. . . . . . . . . . . . . . . . . . . 7

OTHER AUTHORITIES

Paul Ohm, Massive Hard Drives, General Warrants, And ThePower of Magistrate Judges, 97 Va. L. Rev. 1 (2011).. . . . . . . . . . . . . . . . . . . . . . . . . . 47

Raphael Winick, Searches and Seizures of Computers andComputer Data, 8 Harv. J. L. & Tech. 75 (1994). 73, 74

vii

www.computer-forensics.net/what-is-a-file-signature?/; en.wikipedia.org/wiki/File_signature... . . . . . . 71

www.zdnet.com/news/faq-forty-years-of-moores-law/42082.. . . . . . . . . . . . . . . . . . . . . . . . . . 39

viii

UNITED STATES COURT OF APPEALS

FOR THE NINTH CIRCUIT

UNITED STATES OF AMERICA, ) No. 10-50403)

Plaintiff-Appellee, ) D.C. No. CR-08-4402-DMS)

v. ))

DAVID GRUMMER ) Southern District) of California,

Defendant-Appellant. ) San Diego)

)

I.

STATEMENT OF JURISDICTION

A. DISTRICT COURT JURISDICTION

The United States charged Mr. Grummer with violating

United States Code with respect to receipt and possession

of child pornography and with a single count of attempted

production of child pornography. [CR 25; ER1 46-55]. 1

The district court had jurisdiction per 18 U.S.C. § 3231.

B. THE JUDGMENT IS FINAL

A judgment of conviction and sentence is a final

“CR” refers to the clerk’s record of 08cr4402-DMS. 1

“CR2" refers to the clerk’s record of 08cr1140-L “ER1”refers to Appellant’s Excerpts of Record, Volume I; “ER2"refers to Appellant’s Excerpts of Record, Volume II.

1

order subject to appeal under 28 U.S.C. § 1291. Berman

v. United States, 302 U.S. 211, 212-13 (1937).

C. COURT OF APPEALS JURISDICTION

The district court’s judgment and commitment is a

final order subject to review under 28 U.S.C. § 1291.

[CR 76; ER2 11-14]

D. THE APPEAL IS TIMELY

Mr. Grummer notice his appeal the day the district

court entered judgment: August 20, 2010. [CR 77; ER 1].

This appeal is timely.

II.

BAIL STATUS

Mr. Grummer is incarcerated. The Bureau of Prisons

projects Mr. Grummer’s release for August 23, 2031.2

III.

STATEMENT OF THE ISSUES

David Grummer was arrested in an Environmental

Protection Agency (“EPA”) investigation into the sale of

www.bop.gov/iloc2/LocateInmate.jsp2

2

DDT and Freon over the internet. Agents learned that3

Grummer worked at a hazardous waste facility and that he

was siphoning off hazardous illegal chemicals (like DDT

and Freon) and reselling them over the internet. Agents

were easily able to establish contact with Grummer,

arrange a few sales, and bust him for selling illegal,

environment-destroying chemicals.

Mr. Grummer pled guilty, with a plea agreement, and

was cooperating with the government at the time that his

computers’ graphics files were searched one by one to

look for evidence of crime. [CR2 1-4; ER2 180-193].

This search was illegal for a variety of reasons.

A. THE WARRANT HAD EXPIRED AT THE TIME OF THE SEARCH

The warrant sets forth that any search of the

computer per the warrant had to be completed in 90 days.

[CR 35-1; ER 297-298]. The warrant’s time limitation is

a normal and important feature given the concerns that

when the government searches a personal computer, there

Mr. Grummer was ultimately sentenced to 18 months3

for that case, U.S. v. Grummer, 08cr1140!L. Thissentence is running consecutively to the 295 monthsimposed for the conviction being appealed.

3

is a substantial amount of over-seizure of documents and

information protected by the 4th Amendment. When the

government over-seizes, United States v. Tamura, 694 F.2d

591, 596 (9th Cir. 1982), requires that removal be

monitored by the magistrate judge. Searching outside the

time boundary of the warrant to review every single

picture in all of Mr. Grummer’s directories constituted:

“the kind of investigatory dragnet the fourth amendment

was designed to prevent.” Id. at 595 (quoting United

States v. Abrams, 615 F.2d 541, 543 (1st Cir. 1980)).

The time restrictions of a warrant are treated as

limiting the scope of the warrant. United States v.

Hitchcock, 2002 U.S. App. LEXIS 15726, *18-19 (9th Cir.

2002). The computer was seized January 17, 2008, and4

“The good faith exception has no application4

here, where there is no dispute about the searchwarrant’s validity but only about whether the agentsexecuted the warrant before it was effective. Rather, theissue is whether the search was conducted within thescope of a warrant, though here the issue is temporalscope whereas in the ordinary case what is at issue arethe items for which the search warrant was issued or theplaces the warrant authorizes to be searched. See, e.g., United States v. Furrow, 229 F.3d 805, 816 (9th Cir.2000) (considering whether search of four ‘outbuildings’was properly within the scope of search warrant),

4

search occurred late May 2008. Mr. Grummer pled guilty

with a cooperation plea agreement April 24th. The

offensive image was found on June 9, 2008. [CR2 1-4].

If the government wanted to search the computer in May of

2008, it needed to get a new warrant and explain to the

Magistrate Judge why probable cause was satisfied and

what sort of search parameters would be appropriate in

light of the change in circumstances. United States v.

Stanert, 762 F.2d 775 (9th Cir. 1985).

B. THE SEARCH PARAMETER OF “THE AGENT CAN LOOK ATEVERYTHING” IS NECESSARILY OVER-BROAD ANDINVALID UNDER THE FOURTH AMENDMENT.

The affidavit asked for the ability to view

information outside the scope of the warrant, but assured

that it would “not be made available to the investigating

agents unless it appears to the examiner that the

information relates to the commission of offenses not

covered by this warrant.” [CR 35-1]. That is the

overruled on other grounds by United States v. Johnson,256 F.3d 895 (9th Cir. 2001) (en banc); United States v.Rude, 88 F.3d 1538, 1551-52 (9th Cir. 1996) (consideringwhether seized documents were outside the scope of searchwarrant).”

5

“general warrant” condemned by this Court in United

States v. Comprehensive Drug Testing, Inc. 621 F.3d 1162,

1176 (9th Cir. 2010) (en banc) (“CDT II”). Magistrate

judges should insist that the government waive reliance

upon the plain view doctrine in digital evidence cases.

CDT II, 621 F.3d at 1170-71(Maj. Op.); id. at 1177-78

(Kozinski, C.J., concurring). 5

If the segregation is to be done by government

computer personnel, the government must agree in the

warrant that the computer personnel will not disclose to

“When the government wishes to obtain a warrant5

to examine a computer hard drive or electronic storagemedium to search for certain incriminating files, or whena search for evidence could result in the seizure of acomputer, see, e.g., United States v. Giberson, 527 F.3d882 (9th Cir. 2008), magistrate judges should insist thatthe government forswear reliance on the plain viewdoctrine. They should also require the government toforswear reliance on any similar doctrine that wouldallow retention of data obtained only because thegovernment was required to segregate seizable fromnon-seizable data. This will ensure that future searchesof electronic records do not ‘make a mockery of Tamura’--indeed, the Fourth Amendment--by turning all warrantsfor digital data into general warrants. Maj. op. at13950. If the government doesn’t consent to such awaiver, the magistrate judge should order that theseizable and non-seizable data be separated by anindependent third party under the supervision of thecourt, or deny the warrant altogether.”

6

the investigators any information outside the scope of

the warrant. Id. at 1180. The government’s search

protocol must be designed to identify only information

within the scope of the probable cause; that is the only

information which may be examined by the case agents.

Id. at 1170-72.

It defies credulity to believe that the agent was

searching for more evidence on the already pled guilty

and cooperating EPA case. Under the Agent’s proposed

rationale for the search (more EPA evidence), he would

plow through giga-byte after gigabyte of data -- what the

government described as a stack of paper the size of the

Washington Monument -- in order to get to the bottom of

that EPA case. Adkinson was looking at the computer data

in bulk (480 images per view) stretched on 2 screens.

One could not design a more invasive method of searching

other than going every photo a person has their computer

or phone. The government cannot search a person’s

computer for evidence in this way without making a farce

of the individual’s privacy. Agent Adkinson seeks

credulity by saying he “didn’t get to search the evidence

7

in this case.” [ER2 101]. Agent Adkinson had already

found and book marked the EPA evidence he was allegedly

seeking when he began the methodical search of every

photograph on Mr. Grummer’s drive.

C. IF THE WARRANT ALLOWED AN ALL-RECORDS SEARCH, ITWAS OVER-BROAD IN VIOLATION OF THE FOURTHAMENDMENT AND GOOD-FAITH DOES NOT APPLY.

The search warrant listed seventeen broad categories

of documents (a. through q.) all of which began with the

language “all permanent and temporary files containing.”

This sounds like the all-records search which eliminates

any possible individual privacy regarding computer

information. But to the extent that any privacy interest

remained, the warrant ended with a proviso for items

beyond the warrant’s scope: “The forensic examiner may

still view information not within the scope of the

warrant but it will not be made available to the

investigating agents unless it appears to the examiner

that the information relates to the commission of

offenses not covered by this warrant.” [CR 35-1].

Whatever of the search protocols described in the

warrant, the government’s actual search was nothing other

8

than the “general exploratory rummaging” condemned by

Chief Judge Kozinski in the context of electronic

evidence. Comprehensive Drug Testing, Inc. 621 F.3d

1162, 1180 (Kozinski, C.J., concurring).

D. POSSESSION IS A LESSER INCLUDED OFFENSE OFRECEIPT OF CHILD PORNOGRAPHY.

It is established that if one receives contraband,

the person has taken possession of the contraband.

United States v. Davenport, 519 F.3d 940, 947 (9th Cir.

2008)(concluding that possession was a lesser-included

offense of receipt for purposes of the Blockburger v.

United States, 284 U.S. 299, 304 (1932) test). Thus, Mr.

Grummer cannot be convicted of both receipt and

possession of the same offensive images. See United

States v. Lynn, 2011 U.S. App. LEXIS 11254 (9th Cir.

2011) (plain error reversal on possession/receipt double

jeopardy violation, case remanded); United States v.

Schales, 546 F.3d 965, 980 (9th Cir. 2008). In the

instant matter, Mr. Grummer was convicted of the receipt

of particular images as well as possession of the

computer drives in which such images were encoded.

9

Nothing in the jury instructions or the indictment

instructed the jury that Mr. Grummer could not be

convicted of possession of the computer drives only based

upon images separate from those underlying the receipt

counts. United States v. Schales, 546 F.3d at 980 (“If

the government wishes to charge a defendant with both

receipt and possession of material involving the sexual

exploitation of minors based on separate conduct, it must

distinctly set forth each medium forming the basis of the

separate counts.”)

IV.

STATEMENT OF THE CASE

A. THE EPA CASE: SOURCE OF THE CHILD PORNOGRAPHY CHARGES

In April of 2006, the EPA learned of David Grummer’s

sale of unregistered pesticides over the internet; EPA

Special Agent Leslie Gorman was assigned. [CR 35].

Grummer had an advertisement to sell DDT and chlordane (a

banned pesticide) on Agriseek.com. [Id.] Agent Gorman,

with six years experience, emailed Grummer and the EPA

prepared to conduct a few controlled buys. [Id.]

10

Grummer sold chlordane, DDT and R-12 Freon for small

amounts of money to the agents over the course of months.

Mr. Grummer did nothing during the case which would

make anyone believe that he was seeking to conceal his

identity or hide information. The reply email to Agent

Gorman was addressed “David Grummer” from yahoo email

stating that he accepted “paypal and check” and “any

questions call” and gave his phone number. [Id.]

Despite the impressive array of electronic evidence --

emails, checks, checking account, paypal information --

Gorman began surveillance. [Id.]

The government arranged several controlled buys and

deployed 2 under cover agents. [ER2 60] Grummer gave

the government his business card for being the “HHW

Project Manager” for Clean Harbors Environmental Services

in San Diego. [CR 35]. Mr. Grummer sold the agents a

quart bottle of liquid chlordane and a quart bottle,

approximately half full of liquid DDT for approximately

one hundred and ninety dollars. [Id.] Grummer offered

to sell Freon. [ER2 58].

On June 7, 2007, Grummer sold the undercover agents

11

a 30-pound cylinder of Freon for approximately $300

dollars. [CR 35]. The meeting and sale took place at

the City of Vista’s Household Hazardous Waste (HHW)

facility where Grummer worked. [Id.]

The agents got Mr. Grummer to sell them $37 worth of

freon. [CR 35]. The agents followed him home and then

seized him at FedEx in Oceanside with a package

containing 3 14-ounce cans labeled “Sercon, Refrigerant

12.” [CR 35].

Thus, Agent Gorman explained that, based on the

investigation, there was probable cause to believe that

Grummer’s residence in Oceanside contained evidence of

violations of FIFRA (illegal sale of chlordane and DDT,

which are banned pesticides), the CAA (illegal sale of

CFC R-12, a listed Class I Substance under the CAA, to an

individual who does not possess the proper EPA

certification), and the HMTS (improper packaging,

labeling and marking of HazMat shipment; improper or

false declaration of HazMat; and the transportation of

HazMat without shipping papers). [CR 35].

On April 24, 2008, Grummer made a first appearance,

12

waiver of indictment, and guilty plea per a cooperation

plea agreement. [CR 33-1; CR 39-3]. Sentencing was set

for July 7, 2008.

B. THE CHILD PORNOGRAPHY CHARGES

On December 17, 2008, Grummer was indicted for two

counts of receipt and possession of child pornography in

violation of 18 U.S.C. § 2252. [CR 9]. A superseding

indictment was filed on September 23, 2009, charging 1

count of attempted sexual exploitation of a minor, and 23

counts of receipt and possession of child pornography: 18

U.S.C. §§ 2251, 2252. [CR 25;].

C. MOTION TO SUPPRESS EVIDENCE

1. Motions and Responses

On March 5, 2010, Grummer filed a Motion to Suppress

Evidence, [CR 33], arguing that on June 9, 2008, the EPA

conducted a warrantless search of his hard drives and no

exigent circumstance or other exception obviated the

warrant requirement. [CR 33]. Grummer argued this was

an all records, all container search in violation of

United States v. Payton, 573 F.3d 859, 862 (9th Cir.

2009). [CR 33]. Grummer asserted a personal privacy

13

interest in his personal data on the computer. See

United States v. Payton, 573 F.3d at 864 (noting special

privacy concerns regarding computer storage.)

Grummer also argued that probable cause had expired

or was stale. [CR 33]. The suspected image of child

pornography was, of course, the “probable cause” that

tainted the second warrant issued June 27, 2008.

In its Response and Opposition to Defendant’s Motion

to Suppress, the government conceded that Agent Adkison

did not discover the thumbnail image he believed to be

child pornography until June 2008. [CR 35]. This was

nearly five months after the January 17, 2008, search and

seizure and two months past the deadline. The Affidavit

in support of the warrant and incorporated states at

paragraph 59. a., “The imaging and preliminary review

process, depending upon the number of computers seized,

the volume of data contained on the computers, any steps

taken by the owners to conceal the stolen data (sic) or

use of that data and the software deployed on the

computers, can take up to 90 days.” [CR 35-1].

The government first attempts to re-brand its

14

protocol as a “graphics review” in which Agent Adkison

located a series of images with “chlordane” in the

filename and tagged them with book marks. [CR 35]. The

image encountered by Adkinson was a thumbnail file of

child pornography on HD 2 of “Bdrm PC 1”:

“(Hussyfan)(pthc)(r@ygold)-Trish&Dragon (13 yr old)

py4.jpg.” [Id.] The dissimilarity between this filename

and the word “chlordane” eliminates the possibility that

these files would appear near one another in an

alphabetized list. The thumbnail image was located in6

the Program Files/Kazaa/My Shared Folder of the hard

drive. [Id.] There is no indication that the offensive

picture was located in a segment or folder wherein

information about the EPA case would be found. Agent

Adkison claims he immediately discontinued analysis of

the seized evidence upon discovering the image. [Id.]

At the suppression hearing, the government took every

position to validate the search. The search was not even

Computers have default sorting rules which are6

familiar to most users. File names are sortedalphabetically. See msdn.microsoft.com/en-us/goglobal/bb688122

15

a search because it was a part of the original search.

The Agent claimed to be searching for more evidence on

that EPA cases because a “a probability existed” that7

more incriminating evidence could be located for

sentencing enhancement purposes or further investigation.

[Id.] This statement is difficult to square with the

government’s cooperation plea agreement with Mr. Grummer

which prohibited the government from sentencing

enhancements not set forth in the agreement [ER2 190-

193].

At the motion hearing, the district court asked to

the parties to file further briefing regarding the

circumstances attendant at the time of the search.

Grummer complied and set forth undisputed facts. [CR

39]. Shortly after the warrants were executed, Mr.

Grummer began to meet and cooperation with the EPA

investigation. [Id.] During the months of February and

March, Grummer met with EPA agents and provided

Although not entirely clear, it appears the agent7

meant that it was theoretically possible that moreevidence existed.

16

additional incriminating information. [Id.] Based on

this cooperation, a plea agreement on the EPA

investigation was reached. [Id.] Grummer noted in his

supplemental memorandum that the common thread in the

cases cited by the court was the potential for abuse in

extended searches and that nothing impaired the EPA from

completing the search prior to Grummer’s tendering his

guilty plea. [Id.] The guilty plea was entered just

after expiration of the 90 days deadline for the forensic

search. [CR2 1-4].

The government’s supplemental response and opposition

argued that off-site forensic examinations take a long

time, probable cause remained attendant, this search was

simply a continuation of the original search, and

Grummer’s guilty plea did not affect the status of the

warrant or the probable cause underlying the January 2008

EPA warrant and, Agent Adkison was acting in good-faith

in any case so the invalidity of the warrant was

irrelevant. [CR 40].

2. The Disputed Warrant

EPA Agent Gorman prepared an Application and

17

Affidavit for Search Warrant for Grummer’s residence

consisting of: Attachment “A” -- a description of the

premises to be searched; Attachment “B” -- the list of

items concealed on the premises to be searched and

seized; and it incorporated the attached Affidavit of

Agent Gorman providing the facts supporting probable

cause and the protocol for seizure and search of

computers and computer media. [CR 35-1].

a. The Application

On January 16, 2008, Agent Gorman sought approval of

an Application and Affidavit for Search Warrant of

Grummer’s residence in Oceanside, California, and several

other locations, from Magistrate Judge Nita L. Stormes.

[CR 35]. The affidavit claimed probable cause existed to

believe evidence of crimes concerning violations of the

Federal Insecticide, Fungicide, and Rodenticide Act

(“FIFRA”), 7 U.S.C. § 136(a)(1)(A), the Clean Air Act

(“CAA”), 42 U.S.C. § 7413(c)(1), and the Hazardous

Materials Transportation Statute (“HMTS”), 49 U.S.C. §

5124 would be found at Grummer’s residence. [Id.]

The premises to be searched was described in

18

Attachment A. [CR 35]. Grummer’s residence was

described therein and two photographs were included with

Attachment A: Exhibit 1 was a photograph of the street

address numbers on the left side of the two-car garage

and Exhibit 2 was an aerial photograph of the residence.

[Id.]

Attachment B described the property to be searched,

including physical documents and electronic data. [Id.]

Attachment B stated that the seizure and search of

computers and computer media will be conducted in

accordance with paragraph 59 of the affidavit

(incorporating the 90-day limitation in ¶59 a). [Id.]

The search was to include deleted data, remnant data and

slack space. [Id.] Paragraph 4 of Attachment B listed

17 categories (a. through q.) of records for the period

from April, 2005, through the present (January 16, 2008).

[Id.] Each of these 17 categories began with the

language “all permanent and temporary files containing,”

then listing various items and categories of items.

[Id.]

b. The Computer Search Protocol At ¶59

19

Agent Gorman requested authorization to make forensic

images of the computers on the premises. She concluded

there was probable cause to believe that the computer(s)

used by Grummer had evidence of crime - the solicitations

to purchase the unregistered pesticides and CFC-12. [CR

35]. She then went on to describe the imaging procedure:

As this data cannot effectively be segregatedonsite from other data which may be stored onthe computer(s) and cannot be left behind, thecomputers will be seized and transported offsitefor imaging. Once a verified image has beenobtained and the data subjected to preliminaryreview, any computers which do not containevidence of the sale and shipment ofunregistered pesticides, CFC-12 or improperlyshipped hazardous materials will be returned tothe owner. The imaging and preliminary reviewprocess, depending upon the number of computersseized, the volume of data contained on thecomputers, any steps taken by the owners toconceal the stolen data (sic) or use of thatdata and the software deployed on the computers,can take up to 90 days. It should be noted thatsome database programs cannot be searched bykeywords without first extracting the data fromthe image and importing it into a new, cleancompatible version of the database software on aseparate, forensic computer.

[Id.]

The affidavit stated it was necessary to create a

forensic image, an exact physical copy of the hard drive

20

or other media, before conducting any search of the data

to prevent changing or irretrievably losing any data.

[Id.] Creating the forensic image(s) was necessary to

prevent the operating system from writing hundreds of new

files about its status and operating environment that

might delete or alter other files or metadata. [Id.]

Next, the affidavit explains how the forensic

analysis would be conducted, starting at ¶59 d. Agent

Gorman explained it can take days to properly search a

single hard drive for specific data because searching by

keywords, for example, often yields many thousands of

“hits,” each of which must be reviewed in context to

determine whether the data is within the scope of the

warrant. [CR 35]. Moreover, the computer may have

metadata stored about a relevant hit with additional

information: who created it, when was it was created,

when it was last accessed, when it was last modified,

when it was last printed and when it was deleted. [Id.]

Sometimes it is even possible, Agent Gorman claims, to

recover an entire document that never was saved to the

hard drive if the document was printed. [Id.] Certain

21

file formats do not lend themselves to keyword searches

such as many common electronic mails (e.g. Microsoft

Outlook), database and spreadsheet applications that do

not store data as searchable text; instead, it is saved

in a proprietary non-text format. [Id.] Agent Gorman

further claims that graphics images, such as faxes sent

to the computer or even documents printed by the computer

but not saved, are not text searchable. [Id.]8

In paragraph 59. f., Agent Gorman briefly addresses

difficulties in analyzing computer data onsite due to the

volume of data stored on a typical computer system. A

single megabyte of storage space is the equivalent of 500

double-spaced pages of text. [CR 35]. A single gigabyte

of storage space, or 1,000 megabytes, is the equivalent

of 500,000 double-spaced pages of text. [Id.] In 2008,

it was common for computer hard drives to store more than

100 gigabytes of data. [Id.] Forensic examination of a

hard drive images) may require a range of data analysis

This ignores the fact that software can convert8

images into text. This is commonly called OpticalCharacter Recognition (“OCR”) software and it was readilyavailable in 2008.

22

techniques and may take weeks or even months. [Id.]

Considering these difficulties, Agent Gorman

requested “permission to use whatever data analysis

techniques reasonably appear necessary to locate and

retrieve digital evidence within the scope of the

warrant.” [CR 35]. Magistrate Judge Stormes was assured

that “all forensic analysis of the imaged data will be

directed exclusively to the identification and seizure of

information within the scope of the warrant.” [Id.]

Agent Gorman then stated in the same paragraph, the

forensic examiner may still view information not within

the scope of the warrant, but it will not be made

available to the investigating agents unless it appears

to the examiner that the information relates to the

commission of offenses not covered by this warrant.

[Id.]

c. The Agent’s Testimony

Agent Gorman, the case agent and affiant, explained

that the time of the search she had subpoenaed records

from PayPal and Ebay. [ER2 58-59]. The records she

received from PayPal and Ebay identified individuals who

23

purchased DDT and chlordane from Grummer. [ER2 59]. The

EPA interviewed some people who purchased DDT and

chlordane from Grummer. [ER2 59-60].

Agent Gorman acknowledged that Attachment B to the

Search Warrant for Grummer’s residence authorized agents

to search for records identifying the buyer, recipient,

seller, shipper and/or broker of CFCs and unregistered

pesticides. [ER2 64]. It also authorized her to search

for documents identifying persons doing business with Mr.

Grummer. [Id.]

At the time the image suspected to be child

pornography was found, Agent Gorman claimed she was

awaiting the results of the search of the seized

computers from Agent Adkison at the NCFL [ER2 64],

including electronic records identifying people who may

have purchased unregistered pesticides from Mr. Grummer-

- although she already possessed the PayPal and Ebay

records. [ER2 64-55]. She had no contact with Adkison

from January 17, 2008, to June 9, 2008.

Grummer met with investigators for proffer sessions

in February and March of 2008. [ER2 65]. Agent Gorman

24

scheduled and attended multiple debriefs or proffers

where Grummer was cooperating. [ER2 66-67]. Grummer

explained his involvement with DDT and chlordane,

including what he did with it and how he would sell it

and ship it. [ER2 77]. Reports were written by the

agents recording that information. [ER2 79-80]. Gorman

conferred with the AUSA prosecuting the EPA case

concerning the plea offer extended to Grummer. [ER2 83-

85]. She was informed that on April 24, 2008, Grummer

pled guilty in the EPA case. [ER2 68].

Agent Gorman testified that the guilty plea before

the magistrate judge did not end her case because it was

not “official” until accepted by the district judge.

[ER2 69-70, 50-54]. The Agent indicated that she thought9

that because the plea was not accepted, then the case was

not final, and the computer could be searched just it

could searched at any time. Agent Gorman admitted that

she did not have a thorough understanding of the

The agent’s understanding of the law was wrong. 9

See Garcia-Aguilar v. U.S. Dist. Ct. for S. Dist. ofCal., 535 F.3d 1021, 1025 (9th Cir. 2008).

25

controlling circuit authority. [ER2 89]. While Gorman

was aware of the plea, she had not follo1wed up to see if

the computer had already been searched. [ER2 91-92].

Agent Adkison is an EPA criminal investigator in

their National Computer Forensics Lab (NCFL) [CR 55; ER2

101], where he had worked for four and a half years at

the time of the suppression hearing. [Id.] Prior to

working for the EPA, Adkison was a special agent with the

State Department, [ER2 102], where he worked for eight

years. [ER2 103]. He has considerable experience as a

law enforcement officer and as a computer forensic

examiner.

His explanation for why the search commenced in May

2008 was that Department policy (now changed) required

the computer seizing agent to be the computer searching

agent. [ER2 121]. Adkinson described his circumstances

with personal and medical leave time, training and other

cases which delayed him from getting to Mr. Grummer’s

computer. (Apparently, there is a staffing issue, too.

[ER2 124]). The policy requiring the search warrant

agent to do the forensic analysis had also been changed

26

before the evidentiary hearing. [ER2 124-125].

Agent Adkinson loaded up all of Mr. Grummer’s drives

at once and began going though them 480 images a click.10

The examination software was a blunt tool which looks for

the least common denominators: file type and any possible

relevancy. [Id.] The Agent described the software as

giving a complete look at everything on the computer:

“for example, if I want to look at all the documents on

the computer, I click on the documents tab, basically.

It brings up all of the documents that are on that

computer.” [ER2 130]. FTK allows the examiner to bring

up a family of files as opposed to a specific file type,

including documents, emails, multi media, and graphics.

[ER2 131]. In the graphics view of FTK it brings up all

.bmp files -- bit maps; .jpgs -- typical graphics files

created by a camera; .tiff files, which tend to be fax

files; and Powerpoint presentations. [Id.] There is a

significant list of files that FTK believes are graphics.

The agent described looking at two 24-inch10

screens loaded with graphics files from across all fivecomputers. [ER2 133, 135].

27

[Id.]

Agent Adkison testified that he was doing a graphics

review or graphics search when he encountered the

thumbnail image he suspected was child pornography. [ER2

131]. Additionally, Agent Adkinson had little problem

finding the EPA evidence that he was allegedly seeking

since he found documents with the term “chlordane.” [ER2

135, 108]. The Agent had found the files for which

probable cause existed as being in the series of photos

with “chlordane” in the filename. [ER2 136]. Adkinson

book marked these files. [Id.]

Adkison testified further that: (1) while doing the

graphics search he was not aware that Grummer had already

pled guilty in April [ER2 139]; (2) he had no contact

with the case agent after executing the seizures [ER2

142]; (3) he had his marching orders and the search

warrant for guidance [Id.]; and (4) he was not asked to

speed up his review for sentencing purposes. [ER2 148].

The district court asked Agent Adkison some follow up

questions, to which he responded that he was not

searching for any specific criteria, only “culling the

28

data” [ER2 150]: “I wasn’t looking for anything. I was

just looking to get rid of data.” [ER2 151].

THE COURT: ...What sets the parameters of yoursearch? In other words, in any given case, whatis it that tells you what the parameters are,what you are looking for, amidst all thegigabytes of data?AGENT ADKISON: Can I answer that in two parts?THE COURT: I am sorry?AGENT ADKISON: Can I answer that in two parts?THE COURT: Yes.AGENT ADKISON: I didn’t get to search theevidence in this case.

* * *

AGENT ADKISON: I didn’t get to search theevidence in this case for any specific criteria. I was going through the culling process to getto a definitive search based on what the searchwarrant allowed me to search for, and then whatthe case agent specifically asked me to searchfor which might be of evidentiary value. So Idid not get to search this case for anythingspecific.

[ER2 150].

Relying on this dichotomy between “culling” and

“searching,” Agent Adkison admitted he never even

attempted to speak with the case agent to limit the scope

of the search he labeled “the culling phase.” [ER2 150].

His procedure was to do “the culling” first followed by

a search within the parameters of the warrant. [ER2

29

151]. In Agent Adkison’s experience at his prior job as

a forensic examiner for the State Department, he was not

bound by the search warrant during the culling phase.

[ER2 152].

d. The District Court’s Findings

The district court accepted Adkison’s label, i.e.

Adkison was “simply going through a culling process,

weeding out irrelevant information, not looking for

anything specific;” rather, he was looking for items to

exclude. [ER1 44]. The district court found that: “the

identification of the child pornography was inadvertent.

It was not targeted, it was not designed, it wasn’t

premeditated.” [Id.]

The motion to suppress evidence was denied. [CR 42].

D. TRIAL AND SENTENCING

Mr. Grummer proceeded to trial and was convicted on

all counts except for the attempted production of child

pornography. The indictment charged Grummer with the

receipt of images in counts 2-19, and possession of the

computers which contained those images (and others) in

counts 20-24. Mr. Grummer made a timely Rule 29 motion

30

at the close of evidence. [ER1 5-11].

The jury instructions for these 2 counts were largely

duplicates of one another. The only real difference was

that counts 2-19 charged liability for particular images

whereas the possession offenses involved the actual drive

on which an image was stored. [CR 65, ER1 29-30]. With

respect to the possession counts, the verdict form only

stated that the jury found Grummer guilty of “of

Possession of Images of Minors Engaged in Sexually

Explicit conduct as charged in Count 20 of the indictment

on or about” and then would specify the time period

recited in the indictment for the count. [CR 66].

Nothing required the jury to find that the possession

offense be based upon images different or conduct

separate from that underlying the receipt counts.

V.

SUMMARY OF ARGUMENTS

The search protocol was designed to review the

private and 4th Amendment protected records. The warrant

actually asked for authority to search beyond what

probable cause would justify and, if upheld, would

31

eliminate the possibility of privacy in a personal

computer. Cf. United States v. Payton, 573 F.3d at 864

(“In order to uphold the search in this case, we would

have to rule that, whenever a computer is found in a

search for other items, if any of those items were

capable of being stored in a computer, a search of the

computer would be permissible. Such a ruling would

eliminate any incentive for officers to seek explicit

judicial authorization for searches of computers.”)

Moreover, this search simply looks fishy. It occurred

outside the 90 days given in the warrant on a case that

had already settled with a cooperation plea agreement.

These are material changes in circumstance which the

issuing judge could have found suspicious. Certainly,

given that the government was meeting with Mr. Grummer

and had all this evidence about how he did business, no

serious contention could be made that Mr. Grummer was

encrypting files and engaging in sophisticated deceit.

The government’s purported justifications for search

add to the irregularity. The government had Grummer’s

pay pal records, ebay, and personal records. People that

32

do business over the internet on these sites are easily

traceable. Additionally, it is no coincidence that the

search protocol employed by Adkinson was to first search

for the keywords of the restricted chemicals and then go

straight to the picture directories. If one were

interested in searching for child pornography under the

guise of investigating the EPA case, that is the

straightest path.

Mr. Grummer is part of an evolving body of case law

whose importance cannot be overstated. Computers have

unmatched ability to manage and catalogue our lives. The

idea that computers are like filing cabinets

fundamentally misunderstands the nature of the device.

File cabinets do not double their storage capacity every

18 months. File cabinets do not condense all other file11

cabinets into searchable formats. The view that

computers are not different from other 4th Amendment

The common Moore’s law analogy is the automobile. 11

If autos followed Moore’s law, cars would get 100,000miles to the gallon, cost nearly nothing, and be smallenough to fit in the pocket of trousers.www.zdnet.com/news/faq-forty-years-of-moores-law/42082

33

subjects, cf. United States v. Giberson, 527 F.3d 882

(9th Cir. 2008), has been correctly rejected by United

States v. Comprehensive Drug Testing, Inc., 621 F.3d 1162

(9th Cir. 2010)(en banc).

Additionally, Mr. Grummer was convicted of both the

receipt and possession of child pornography. This

violates double jeopardy. United States v. Davenport,

519 F.3d at 947.

VI.

STANDARD OF REVIEW

Denial of a motion to suppress evidence is reviewed

de novo. United States v. Krupa, 633 F.3d 1148, 1151

(9th Cir. 2011). The trial court’s factual findings are

reviewed for clear error. United States v. Summers, 268

F.3d 683, 686 (9th Cir. 2001).

It is unclear whether a double jeopardy claim that

was not raised in the district court is subject to plain

error review or is deemed to have been waived. See

United States v. Hernandez-Guardado, 228 F.3d 1017, 1028

(9th Cir. 2000) (noting that “the case law in this

34

circuit reflects some uncertainty as to whether a double

jeopardy claim not raised in the district court is

subject to plain error review [or waived],” and applying

plain error review without deciding the issue).

VII.

ARGUMENTS

The search of Mr. Grummer’s computer was performed in

the maximally constitutionally offensive way. Agent

Adkinson found the files that he needed for the EPA case

upon his use of the appropriate key words. He then

embarked on a picture by picture search of the hard-

drive. This search was unconstitutional and the evidence

should be suppressed.

That computers create special privacy concerns has

been known since the advent of the personal computer.

United States v. Adjani, 452 F.3d 1140 (9th Cir. 2006).

See United States v. Tamura, 694 F.2d at 591, 595 (9th

Cir. 1982) (“[T]he wholesale seizure for later detailed

examination of records not described in a warrant is

significantly more intrusive, and has been characterized

as ‘the kind of investigatory dragnet the fourth

35

amendment was designed to prevent’”(quoting United States

v. Abrams, 615 F.2d 541, 543 (1st Cir. 1980))). See

Tamura, 694 F.2d at 596 (“The essential safeguard

required is that wholesale removal must be monitored by

the judgment of a neutral, detached magistrate.”)

All warrants, even those with the most expansive of

language, are subject to the inherent limitations of the

Fourth Amendment. Whether a particular search protocol12

is described in the warrant, the officer is always

“limited by the longstanding principle that a duly issued

warrant, even one with a thorough affidavit, may not be

used to engage in a general exploratory search.” See

United States v. Hill, 459 F.3d 966, 978 (9th Cir. 2006).

See also, United States v. Rettig, 589 F.2d 418, 423 (9th

Cir. 1978)(“Where evidence is uncovered during a search

pursuant to a warrant, the threshold question must be

“The right of the people to be secure in their12

persons, houses, papers, and effects, againstunreasonable searches and seizures, shall not beviolated, and no Warrants shall issue, but upon probablecause, supported by Oath or affirmation, and particularlydescribing the place to be searched, and the persons orthings to be seized.” U.S. Const. Amend. IV.

36

whether the search was confined to the warrant’s

terms.... [T]he search must be one directed in good faith

towards objects specified in the warrant or for other

means and instrumentalities by which the crime charged

has been committed. It must not be a general exploratory

search ....”(internal quotation marks omitted)). New

technology may become readily accessible, for example, to

enable more efficient or pinpointed searches of computer

data, or to facilitate onsite searches. Hill, 459 F.3d

979.

A. THE WARRANT WAS MORE THAN A MONTH EXPIRED AT THETIME OF THE SEARCH

The government’s right to search for a definite

period of time is part of the warrant and defines the

warrant’s scope. United States v. Hitchcock, 2002 U.S.

App. LEXIS 15726 at *18-19. Here the five month delay

between execution of the search warrant and analysis of

the seized computer evidence was outside the temporal

scope of the warrant and therefore unreasonable.

After the seizure on January 17, 2008, Adkison took

the imaged hard drives to his lab in Jacksonville,

37

Florida to search. [ER2 111]. The government concedes

that Adkison did not begin his search until late May

2008. He did not discover the image of child pornography

until June 9, 2008, almost five months after seizures,

six weeks after Mr. Grummer pled guilty on April 24,

2008, and nearly two months after the 90-day

authorization in the warrant had expired. Renewed

judicial authorization was necessary to prevent this

broad seizure from violating the Fourth Amendment.

Wholesale removal of records for later examination

must be monitored by the magistrate judge to prevent the

kind of general rummaging the Fourth Amendment was

designed to prevent. See United States v. Tamura, 694

F.2d 591 (9th Cir. 1992). If the Agent had sought

renewed authorization, it would have been incumbent on

the agent to explain the delay and disclose that Grummer

had pled guilty and was now cooperating with the

government.

The government concedes that a computer forensic

examination may become unreasonable, even though

supported by probable cause, merely based on delay. [CR

38

40]. Based on the length of delay, the affidavit and

search warrant, the government was required to obtain

authorization from the magistrate judge to extend the

deadline. United States v. Syphers, 426 F.3d 461, 469

(1st Cir. 2005) (file encryption and a large of backlog

of cases was sufficient cause for a magistrate judge to

extend the time frame for warrant’s execution.)

Agent Adkison did not speak to the case agent about

case’s progress during the five months between the

seizure of the evidence and Adkison’s search. [ER2 150].

The five month delay involved Agent Adkison taking almost

a month of personal and medical leave, 3 weeks of

training, and the policy requiring the agent assisting

with the seizure to conduct the search (a policy

subsequently changed because of inefficiency), and

Adkinson’s caseload. [ER2 122-123]. All these factors

were controlled by Agent Adkison or the EPA.

It appears that much of the backlog at the computer

lab is self-inflicted. Adkinson testified that he builds

an entirely new computer system for each search, then

disassembles the system after he finishes the search.

39

[ER2 128, 141]. Not only does he need to assemble the

hardware each time, he also must reinstall the operating

system and forensic analysis software. [Id.] He

literally starts from scratch on each case, creating

inefficiency with no justification. Imaged hard drives

can be loaded onto and unloaded from a forensic review

system to change data sets without disassembling the

equipment and reinstalling all the software. Clean rooms

are important in the production of silicon chips, not

looking up the boolean strings they contain.

B. LOOKING THROUGH THE FILES TO SEE WHICH ONES ARERELEVANT IS NOT “CULLING”, IT IS SEARCHING AND ITVIOLATES THE SCOPE OF THE SEARCH.

In order to be constitutional, a warrant cannot

authorize search for items which are not the subject of

probable cause. The government is not allowed to conduct

searches in a maximally intrusive way so that it gets a

look at more than it is entitled. U.S. Const. Amend. IV

(“The right of the people to be secure in their persons,

houses, papers, and effects, against unreasonable

searches and seizures, shall not be violated, and no

Warrants shall issue, but upon probable cause, supported

40

by Oath or affirmation, and particularly describing the

place to be searched, and the persons or things to be

seized.”) A file by file search of the hard-drive is

like a body-cavity search of the hard-drive. If the

Tamura filing cabinet analogy is employed, it begins the

search for financial records at the underwear drawer.

The warrant sought by the government was quite broad,

but it still had the ex ante Fourth Amendment

restrictions. Cf. United States v. Grubbs, 547 U.S. 90,

99 (2006)(the warrant process protects the property owner

by imposing “ex ante” restrictions on how and when

warrants issue.) Thus, Adkinson’s chosen search

methodology -- look through everything piece by piece --

violates the fundamental restriction that the search must

be focused. That the methodology employed be designed to

find the evidence that the investigator seeks. While

there may be greatly differing opinions about what

constitutes the best search criteria, there could be no

argument that “culling” satisfies the condition of only

looking for what the warrant justifies looking for. This

is the broadest possible search protocol: every thumbnail

41

on the drive, 480 at a time.

Ex ante restrictions in a warrant generally are13

designed to cure the manifest lack of probable cause and

particularity in every computer search case. See Paul

Ohm, Massive Hard Drives, General Warrants, And The Power

of Magistrate Judges, 97 Va. L. Rev. 1, 4 (2011). Both

the manner and timing of this search were unreasonable.

Although the warrant authorized wholesale seizure of all

of Mr. Grummer’s computer data for later examination, it

delineated seventeen broad categories of records in

Attachment B to the Application and Affidavit to the

Search Warrant. [CR 35-1; ER 276-277].

1. Attachment B

The warrant alleged certain property concealed in

Grummer’s residence was evidence, fruits, or property

used in committing a crime [CR 35], listing the items by

broad categories in Attachment B to the Application and

Affidavit for Search Warrant:

Grummer uses “ex ante” to signify the inherent13

constitutional limitations on a search ofconstitutionally protected matters.

42

This authorization... includes electronic datato include deleted data, remnant data and slackspace. The seizure and search of computers andcomputer media will be conducted in accordancewith paragraph 59 of the affidavit submitted insupport of the warrant. Evidence to be seizedincludes the following:....

4. The following records for the period fromApril, 2005, through the present:

all permanent and temporary files containing...

a. records relating to the purchase, sale,transfer, storage, inventory, distribution,and shipment of CFCs and unregisteredpesticides, including DDT and chlordane;

b. purchase orders, packing lists, invoices,bills of lading, receipts, electronic mail,PayPal records, and other records related tothe shipping of CFCs, including CFC-12, andunregistered pesticides, including DDT andchlordane;

c. correspondence, facsimiles, records oftelephone conversations relating to thesale, and distribution of CFCs, includingCFC-12, and unregistered pesticides,including DDT and chlordane;

d. records identifying the buyer, recipient,seller, shipper, and/or broker of CFCs, andunregistered pesticides;

e. financial records, including ledgers,records of wire transfers, bank statementsand cancelled checks, indicating thetransfer of funds relating to purchases,sales and shipment of CFCs and unregistered

43

pesticides;

f. phone books, day planners, rolodexes,business cards and other documentsidentifying persons doing business withDavid Grummer;

g. copies of CAA Section 609 Certifications forpurchasers of CFCs;

h. David Grummer’s hazardous materials trainingrecords, including training recordsregarding the shipment of hazardousmaterials;

i. records related to the storage of CFCs andunregistered pesticides, including recordsof the date of accumulation of the hazardousmaterials;

j. records related to the transportation ofhazardous materials by David Grummer;

k. records related to the purchase, sale,shipment, transportation and storage ofhazardous materials by David Grummer forcommercial purposes;

l. records, notes, lists, memorandums, or othermedia showing user names, account names,passwords, personal identification numbersthat are related to the access ofelectronically stored data;

m. records related to communication betweenDavid Grummer and/or Free ElectronicsDisposal, and Federal Express and otherinterstate commercial transporators (sic),including invoices, billing statements,delivery records, shipping records, andrecords of payment;

44

n. records related to federal rules andregulations applicable to the shipment ortransportation of hazardous materials,including brochures, pamphlets, industrypublications, guidance letters, informationprinted on internet websites and trainingmaterials;

o. records indicating the method and means thatDavid Grummer obtained the unregisteredpesticides and CFCs, including intakerecords, electronic mail, correspondence,facsimiles, records of telephoneconversations and records of accumulatedstorage time;

p. hazardous waste manifests and other recordsof the transporation, storage and disposalof hazardous waste by David Grummer;

q. records of offers to sell and distribute forsale CFCs and unregistered pesticides overthe internet, included but not limited toeBay, Agriseek and other postings, andrecords of payment for such transactions,including but not limited to PayPal recordsand records of wire transactions.

[CR 35]. These records were to be seized and searched

“in accordance with paragraph 59 of the affidavit,” which

set some ex ante limitations on searching the seized

computer evidence.

2. Computer Search Protocol: ¶59 Of The Affidavit

Paragraph 59 required agents executing the search

45

warrant to “employ the following procedures regarding

computers that may be found on the premises,” [CR 35],

including creating forensic images of the computers found

onsite and then forensic analysis of the data later

because “[the above listed] data cannot effectively be

segregated onsite from other data which may be stored on

the computer(s) and cannot be left behind.” [CR 35].

Agent Gorman requested up to 90 days for imaging and

preliminary review of the seized data. [Id.] Due to the

volume of data stored on a typical computer system,

agents would not even attempt to segregate data onsite

before determining to seize everything. [Id.]

The forensic examination was to be done by keyword

searches and other methods where “certain file formats do

not lend themselves to keyword searches.” [Id.] One

such file format was listed as documents printed by the

computer, even if never saved to the hard drive, stored

as a graphic image. [Id.] Faxes sent to the computer

stored as graphics images were also listed as not being

keyword searchable. [Id.]

Agent Gorman also expressed concern about the

46

possibility that criminals might “mislabel and hide files

and directories, use codes to avoid using keywords,

encrypt files, deliberately misspell certain words,

delete files and take other steps to defeat law

enforcement.” [Id.] Given these potential problems, she

requested permission to “use whatever data analysis

techniques reasonably appear necessary to locate and

retrieve digital evidence within the scope of this

warrant.” [Id.] Agent Gorman assured the magistrate

judge that “all forensic analysis will be directed

exclusively to the identification and seizure of

information within the scope of the warrant.” [Id.]

Despite that assurance, Agent Gorman also claimed “the

forensic examiner may view information not within the

scope of the warrant,” and, “such information will not be

made available to the investigative agents unless it

appears to the examiner that the information relates to

the commission of offenses not covered by this warrant.”

[Id.]

Agent Adkison is a highly trained and experienced

criminal investigator and forensic examiner, [ER 52-56],

47

who chose a “very gross and blunt” tool to conduct an all

records search (i.e., “culling”) before consulting the

warrant. Culling is searching. Adkison’s stated reasons

for conducting a “graphics review” were illogical: (1) he

never attempted to search for image files corresponding

with printed but not saved business records or faxes

concerning purchase, sale and shipment of CFCs and

unregistered pesticides, (2) nothing in the warrant or

“reasonableness” justifies initially searching for

pictures of chlordane, and (3) “culling” image files

would not eliminate the standard program files he claimed

to be trying to eliminate “before searching.”

If an agent or officer conducts an unreasonable

search, any evidence seized from that unwarranted search

may be suppressed. See, e.g., Arizona v. Hicks, 480 U.S.

321, 324-25 (1987)(moving shooting suspect’s stereo in

order to record serial numbers without probable cause

forced suppression of evidence).

During the suppression hearing, the district court

twice asked Agent Adkison “What sets the parameters of

your search?” Agent Adkison did not give a direct

48

response, “Can I answer that in two parts?” [ER2 150].

Although the search was nothing other than looking at

every picture on the drive -- an exploratory rummaging –

Agent Adkison would not even admit that what he did was

a search:

I didn’t get to search the evidence in this casefor any specific criteria. I was going throughthe culling process to get to a definitivesearch based on what the search warrant allowedme to search for.

[ER 150]. There is a word that the founders would use

for the “the culling process”: a search.

The district court ended up accepting this

distinction between culls and searches. But the process

described by Adkinson was a search in every sense of the

word which allow Adkinson to look at everything and

anything on the drive. The upshot of Adkinson’s

testimony was that he looked at the data on the drive

without restriction as to file type or likelihood that it

would be related to probable cause.” Adkinson emphasized

that this “culling” behavior predates and search and is

somehow not a search.

The danger is open, obvious, and known with respect

49

to giving the government the ability to search though an

individual’s personal computer. Adkison’s real skill was

not in using a culling procedure, it was to introduce the

idea that this sort of practice was something other than

a search. This is the sort of double-speak that this

Court cannot tolerate. Comprehensive Drug Testing, Inc.,

621 F.3d at 1170 (Maj. Op.).

The district court found that this search of the

computers photos did not count because it occurred in the

course of preparing to search (and also after the files

with relevant names had been tagged):

I accept the testimony here ... particularlythat of Agent Adkison ... that he was “simplygoing through a culling process, weeding outirrelevant information, not looking for anythingspecific; rather, he was looking for items toexclude so that he could later focus within thescope of the search warrant...

* * *

...the identification of the child pornographywas inadvertent. It was not targeted, it wasnot designed, it wasn’t premeditated.

[ER1 39-45]. In other words, the district court found

that as long as the searching agent’s discovery was

inadvertent and not premeditated, the agent is not

50

looking at all for Fourth Amendment purposes. This

creates precisely zero limitation on the government’s

ability to look at any bit of data on a hard-drive. It

means that searching is not searching when properly

labeled. “‘When I use a word,’ Humpty Dumpty said, in

rather a scornful tone, ‘it means just what I choose it

to mean-neither more nor less.’ ” Tennessee Valley

Authority v. Hill, 437 U.S. 153, 174 n.18 (1978).

To the extent that a culling process occurred, it

should have been done by specialized personnel or an

independent third party. Comprehensive Drug Testing,

621 F.3d 1162, 1178-1179 (Kozinski, C.J., concurring);

Id. at 1168-70, 1170-72 (Maj. Op). If the segregation is

to be done by government computer personnel, the

government must agree in the warrant application that the

computer personnel will not disclose to investigators any

information other than that which is the target of the

warrant. Id. at 1180. Agent Adkison is not the type of

neutral or detached independent third party this Court

envisioned in CDT II.

The sort of review described by Adkinson involved him

51

looking at plainly unrelated files. Perhaps there is a

circumstance where the government would have no choice

but to look file by file because no other option was

present, but there was nothing unusual about the search

and described mountainous data came from the standard

pre-loaded operating system programs. For example, “the

pinball games that come preloaded, the solitaire, all of

those programs have graphics associated with them.” In

no set of circumstances can the protocol of eyeballing

each photo increase efficiency (as Adkinson claimed the

culling process did. [ER2 135]).

Adkison searched all data on all five seized hard

drives simultaneously using Forensic Toolkit (FTK). [ER2

128]. Thus, Adkison conducted an all records search of

all computer hard drives placing everything that was a

graphics file in plain view even though none of the

evidence of the EPA violations could be identified

without words or letters on the images, i.e. “chlordane,”

“Freon,” “DDT,” or “CFC.” FTK allows forensic examiners

to go through computer images – based on keyword

searches, graphics displays, documents tab, emails and

52

other criteria. [ER2 128-131]. Accordingly, if Adkison

were seeking only evidence of EPA violations he would

have searched all images by keyword, employing an optical

character recognition program. [Id.] The documents tab

in FTK also shows all standard documents recognized by

the software, including WordPerfect, Open Office,

Microsoft Word. [Id.] FTK allows examiners to view a

family of files – i.e., “several different kind (sic) of

canned, if you will, divisions that it already has in it”

– as opposed to a specific file type. [ER2 131]. The

documents tab was the most likely division to return the

type of electronic evidence the warrant described.

Similarly, a graphics display in FTK would include things

like graphics generated by a digital camera, fax files,

Powerpoint presentations, and a significant list of other

file types. [Id.]

As a sophisticated forensic examiner, Agent Adkison

knew his methodology was fatally flawed. First, pre-

loaded games like solitaire, pinball and other irrelevant

images within Microsoft’s operating system are stored in

standard locations on the hard drive, easily and less

53

intrusively eliminated at the directory review -- the

surgical tool for limiting the search.

Second, by 2008 computers could quickly process the

amount of data in Grummer’s computers obviating the need

for “culling” graphics files in pinball and solitaire.

Moreover, additional computer hardware, e.g., a faster

processor, parallel processing, and additional RAM could

be added to any forensic review system processing data

too slowly.

Third, there was no relationship or link between the

files Agent Adkison claimed to be reviewing with

“chlordane” in the filename and the suspected image of

child pornography. The government withheld the exact

directory locations of the images allegedly with

“chlordane” in the filename that Adkison supposedly

discovered right before he encountered the image of child

pornography. The name “chlordane,” if actually searched

using keywords in the graphics review, would not return

the file suspected to be child pornography. The image of

child pornography was named, “ (Hussyfan)(pthc)(r@yGold)

- Trish&Dragon(13 yr old)pt4.avi.jpg”. Obviously, there

54

is nothing in that filename resembling “chlordane.”

Alternatively, if Adkison was searching graphics

organized alphabetically by filename alone, rather than

by keyword, these images would also be many pages apart.

Fourth, the actual location of child pornography that

Adkison found bears no relationship to the location of

images built-in with the Microsoft operating system. The

thumbnail image that Adkison encountered was stored

within the “Program Files\Kazaa\My Shared Folder”

directory - a location related to Grummer’s file sharing

program Kazaa, which was stored within its own directory

inside the Program Files folder. Pinball, solitaire, and

other built-in image files are located in completely

separate standard operating system directories associated

with Microsoft operating system files (not Kazaa).

Adkison decided to simultaneously sweep literally

hundreds of images lacking words or letters into “plain

view” using the “blunt” graphics review that presented

him with the image of child pornography, despite the fact

that without words or letters like “chlordane,” “Freon,”

“DDT,” or “CFC” those images could not constitute

55

evidence of EPA violations because none of the regulated

substances is recognizable in an image without words or

letters.

Fifth, graphics review was unnecessary given the

items listed in Attachment B and the availability of

specific, less intrusive directory level review, or other

sharper tools. The warrant authorized searching for

business records related to purchase, sale and shipment

of CFCs and unregistered pesticides, which were almost

certainly standard word processing type documents,

spreadsheets or emails. An image of this type of

document would have been identifiable and separable from

other images using Optical Character Recognition (OCR)

software.

Any search of image files should have been conducted

using less intrusive OCR software, protecting the

contents of every image file from “plain view.” Adkison

should have isolated all image type files without

searching them, then processed them with OCR software

that would return text if the image contained relevant

text. For example, OCR technology makes all .PDF

56

transcript documents searchable. The OCR text could then

be reviewed using keywords and the privacy interest in

image files would be protected.

Sixth, the government will likely assert the graphics

search was warranted because printed, but not saved,

document files or even faxes would be stored somewhere on

the computer as image files. [CR 35]. The affidavit

states:

Documents printed by the computer, even if thedocument was never saved to the hard drive, arerecoverable by forensic examiners but notdiscoverable by keyword searches because theprinted document is stored by the computer as agraphic image and not as text. Similarly, faxessent to the computer are stored as graphicsimages and not as text.

[Id.] This argument is equally unavailing: (1) Adkison’s

report concedes he never performed Analysis of Residual

Data to locate these types of files [id.]; (2) these

files would be stored in a standard system directory of

the Windows operating systems predetermined by the

version of Windows Grummer was running; and, (3) these

files would also have a standard file extension, which

should have been searched instead of every graphic image.

57

Adkison’s report says:

Residual data can include deleted and purgedfiles and artifacts from previously deletedfiles. Residual data may also include deletedtemporary files, such as Internet Cache Files &Printer or Fax Spool files. These files andartifacts are not available through normal useraccess. Residual data is located in portions ofthe computer media that are not activelyallocated for use. These portions of the mediaare normally not visible through normal useraccess. Result: Residual data on hard drives 1- 5 was not examined.

[Id.]

Adkison’s “blunt” plain view search was unreasonable

because less intrusive means would identify this type of

printed file or fax (e.g., directory view searching, file

extension or keyword searching, and/or OCR searching).

Adkison’s report concedes he knew exactly where to search

for these types of files. The government’s misleading

statement about and omission of the search technology

available in 2008 obviating the need to search images in

this case lacking words or letters indicating EPA

violations requires suppression of the child pornography

evidence. United States v. Stanert, 762 F.2d 775, 780-

782 (9th Cir. 1985).

58

C. GOOD-FAITH DOES NOT APPLY

Conducting searches in such a way as to sweep

everything into plain view is not good faith. “When, as

here, the government comes into possession of evidence by

circumventing or willfully disregarding limitations in a

search warrant, it must not be allowed to benefit from

its own wrongdoing by retaining the wrongfully obtained

evidence or any fruits thereof. When the district court

determines that the government has obtained the evidence

through intentional wrongdoing--rather than through a

technical or good faith mistake--it should order return

of the property without the need for balancing that is

applicable in the more ordinary case. CBT II, 621 F.3d

at 1174.

The exclusionary rule is not an individual right and

applies only where it “results in appreciable

deterrence.” Herring v. United States, 555 U.S. 135, 129

S.Ct. 695 (2009)(quoting United States v. Leon, 468 U.S.

897, 909 (1984)(internal quotations omitted)). “The

extent to which the exclusionary rule is justified by

these deterrence principles varies with the culpability

59

of the law enforcement conduct. As we said in Leon, ‘an

assessment of the flagrancy of the police misconduct

constitutes an important step in the calculus’ of

applying the exclusionary rule. 468 U.S. at 911.

Similarly, in Krull we elaborated that ‘evidence should

be suppressed ‘only if it can be said that law

enforcement officer had knowledge, or may be properly

charged with knowledge that the search was

unconstitutional under the Fourth amendment.’’ 480 U.S.,

at 348-349 (quoting United States v. Peltier, 422 U.S.

531, 542 (1975).” Herring, 129 S.Ct. At 701.

D. THE WARRANT WAS OVER-BROAD

Agent Adkison equated one gigabyte of data to printed

sheets of paper stacked 555 feet tall. [ER2 110]. He

seized a total of 710 gigabytes of data or 710 such

stacks. [ER2 132]. The vast majority of this data was

unrelated to the EPA case. However, the warrant

purported to authorize the search of “all permanent and

temporary internet files containing,” seventeen

categories of records (a. through q.) in Attachment B,

authorizing examination of all permanent and temporary

60

files regardless of their locations.

The warrant was interpreted as authorizing a search

of any file: “all permanent and temporary files

containing records, notes, lists, memorandums, or other

media showing user names, account names, passwords,

personal identification numbers that are related to the

access of electronically stored media.” Perhaps program

files would not satisfy the list, but that appears to be

the only exclusion. This mandates searching everything

stored by any user anywhere and all other computers

accessed across the internet (using all recovered user

and account names or PINs with recovered passwords),

including information unrelated to purchase, sale and

shipment of CFCs and unregistered pesticides.

The warrant sweeps well beyond what probable cause

authorizes. This search was invalid even under the

expansive language of Giberson. In Giberson, agents

conducted a computer forensic search for evidence related

to false identifications. Giberson, 527 F.3d at 890.

During that search an agent inadvertently discovered

child pornography. [Id.] Mr. Grummer’s case is not like

61

Giberson because in Mr. Grummer’s case, the agents had

found the documents with chlordane and the other relevant

file and were thereafter systematically eyeballing every

picture file. Thus, this is an instance where the Agent

strayed from the path of looking for items for which

probable cause existed:

Our holding is not inconsistent with UnitedStates v. Carey, 172 F.3d 1268 (10th Cir. 1999).There, the Tenth Circuit suppressed evidencefound when an officer, who was supposed to besearching a computer for drug-related documents,stumbled upon child pornography and began tosearch for more. Id. at 1276. Based on theofficer's own testimony, the court found thatthe child pornography was not "inadvertentlydiscovered" because the officer had temporarilyabandoned the search authorized by the warrantin order to look for child pornography,contravening the limitations of the searchwarrant. Id. at 1273. The court was careful tostate that the result in the case (suppressionof the evidence) was "predicated only upon theparticular facts of this case, and a search ofcomputer files based on different facts mightproduce a different result." Id. at 1276(footnote omitted). A concurring opinion statedthat "if the record showed that [the officer]had merely continued his search for drug-relatedevidence and, in doing so, continued to comeacross evidence of child pornography, . . . adifferent result would be required." Id. at 1277(Baldock, B., concurring).

United States v. Giberson, 527 F.3d at 890; see also

62

United States v. Payton, 573 F.3d at 864 (suppression

required where agents abandoned search for narcotics and

began searching for child pornography). This is just

the sort of “widest possible net” search that sweeps

everything into plain view and eliminates any possibility

of privacy simply because a computer has categories of

files. Cf. United States v. Walser, 275 F.3d 981, 986

(10th Cir. 2001)(“The underlying premise in Carey is that

officers conducting searches (and the magistrates issuing

the warrants for those searches) cannot simply conduct a

sweeping, comprehensive search of a computer’s hard

drive”). Just because it is possible for a computer to

pull every picture file on a laptop in order to find out

if it relates to the illegal sale of pesticides does not

mean that the government should be allowed to leaf

through every personal picture a person has on their

drive. Clearly, the government is asking for the right

to look at everything. The purpose of the exclusionary

rule is to deter “knowing,” “widespread,” “routine” or

“systemic” police misconduct. Ample evidence in the

warrant affidavit and Adkison’s testimony establishes

63

“knowingly” and “systematically” contriving to create

plain view of everything seized, outside probable cause

for purchasing, selling and shipping CFCs and

unregistered pesticides. The second warrant based on the

illegally obtained evidence doesn’t survive the

requirements of CDT II, viz. magistrate judges should

require waiving “plain view.” Comprehensive Drug

Testing, 621 F.3d 1162, 1177-1178 (Kozinski, C.J.,

concurring); Id. at 1170-71 (Maj. Op).

It may well be the case that some computer users are

extremely sophisticated and can hide files in inventive

ways. There was no reason to believe that David Grummer

was one of those individuals. Indeed, it did not appear

that Mr. Grummer was making any efforts whatsoever to

conceal his EPA violating sales. Moreover, Mr. Grummer

was cooperating with the government at the time of the

search and had pled guilty. Thus, when the affiant says

that “criminals can mislabel and hide files and

directories, use codes to avoid using keywords, encrypt

files, deliberately misspell certain words, delete files

and take other steps to defeat law enforcement,” [CR 35],

64

while theoretically possible, there was no reason to

believe such a circumstance obtained. Comprehensive

Drug Testing, 621 F.3d 1162, 1178-1179 (Kozinski, C.J.,

concurring); Id. at 1167-68, 1175-76 (Maj. Op). Here,

the risk asymptotically approaches zero, which was not

disclosed to the magistrate judge who requires this

information to determine probable cause and proper

protocols to search computers. Id. at 1170-72 (Maj. Op).

Only once a targeted search has failed should the

possibility be entertained that Mr. Grummer was hiding

files with misleading names or formats.

Thousands of file types exist; most have been

standardized, meaning a signature – or header – is

recognized by the program the file belongs to and the

operating system. One tactic to hide data is changing

the 3 letter extension on a file or removing the file

extension altogether. Performing a signature analysis,

however, identifies which files may have been altered to

h i d e t h e i r t r u e f u n c t i o n . S e e

www.computer-forensics.net/what-is-a-file-signature?/;

en.wikipedia.org/wiki/File_signature. FTK and other

65

forensic examination software can identify files with bad

signatures to limit searches to these suspect files.

This technology obviates the need to open every image

file in case a criminal attempting to frustrate a search

renamed his “criminal_conspiracy_notes.doc” to

“sundayschoolphoto.jpg.” The bad signature on such files

flags them for investigators, eliminating the excuse to

“check everything.”

Similarly, hidden files and directories are

detectable using the operating system and with forensic

search software. Initial steps in computer forensic

searches should employ the forensic software to find

every file on the computer, particularly those hidden

deleted, encrypted, or protected by passwords, and

deleted but not yet overwritten. Searches are neither

defeated nor impeded by “hidden” files or directories.

If probable cause exists such files should be searched,

but mere possibility of or encounter with these types of

files cannot justify placing everything in plain view.

The search of Carey’s computer transformed the

warrant into a “general warrant,” constituting a general,

66

illegal search in “flagrant disregard” for the terms of

the warrant and in violation of the Fourth Amendment.

Carey, 172 F.3d at 1272. Despite the specificity of the

warrant, files unrelated to sale or distribution of

controlled substances were opened and searched. Id.

citing United States v. Foster, 100 F.3d 846, 859-850

(10th Cir. 1996).

The claim that mislabeled files could contain

evidence of EPA violations is not credible here, where

the putative “disguise” suggests the heinous crime of

possessing child pornography. The Supreme Court has

instructed, “the plain view doctrine may not be used to

extend a general exploratory search from one object to

another until something incriminating at last emerges.”

Coolidge v. New Hampshire, 403 U.S. 443, 466 (1971).

That principle is crystallized in computer search

contexts by this Court in CDT II.

As in Carey, there are no ambiguously labeled files

contained on Grummer’s hard drive directories. 172 F.3d

at 1275. There was no need to open each file to discover

its contents. Id. Relying on analogies to closed

67

containers or file cabinets may lead courts to

“oversimplify a complex area of Fourth Amendment

doctrines and ignore the realities of massive modern

computer storage.” Id. quoting Raphael Winick, Searches

and Seizures of Computers and Computer Data, 8 Harv. J.

L. & Tech. 75, 104 (1994).

Just as in Carey, officers seized the computers;

there were no “exigent circumstances or practical reasons

to permit officers to rummage through all of the stored

data regardless of its relevance or its relation to the

information specified in the warrant.” Id. at 1276,

quoting Winick, 8 Harv. J.L. & Tech. At 105. With the

computer images in his custody, Agent Adkison could have

avoided searching file types not identified in the

warrant by observing file types and titles listed in the

directory, doing a key word search for relevant terms,

checking file signatures and identifying hidden files and

directories as necessary, and even using OCR searching of

images rather than opening them, if warranted. Id. at

107.

Agent Adkison never bothered to list files on the

68

directory and conduct keyword searches, nor did he use

information from the warrant or the case agent to limit

his searches to items specified in the warrant, nor seek

a new warrant authorizing a search for any image files.

Carey, 172 F.3d at 1276. Accordingly, this Court should

hold that Adkison violated the limits of the warrant, the

search violated the Fourth Amendment, and remand to the

district court to suppress the evidence.

E. MR. GRUMMER’S CONVICTION FOR BOTH THE POSSESSIONAND RECEIPT OF CHILD PORNOGRAPHY VIOLATED DOUBLEJEOPARDY

In United States v. Davenport, this Court held that

possession was a lesser included offense of receipt. 519

F.3d at 947 (“Having rejected the government’s argument

that possession of child pornography requires proof of an

element that receipt does not, we conclude that, under

the Blockburger test, the offense of possessing child

pornography is a lesser included offense of the receipt

of child pornography.” Mr. Grummer’s case involves

convictions for both possession and receipt and the

evidence overlapped between the counts.

The only distinction to be drawn in Mr. Grummer’s

69

case is that the government charged the possession of

specific images in the receipt counts, but charged the

possession of the storage devices in the possession

counts. [CR 25]. This Court rejected a similar style

argument in United States v. Schales:

If the government wishes to charge adefendant with both receipt and possession ofmaterial involving the sexual exploitation ofminors based on separate conduct, it mustdistinctly set forth each medium forming thebasis of the separate counts. For example, wenote that there would have been no doublejeopardy violation if the government haddistinctly charged Schales with both receipt ofmaterial involving the sexual exploitation ofminors for the images that he downloaded fromthe internet and with possession of materialinvolving the sexual exploitation of minors forthe images that he transferred to and stored oncompact discs. However, the indictment aswritten does not allow us to conclude that thejury found Schales guilty of separate conduct.Instead, the indictment charges Schales withreceipt of the material by way of downloading itfrom the internet onto his computer andpossession of this material in the same medium.This is multiplicitous. See Davenport, 519 F.3dat 947; Giberson, 527 F.3d at 891.

546 F.3d at 980.

The indictment’s allegation of different dates of

commission for the possession and receipt counts is

insufficient to save the charges from a double jeopardy

70

claim:

The allegation of different dates ofcommission for each offense, by itself, isinsufficient to carve out separate conduct. Oncea person receives something, he also necessarilypossesses it as of that moment, based upon asingle action (like downloading a file). SeeDavenport, 519 F.3d at 943. Thus, merely citingdifferent dates or date ranges for the receiptand possession charges alone does not suffice toseparate the conduct for double jeopardypurposes. Cf. Schales, 546 F.3d at 979-80(noting that the indictment charged Schales withpossession during a period that was a monthlonger than the period charged for the receiptoffense, but nevertheless concluding theindictment was multiplicitous). Rather, thegovernment must allege and prove distinctconduct underlying each charge, whether theconduct underlying each charge occurred on thesame or different dates.

United States v. Lynn, 2011 U.S. App. LEXIS 11254, 24-25

(9th Cir. Cal. May 31, 2011).

The burden is on the government to allege distinct

conduct for each charge: “If the government wishes to

charge a defendant with both receipt and possession of

material involving the sexual exploitation of minors

based on separate conduct, it must distinctly set forth

each medium forming the basis of the separate counts.”

Schales, 546 F.3d at 980. The government “must allege in

71

what form the defendant received the image and in what

form he possessed it. In Schales, the indictment did not

specifically allege different media, nor did the

instructions or verdict reflect separate conduct;

therefore, the dual convictions violated double jeopardy.

United States v. Lynn, 2011 U.S. App. LEXIS 11254 at

25-26.

Nothing in the indictment required the jury to find

that Mr. Grummer’s possession convictions be premised on

different images than those involved in the receipt

convictions. [CR 25]. Nothing in the jury instructions

told the jurors that the possession convictions had to be

premised on different images. [CR 65]. The jury’s

verdict form did not require any finding that a different

image was involved. [CR 66].

Inasmuch as the Court has consistently found that

receipt/possession double jeopardy violation should be

noticed on plain error review, e.g. Davenport and Lynn,

Mr. Grummer’s possession or receipt convictions ought to

be vacated.

72

VIII.

CONCLUSION

Mr. Grummer’s conviction should be vacated and the

matter remanded to the district court to suppress the

illegally obtained evidence.

Respectfully Submitted,

Date: August 11, 2011 /S/DAVID J. ZUGMANDAVID J. ZUGMANGABRIEL L. COHANCounsel for Mr. Grummer

73

APPENDIX OF STATUTES

18 U.S.C. § 2251. Sexual exploitation of children

(a) Any person who employs, uses, persuades, induces,entices, or coerces any minor to engage in, or who has aminor assist any other person to engage in, or whotransports any minor in or affecting interstate orforeign commerce, or in any Territory or Possession ofthe United States, with the intent that such minor engagein, any sexually explicit conduct for the purpose ofproducing any visual depiction of such conduct or for thepurpose of transmitting a live visual depiction of suchconduct, shall be punished as provided under subsection(e), if such person knows or has reason to know that suchvisual depiction will be transported or transmitted usingany means or facility of interstate or foreign commerceor in or affecting interstate or foreign commerce ormailed, if that visual depiction was produced ortransmitted using materials that have been mailed,shipped, or transported in or affecting interstate orforeign commerce by any means, including by computer, orif such visual depiction has actually been transported ortransmitted using any means or facility of interstate orforeign commerce or in or affecting interstate or foreigncommerce or mailed. (b) Any parent, legal guardian, or person having custodyor control of a minor who knowingly permits such minor toengage in, or to assist any other person to engage in,sexually explicit conduct for the purpose of producingany visual depiction of such conduct or for the purposeof transmitting a live visual depiction of such conductshall be punished as provided under subsection (e) ofthis section, if such parent, legal guardian, or personknows or has reason to know that such visual depictionwill be transported or transmitted using any means orfacility of interstate or foreign commerce or in oraffecting interstate or foreign commerce or mailed, ifthat visual depiction was produced or transmitted usingmaterials that have been mailed, shipped, or transported

74

in or affecting interstate or foreign commerce by anymeans, including by computer, or if such visual depictionhas actually been transported or transmitted using anymeans or facility of interstate or foreign commerce or inor affecting interstate or foreign commerce or mailed. (c) (1) Any person who, in a circumstance described inparagraph (2), employs, uses, persuades, induces,entices, or coerces any minor to engage in, or who has aminor assist any other person to engage in, any sexuallyexplicit conduct outside of the United States, itsterritories or possessions, for the purpose of producingany visual depiction of such conduct, shall be punishedas provided under subsection (e). (2) The circumstance referred to in paragraph (1) isthat-- (A) the person intends such visual depiction to betransported to the United States, its territories orpossessions, by any means, including by using any meansor facility of interstate or foreign commerce or mail; or (B) the person transports such visual depiction tothe United States, its territories or possessions, by anymeans, including by using any means or facility ofinterstate or foreign commerce or mail. (d) (1) Any person who, in a circumstance described inparagraph (2), knowingly makes, prints, or publishes, orcauses to be made, printed, or published, any notice oradvertisement seeking or offering-- (A) to receive, exchange, buy, produce, display,distribute, or reproduce, any visual depiction, if theproduction of such visual depiction involves the use ofa minor engaging in sexually explicit conduct and suchvisual depiction is of such conduct; or (B) participation in any act of sexually explicitconduct by or with any minor for the purpose of producinga visual depiction of such conduct; shall be punished as provided under subsection (e). (2) The circumstance referred to in paragraph (1) is

75

that-- (A) such person knows or has reason to know thatsuch notice or advertisement will be transported usingany means or facility of interstate or foreign commerceor in or affecting interstate or foreign commerce by anymeans including by computer or mailed; or (B) such notice or advertisement is transportedusing any means or facility of interstate or foreigncommerce or in or affecting interstate or foreigncommerce by any means including by computer or mailed. (e) Any individual who violates, or attempts or conspiresto violate, this section shall be fined under this titleand imprisoned not less than 15 years nor more than 30years, but if such person has one prior conviction underthis chapter, section 1591 [18 USCS § 1591], chapter 71,chapter 109A, or chapter 117 [18 USCS §§ 2251 et seq., 18USCS §§ 1460 et seq., 2241 et seq., or 2421 et seq.], orunder section 920 of title 10 (article 120 of the UniformCode of Military Justice), or under the laws of any Staterelating to aggravated sexual abuse, sexual abuse,abusive sexual contact involving a minor or ward, or sextrafficking of children, or the production, possession,receipt, mailing, sale, distribution, shipment, ortransportation of child pornography, such person shall befined under this title and imprisoned for not less than25 years nor more than 50 years, but if such person has2 or more prior convictions under this chapter, chapter71, chapter 109A, or chapter 117 [18 USCS §§ 2251 etseq., 18 USCS §§ 1460 et seq., 2241 et seq., or 2421 etseq.], or under section 920 of title 10 (article 120 ofthe Uniform Code of Military Justice), or under the lawsof any State relating to the sexual exploitation ofchildren, such person shall be fined under this title andimprisoned not less than 35 years nor more than life. Anyorganization that violates, or attempts or conspires toviolate, this section shall be fined under this title.Whoever, in the course of an offense under this section,engages in conduct that results in the death of a person,shall be punished by death or imprisoned for not lessthan 30 years or for life.

76

18 U.S.C. § 2252. Certain activities relating to materialinvolving the sexual exploitation of minors

(a) Any person who-- (1) knowingly transports or ships using any means orfacility of interstate or foreign commerce or in oraffecting interstate or foreign commerce by any meansincluding by computer or mails, any visual depiction,if-- (A) the producing of such visual depiction involvesthe use of a minor engaging in sexually explicit conduct;and (B) such visual depiction is of such conduct; (2) knowingly receives, or distributes, any visualdepiction using any means or facility of interstate orforeign commerce or that has been mailed, or has beenshipped or transported in or affecting interstate orforeign commerce, or which contains materials which havebeen mailed or so shipped or transported, by any meansincluding by computer, or knowingly reproduces any visualdepiction for distribution using any means or facility ofinterstate or foreign commerce or in or affectinginterstate or foreign commerce by any means including bycomputer or through the mails, if-- (A) the producing of such visual depiction involvesthe use of a minor engaging in sexually explicit conduct;and (B) such visual depiction is of such conduct; (3) either-- (A) in the special maritime and territorialjurisdiction of the United States, or on any land orbuilding owned by, leased to, or otherwise used by orunder the control of the Government of the United States,or in the Indian country as defined in section 1151 ofthis title [18 USCS § 1151], knowingly sells or possesseswith intent to sell any visual depiction; or (B) knowingly sells or possesses with intent tosell any visual depiction that has been mailed, shipped,or transported using any means or facility of interstateor foreign commerce, or has been shipped or transportedin or affecting interstate or foreign commerce, or which

77

was produced using materials which have been mailed or soshipped or transported using any means or facility ofinterstate or foreign commerce, including by computer,if-- (i) the producing of such visual depictioninvolves the use of a minor engaging in sexually explicitconduct; and (ii) such visual depiction is of such conduct;or (4) either-- (A) in the special maritime and territorialjurisdiction of the United States, or on any land orbuilding owned by, leased to, or otherwise used by orunder the control of the Government of the United States,or in the Indian country as defined in section 1151 ofthis title [18 USCS § 1151], knowingly possesses, orknowingly accesses with intent to view, 1 or more books,magazines, periodicals, films, video tapes, or othermatter which contain any visual depiction; or (B) knowingly possesses, or knowingly accesses withintent to view, 1 or more books, magazines, periodicals,films, video tapes, or other matter which contain anyvisual depiction that has been mailed, or has beenshipped or transported using any means or facility ofinterstate or foreign commerce or in or affectinginterstate or foreign commerce, or which was producedusing materials which have been mailed or so shipped ortransported, by any means including by computer, if-- (i) the producing of such visual depictioninvolves the use of a minor engaging in sexually explicitconduct; and (ii) such visual depiction is of such conduct; shall be punished as provided in subsection (b) of thissection. (b) (1) Whoever violates, or attempts or conspires toviolate, paragraph (1), (2), or (3) of subsection (a)shall be fined under this title and imprisoned not lessthan 5 years and not more than 20 years, but if such

78

person has a prior conviction under this chapter, section1591 [18 USCS § 1591], chapter 71, chapter 109A, orchapter 117 [18 USCS §§ 2251 et seq., §§ 1460 et seq.,2241 et seq., or 2421 et seq.], or under section 920 oftitle 10 (article 120 of the Uniform Code of MilitaryJustice), or under the laws of any State relating toaggravated sexual abuse, sexual abuse, or abusive sexualconduct involving a minor or ward, or the production,possession, receipt, mailing, sale, distribution,shipment, or transportation of child pornography, or sextrafficking of children, such person shall be fined underthis title and imprisoned for not less than 15 years normore than 40 years. (2) Whoever violates, or attempts or conspires toviolate, paragraph (4) of subsection (a) shall be finedunder this title or imprisoned not more than 10 years, orboth, but if such person has a prior conviction underthis chapter, chapter 71, chapter 109A, or chapter 117[18 USCS §§ 2251 et seq., §§ 1460 et seq., 2241 et seq.,or 2421 et seq.], or under section 920 of title 10(article 120 of the Uniform Code of Military Justice), orunder the laws of any State relating to aggravated sexualabuse, sexual abuse, or abusive sexual conduct involvinga minor or ward, or the production, possession, receipt,mailing, sale, distribution, shipment, or transportationof child pornography, such person shall be fined underthis title and imprisoned for not less than 10 years normore than 20 years. (c) Affirmative defense. It shall be an affirmativedefense to a charge of violating paragraph (4) ofsubsection (a) that the defendant-- (1) possessed less than three matters containing anyvisual depiction proscribed by that paragraph; and (2) promptly and in good faith, and without retainingor allowing any person, other than a law enforcementagency, to access any visual depiction or copy thereof-- (A) took reasonable steps to destroy each suchvisual depiction; or (B) reported the matter to a law enforcement agencyand afforded that agency access to each such visual

79

depiction

80

CERTIFICATE OF RELATED CASES

Mr. Grummer is unaware of other cases related to his

own.

Respectfully submitted,

S/David ZugmanDated: August 11, 2011 David Zugman

Attorney for Mr. Grummer

81

CERTIFICATE OF COMPLIANCE PURSUANT TO FED. R. APP. 32(A)(7)(C)AND

CIRCUIT RULE 32-1 FOR CASE NUMBER 10-50403

I certify that: (check appropriate options(s))

X 1. Pursuant to Fed. R. App. P. 32(a)(7)(C)and Ninth CircuitRule 32-1, the attached opening/answering/reply/crossappeal brief is

X Proportionately spaced, has a typeface of 14 points or more and contains 12874 words (opening, answering, and the second and third briefs filedin cross-appeals must NOT exceed 14,000 words; reply briefs mustNOT exceed 7,000 words),

or is

Monospaced, has 10.5 or fewer characters per inch and contains ______words or _____ lines of text (opening, answering, and second and thirdbriefs filed in cross-appeals must NOT exceed 14,000 words, or 1,300lines of text; reply briefs must NOT exceed 7,000 words or 650 lines oftext).

2. The attached brief is NOT subject to the type-volume limitations of Fed. R.App. P. 32(a)(7)(B) because

This brief complies with Fed. R. App. P. 32(a)(1)-(7) and is a principalbrief of no more than 30 pages or a reply brief of no more than 15 pages;

This brief complies with a page or size-volume limitation established byseparate court order date __________ and is

Proportionately spaced, has a typeface of 14 points or more andcontains ____ words,

or is Monospaced, has 10.5 or fewer characters per inch and contains

____ pages or ____ words or ____ lines of text.

82

____ 3. Briefs in Capital Cases

This brief is being filed in a capital case pursuant tot he type-volume limitations set fourth a Circuit Rule 32-4 and is

Proportionately spaced, has a typeface of 14 points or more andcontains __________ words (opening, answering, and the secondand third briefs filed in cross-appeals must NOT exceed 21,000words; reply briefs must not exceed 9,800 words)

Monospaced, have 10.5 or fewer characters per inch and contain___________ words or _________ lines of text (opening,answering, and the second and third briefs filed in cross-appealsmust NOT exceed 75 pages or 1,950 lines of text; reply briefsmust NOT exceed 35 pages or 910 lines of text).

_____4. Amicus Briefs

Pursuant to Fed. R. App. P. 29(d) and 9th Cir. R. 32-1, theattached amicus brief is proportionally spaced, has a typeface of14 points or more and contains 7,000 words or less.

or is

Monospaced, has 10.5 or fewer characters per inch and containsnot more than either 7,000 words or 650 lines of text.

or is

NOT subject to the type-volume limitation because it is anamicus brief of no more than 15 pages and complies with Fed. R.App. P. 32(a)(1)(5).

S/David ZugmanDate: August 11, 2011 DAVID ZUGMAN

Signature of Filing Party

83

PROOF OF SERVICE

I hereby certify that on August 11, 2011, Ielectronically filed the foregoing with the Clerk of theCourt for the United States Court of Appeals for theNinth Circuit by using the appellate CM/ECF system.

I certify that all participants in the case areregistered CM/ECF users and that service will beaccomplished by the appellate CM/ECF system.

s/David J. ZugmanDavid J. Zugman

84