A federal district court judge in the District of Columbia last week granted a motion to suppress evidence obtained by a DHS Special Agent after a laptop was seized from a departing passenger at LAX and subsequently subjected to a comprehensive forensic search. Prosecutors attempted to defend the search as a routine border search which could be conducted without reasonable suspicion of any kind and without any warrant. The court held that the search was impermissible both because the government had no reasonable suspicion of “ongoing or imminent” criminal behavior and because the search was an extensive forensic search conducted away from the border after the passenger had long departed the country.

In the case at issue, the DHS had some evidence that the defendant, five years prior to the search, had shipped items to China knowing that they were going to be transshipped to Iran. When the investigating special agent learned that the defendant had traveled to the United States, the agent decided to have CBP seize the defendant’s laptop at LAX when he departed the country. The laptop was then shipped to San Diego where the hard drive was imaged. Specialized software was then used to search the contents of the hard drive. More than 20,000 files and a large number of emails were retrieved which, after review by the special agent, provided evidence of the Iran exports that occurred five years earlier. The special agent then applied for, and obtained, a search warrant seeking authority to seize those emails and documents which then served as a basis for the prosecution before the federal district court in the District of Columbia.

The Court’s decision that the search was unreasonable relied on a number of factors. First, the court noted that suspicion of prior criminal activity was not a reasonable suspicion that could support a warrantless search at the border. Such a search could only be justified on the basis of a suspicion of imminent or ongoing criminal activity, not past criminal activity, and there was no reason for the agent to suspect ongoing or imminent criminal activity. Instead he was just fishing for evidence of past criminal activity.

Second, the court distinguished the type of search that occurred from a routine border search that could be justified by reasonable suspicion of ongoing or imminent criminal activity. The court noted that the actual search occurred long after the passenger had departed and at hundreds of miles from the border where the laptop was seized. Additionally, it was a search of unlimited scope and unlimited duration. This, the court felt, was far different from opening and examining a passengers luggage or briefcase at the border for a search prior to departure.

The court also seemed troubled by misrepresentations made by the DHS Special Agent when he did finally apply for a warrant to seize the documents obtained from the defendant’s hard drive. The affidavit in support of the application for a warrant represented to the court that the warrant was needed to enable a search of the “mind-boggling” amount of data on the hard drive and that the extraction of the data “may take weeks or months.” In fact, this was all a charade (to use a polite term); all of the extraction had already occurred and no further searches of the hard drive were thereafter conducted by the DHS special agent or the government.

Although the court did not directly focus on this, another factor seems dispositive here. Warrantless searches are normally justified by some exigency for the search which makes it difficult to obtain a warrant in advance. In a typical border search, the luggage or briefcase being examined is about to leave the country and seeking a warrant before that departure would be impractical. Here, however, the government had the luxury of all the time in the world to image the hard drive and examine its contents. There is no possible reason as to why it was impractical to get a warrant before extracting the data and rifling through its contents.