You are on page 1of 31

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 1 of 31

IN THE UNITED STATES DISTRICT COURT


FOR THE DISTRICT OF OREGON

UNITED STATES OF AMERICA,


Plaintiff,
v.

3:16-cr-00051-BR
ORDER DENYING MOTION TO
SUPPRESS FACEBOOK
EVIDENCE

AMMON BUNDY, JON RITZHEIMER,


JOSEPH OSHAUGHNESSY, RYAN
PAYNE, RYAN BUNDY, BRIAN
CAVALIER, SHAWNA COX, PETER
SANTILLI, JASON PATRICK,
DUANE LEO EHMER, DYLAN
ANDERSON, SEAN ANDERSON,
DAVID LEE FRY, JEFF WAYNE
BANTA, SANDRA LYNN ANDERSON,
KENNETH MEDENBACH, BLAINE
COOPER, WESLEY KJAR, COREY
LEQUIEU, NEIL WAMPLER, JASON
CHARLES BLOMGREN, DARRYL
WILLIAM THORN, GEOFFREY
STANEK, TRAVIS COX, ERIC LEE
FLORES, and JAKE RYAN,
Defendants.

BROWN, Judge.
This matter comes before the Court on the reopened Motion
(#741) to Suppress Evidence (Facebook Accounts) filed by
Defendant David Lee Fry on behalf of all Defendants.
1 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 2 of 31

For the reasons that follow, the Court DENIES Defendants


Motion, and, pursuant to the Courts supervisory authority over
the government, the Court ADMONISHES the government for its lack
of diligence in failing to ensure that nonresponsive information
from the seized Facebook accounts was sealed or destroyed in a
timely manner pursuant to the Warrant issued April 8, 2016,
following completion of the segregation of such data on June 21,
2016.

PROCEDURAL BACKGROUND
On June 20, 2016, Fry filed on behalf of all Defendants a
Motion (#741) to Suppress Evidence (Facebook Accounts).

The

Court initially heard oral argument on Defendants Motion on


July 18, 2016, and received into evidence for purposes of this
Motion Defendants Exhibits D-H in addition to the materials
filed with the Motion.1

On July 20, 2016, the Court issued an

Order (#915) denying Defendants Motion.


On August 16, 2016, however, Defendants filed a Motion
(#1040) to Reopen their Motion (#741) to Suppress on the basis
that the United States Attorneys Office (USAO) had inadvertently
produced to Defendants (as part of discovery) information from 11
Facebook accounts that was not responsive to the Warrant and,
1

The Court directs the Clerk to return Exhibits D-H to


counsel for Defendant Fry to maintain through any appeal of this
matter.
2 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 3 of 31

therefore, that should have been segregated and sealed pursuant


to the search procedures laid out in the Warrant.

On August 19,

2016, the government filed a Response (#1077) to Defendants


Motion to Reopen Motion to Suppress Facebook Evidence.
On August 23, 2016, the Court heard oral argument and held
an evidentiary hearing on the Motion to Reopen during Pretrial
Conference proceedings.

During those proceedings the Court

concluded the governments previous responses concerning the


Facebook suppression issues contained either incomplete or
inaccurate information and that the factual record was not
sufficiently developed to (1) explain how the inadvertent
disclosure of nonresponsive evidence occurred or (2) assure the
Court that the government properly followed the search procedures
laid out in the Warrant.

Accordingly, by Order (#1097) issued

August 23, 2016, the Court withdrew that portion of its Order
(#915) that denied Defendants Motion (#741) to Suppress;
reopened Defendants Motion; struck the governments Response
(#827) to Defendants Motion to Suppress, the governments
Response (#1077) to Defendants Motion to Reopen the Motion to
Suppress, and the Declaration (#1079) of Geoffrey A. Barrow; and
directed the government to file the following no later than Noon,
August 29, 2016:
(a) a new, complete factual record, including
declarations by individuals with personal knowledge,
that fully identifies all representatives of the
government who had possession of or access to the
3 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 4 of 31

materials Facebook produced at anytime in response to


the Search Warrant issued April 8, 2016, from the
time(s) Facebook made the productions until the
present, and (b) a new memorandum with its position on
the Motion to Suppress in light of the factual record.
On August 29, 2016, the government filed its Amended
Response (#1129) to Defendants Motion to Suppress together with
the Declarations of Peter L. Summers (#1130); Claudia I. Bonilla
(#1131); Matthew D. Hiemstra (#1132); Richard A. Baltzersen, Jr.
(#1133); J. Matthew Yeager (#1134); Michelle Holman Kerin
(#1135); Douglas Paul Angel (#1136); and Rena R. Rallis (#1137).
On September 1, 2016, Defendants filed a Reply (#1170) to the
governments Response.
The Court heard a second oral argument on September 6, 2016,
at which time the Court concluded the governments record was
incomplete as to when and by whom information nonresponsive to
the Warrant was either destroyed or sealed.

Accordingly, the

Court directed the government to complete the record.


On September 7, 2016, the government filed a Sur-Reply
(#1215) to Defendants Motion to Suppress together with the
Amended Declarations of Peter L. Summers (#1216); Richard A.
Baltzersen, Jr. (#1217); Claudia I. Bonilla (#1218); J. Matthew
Yeager (#1219); Matthew D. Hiemstra (#1220); and Travis J. Welter
(#1221).
The Court heard a third oral argument on September 9, 2016,
and took the matter under advisement on that date.

4 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 5 of 31

FACTUAL BACKGROUND
Based on its assessment of the record, the Court finds the
following facts beyond a preponderance of the evidence:
On April 8, 2016, Magistrate Judge Paul Papak of the United
States District Court for the District of Oregon issued a searchand-seizure Warrant for Facebook accounts that were associated
with Defendants.

The Warrant authorized the government to search

Defendants Facebook accounts for information that constitutes


evidence of a violation of 18 U.S.C. 372 in connection with
Defendants activities at the Malheur National Wildlife Refuge
(MNWR) in January and February 2016.

The accounts to be searched

were stored at premises owned, maintained, controlled, or


operated by Facebook (a company headquartered in Menlo Park,
California) in the Northern District of California.

In

particular, the Warrant permitted the search and seizure of


information pertaining to:
a.

Records, including photographs, comments, videos, and


other postings, of or about individuals illegally
occupying the Malheur National Wildlife Refuge (MNWR),
the planning and preparation of that occupation, and
requests for support or assistance and the recruitment
of others in furtherance of the occupation of the MNWR.

b.

Records, including photographs and videos or the


sharing of any photographs and videos, of individuals
in possession of firearms or with others in possession
of firearms, while at the MNWR or in Harney County,
Oregon.

c.

Records of communications, including private messages,

5 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 6 of 31

with other coconspirators.


d.

Evidence indicating how and when the Facebook account


was accessed or used, to determine the chronological
and geographic context of account access, use, and
events relating to the crime under investigation and to
the Facebook account owner.

e.

Records relating to who created, used, or communicated


with the user ID, including records about their
identities and whereabouts.

f.

Evidence indicating the Facebook account owners or


users state of mind as it relates to the crimes under
investigation.

g.

The identity of the person(s) who communicated with the


user ID about matters relating to the armed occupation
of MNWR, including records that help reveal their
whereabouts.

The Warrant limited the search to information during the period


November 1, 2015, through Defendant-specific dates in lateJanuary 2016 to mid-February 2016.
The Warrant also laid out a specific search procedure for
the government to follow:
4. During its review of the information received
from Facebook under this warrant, law enforcement
will segregate the information into two groups:
(i) information that is responsive to the warrant and
that the government may therefore seize; and
(ii) information that is not responsive to the warrant.
This review will be performed within a reasonable
amount of time not to exceed 180 days from the date of
execution of the warrant. If the government needs
additional time to conduct this review, it may seek an
extension of the time period from the Court.
5. Information that is responsive to the warrant
will be copied onto a separate storage device or
medium. Responsive information may be used by law
enforcement in the same manner as any other seized
evidence. Information that is not responsive to the
6 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 7 of 31

warrant will be sealed and stored on a secure medium or


in a secure location. Nonresponsive information will
not be reviewed again without further order of the
Court (e.g., subsequent search warrant or order to
unseal by the district court).
6. The government will retain a complete copy of
the information received from Facebook for a number of
reasons, including proving the authenticity of evidence
to be used at trial, responding to questions regarding
the corruption of data, establishing the chain of
custody of data, refuting claims of fabricating,
tampering, or destroying data, and addressing potential
exculpatory evidence claims where, for example, a
defendant claims that the government avoided its
obligations by destroying data or returning it to a
third party.
At the outset of this litigation the USAO established a
filter team separate from the prosecution team to be available
to remove privileged material from the information otherwise
available to the government before the prosecution team and its
agents reviewed such information.

The USAO filter team was led

by Assistant United States Attorney (AUSA) Michelle Holman Kerin.


On May 2, 2016, as part of the separate prosecution team,
Federal Bureau of Investigation (FBI) Special Agent (SA) Peter L.
Summers downloaded Facebooks initial response to the Warrant
from a law-enforcement portal provided by Facebook.

This

first response to the Warrant contained text and pictures from


all 23 Facebook accounts to be searched under the Warrant, but it
did not include videos due to the size of the video files.
SA Summers entered the downloaded information and provided a copy
of the information to the USAO.

7 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 8 of 31

On May 4, 2016, SA Summers received a second response from


Facebook in the form of five disks that contained the same text
and pictures that Facebook produced on May 2, 2016, but also
included the videos that were not included in the May 2, 2016,
response.
Due to the size of the responses from Facebook, on May 6,
2016, the prosecution team enlisted the assistance of SA Matthew
Hiemstra with the FBI Domestic Terrorism Operations Unit (DTOU)
in Virginia to conduct an initial, software-based search of the
information provided by Facebook to flag information that
contained any reference to a certain set of search terms.
Separately through correspondence with counsel for Ammon
Bundy sometime before May 13, 2016, AUSA Kerin determined two
Facebook accounts covered by the Warrant and associated with
Ammon Bundy and the Bundy Ranch could contain privileged
material.

Accordingly, on May 13, 2016, AUSA Kerin received the

disks containing the information from Facebooks first and second


responses to the Warrant including the two Bundy Facebook
accounts.
Also on May 13, 2016, SA Claudia Bonilla (with the
prosecution team) received from Facebook a third response in the
form of two disks that contained data through February 11, 2016.
On May 16, 2016, the government provided each Defendant with
a complete, unsegregated copy of that Defendants Facebook

8 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 9 of 31

account.
Also on May 16, 2016, AUSA Kerin provided to Ammon Bundys
counsel complete copies of the portions of the two Facebook
accounts associated with Ammon Bundy and Bundy Ranch seized
pursuant to the Warrant.
That same day SA Bonilla provided SA Hiemstra with a copy of
the Warrant Affidavit and the Warrant search procedures as well
as a list of search terms to be employed.
On May 19, 2016, SA Summers received from Facebook a fourth
response to the Warrant through the law-enforcement portal that
consisted of a single, comprehensive collection of all
information provided by Facebook pursuant to the Warrant.
SA Summers downloaded this response, which was 10.7 gigabytes in
size, to an external hard drive.
On May 19, 2016, SA Summers provided to SA Hiemstra a link
to the Facebook law-enforcement portal through which SA Hiemstra
could access the fourth response from Facebook.

Sometime between

May 16, 2016, and May 19, 2016, SA Hiemstra initiated the
software-based review of the information provided by Facebook,
which was a search separate and distinct from the search directed
by AUSA Kerin for privileged information.

SA Hiemstra and

members of the DTOU uploaded the information provided by Facebook


to a software program called Palantir Mint, which analyzed the
information and flagged those portions of the Facebook accounts

9 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

in which the search terms appeared.

Filed 09/14/16

Page 10 of 31

The Palantir Mint software

then generated a Mint report that identified the flagged


portions of the Facebook accounts.

Neither SA Hiemstra nor any

member of his team personally made judgments regarding which


material was responsive to the Warrant and which information was
nonresponsive.
Between May 17, 2016, and May 26, 2016, the Mint reports
were sent to FBI personnel in Portland, Oregon, where government
agents with the prosecution team used the Mint reports to help
segregate information that was responsive to the Warrant from
information that was nonresponsive.

The review conducted by FBI

personnel in Portland, Oregon, took place between May 17, 2016,


and June 21, 2016.

In order to conduct this review various

agents were assigned subsets of the 23 Facebook accounts obtained


through the Warrant.

Although agents conducted the review of the

21 Facebook accounts not associated with Ammon Bundy or the Bundy


Ranch simultaneously with the USAO filter teams review of the
Ammon Bundy and Bundy Ranch accounts for privileged material, the
FBI agents did not review the Ammon Bundy or Bundy Ranch accounts
until after the USAO filter team had removed the privileged
materials in those accounts.
The prosecution teams review for responsive and
nonresponsive material included the following:
SA J. Matthew Yeager reviewed the accounts associated with

10 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 11 of 31

Peter Santilli and Guerilla Media on May 17, 2016; Jason


Patrick and Darryl Thorn on May 26, 2016; and Travis Cox and
David Fry on June 3, 2016.
SA Summers reviewed the accounts associated with Jon
Ritzheimer and Joseph OShaughnessy on May 26, 2016, and Duane
Ehmer on June 15, 2016.
FBI Joint Terrorism Task Force Officer (TFO) Jeremy
Chedester reviewed the account associated with Geoffrey Stanek on
June 1, 2016.
SA Adam Krametbauer reviewed the accounts associated with
Ryan Bundy and Ryan Payne on June 1, 2016.
SA Kevin Strauss reviewed the accounts associated with
Blaine Cooper on May 31, 2016; Corey Lequieu on June 8, 2016;
Sandra Anderson on June 9, 2016; Wesley Kjar on June 10, 2016;
and Jason Blomgren on June 13, 2016.
SA Wade Mutchler reviewed the accounts associated with
Shawna Cox and Sean Anderson on June 1, 2016.
TFO Daniel Diamond reviewed the account associated with Eric
Flores on June 2, 2016.
The agents provided to the USAO prosecution team the
information from those accounts that they determined was
responsive to the Warrant, but the agents did not provide to the
USAO prosecution team any information that was determined to be
nonresponsive to the Warrant.

11 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 12 of 31

Meanwhile on May 25, 2016, SA Summers provided to AUSA Kerin


for the USAO filter team five disks that contained the entirety
of Facebooks fourth response (including information that was not
responsive to the Warrant).

AUSA Kerin provided those disks to

Automated Litigation Support (ALS) Specialist Doug Angel, who


copied the information onto his computer hard drive and separated
the information into folders for each of the 23 accounts on the
disks.

Angel was not informed of the FBIs two-step, substantive

segregation of nonresponsive information required by the Warrant.


Pursuant to the USAO filter teams instructions, Angel reviewed
the Ammon Bundy and Bundy Ranch accounts, removed information
that was privileged, and copied that information to a disk to
provide to Ammon Bundys counsel.

Angel copied the nonprivileged

information from the Ammon Bundy and Bundy Ranch accounts to a


network folder accessible by the USAO prosecution team.

The USAO

prosecution team, however, did not have access to the privileged


information that Angel segregated from the accounts.
AUSA Kerin instructed Angel to return the nonprivileged
information in the 23 Facebook accounts to ALS Specialist Rena
Rallis who was working with the prosecution team.

Angel intended

to copy all 23 accounts (minus the privileged information removed


from the Ammon Bundy and Bundy Ranch accounts) to a thumb drive,
but inadvertently only copied 11 accounts (none of which belong

12 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 13 of 31

to any of the Defendants involved in the trial that began on


September 7, 2016) to that thumb drive.

At some point in June

Angel then returned the disks he had in his possession to


AUSA Kerin and deleted any remaining information from his hard
drive.
On June 21, 2016, SA Yeager and SA Bonilla reviewed the
Ammon Bundy and Bundy Ranch Facebook accounts (minus the
privileged information removed by Angel) to segregate information
responsive to the Warrant from information that was nonresponsive
to the Warrant.
On June 24, 2016, the government provided the information
responsive to the Warrant from 21 Facebook accounts (omitting the
accounts of Ammon Bundy and the Bundy Ranch) to all of the
Defendants in Discovery Volume 39.

In Discovery Volume 39,

however, Rallis inadvertently also included the 11 complete


Facebook accounts that Angel had provided to her.
On July 1, 2016, the government provided the information
responsive to the Warrant from the Ammon Bundy and Bundy Ranch
accounts to all Defendants in Discovery Volume 41.
At the initial July 18, 2016, oral argument on Defendants
Motion (#741), AUSA Craig Gabriel informed the Court:
The warrant has been executed. The raw materials are
in a secure location at the FBI. They will not be
accessed unless there is follow-on search warrant or
order from this Court.

13 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 14 of 31

And I will say, your Honor, that each account holder


was provided with his or her raw data from the account.
So, for example, the - the voluminous exhibit that
Mr. Per excuse me, Per Olson provided to the Court,
he has that, his client has that. No other defendant
has that because thats his account. And the
Governments lawyers have not seen that.
The search was undertaken by the FBI, and so that raw
data is in two places. Its with each individual
account holder, and its in a sealed, secure location
at the FBI.
Tr. of Proceedings (#1051) at 53.
On August 3, 2016, however, Per Olson, counsel for Defendant
Fry, emailed AUSA Gabriel and informed him that Discovery Volume
39 contained the 11 unsegregated Facebook accounts.

AUSA Gabriel

instructed Rallis to search the USAO network for those files and
to delete them immediately.

Rallis did so promptly and believed

that all such information had been deleted at that point.


Sometime in the week of August 23, 2016, however, Rallis
discovered to her horror that she still possessed in her office
the thumb drive that Angel originally gave to her.

Rallis gave

that thumb drive to FBI Agent Ronnie Walker.


On August 4, 2016, SA Travis J. Welter met with AUSA Gabriel
and AUSA Geoffrey Barrow.

At that meeting AUSAs Gabriel and

Barrow instructed Welter to seal and to return to the Portland


FBI office all Facebook data that remained at the USAO and to
destroy all remaining copies of Facebook data that were not

14 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 15 of 31

sealed and stored in evidence.2


On August 4 or August 5, 2016, SA Welter collected and
destroyed the remaining working copies of unsegregated Facebook
information from the FBI search teams in Portland, Oregon.
On August 5, 2016, the government notified the Court of its
inadvertent disclosure of the 11 unsegregated Facebook accounts
to Defendants.

In that letter the government indicated:

The FBI properly executed the warrant pursuant to


the warrants procedures; however, a miscommunication
within the U.S. Attorneys Office unfortunately caused
the raw data for the above accounts (that was initially
sent only to each individual account holder) to be
produced to all defense counsel in Volume 39 on
June 24, 2016.
None of the prosecution teams attorneys or staff
accessed the raw data at any time, with the exception
of confirming the inadvertent disclosure. On August 4,
2016, the U.S. Attorneys Office removed all raw
Facebook data from its discovery database and computer
system. The raw data will not be accessed again absent
an order by the Court.
On August 8, 2016, a member of SA Hiemstras DTOU team
received an email from a Plantir Mint system operator confirming
that all information responsive to the Warrant had been deleted

In light of the necessary separation between the


prosecutors and the investigative team conducting the review of
the Facebook materials, the Court concludes AUSA Gabriel did not
intentionally mislead the Court at the July 18, 2016, oral
argument. The more reasonable inference is that AUSA Gabriel
represented the nonresponsive materials had been destroyed and/or
sealed either because he was misinformed or because he
erroneously (but in good faith) believed the nonresponsive
information had been sealed and/or destroyed at the time that it
was segregated from the responsive information.
15 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

from DTOU computer systems.

Filed 09/14/16

Page 16 of 31

On August 23, 2016, SA Welter

deleted unsegregated Facebook information that remained on the


hard drive of a computer used by SA Bonilla, who left the
Portland FBI office on June 30, 2016.
On August 29, 2016, SA Chad Lapp destroyed disks that were
in SA Yeagers office at the Bend, Oregon, FBI office.

Those

disks contained unsegregated Facebook information and had not


been accessed since the May 17-June 21, 2016, review was
completed.
The five disks that were provided to AUSA Kerin for use by
the USAO filter team have remained sealed in AUSA Kerins office
since Angel returned them to her sometime in June 2016.

The seal

on the disks includes instructions not to access them without


further order of the Court.

It now appears that all other media

with unsegregated Facebook information and/or Facebook


information that was deemed nonresponsive to the Warrant have
either been destroyed or are sealed with instructions not to
access without further order of the Court.

DISCUSSION
I.

Overbreadth of the Search Warrant


In their original Motion (#741) to Suppress Defendants

contend the Warrant was overbroad because there was not


sufficient probable cause to justify a Warrant to search all

16 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 17 of 31

Facebook functions, including the private-messaging function.


Probable cause is established if an affidavit presents a
fair probability that evidence of criminal activity will be
found in the place to be searched.

United States v. Flores, 802

F.3d 1028, 1043 (9th Cir. 2015)(quoting Illinois v. Gates, 462


U.S. 213, 238 (1983)).

Probable cause in a search-warrant

affidavit must be based on the material supplied by the affiant


as well as reasonable inferences drawn from the material.
Gates, 462 U.S. at 240.

See also United States v. Schesso, 730

F.3d 1040, 1045 (9th Cir. 2013).

When determining whether the

warrant was supported by probable cause, the court gives great


deference to the probable-cause determination of the issuing
judge.

United States v. Grant, 682 F.3d 827, 832 (9th Cir.

2012).

See also Flores, 802 F.3d at 1043.

The court considers three factors when analyzing the


overbreadth of a warrant:
(1) whether probable cause existed to seize all items
of a category described in the warrant; (2) whether the
warrant set forth objective standards by which
executing officers could differentiate items subject to
seizure from those which were not; and (3) whether the
government could have described the items more
particularly in light of the information available.
Flores, 802 F.3d at 1044 (quoting United States v. Le Shi, 525
F.3d 709, 731-32 (9th Cir. 2008)).
Defendants assert the Warrant was overbroad because Facebook
functions are obviously severable, and the search-warrant

17 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 18 of 31

application only provided probable cause to search Defendants


public postings and not other features that included the privatemessaging function.

According to Defendants, therefore, the

Warrant was overbroad because it permitted a comprehensive


initial seizure of all functions of Defendants Facebook accounts
subject to the two-step review and filtering process provided
within the Warrant.
The government, on the other hand, contends the Warrant was
not overbroad as demonstrated by the fact that the Ninth Circuit
approved a similar warrant in Flores, including the use of the
two-step search process by which the government initially seizes
the entirety of a Facebook account, conducts an initial review of
the materials seized to identify the material that is responsive
to the search warrant, and then separates and seals material that
is not responsive to the warrant.

Because the Warrant in this

case closely mirrors the warrant in Flores, the government


contends this Warrant similarly was not overbroad, and, in any
event, suppression would be inappropriate even if the Warrant was
overbroad because the law-enforcement officers acted in goodfaith reliance on the Magistrate Judges issuance of the Warrant.
See Flores, 802 F.3d at 1028.
In Flores the government obtained a search warrant that
permitted the government to search the Facebook account
associated with Floress name and email address and to seize only

18 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 19 of 31

evidence relevant to the two offenses listed in the warrant.


F.3d at 1044.

The warrant authorized Facebook to provide agents

with the entire contents of Floress Facebook account.


1046.

802

Id. at

Agents then segregated information that was responsive to

the search warrant from information that was nonresponsive and


sealed the nonresponsive information so it could not be accessed
absent a new warrant.

Id.

Ultimately the agents determined 100

of the 11,000 pages of data initially seized were responsive to


the search warrant.

Id.

Applying the factors from Le Shi, the Ninth Circuit


specifically concluded the warrant in Flores was not overbroad
because it allowed the government to search only the Facebook
account associated with the defendant, authorized the government
to seize permanently only the information that was relevant to
the alleged violations on which the warrant application was
based, and established sufficient objective standards for
segregating responsive material from the rest of Floress
account.

Id. at 1044 (quoting Le Shi, 525 F.3d at 731-32).

Although the Ninth Circuit expressed some concern over the lack
of any temporal limit on the warrant (i.e., the warrant permitted
seizure of relevant information created at any time during the
existence of the Facebook account), the court ultimately
concluded the warrant was not overbroad because the warrant here
specified a crime and a suspect, the seized data was not used for
19 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 20 of 31

any broader investigative purposes, and Facebook, rather than


government agents, segregated Floress account to protect third
parties rights.

Id. at 1045-46.

Moreover, any concern about a

lack of any temporal limit was moot because the only information
the government sought to introduce originated on the day of the
defendants arrest.

Id.

Here the government is correct that the Magistrate Judge


issued a Warrant similar to the warrant that the Ninth Circuit
largely approved in Flores.

The Warrant in this case similarly

specified a crime and the suspects, provided for a two-step


search-and-seizure process to ensure nonresponsive information
was separated and sealed, and only authorized the seizure of
information within the listed accounts associated with
Defendants.

Moreover, unlike the warrant in Flores, the Warrant

issued in this case also contained a temporal limitation for


information from November 1, 2015, through the date of the
relevant Defendants arrest (each arrest date occurring between
late-January and mid-February 2016).

The Warrant in this case,

therefore, was, in fact, narrower than the one approved by the


Ninth Circuit in Flores.
Moreover, the Court disagrees with Defendants contention
that the Warrant Affidavit did not provide probable cause to
search nonpublic features such as the private-messaging function.
To the contrary, the Affidavit provided:

20 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 21 of 31

[I]nformation stored in connection with a Facebook


account may provide crucial evidence of the who, what,
when, where, and how of the criminal conduct under
investigation, thus enabling the United States to
establish and prove each element or alternatively, to
exclude the innocent from further suspicion. In my
training and experience, a Facebook users Neoprint,
IP log, stored electronic communications, and other
data retained by Facebook, can indicate who has used or
controlled the Facebook account. This user
attribution evidence is analogous to the search for
indicia of occupancy while executing a search warrant
at a residence. For example, profile contact
information, private messaging logs, status updates,
and tagged photos (and the data associated with the
foregoing, such as date and time) may be evidence of
who used or controlled the Facebook account at a
relevant time. Further, Facebook account activity can
show how and when the account was accessed or used.
These assertions were sufficient for the Magistrate Judge to find
there was a fair probability that evidence of the relevant crime
could be found in the private features of Defendants Facebook
accounts.

In addition, in light of the evidence of public

postings presented in the Warrant Affidavit as well as the


information that various alleged members of the conspiracy were
Facebook friends, the Magistrate Judge could reasonably infer
there was a fair probability that evidence of the alleged crime
could also be found in many of the private functions of
Defendants Facebook accounts.
Accordingly, on this record the Court concludes Flores is
controlling, and, therefore, the Warrant in this case was not
overbroad on its face.

21 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

II.

Document 1275

Filed 09/14/16

Page 22 of 31

Execution of the Search Warrant


In light of the recently developed evidene, Defendants

contend the government improperly executed the Warrant (1) when


the government did not set up a search team separate from the
primary investigation team to conduct an initial review of the
materials produced by Facebook; (2) when the government included
search terms in their initial review that were outside of the
scope of the Warrant; (3) when the government provided
unsegregated Facebook information to the USAO filter team;
(4) when the government provided 11 unsegregated Facebook
accounts to all Defendants in Discovery Volume 39; and (5) when
the government failed to seal or to destroy unsegregated Facebook
data in a timely manner after the agents segregated responsive
and nonresponsive information.

In particular, Defendants contend

the governments failure to destroy or to seal nonresponsive


Facebook information in a timely manner constitutes flagrant
disregard for the search procedures set out in the Warrant and,
as a consequence, necessitates complete suppression of all
information obtained pursuant to the Warrant.
Ordinarily, only evidence that is obtained in violation of
a warrant is suppressed.
717 (9th Cir. 1992).

United States v. Chen, 979 F.2d 714,

See also United States v. Sears, 411 F.3d

1124, 1131 (9th Cir. 2005).

However, in cases where there is

flagrant disregard for the terms of the warrant, the district

22 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 23 of 31

court may suppress all of the evidence, including evidence that


was not tainted by the violation.
(quoting Chen, 979 F.2d at 717).

Sears, 411 F.3d at 1131

Wholesale suppression is an

extraordinary remedy that is appropriate only when the


officers transform the search into an impermissible general
search by ignoring the terms of the warrant and engaging in
indiscriminate fishing.

Sears, 411 F.3d at 1131 (quoting Chen,

979 F.2d at 717).


As noted, the Warrant required the following search
procedure:
4. During its review of the information received
from Facebook under this warrant, law enforcement
will segregate the information into two groups:
(i) information that is responsive to the warrant
and that the government may therefore seize; and
(ii) information that is not responsive to the warrant.
This review will be performed within a reasonable
amount of time not to exceed 180 days from the date of
execution of the warrant. If the government needs
additional time to conduct this review, it may seek an
extension of the time period from the Court.
5. Information that is responsive to the warrant
will be copied onto a separate storage device or
medium. Responsive information may be used by law
enforcement in the same manner as any other seized
evidence. Information that is not responsive to the
warrant will be sealed and stored on a secure medium or
in a secure location. Nonresponsive information will
not be reviewed again without further order of the
Court (e.g., subsequent search warrant or order to
unseal by the district court).
6. The government will retain a complete copy of
the information received from Facebook for a number of
reasons, including proving the authenticity of evidence
to be used at trial, responding to questions regarding
the corruption of data, establishing the chain of
23 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 24 of 31

custody of data, refuting claims of fabricating,


tampering, or destroying data, and addressing potential
exculpatory evidence claims where, for example, a
defendant claims that the government avoided its
obligations by destroying data or returning it to a
third party.
A.

Use of a Separate Search Team

Although the Court finds the use of a search team separate


from the primary investigation team for the purposes of
conducting substantive review of the Facebook data would have
been an added layer of protection for ensuring the investigation
team did not benefit from exposure to information that was
nonresponsive to the Warrant (and, in this case, could have
prevented many of the errors that plagued execution of the
Warrant), there is not any such requirement in the Warrant nor
does Flores mandate such an additional safeguard.

Accordingly,

the governments failure to employ a separate search team to


segregate responsive information from nonresponsive information
does not by itself constitute a violation of the Warrant.
Nevertheless, the Court points out the errors that occurred in
the execution of this Warrant highlight the utility of such a
separate search team to conduct the initial review under similar
warrants.
B.

Use of Search Terms

During the initial review of the information provided by


Facebook, the government used many different search terms to
locate information responsive to the Warrant and to identify
24 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

nonresponsive information.

Filed 09/14/16

Page 25 of 31

Although these search terms were

diverse and related to several different topics, the Court finds


each of the search terms are relevant in some way to the alleged
occupation of the MNWR that constitutes the conspiracy charge on
which the Warrant was predicated.
Accordingly, the Court concludes the search terms did not
impermissibly exceed the scope of the Warrant.
C.

Use of the USAO Privilege Filter Team

As noted, the Warrant did not expressly provide for the use
of a privilege filter team.

Although the privilege filter team

was not contemplated in the Warrant and, therefore, existed


separately from the searches authorized by the Warrant, the Court
concludes the terms of the search procedures laid out in the
Warrant were sufficiently broad to permit the use of the
privilege filter team separate from the prosecution team for the
purpose of screening for privileged information at the request of
Ammon Bundys counsel.
Moreover, the use of that privilege filter team narrowed
rather than expanded the scope of the search because it removed
privileged material from the information that investigating
agents would otherwise search for responsiveness to the Warrant.
Accordingly, regardless whether the Warrant procedures are
sufficiently broad to permit the use of a privilege filter team
expressly, the privilege filter process is not the type of

25 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 26 of 31

flagrant disregard for a search-warrant procedure that would


justify wholesale suppression.

See Sears, 411 F.3d at 1131.

The Court, nonetheless, notes it would have been prudent for


the government to alert and to seek guidance from the issuing
Magistrate Judge when it became clear that some Facebook
materials should be submitted to a privilege filtering process in
addition to the process of separating responsive data from
nonresponsive data.

If the government had done so, the

Magistrate Judge could have clarified the Warrant procedures to


address expressly the use of a privilege filter team, and the
government could have avoided the risks inherent in conducting
the simultaneous screenings without such direction.
D.

Inadvertent Disclosure of Unsegregated Facebook


Information in Discovery Volume 39

The Court concludes the inadvertent disclosure of the 11


unsegregated Facebook accounts to all Defendants in Discovery
Volume 39 does not justify wholesale suppression of all evidence
obtained pursuant to the Warrant.

This inadvertent disclosure

was a result of mistakes on the part of Angel and Rallis arising


from confusion caused by the simultaneous employment of the
privilege filter team along with the separate segregation of
responsive and nonresponsive information.

Moreover, it is clear

that the prosecution team never accessed the unsegregated records


inadvertently disclosed to other Defendants who are not the
subject of the current trial.
26 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 27 of 31

The Court fully credits the testimony of both Angel and


Rallis and appreciates the candor and accountability that both
demonstrated in their Declarations and during the August 23,
2016, evidentiary hearing.

Ultimately the inadvertent errors

that Rallis and Angel made are of the type that otherwise careful
government agents can understandably make, especially during the
course of highly complex litigation such as this matter involving
voluminous discovery.

Such errors, as Defendants now agree, do

not constitute flagrant disregard of the terms of the Warrant.


E.

Failure to Destroy or to Seal Nonresponsive Facebook


Data in a Timely Manner

The Court, nevertheless, is troubled by the failures of the


various agents, collectively and individually, to destroy or to
seal information in their possession that was determined to be
nonresponsive to the Warrant.

It is clear that the segregation

of responsive and nonresponsive information was accomplished by


June 21, 2016, when the Ammon Bundy and Bundy Ranch accounts were
reviewed by SA Yeager and SA Bonilla.

It was not until more than

six weeks later on August 4, 2016, and then only at Defendants


collective insistence, that there was any concerted effort by the
government to destroy or to seal nonresponsive information that
remained in the possession of government agents.
The government contends this delay did not violate the terms
of the Warrant because the Warrant allowed the government up to
180 days to complete the search, which the government points out
27 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

will not elapse until early October.

Filed 09/14/16

Page 28 of 31

The Court disagrees.

The Court notes the Warrant required the government to


complete its review within a reasonable amount of time not to
exceed 180 days from the date of execution of the warrant.

The

180-day limitation, therefore, was the outer limit of the time


that the government had to complete the search.

Even with that

180-day limit, the government was required to perform the search


in a reasonable amount of time.

In light of the complexity of

the search and the volume of information that the government was
required to review, the Court concludes it was reasonable for the
government to take until June 21, 2016, to finish the review.
On the other hand, it appears to have taken most of the
month of August for the government successfully to locate and to
destroy or to seal the nonresponsive information still in its
possession.

While it is not per se unreasonable to take that

much time to complete the seal or destroy process, the Court


finds the six-week delay between the governments completion of
the review under the Warrant and the beginning of the
governments concerted effort to locate and to destroy or to seal
nonresponsive information was unreasonable, especially when it
appears the initiation of that effort was prompted by defense
counsel rather than the government.
Nevertheless, there is not any evidence in the record from
which the Court could conclude that the government agents

28 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 29 of 31

unreasonable delay expanded the scope of the search or otherwise


exposed the government to more information than that which they
were entitled to under the Warrant.

The agents actions,

therefore, did not transform the search into an impermissible


general search by ignoring the terms of the warrant and engaging
in indiscriminate fishing.

See Sears, 411 F.3d at 1131

(quoting Chen, 979 F.2d at 717).

Accordingly, the Court

concludes even though the governments efforts to complete this


final step of the Warrant procedures were late and seemingly
nonchalant, the extraordinary remedy of wholesale suppression
is not warranted in the circumstances.

See id.

Nonetheless, Defendants contend the Court should exercise


its inherent supervisory authority over government agents by
suppressing all of the Facebook evidence on this ground.
Although the Court is frustrated by the government agents delay
in sealing and/or destroying the information that was
nonresponsive to the Warrant, the Court concludes suppression of
evidence that was otherwise properly obtained pursuant to the
Warrant is not an appropriate remedy for the governments timing
error.

Whether pursuant to the Fourth Amendment or to the

Courts supervisory authority, wholesale suppression is an


extraordinary remedy only to be applied to flagrant abuses of
government authority.

Although the governments delay in sealing

and/or destroying nonresponsive Facebook information was

29 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 30 of 31

unreasonable, it was not sufficiently egregious to justify the


suppression of a significant amount of evidence that was
otherwise lawfully obtained under the totality of the
circumstances.
The Court, nevertheless, admonishes the government for its
obvious lack of diligence, attention to detail, and failure to
destroy or to seal information pursuant to the Warrant that the
government identified as nonresponsive to the Warrant in a timely
manner.

This should not have happened in any case, and, in any

event, is particularly unacceptable in the context of this highprofile, complex prosecution with seemingly extraordinary
resources being expended at every turn.

In the future the Court

expects the government to provide high-level leadership to ensure


issues such as these are identified and resolved proactively and
well before, as in this case, three rounds of evidentiary
presentations and arguments that could have been avoided.

The

Court trusts the USAO and the investigators on whom it relies


will take appropriate actions to address the oversights in this
case to ensure they are not repeated in the future.

CONCLUSION
For these reasons, the Court DENIES Defendants Motion, and,
pursuant to the Courts supervisory authority over the
government, the Court ADMONISHES the government for its lack of

30 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

Case 3:16-cr-00051-BR

Document 1275

Filed 09/14/16

Page 31 of 31

diligence in failing to ensure that nonresponsive information


from the seized Facebook accounts was sealed or destroyed in a
timely manner pursuant to the Warrant issued April 8, 2016,
following completion of the segregation of such data on June 21,
2016.
IT IS SO ORDERED.
DATED this 14th day of September, 2016.

/s/ ANNA J. BROWN


ANNA J. BROWN
United States District Judge

31 - ORDER DENYING MOTION TO SUPPRESS FACEBOOK EVIDENCE

You might also like