Oral Argument Recap: United States v. Ganias

The U.S. Court of Appeals for the Second Circuit sat en banc Wednesday afternoon for the first time in almost two years. The occasion? An otherwise-mundane tax fraud prosecution that propelled the Fourth Amendment into the digital era.

My backgrounder on Tuesday provides some of the details of the Ganias case, but the Court asked for briefing on two issues: First, did the government’s 2006 search—pursuant to a warrant—of data that was obtained during the execution of a 2003 warrant violate the Fourth Amendment, given that the data was not responsive to the first warrant? Second, if so, did the good faith exception nonetheless preclude application of the exclusionary rule? Roughly halfway through the Government’s argument, though, Chief Judge Robert Katzmann hinted at the underlying privacy issues that helped explain why the courtroom was full: He asked whether, if the government collected private data on him, or anyone else in the room, it would be obligated to inform that person. (The Government artfully sidestepped the question, saying that it would have no way of knowing whether it held any such information because it wouldn’t review nonresponsive data.)

Although the argument was nominally divided between appellant and appellee, it might as easily have been divided by issue. While the court questioned Ganias’s lawyer, former U.S. Attorney for Connecticut Stanley Twardy, extensively about the good faith exception, AUSA Sandra Glover faced questions almost exclusively on the Fourth Amendment violation issue. It’s always hard, and perhaps foolish, to draw conclusions based on oral argument, but the court appeared skeptical about the application of the exclusionary rule. (Recall that this was the only issue for which the government sought panel rehearing.) While that decision matters a great deal to Stavros Ganias, Lawfare readers are likely more interested in the underlying Fourth Amendment issue.

Having that in mind, I’ll just note that much of the exclusionary rule discussion—led by Judge Reena Raggi—seemed to turn on whether the appropriate standard was announced by the Supreme Court's decision in Davis v. United States, or its decision in United States v. Leon. I overview the rest of the day's key themes below.

Computer Search Protocols

Chief Judge Katzmann quickly set the tone for the rest of the hour when he almost immediately interrupted Ganias’s lawyer, asking whether the government could have retained Ganias’s actual computer for the duration of the prosecution. Twardy answered no, and none of the judges really pressed him on this issue—Ganias conceded that the government could make a mirror image copy for offsite review. Ganias also largely dropped his argument, pressed in the district court and in the briefs, that the mirror imaging (and subsequent use) rendered the 2003 warrant an impermissible “general warrant.” Rather, Ganias argued only that the government had to return nonresponsive documents, relying heavily on United States v. Tamura, a Ninth Circuit case related to voluminous paper records.

The Government seized on this acceptance of the procedures—copy, remove, search, retain—in its (very brief) argument devoted to the good faith exception. The agents followed established protocol, Glover argued, and when they wanted to go beyond the initial warrant, they got a new one. The critical question, though, was how long the government got to retain the data, and more specifically how long it got to retain the nonresponsive data. The Government disclaimed any argument that it could retain the data indefinitely—instead it could retain it only for a “reasonable” amount of time, which would include at least the length of the underlying investigation and prosecution—here, the prosecution of the government contractors targeted by the 2003 warrant.

The government advanced several reasons it would need to retain any nonresponsive data for the duration of the prosecution. First, it argued it would need it to authenticate the evidence. Second, the government also argued that it would need to retain it in case some of the nonresponsive files turned out later to be responsive—the “nonresponsive” files might include files that just had not yet been characterized as responsive. And the government also argued that it couldn’t destroy the nonresponsive files because doing so might violate its obligations under Brady. Several judges asked whether Brady would really authorize such a broad overseizure, on the off-chance that some “nonresponsive” documents might turn out to also be exculpatory. (In its brief, the government also argued that the mirror images were needed to maintain data integrity in the event temporary storage devices—the DVDs containing segregated data relied on by the actual investigators—degraded over time.)

The court also considered possible changes to the warrant process. Judge Raggi asked whether the government should be required to tell the magistrate judge of its post-segregation plans for the nonresponsive data. Otherwise, she wondered, how could the magistrate assess the reasonableness of the seizure? Judge Dennis Jacobs asked whether magistrates should impose use restrictions on the evidence collected. Such a solution would allow the government to meet all of its asserted interests here while also preventing warrant scope creep.

Analogizing to Other Types of Evidence

The key issue was what the government had to do with nonresponsive data after it had segregated it from data responsive to the 2003 warrant. The government wanted to keep it for authentication and, if it got a warrant, subsequent search. Ganias, of course, thought it needed to be returned or destroyed as soon as it was marked nonresponsive. To answer this question, the judges considered several possible analogies, including Chief Judge Katzmann’s analogy to the actual computer. The court and parties also considered filing cabinets, physical evidence, and diaries. Judge Debra Livingston suggested that the government could keep a piece of clothing with a bloodstain on it for the duration of the trial—echoing an argument the government made in its brief about a seized car—even after it had collected the DNA sample. Twardy acknowledged this, but pointed out that in such a case the warrant would authorize seizure of the entire dress—by contrast, in this case the 2003 warrant was narrowed to files related to the underlying contractor fraud.

The government seemed torn on how to address the differences when searching computers. Glover began by arguing that the “filing cabinet” analogy was wrong. Instead, the proper analogy was to a diary, where two entries might contain damning evidence, and the rest innocuous but private details. In that case, no one would ever suggest that the government had to tear out the nonresponsive pages and return them to the author. This argument didn’t gain much traction with the judges, some of whom explicitly rejected it and some of whom persisted in using the filing cabinet analogy. As Judge Denny Chin pointed out, a computer contains far more information, and far more private information, than even a diary (a point Twardy later echoed, citing Riley).

From that point forward, Glover’s response to the filing cabinet analogy seemed to boil down to “computers are different.” Glover argued that, unlike with a filing cabinet, the government couldn’t return nonresponsive data because some of it—such as metadata and log files—might later turn out to be responsive. But as Judge Gerard Lynch characterized it, the government’s argument was essentially that the more information there was, the more information the government could keep in case at some point in the future more of it became apparently responsive.

Hashes and Authentication

If the government is allowed to retain the nonresponsive data, what is it allowed to do with it? The government argued that, as long as it got a warrant, it could search it, as it did here. Judge Chin, who wrote the panel opinion, appeared skeptical of this claim, and got the government to admit that the data remained Ganias’s property while they retained it. But the Government also argued that it could retain the data, independent of any other investigation, to use for authentication purposes. The Court explored the issue in depth.

As Twardy pointed out, the government could authenticate the evidence the same way it authenticated paper evidence: with agents testifying about the steps they took to obtain the evidence and secure it against tampering. Judge Rosemary Pooler even suggested that if the government needed to authenticate the evidence in its case against the contractors, it could call Mr. Ganias himself to aver that the documents came from his computer. Judge Peter Hall, though, suggested that authentication also spoke—and loudly—to the weight of the evidence. Judge Raggi agreed: a defense attorney would be certain to argue that there were ways to definitively authenticate a digital record and that they were not used.

The Government didn’t walk away with that argument though: Judge Lynch in particular thought these arguments were equally likely to crop up when the government introduced other evidence—including evidence from a filing cabinet. If the government’s argument didn’t work in the filing cabinet context, why would it work in the computer context? The government argued that there was more skepticism of computer data, which might be more subject to tampering.

The court also examined the technical aspects of authentication in some detail. Judge Richard Wesley asked whether the government would ever need to examine the actual substance of any of the nonresponsive files in order to authenticate the responsive files. If the hash values are based just on the “ones and zeroes,” then authentication wouldn’t justify ever looking at the documents. One other aspect gave particular pause to many of the judges: why couldn’t the government just obtain hash values for the files that were responsive, and then return or destroy the nonresponsive files? The government argued that this would be infeasible because it wouldn’t know which files were responsive until it completed its offsite review. But, the judges countered, why couldn’t the Government just rehash the responsive files after they were segregated? The government argued that creating hashes for each of the responsive files, at least when there were many thousands of files, would take too long and be too burdensome.