Data Security

2nd Circuit Permits Search of Hard Drives Seized Years Earlier

Published: Jun. 06, 2016

Updated: Oct. 05, 2020

The Second Circuit Court of Appeals has handed down an important decision, en banc, concerning governmental access to data. In United States v. Ganias, the Court determined that law enforcement, relying in good faith on a warrant, could search a set of hard drives which were seized pursuant to a separate warrant in an investigation years earlier. The hard drives contained data which was non-responsive to this earlier warrant, but regardless, both the responsive and non-responsive data was retained by the government and thus available for searching pursuant to the second warrant. The case highlights the importance of taking steps to ensure data disclosed to the government is used only for limited purposes, and that the government destroys or returns the data after such usage. Ganias demonstrates that companies that are compelled to disclose data should: 1) Narrowly interpret any warrants, subpoenas, or court orders and carefully limit the production to that data which was specifically requested; 2) At the time the data is shared with the government, include written requirements that non-responsive data be returned or destroyed once identified, and that all other data be returned or destroyed at the conclusion of the investigation; and 3) Follow-up with the government to ensure the data has been destroyed or returned.

Originally, the U.S. Army Criminal Investigation Division was investigating contractors for making false claims and stealing government property. A warrant authorized the search and seizure of records held by the contractors’ accountant, including hard drives, relevant to the alleged crimes. The search was executed in 2003, and the accountant’s hard drives were mirrored for later forensic analysis. The hard drives contained data unrelated to the contractors under investigation, including the accountant’s own financial records, and those of other clients. Eventually, IRS investigators came to suspect that the accountant himself was underreporting his personal income and thereby committing tax evasion.

A second warrant was authorized in 2006 for the accountant’s tax files. That data was known to be stored on the hard drives seized in 2003, though it was irrelevant to that case. The accountant was convicted of two counts of tax evasion in 2011, and evidence from those files was presented at trial. The accountant appealed his conviction, and a panel of the Second Circuit concluded unanimously that the government had violated the Fourth Amendment by searching the hard drives pursuant to the 2006 warrant. The panel ordered suppression of the evidence obtained in executing the 2006 warrant and vacated the jury verdict. The Court subsequently ordered a rehearing en banc.

In its en banc opinion, the Second Circuit did not reach the Fourth Amendment question, finding instead that the 2006 search was conducted in reliance in good faith on a warrant. The good faith exception to the exclusionary rule holds that evidence obtained under a warrant later found to be invalid is nonetheless admissible if the police reasonably relied on the notion that the warrant was valid. Therefore, the Court did not require suppression of the evidence and thus avoided any decision as to whether retention of the hard drives did in fact violate the Fourth Amendment.

The Court nonetheless devoted a significant portion of the opinion—25 pages—to the discussion of digital file searches. In this dicta, the Court expresses a clear belief that digital files are different in kind than physical files, and that the return or destruction of non-responsive digital files may not be required under the Fourth Amendment. In contrast, Judge Chin wrote a forceful dissent, arguing that the Second Circuit panel was correct that the search was unconstitutional and should not be covered by the good faith exception.

Additionally, the Court highlighted throughout its opinion that the defendant never sought the return or destruction of his data after its use in the initial investigation of the contractors:

As noted above, Ganias never sought the return of any seized material, either by negotiating with the Government or by motion to the court…. [W]e agree with the district court that, as a pragmatic matter, such a motion would have given a court the opportunity to consider whether the government’s interest could be served by an alternative to retaining the property, and perhaps to order the mirrors returned to Ganias, all while enabling the court to impose reasonable conditions to protect access to the property and its use in later proceedings.

As Judge Lohier stated in his concurrence, “it may be helpful for litigants to use the mechanism provided by Rule 41(g) of the Federal Rules of Criminal Procedure when faced with the Government’s retention of electronic data.” Other tools, including stipulations and protective orders, may also be employed to prevent data from being stockpiled by law enforcement for future use in any number of ways. Ganias demonstrates that companies who are compelled to disclose user data pursuant to legal process should implement policies and procedures to ensure the government destroys or returns non-responsive data, and data no longer being used in an investigation.