211 F.R.D. 31 (D. Conn. 2002)
RULING ON MOTION TO SUPPRESS
NEVAS, District Judge.
Three of the five defendants charged in the superseding indictment in this public corruption case moved to suppress all of the evidence obtained through a search and seizure of a Compaq Pentium laptop computer that was owned by the defendant, Triumph Capital Group, Inc. (“Triumph”) and used exclusively by Triumph’s Vice President and General Counsel, defendant Charles B. Spadoni (“Spadoni”).1 Defendant Frederick W. McCarthy (“McCarthy”), Triumph’s CEO and controlling shareholder, asserts a proprietary interest in the laptop computer and claims to have standing to challenge its search and seizure.
In support of their motion for wholesale suppression of all evidence obtained pursuant to the warrant authorizing a search and seizure of the laptop computer, the defendants assert that: (1) the government improperly coerced them to deliver the laptop computer pursuant to a forthwith subpoena that was issued without exigent circumstances; (2) the warrant subsequently issued by a magistrate judge violated the Fourth Amendment’s particularity and probable cause requirements; (3) the executing agent acted in flagrant disregard of the warrant’s terms and grossly exceeded the scope of the warrant; (4) the government did not follow appropriate procedures to protect attorney-client privileged material; and (5) the government violated the requirements of Fed.R.Crim.P. 41.
The government disputes all of the defendants’ claims and maintains that the drastic remedy of blanket suppression is not warranted or justified. It also maintains that: (1) there existed good faith and reasonable concerns that evidence could be altered or destroyed and this provided exigent circumstances that justified the use of a forthwith subpoena and the defendants’ compliance with it was voluntary; (2) the warrant satisfied the requirements of the Fourth Amendment; (3) the search was reasonable, did not resemble a general search and the executing agent did not flagrantly disregard the warrant; (4) the agreed-upon procedures to protect privileged documents provided adequate safeguards and the defendants were not prejudiced; (5) the requirements of Rule 41 are purely ministerial and were adequately complied with; and (6) McCarthy does not have standing to challenge the search.
For the following reasons, the defendants’ motion to suppress [doe. # 189] is DENIED.
The multi-count indictment in this case alleges, inter alia, a RICO violation and a RICO conspiracy, as well as bribery, obstruction of justice, witness tampering, mail fraud/theft of honest services and theft or bribery concerning programs receiving federal funds.
The two RICO counts in the superseding indictment allege that from March, 1997, to October, 2000, Triumph, McCarthy, Spadoni, co-defendant Lisa A. Thiesfield (“Thiesfield”) and co-defendant Benjamin Andrews (“Andrews”), together with Paul J. Silvester (“Silvester”), the former Connecticut State Treasurer, and Christopher A. Stack (“Stack”), an associate of Silvester, conspired to and conducted the affairs of an association-in-fact enterprise through a pattern of racketeering activity.
Triumph is an investment firm with its principal place of business in Boston, Massachusetts. McCarthy is Triumph’s Chairman and controlling shareholder. Spadoni is a Vice President and General Counsel of Triumph. Thiesfield was an employee of the Connecticut State Treasurer’s Office from September, 1997, to May, 1998, at which time she became campaign manager for the Silvester for State Treasurer Campaign. Andrews was employed as managing director of a company that provided investment services to the Connecticut State Treasurer’s Office and was the Republican candidate for Connecticut Secretary of State in 1998. From January, 1995, to October, 1996, Silvester was the Chief of Staff at the Connecticut State Treasurer’s Office. In October, 1996, he became the Deputy Treasurer, and in July, 1997, he was appointed State Treasurer when the elected state treasurer resigned.
As state treasurer, Silvester had sole authority for managing and investing hundreds of millions of dollars of assets of the Connecticut Retirement Plans and Trust Fund (“CRPTF”). In 1998, Silvester ran as the Republican candidate for Connecticut State Treasurer. He was defeated in the November, 1998, election and left office on January 6, 1999.
The indictment alleges that the purposes of the enterprise’s racketeering activity were to enrich the defendants and others through ongoing criminal activity including bribery and fraud; to conceal the defendants’ participation in the criminal activity through obstruction of justice and witness tampering; and to conceal Silvester’s participation in and enrichment from the criminal activity.
More specifically, the indictment charges that Triumph illegally funneled campaign contributions to the Silvester for State Treasurer Campaign in exchange for the investment of state pension assets in a Triumph-related fund. It also outlines a scheme whereby Triumph solicited and paid bribes, rewards and gratuities to Silvester in exchange for pension fund investments and disguised these illegal payments by entering into consulting contracts with Stack, Thiesfield and Andrews, who agreed to “kick back” a portion of their consulting fees to Silvester.
The indictment also charges that Triumph and Spadoni obstructed justice by attempting to conceal the corrupt arrangements with Stack, Thiesfield and Andrews. Specifically, between May 25, 1999, and April, 2000, Spadoni and Triumph allegedly obstructed a grand jury investigation by deleting, overwriting or destroying documents and information stored on a laptop computer owned by Triumph and assigned to Spadoni. In addition, the indictment charges that Spadoni and Triumph obstructed justice by deleting, destroying or failing to produce diskettes that contained documents and information which was relevant to a grand jury investigation.
In addition to the RICO and RICO conspiracy, the indictment also charges that the defendants violated the mail fraud/theft of honest services statute by devising a scheme to defraud and deprive the citizens of Connecticut of their right to Silvester’s honest services as state treasurer, i.e., performance of his duties free from deceit, favoritism, bias, conflict of interest and self-enrichment.
Finally, the indictment charges each defendant with willfully, knowingly, and corruptly giving, offering, and agreeing to give financial support to Thiesfield and to Silvester’s re-election campaign with the intent to influence and reward Silvester for investing CRPTF assets in a Triumph-related investment fund.
During the investigation that led to the indictment, the grand jury issued a forthwith subpoena to obtain possession of a laptop computer that was owned by Triumph and used by Spadoni. After obtaining possession of the laptop computer, the government obtained a warrant to search and seize its hard drive and obtained certain incriminating evidence. Triumph, Spadoni and McCarthy moved for blanket suppression of all documents, data and evidence the government seized from the laptop computer.
Based on the evidence presented at a five-day suppression hearing, the court makes the following findings of fact.
In late October, 1999, Silvester told FBI Special Agent Charles Urso (“SA URSO”), the case agent assigned to the grand jury investigation, about a conversation he had with Spadoni on May 25, 1999, shortly after Triumph had received its first grand jury subpoena for documents relating to the investigation.
Silvester told SA Urso that Spadoni told him that in response to the subpoena, Triumph had not produced the consulting contracts it had entered with Thiesfield and Stack. He further said that Spadoni told him that Triumph’s lawyer had advised him that more subpoenas were likely and documents that could be incriminating and that had no business purpose should be “purged.”
In addition, Silvester said that Spadoni mentioned that he or someone from Triumph had purchased a software program to purge or “blow out” a computer. Silvester indicated that he did not know the specific computer to which Spadoni was referring and did not know if any computers were actually purged. But Silvester said that Spadoni told him that he had deleted contracts with Park Strategies, the company that Silvester went to work for after he left the treasurer’s office.
In an attempt to corroborate this information, the government issued a subpoena to Triumph on December 29, 1999, seeking back-up tapes for Triumph’s computers and records relating to Triumph’s computer network or systems used by its employees.
On January 19, 2000, Triumph responded to that subpoena by producing seven back-up tapes and certain documents. The government did not immediately review this information.
One of the documents Triumph produced was dated July 28, 1999. It showed that the company owned a laptop computer, specifically, a Compaq Notebook Pentium 150 MZ 16 MB Ram, 1.6 GB hard drive (the “laptop computer”) which was used by Spadoni.
On about February 1, 2000, SA Urso sent an electronic communication to Special Agent Jeff Rovelli (“SA Rovelli”), an FBI Computer Analysis Response Team (“CART”) Field Examiner, asking for assistance in analyzing and reviewing Triumph’s back-up tapes to determine if memory had been destroyed.
SA Rovelli is a FBI-certified and skilled CART agent with extensive experience in searching and seizing computer-related evidence, computer hardware, operating systems and forensic techniques and methods for computer searches.
Before S.A. Rovelli began his review of the back-up tapes, he met with SA Urso to discuss the investigation and obtain certain background information.
In this regard, he reviewed two consulting contracts dated January 15, 1999, between Triumph and Thiesfield and Triumph and Stack, a consulting contract dated May 1, 1998, between Triumph and Thiesfield, a marketing contract dated November 24, 1998, between Triumph and Capital Marketing Investment Corp., Andrews’s company, and the face sheet of the partnership agreement for Triumph Connecticut-II, the collateralized bond obligation (“CBO”) fund in which Silvester had invested $200 million of CRPTF assets.
S.A. Rovelli was asked to review Triumph’s back-up tapes, focusing on the dates of these contracts, to determine if they showed destruction, alteration, changes, deletions or destruction of computer memory or evidence.
On March 28, 2000, S.A. Rovelli and S.A. Urso reviewed three back-up tapes from Triumph’s Boston office: one tape was dated December 28, 1998, one tape was dated May 18, 1999, and the third was dated August 27, 1999. These tapes showed that on May 31, 1999, six days after Triumph had received its first grand jury subpoena, between 9:41 a.m. and 1:56 P.M., forty files were reviewed and then transferred to Triumph’s Boston computer system into a directory named “Spadoni.” The tapes also showed that certain documents relating to Park Strategies which were on the computer on May 18, 1999, were not on the computer on May 31, 1999. This corroborated the information that Silvester had provided concerning Spadoni’s deletion of documents.
The agents did not, and could not, fully analyze the information from the back up tapes immediately. They needed time to digest that information and put it into context with other information obtained during the investigation, particularly the information provided by Silvester about Spadoni’s alleged plan to “blow out” or purge documents from a computer.
After the agents completed their analysis of this information, they concluded that the May 31, 1999, transfer of documents to the Spadoni directory on Triumph’s Boston computer system was probably done to preserve or protect them and that this transfer was consistent with what Silvester had said about Spadoni’s plan to purge or blow out a computer.
The tapes and documents that Triumph produced in response to the subpoena did not provide any specific information about the laptop computer except that as of October, 1999, Spadoni was its primary user. The agents did not know if the computer still existed or where it was located.
A laptop computer is a completely self-contained portable computer containing a hard disk drive, a keyboard, a screen, input/output ports, and a modem. By using input/output ports and the modem, a computer user can transfer documents from one hard drive to a computer network in another location over telephone lines.
As far as the agents knew, if the computer still existed, it could be in Triumph’s Boston office, its Hartford office, Spadoni’s home, Spadoni’s car, or the place where Spadoni stayed when he worked at Triumph’s Boston office.
The agents did not seek warrants to search all of those locations because they were not certain if the laptop computer still existed. Instead, they opted to go before the grand jury that was investigating the matter and ask for a subpoena. This was a reasonable decision, even though the next session of that grand jury was not scheduled until April 11, 2000, and even though other grand juries were sitting before that date.
On April 11, 2000, S.A. Urso appeared before the grand jury and requested a forthwith subpoena directing Triumph to produce the laptop computer by 4:30 p.m. that day. In support of his request, S.A. Urso told the grand jury that a forthwith subpoena was necessary because a real danger existed that more evidence, or even the laptop computer itself could be destroyed if Triumph had advance notice that the government wanted to search it. He based this assertion on the information he and SA Rovelli learned from the back-up tapes together with the information obtained from Silvester about Spadoni’s plan to purge documents or blow out a computer in anticipation of additional subpoenas, and the portable nature of the laptop computer itself.
The nature of the exigency that SA Urso believed existed on April 11, 2000, was, in his words, a “notification kind of exigency.” SA Urso was concerned that if Triumph or Spadoni were given advance notice of the government’s intent to search the laptop computer, the hard drive could be destroyed and along with it any evidence it contained pertaining to prior deletions or alterations of documents, or the computer itself could be intentionally “lost” or destroyed.
In other words, because SA Urso had reason to believe that evidence had previously been destroyed after a grand jury subpoena was served on Triumph, he had a reasonable belief that the same thing could happen again if advance notice was given.
SA Urso assured the grand jury that the government would not open or search the computer until Triumph had an opportunity to file a motion, that the laptop computer would be kept in a secure location in the magistrate judge’s chambers, and that a warrant would be obtained to search it. He also advised the grand jury that because the laptop computer was used by an attorney, the government would take steps to ensure that privileged documents would not be given to the prosecution team.
The U.S. Attorney’s Manual authorizes the use of a forthwith subpoena when an immediate response is justified. The facts and circumstances known to the government on April 11, 2000, support a finding that exigent circumstances existed and justified an immediate response.
Based on the totality of the evidence, it is clear that the government did not intend to obtain the contents of the laptop computer through use of the forthwith subpoena, but only sought to preserve its contents while it obtained a warrant.
After the grand jury issued the forthwith subpoena, AUSA Nora Dannehy (“Dannehy”), the AUSA who was in charge of the investigation, handed it to Tracy Miner, Esq. (“Miner”), one of Triumph’s attorneys and a member of the firm of Mintz, Levin, Ferris, Glovsky & Popeo, P.C. (“Mintz Levin”). Ms Miner was at the federal courthouse in Hartford, Connecticut waiting outside the grand jury room with a Triumph employee who had been subpoenaed to testify that day.
As Ms. Miner testified at the suppression hearing, Ms. Dannehy told her that someone from Triumph’s Hartford office should deliver the laptop computer immediately.
Ms. Miner said that she called Triumph’s Hartford office and learned that neither Spadoni nor the laptop computer were there. She then called Spadoni’s attorney and McCarthy and learned that the laptop computer was at Triumph’s Boston office. She asked Triumph to deliver the laptop computer to Mintz Levin’s Boston office.
Ms. Miner said that she asked Ms. Dannehy for additional time to comply with the subpoena, and requested that the government not search the laptop computer until she had an opportunity to file an appropriate motion with the court.
Ms. Dannehy denied Ms. Miner’s request for more time and instructed her to produce the laptop computer by 5:00 p.m. that day. Ms. Dannehy did, however, agree that the government would not open or search the laptop computer until Ms. Miner had a chance to file a motion.
Ms. Miner is an experienced criminal defense lawyer. She is a member of Mintz Levin, a large Boston law firm, and its criminal practice group. Her practice is limited to white collar criminal defense, and 70% of her work involves federal matters. She is president of the Massachusetts Association of Criminal Defense Lawyers and is a long-time member of the Massachusetts District Court’s CJA panel. She has lectured extensively on criminal law issues pertaining to white collar grand jury investigations.
Ms. Miner testified that she believed that it would be contemptuous to not comply with the subpoena and that she did not have sufficient time or opportunity to consult with her client or Spadoni’s counsel to discuss what was on the laptop computer and prepare a motion before the 5:00 p.m. deadline. She was also told that the judge who was supervising the grand jury was not available that day.
However, the fact that Ms. Miner delivered the laptop computer and did not file a motion contesting the validity of the forthwith subpoena was not the result of threats, coercion or aggressive tactics by the government. Indeed, Ms. Dannehy had assured her that the government would not do anything to the laptop computer until she had a chance to file a motion.
After the laptop computer was delivered to Mintz Levin and before it was delivered to the government, John Silva, Esq. (“Silva”), another member of Mintz Levin’s criminal defense practice group, instructed his technology group to make a copy of the hard drive. It only copied the “MyDocuments” directory, but in doing so, it booted up the computer.
Mintz Levin then gave the laptop computer to a courier service to deliver to Hartford.
At 4:30 p.m. S.A. Urso advised the grand jury that the laptop computer had been located at Triumph’s Boston office and was being driven to Hartford by a courier.
The courier service delivered the laptop computer to S.A. Urso at approximately 4:45 p.m. S.A. Urso immediately delivered it to the magistrate judge’s chambers.
Two days later, on April 13, 2000, Ms. Miner spoke to Ms. Dannehy to discuss how Triumph intended to proceed. Ms. Miner’s notes indicate that Ms. Dannehy asked her if she intended to file a motion to quash the subpoena and that Ms. Miner responded that “if she had something to file, she would file it.”
During the eight days between the time the forthwith subpoena was served and the commencement of the search, Triumph did not file a motion to quash the subpoena, a motion for release of property or otherwise challenge the scope or propriety of the forthwith subpoena. The fact that no such motion was filed was a voluntary, tactical decision on the part of Triumph and its competent, experienced counsel, and was not the result of coercion, promises or misleading conduct by the government.
The totality of the circumstances support a finding that the defendants’ compliance with the forthwith subpoena was voluntary, not coerced.
On April 13, 2000, the magistrate judge issued a warrant to search and seize the laptop computer.
The warrant consisted of the application, the affidavit of SA Urso, and attachments A, B, C and D, the provisions of which were implicitly or explicitly incorporated into and made a part of the warrant.
The warrant authorized the agent to search and seize evidence relating to the crimes of conspiracy, bribery concerning programs receiving federal funds, mail and wire fraud/theft of honest services, and obstruction of justice.
Attachment A to the warrant described the property to be searched as the laptop computer. The warrant did not limit the search to any particular area of the hard drive, or to any specific files or directories.
Attachment B to the warrant, entitled “List of Property to be Searched and Seized”, identified the following property:
“1. Computer logs and file records on the storage media of the laptop computer’s hard drive, including time and date or records associated with individual files which can indicate deletion or destruction of individual files on the storage media of [the laptop computer’s] hard drive or a deletion and restoration of the entire file system on the storage media, at a particular time[;]”
“2. Computerized records of a contract with a type written date of May 1, 1998, between Lisa Thiesfield, acting through LAT, LLC and Triumph Capital, including all computer generated information relating to the creation, modification and/or deletion of the contract;”
“3. Computerized records of a contract with a type written date of January 15, 1999 between Lisa Thiesfield, acting through LAT, LLC and Triumph Capital, including all computer generated information relating to the creation, modification and/or deletion of the contract;”
“4. Computerized records of a contract with typewritten date of January 15, 1999, between Christopher Stack, acting through KCATS, LLC and Triumph Capital, including all computer generated information relating to the creation, modification and/or deletion of the contract;”
“5. Computerized records relating to contracts between Triumph Capital and Benjamin ‘Beri Andrews, Triumph Capital and Park Strategies and/or Benjamin ‘Beri Andrews and Park Strategies, including all computer generated information relating to the creation, modification and/or deletion of contracts between Triumph Capital and Benjamin ‘Beri Andrews, Triumph Capital and Park Strategies and/or Benjamin ‘Beri Andrews and Park Strategies.”
The Affidavit of S.A. Urso that was submitted in support of the warrant set forth, inter alia, the following facts to establish probable cause for the search of the laptop computer’s hard disk drive:
One of Silvester’s pension fund investments under investigation was a $200 million investment on approximately November 12, 1998, with Triumph CT-II, a Triumph-related fund.
The laptop computer would be searched for evidence of deletion of computer files and the creation, modification and/or deletion of contracts between Triumph and Thiesfield’s company, LAT, LLC; Triumph and Stack’s company, KCATS, LLC; and contracts between Triumph and Park Strategies, Triumph and Benjamin “Ben” Andrews and/or Benjamin “Ben” Andrews and Park Strategies.
Silvester pleaded guilty to RICO and money laundering on September 23, 1999. At his guilty plea, he admitted that between March, 1997, and January 6, 1999, he breached his fiduciary responsibilities and corrupted the investment process by soliciting and accepting bribes and rewards for himself and others in return for making investments with certain private equity funds, including Triumph.
Silvester and Stack were cooperating in the ongoing investigation. Stack had been granted testimonial immunity.
On November 11, 1998, Silvester signed the closing documents for an investment of $200 million of Connecticut pension funds with Triumph CT-II. Silvester admitted that in return for the investment he asked Triumph to enter into consulting contracts with Stack and Thiesfield and that they had agreed to “kickback” to him a portion of the fees paid under the contracts, and that McCarthy and Spadoni agreed to enter into contracts with Stack and Thiesfield. Both of their contracts were dated January 15, 1999, were not success based or connected to a particular fund and provided for the payment of a $1 million fee over three years. However, Stack advised that he signed his contract earlier on November 11, 1998, the same day Silvester signed the papers investing $200 million in Triumph CT-II, that Silvester arranged for the contract, that he did no work under the contract and that Silvester expected him to kickback a portion of the fees he received from Triumph. Stack had given a copy of his contract with Triumph to the government.
On May 25, 1999, the grand jury served a subpoena on Triumph CT-II for all documents related to the Connecticut pension fund investment. Triumph did not produce the Thiesfield/Stack contracts in response to that subpoena. On July 13, 1999, the grand jury served another subpoena on Triumph requesting documents relating to contracts and/or agreements between Triumph and Stack and Triumph and Thiesfield. In response, Triumph produced a contract between Triumph and LAT, LLC dated May 1, 1998. The contract provided for a $25,000 payment to Thiesfield for services to Triumph in connection with the Mashantucket Pequot Tribe. The Mashantucket Pequot Tribe, however, never made an investment with Triumph. Silvester stated that the contract was a means to pay Thiesfield to work as his campaign manager in 1998. Triumph also produced two contracts dated January 15, 1999, between Triumph and LAT, LLC and Triumph and KCATS, LLC.
Silvester stated that a few days after Triumph received its first grand jury subpoena, he had a conversation with Spadoni. Spadoni told him that Triumph had not provided the Thiesfield and Stack contracts because it did not believe they were responsive. Spadoni also stated that Triumph’s lawyer said that more subpoenas were likely and that documents that might be incriminating and that had no business purpose should be purged. Silvester further stated that either he or someone from Triumph had purchased a software program to “purge” or “blow out” the computer. Silvester did not know the computer Spadoni was referring to or whether Spadoni or someone else had actually purged the computer.
According to Silvester, Spadoni did not specifically mention that the Thiesfield and Stack contracts had been deleted or purged, but he specifically mentioned that contracts showing a relationship between or among Triumph, Andrews and Park Strategies had been deleted. As part of his guilty plea, Silvester admitted that he invested $50 million in a Caryle Asia fund in return for his job at Park Strategies.
Silvester stated that while he was employed at Park Strategies, he wanted Triumph to hire Park Strategies. But, because McCarthy did not want to hire Silvester directly, Silvester suggested that Triumph enter a contract with Andrews who could then enter contracts with Park Strategies and Silvester.
On December 29, 1999, the grand jury served another subpoena on Triumph seeking back-up tapes for its server and/or any other computers or computer systems used by any employee of Triumph, and records relating to Triumph’s network configuration. In response to the subpoena, Triumph produced back-up tapes and a document that showed Spadoni used a Triumph-owned laptop computer.
A CART agent reviewed the back-up tapes. He discovered that the Stack and Thiesfield contracts were not on the back-up tapes from Triumph’s Boston office dated December 28, 1998, May 18, 1999, and August 27, 1999. He also discovered that a contract between Park Strategies and a firm named Empire Office, Inc. was on the May 18, 1999, back-up tape, but was not on the August 27, 1999, back-up tape. The CART agent was not able to determine how or when it was taken off the system.
The August 27, 1999, back-up tape showed that between 9:41 a.m. and 1:56 p.m. on Memorial Day, May 31, 1999, six days after Triumph received its first grand jury subpoena, a substantial number of documents were transferred from an unknown computer to Triumph’s Boston computer system, into a directory named “Spadoni.” The agent believed that this transfer was consistent with Silvester’s information that Spadoni was planning to “blow out” a computer and that he moved the documents he wanted to save.
The affidavit in support of the warrant provided the following information pertaining to the scope of the requested search:
The laptop computer could store the equivalent of thousands of pages of information.
Data-search protocols were exacting scientific procedures that were designed to protect the integrity of the evidence and to recover hidden, erased, compressed, password-protected or encrypted files.
To properly, completely and accurately retrieve and analyze all of the data on the computer and to prevent the loss or overwriting of data from inadvertent or intentional modification or destruction (both from external sources or from destructive codes imbedded in the system as a “booby trap”) the search should be conducted in a properly controlled, off-site laboratory.
Examination of the evidence could take weeks or months.
The search and seizure would be conducted in accordance with the United States Attorney’s Office Instructions to Agents and Instructions to Attorney which were set forth in Attachments C and D and made part of the warrant.
Because the laptop computer was used by a lawyer, the warrant contained a search methodology and procedures governing the review of seized data to ensure that no attorney-client privileged communications would be inadvertently seen or reviewed by the prosecution team.
The magistrate judge approved and authorized those procedures, which were set forth in Attachment D. This attachment provided that a supervising AUSA, who was not a member of the prosecution team and was not participating in the search, would act as a “taint team” to set up a “Chinese Wall” between the evidence and the prosecution team that would prevent any privileged material from getting through.
The use of a taint team is a proper, fair and acceptable method of protecting privileged communications when a search involves property of an attorney.2
Attachment D instructed the taint team to be available to the agent conducting the search and to review all documents to be seized to determine if they contained any privileged information. It provided that: (1) documents covered by the attorney-client privilege would not be seized; (2) documents which were arguably privileged or which were privileged but could fall within an exception to the privilege, would be sealed and delivered to a United States Magistrate Judge; (3) documents which were not privileged were to be separately sealed and delivered to the magistrate judge; (4) if the magistrate judge determined that a seized document was not privileged, it would be turned over to the agents and the prosecution team.
The taint team procedures set out in Attachment D were filed under seal and were not served on defendants.
On April 13, 2000, Ms. Dannehy informed Ms. Miner that the government had obtained a warrant to search the laptop computer and provided her with a copy of the warrant. Ms. Dannehy did not give Ms. Miner a copy of Attachment C, Attachment D or the Affidavit because they were under seal.
The Application, Affidavit and Attachments C and D were provided to the defendants on October 24, 2000, after the indictment was returned and the documents were unsealed.
On April 13, 2000, the day the warrant was served, Ms. Dannehy advised Ms. Miner that a taint team would conduct the search to insure that privileged documents would not be inadvertently turned over to the prosecution team. Ms. Dannehy did not describe the precise procedures set out in Attachment D because it was sealed.
Ms. Miner understood Ms. Dannehy’s explanation of the taint team procedures to mean that a Chinese Wall would be created to prevent any privileged material on the laptop computer from being disclosed or reviewed by the prosecution team before Triumph could assert a claim of privilege. Despite her testimony to the contrary, Triumph’s counsel, a competent and experienced criminal defense attorney, could not have reasonably believed that no procedures were in place to prevent privileged materials from being reviewed, seized or given to the prosecution team before a privilege claim could be asserted and decided.
Ms. Dannehy told Ms. Miner that the government would not commence the search of the laptop computer until Triumph had an opportunity to file a motion regarding its examination and procedures to protect attorney-client privileged material.
On April 14, 2000, Triumph’s counsel filed a motion to preclude the government from reviewing or copying attorney-client privileged materials in the course of executing the search. The motion requested the court implement various procedures to protect privileged material.
On April 17, 2000, Ms. Dannehy and Mr. Silva discussed the issues raised in the April 14, 2000, motion in an attempt to reach an agreement on procedures that would protect privileged material.
Mr. Silva testified that during his conversation with Ms. Dannehy, he believed that the government would only search the “MyDocuments” directory on the laptop computer. There is no evidence that Ms. Dannehy knew that Mr. Silva was operating under that erroneous assumption or that she did anything to create or foster it. In fact, Mr. Silva admitted during the hearing that Ms. Dannehy was unwilling to limit the search to that one directory. Moreover, Ms. Dannehy could not have misled Mr. Silva because the government had not even opened the laptop computer and was therefore completely unaware of its contents.
Mr. Silva and Ms. Dannehy reached an agreement on the procedures that would be followed during the search to protect privileged material. The agreement, as memorialized in a letter dated April 18, 2000 (the “letter agreement”), contained different procedures than those contained in Attachment D. According to the letter agreement, “[i]f the [CART agent] seeks to review any document(s) currently on the hard drive and contained in either the directory labeled ‘Triumph’ or ‘Employment’, he will first provide [Triumph’s counsel] with the name of the document(s) or, if necessary, a copy of the document(s) on a computer disc; [i]f Triumph claims that the document(s) should not be disclosed because of the attorney/client privilege, the CART Agent will copy the document(s), without opening it, to a disc and file the disc with the court[;] Triumph[ ] will then file the appropriate motion seeking an in camera review ... and will simultaneously provide the CART Agent and the AUSA with a privilege log which sets forth the author, the recipient(s), the date and the general nature of the document(s); the government will have the opportunity to brief the Court on its position prior to the Court’s determination as to whether the document(s) is protected by the attorney/client privilege.”
Based on this agreed-to procedure, Triumph said that its motion to preclude could be denied as moot.
Although Mr. Silva testified that he would not have agreed to withdraw the motion to preclude if he had realized that the government intended to search the entire hard drive, his erroneous belief as to the scope of the search was not caused by any action or inaction of the government and is not supported by a reasonable reading of the warrant. The warrant does not limit or even suggest that the search would be limited to any particular directory, subdirectories or files. To the contrary, it specifically states that the entire hard drive would be searched. Further, there is no merit to the defendants’ claim that the procedures were inadequate and they were not harmed or prejudiced in any way by the agreed-upon procedures, which actually provided greater protection to the defendants by giving their counsel a role in the screening process. Moreover, Triumph was given an opportunity to review and raise a privilege claim for all documents and material, not just the documents in the “Triumph” and “Employment” subdirectories, before any of it was given to the prosecution team.
The taint team was comprised of AUSA Mark Califano (“Califano”). SA Rovelli, the CART Agent who conducted the search of the hard drive, was not a member of the taint team.
On April 24, 2000, Mr. Califano notified Mr. Silva by telephone that SA Rovelli wanted to review six documents from the two subdirectories that were specified in the letter agreement. That same day, Mr. Silva received a letter with a list of the documents SA Rovelli sought to review along with a disk containing copies of the documents.
The document entitled “Tri-Conn Minutes Advisory” was not on the list of documents that SA Rovelli wanted to review, nor was it on the disk. There is no evidence that SA Rovelli, Mr. Califano or any member of the prosecution team reviewed that document.
On April 24, 2000, Mr. Califano also spoke to Ms. Miner about the list of documents that SA Rovelli wanted to review. Mr. Califano had not received a copy of the list of documents and was looking for the names of the documents.
Ms. Miner’s handwritten notes of that conversation contain a vague reference to “Tri Conn — Minutes Advisory Comm.” The “TriConn Minutes Advisory Comm.” document was not on the list of documents produced by the taint team, nor was it on the disk containing the documents submitted for defendants’ review.
After Mr. Silva reviewed the six documents produced by the taint team, he notified Mr. Califano that Triumph was asserting a privilege claim for one document entitled “All Hands Meeting.doc”.
Although the letter agreement specifically pertained only to material in the “Triumph” and “Employment” subdirectories, on May 24, 2000, Mr. Califano gave Triumph’s counsel 1,292 pages of printed material, including data from free and slack space and a compact disc (“CD”) containing 23 active files, including 18 document files and 5 Microsoft Outlook files (4 .pst files and one .pab file), 39 recovered deleted documents, 6 recovered deleted link files and a listing of active link files. He advised the defendants that SA Rovelli intended to search and/or seize this data.
Mr. Califano asked defendants’ counsel to raise any privilege claim for this material by May 31, 2000. He further advised that “all seized documents and data for which no claim of privilege is raised by that date will be turned over to the [prosecution team].”
Mr. Califano also advised defendants’ counsel that the government intended to use as evidence other software properties, directory structures, file attributes and file links from the laptop hard drive.
Mr. Silva testified that after he received this letter he realized that the scope of the search went beyond the “Triumph” and “Employment” subdirectories. But even with this knowledge he took no action to question or limit the search and seizure.
On June 1, 2000, hard copies of all seized documents, including the identified active files, free and slack space, and recovered deleted files, but not the documents for which Triumph asserted a privilege claim, were turned over to the prosecution team.
The prosecution team was not given a copy of the CD that was given to Triumph’s counsel on May 24, 2000.
SA Rovelli executed the warrant.
SA Rovelli began his forensic examination of the laptop computer’s hard disk drive (“hard drive”)3 on April 19, 2000, after reading the warrant, the attachments, the affidavit and the April 18, 2000, letter agreement pertaining to privileged material, and discussing the investigation with SA Urso and Ms. Dannehy so that he understood the nature of the search and what he was to look for under the warrant.
The methodology SA Rovelli used to search the hard drive was consistent with the methodology that a well-trained CART agent would use. The evidence establishes that SA Rovelli acted in good faith and conducted an extensive, careful and thorough examination of the entire hard drive and attempted to stay within, as far as practicable and possible under the circumstances, the methodology and limits set out in the warrant. SA Rovelli had a reasonable, logical and credible explanation for the vast majority of documents and data he seized, scanned or reviewed without seizing, even for the data and documents that did not fall within the scope of the warrant.
SA Rovelli is a well-trained, experienced CART agent. He testified at length as to the steps he took to thoroughly search the hard drive, explained his search strategy and methodology, and gave specific reasons why he seized documents and data. His testimony showed that he understood the criminal conduct alleged and the rationale for the search as explained in the warrant. He described a careful, informed and deliberate search. His testimony was credible, candid and comprehensive.
To search for the evidence listed on Attachment B, SA Rovelli had to review and examine the entire hard drive, including active files,4 free space,5 slack space,6 recovered deleted files,7 directory structures,8 link files,9 file attributes, software programs and properties, image files10 such as internet cache files11 and temporary directories.
The laptop computer remained in the magistrate judge’s custody until SA Rovelli began the search and until then, the government did not have access to it. The warrant was drafted without any knowledge of its contents and did not, and was not intended to, limit the search to any specific areas of the hard drive. In addition, the warrant did not limit the search to only documents created by Spadoni.
The storage capacity of the hard drive is 1.6 GB or approximately 453,000 pages of text. The hard drive actually contained approximately 1 GB, or 250,000 pages of data, including 18,768 active files and 1,800 recovered deleted files.
SA Rovelli actually seized only a small fraction of the data, documents and information that was contained on the hard drive.12 The material he seized included, inter alia, the following evidence that the government intends to use at trial: evidence that documents called “LAT Contract.doc” and “Stack Contract.doc” existed as early as November 10, 1998; evidence that a directory entitled “Silvester” and documents contained therein were deleted after May 31, 1999; evidence that a draft contract between Ben Andrews’s company, Capital Marketing Investment Corp., and Triumph was deleted; evidence showing that documents from a directory entitled “Andrews” were deleted; evidence showing that documents from the laptop computer were transferred to Triumph’s network on May 31, 1999; evidence that a software program called Destroy-it13 had been installed on the hard drive on June 21, 1999, and was used on a “LAT.LLC” directory and the documents it contained.
The defendants do not seek to suppress any of this or any other specific evidence, nor do they identify any particular documents or data that should be suppressed as beyond the scope of the warrant. Rather, they seek blanket suppression of all data and documents seized, even evidence that is clearly within the scope of the warrant as well as innocuous documents and data that the government does not intend to introduce at trial. They claim that blanket suppression is required because the amount of evidence seized and the manner in which the search was executed was not reasonable and violated the defendants’ Fourth Amendment rights.
Computer searches, especially those seeking evidence of deletion, are technical and complex and cannot be limited to precise, specific steps or only one permissible method. Directories and files can be encrypted, hidden or misleadingly titled, stored in unusual formats, and commingled with unrelated and innocuous files that have no relation to the crimes under investigation. Descriptive file names or file extensions such as “.jpg” cannot be relied on to determine the type of file because a computer user can save a file with any name or extension he chooses. Thus, a person who wanted to hide textual data could save it in a manner that indicated it was a graphics or image file. For these reasons and as a practical matter, SA Rovelli acted reasonably and within the scope of the warrant by opening, screening and manually reviewing data and files in all areas of the hard drive, including image files.
There is no evidence that SA Rovelli was instructed to look for documents without regard to the warrant.
The warrant provided SA Rovelli with reasonable flexibility and authorized a thorough search of the programs, directories, active files and deleted data that most likely contained evidence and information relating to the alleged crimes and contracts under investigation. The warrant permitted him to conduct the search by file names, keywords, file dates and other indicia of relevance. It also permitted him to manually review directories, programs, and files that were not labeled or labeled in a way that did not indicate who was associated with them to determine if they pertained to the names or transactions listed in the warrant.
SA Rovelli acted as a reasonably well-trained computer expert by construing the term “file records” in paragraph one of Attachment B as including the text or content of a file, not just information related to a file such as creation date, time, properties, size, last accessed date or directory information. Construing the term “file records” to mean only information about a file and not the text or content of a file would require a cramped and hypertechnical reading of the warrant.
The warrant authorized SA Rovelli, and SA Rovelli reasonably understood it as authorizing him, to take more than ten days to search the hard drive. As a practical matter, SA Rovelli could not have completed a thorough search of the hard drive for the evidence listed in Attachment B in just ten days. Rather, as the warrant states, because of the large amount of data that could be contained on the laptop, the fact that data could be mislabeled, encrypted, stored in hidden directories or embedded in slack space, and the overall complexity of the requested search, the search required an extensive analysis that could take weeks or months.
SA Rovelli commenced his search of the hard drive on April 19, 2000. He first used a program called SafeBack to create an identical copy, or “mirror image” of the data on the hard drive. SA Rovelli did not boot up the computer before making the mirror image because doing so could have altered the data on the hard drive.
Making a mirror image of the hard drive is central to the examination process and is a routine, technical step taken by well-trained CART agents. It is done to maintain the integrity and security of the original evidence. A mirror image is an exact duplicate of the entire hard drive, and includes all the scattered clusters of the active and deleted files and the slack and free space. Having such a mirror image of the hard drive also allows the examiner to reconstruct the steps of his examination at a later time.
Once SA Rovelli made the mirror image, he never went back to the original hard drive or the laptop computer itself. He made only one mirror image. He saved the mirror image to a magneto optical disk (“MO”). It is a reasonable and routine procedure for a computer examiner to save or back up the mirror image to another medium such as an MO for examination purposes. The fact that he created an MO does not mean that he seized the entire hard drive.
During his forensic examination, SA Rovelli restored the mirror image approximately four to six times. He did this so that he would have clean copies of the mirror image on which he could perform searches and to conduct tests, including “destructive” tests that could alter the original image. Also, because an MO has a write-protect safeguard, the data it contains cannot be modified or altered during the review process. A mirror image does not have such a feature. SA Rovelli believed that conducting the search on MOs was the best and most accurate method and would not compromise the original image.
SA Rovelli did not violate the warrant or act unreasonably by not running the SafeBack audit log when he made the mirror image of the hard drive. SA Rovelli made handwritten notes of the imaging process and they contain the same relevant information that would be found on an audit log, including when the image was made and other steps in the restoration process. This is consistent with what a reasonably well trained CART Agent would have done in the circumstances.
Reasonably well trained CART agents are not required to keep detailed, minute-by-minute records of every step they take during a search and SA Rovelli acted reasonably in not keeping such records. The MOs and CDs which SA Rovelli created, along with his handwritten notes, hard copies of documents and data, and print outs constitute an adequate record and inventory as required by the warrant, and sufficiently identify most of the steps he took in his examination.
On April 20, 2000, SA Rovelli copied all the active files, all the recovered deleted files and directory structure information to an MO.
On April 21, 2000, SA Rovelli extracted the free and slack space and divided the data into active files which he created and named “slack.txt” and “free.txt” and stored this on another MO. He created these files because the program he intended to use to search the data could only search active files. This also enabled SA Rovelli to search surrounding clusters of slack space without having to view the active files associated with such slack space. After these preliminary steps, SA Rovelli used a special forensic software program to filter the free and slack space to remove characters that could not be accurately searched by keywords with the program he intended to use. He also saved this filtered free and slack space on an MO. Contrary to the defendants’ claim, the steps SA Rovelli took to extract the free and slack space did not violate the terms of the warrant even though the files he created were “artificial.” The steps he took were consistent with those of a reasonably well-trained CART agent. Using MOs provided greater protection against alteration of data during a search and minimized the intrusiveness of a search. Because SA Rovelli was following established protocol, he did not need the approval of the magistrate judge to copy data to MOs. There is no evidence that he had any improper purpose in doing so or that he did so because there would be no record of the files he opened or viewed.
During the course of his examination, SA Rovelli created two CDs.
One CD contained 23 active files, consisting of 18 document files and 5 Microsoft Outlook14 files (consisting of 4 .pst files and 1 .pab file), a listing of recent link files from three directories, and recovered deleted files. SA Rovelli put all the link files on this CD because he did not then have the software he needed to view the contents of these files.
SA Rovelli produced this CD to the defendants on May 24, 2000. The prosecution team was not given a copy of this CD.
SA Rovelli created another CD on July 18, 2001. This CD was given to defendants on July 20, 2001, as part of the government’s discovery. The CD contained lists of keywords, an active file called esdrvmap,15 results of keyword searches on active files, deleted files and filtered free and slack space, all extracted deleted files and directory structure information. This CD was also not given to the prosecution team.
By putting all of this data, including all of the link files, the extracted free and slack space, and the .pab and .pst files on the CDs and/or labeling the CDs “seized files”, SA Rovelli did not intend to signify that he searched and/or seized that data pursuant to the warrant. Rather, he put the files and data on the CDs to give the defendants’ counsel a record of what he intended to review so that they could assert a privilege claim, to make it easier to access the information and to maintain the integrity of the files and evidence. He did not need the approval of the magistrate judge to do so.
SA Rovelli acted as a reasonably well trained CART agent and in good faith in not limiting his search methodology to just keywords.
The warrant provided that the searching agent would “make every effort to review the text or content of only those programs, directories, files and material” that responded to keywords. But this language did not authorize keywords as the exclusive method of conducting the search, prohibit other search methods or limit manual review to only data that responded to keywords.
In fact, because of the limitations of keyword searches, the warrant authorized searches based on file names, file dates or other indicia of relevance and a manual review when necessary.
Keyword searches are limited because they are literal and search only for an exact sequence of characters. Thus, they do not pick up variations or misspellings of words or names.
Keyword searches are also limited because they cannot be conducted on all files, such as image files that contain scanned documents or faxes.
Searching deleted files and free and slack space using keywords can be particularly problematic because when a file is deleted, its name is altered by the FAT thereby rendering it unresponsive to a keyword search. In addition, a keyword search may locate a portion of a deleted file, but not other portions of the file unless they also contain keywords.
Keyword searches also do not work on files that are in binary format such as “.pst” files that store data used by Microsoft Outlook. Such files can be searched with keywords only if they are opened in the Microsoft Outlook program and the program’s internal find function is used.
Keyword searches will not uncover link files that point to files that contain keywords unless the title of the file contains a keyword.
Keyword searches do not work on documents that are prepared in Unicode rather than ASCII unless the non-ASCII characters are first filtered out.
The warrant gave the searching agent latitude to form keyword searches from the contracts between Triumph and Thiesfield and Triumph and Stack and to specifically use the terms Park Strategies, Benjamin Andrews and/or Ben Andrews. But this specification did not mean that these terms were unalterable or were the only “authorized” or exclusive terms that could be used to the exclusion of all other relevant terms or variations of names and terms.
SA Rovelli reasonably and appropriately formed twenty-five keywords from the contracts, names and information contained in the contracts and the affidavit.
His first two lists of keywords did not contain the term “minutes.” The word “minutes” was added to the list after SA Rovelli searched the slack space using the keyword “Thiesfield” and found a string that read “My DocumentsConsultant Contract — lisa thiesfield.dococ-V.dococ Ltr.docsultant Contract.document.doc Minutes.does”. Because this string contained the words “Thiesfield” and “Consultant Contract” in close proximity to the word “Minutes” and did not have a separate directory path, SA Rovelli reasonably and in good faith believed that “minutes” was an appropriate word to add to his list of keywords.
SA Rovelli’s explanation of why he added “minutes” to his list of keywords is logical and consistent with what a reasonably well trained CART agent would have done. There is no evidence that he was improperly instructed by anyone to add the word “minutes” to his list of keywords or that he acted in bad faith in doing so. Using minutes as a keyword did not constitute flagrant disregard of the warrant, even if it produced numerous irrelevant hits.
Using “Stack” as a keyword was expressly authorized by the warrant and SA Rovelli acted reasonably and in good faith in using it as a keyword regardless of the fact that it is a term commonly used in computer programming and appears frequently in error messages and thus could produce numerous irrelevant hits.
SA Rovelli also acted reasonably and within the express terms of the warrant in using “ben” as a keyword even if doing so could produce numerous irrelevant hits, i.e., hits on documents that contained the word “benefit.”
SA Rovelli did not unreasonably broaden the search by using “Stack” or “ben” as keywords. Both “Stack” and “ben” were keywords authorized by the warrant.
SA Rovelli also acted reasonably and within the scope of the warrant by using “Silvester” and “capital marketing investments” as keywords. These keyword search terms were formed from the contracts and constituted other indicia of relevance.
SA Rovelli used a utility program called DL to search the 18,768 active files on the hard drive by keywords. He seized 23 active files, consisting of 18 document files, and 5 Microsoft Outlook files containing 4 .pst files and 1 .pab file.
One of the 18 document files did not contain a keyword. SA Rovelli manually reviewed that file because its name was similar to another file in the same directory which referred to Thiesfield, Spadoni and McCarthy. He seized it because it mentioned Thiesfield and Spadoni by their initials.
SA Rovelli also searched the 4 .pst files and 1 .pab file by using keywords and manual review. Three of the four .pst files contained keywords. The other .pst file contained directory structure information. The .pst files were in binary format and had to be imported into Microsoft Outlook before they could be viewed or searched with keywords. SA Rovelli imported them and searched with keywords using the find function in the journal portion of the program. He seized the .pab file because he thought he needed it to examine the .pst files.
SA Rovelli did not review or seize the email messages, contact information or notes. The only information he manually reviewed in the .pst files was journal entries. The journal entries showed evidence that a directory named “Silvester” was on the hard drive between April 6, 1999 and May 31, 1999, was last accessed on May 31, 1999, but was subsequently deleted.
SA Rovelli used a utility to recover 1,800 deleted files. He used another utility to search these files by keywords. The search produced 105 hits. He manually screened all 105 files and others that he deemed relevant based on their location, directory, name or lack of descriptive name. Such manual screening was authorized by the warrant.
Manual review is necessary because, when the utility recovers deleted files, it tries to put all pieces of the file back together. But this does not mean that all of the actual data that was originally associated with the file will be found — the document may have been stored in separate clusters, and data on one or more of the original clusters assigned to the file may have been overwritten after the file was deleted.
SA Rovelli seized 45 recovered deleted files, including 39 deleted text files and 6 deleted link files. Keywords appeared in 28 of the 39 deleted text files and in 2 of the 6 deleted link files. SA Rovelli seized the deleted text files that did not contain keywords because their file names did not provide identifying information that would enable him to tell the person associated with them, what they contained or the type of document. SA Rovelli had a reasonable, logical and credible explanation for seizing all but two of these files, even though they did not contain keywords or were not obviously related to the contracts specified in paragraphs 2 through 5 of the warrant. For instance, the files contained other indicia of relevance such as: (1) references to Connecticut Statutes pertaining to political contributions, post-employment agreements discussing the ability of terminated employees to disclose information about the relevant contracts, references to Connecticut Treasurer or Triumph Connecticut investments; (2) dates coinciding with the investments, contracts and events under investigation; (3) Unicode formatting similar to the Stack and Andrews contracts; and (4) references to “Triumph CBO”, a term that was related to files that had been deleted from the Silvester directory.
Although two of the documents did not contain such indicia of relevance and were not within the scope of the warrant, they contained fragmented, innocuous text which the government does not intend to offer at trial.
There were approximately 52,000 pages of free space on the hard drive. SA Rovelli seized 120 pages of it. The majority of this data contained directory structures, including traces of previously existing subdirectories entitled “Silvester” and “Andrews”, portions of a contract between Capital Marketing Investment and Triumph, portions of letters referring to payments to Silvester and containing references to Stack, state ethics laws governing gifts to public officials, news articles about the investigation, references to directories related to Thiesfield, and documents relating to Triumph partnership agreements during the relevant time period.
There were approximately 5,000 pages of slack space on the hard drive, of which SA Rovelli seized 378 printed pages. Two hundred forty eight pages of the seized slack space was directory structure information. This data was within the scope of the warrant because it showed files that had been deleted from the hard drive. The balance, which also was properly seized, consisted of evidence of the directory path used for “Recent Links”, evidence of the CleanSweep program, the Stack contract, portions of other consultant contracts, references to the Andrews contract and memos in the Andrews directory, portions of Triumph employee nondisclosure agreements, references to TriConn, TriumphConnecticut and Tri-Conn II Advisors, references to CBO investments, files deleted from the Silvester directory, fragments of contracts referencing Triumph Connecticut II or relating to rights of Triumph limited partners, state ethics and elections laws, and news stories about Thiesfield and Andrews and the investigation.
After SA Rovelli filtered the free and slack space he was able to search the space with keywords. The utility he used produced a report that showed files contained keywords hits, but did not identify where in the files the hits were located. He used the “find” function of Microsoft Word to search those keywords and locate the clusters that contained the keywords and then manually reviewed those clusters and the surrounding clusters. This process enabled him to find, for instance, the cluster that contained portions of the Stack contract intermingled with another deleted contract. Because he had extracted the slack space to a separate file, he was able to manually review it without having to view the active files associated with the clusters that contained slack space.
SA Rovelli acted reasonably and within the scope of the warrant by manually reviewing surrounding clusters in the filtered slack and free space to see if he could find other parts of deleted files or documents that he had located with a keyword search.
SA Rovelli’s method of searching the slack and free space was reasonable and did not violate the terms or scope of the warrant.
SA Rovelli put all 204 link files on the CD that he gave to the defendants on May 24, 2000, because he did not have the software he needed to view the contents of these files, which is inaccessible to users without a special utility. But this did not constitute a seizure of those link files, even though the CD was labeled “seized files.”
Thereafter, SA Rovelli obtained a utility that displayed the information in link files. He screened and reviewed the content of twelve of them. Eleven of the twelve contained keywords in either the link file itself or the file to which it pointed. The other link file pointed to a file called “LAT Contract”. LAT are Thiesfield’s initials. He seized 6 link files.
SA Rovelli manually screened the internet cache files for evidence of deletions. It was reasonable for him to do so because these files could contain faxed or scanned documents that would not respond to a keyword search or could contain evidence that a program such as Destroy-it had been downloaded or purchased from the internet.
SA Rovelli saw evidence of a different crime while he was screening the deleted cache files for the evidence listed in the warrant. He conducted a cursory review of a number of them to be certain they contained evidence of another crime and then contacted the U.S. Attorney’s Office to obtain a second warrant to search and seize evidence of that crime. The fact that he did not search this material without a separate warrant supports a finding that he was not indiscriminately rummaging through the hard drive for evidence of any crime.
SA Rovelli also searched and seized all directory structure information. This information could identify documents or files that at one time were on the hard drive.
SA Rovelli found two “MyDocuments” directories on the hard drive. One of them was created in February, 1999, under a “SpadoniC” user account. SA Rovelli observed that this directory appeared to contain copies of all files that had been in the other “MyDocuments” directory but had been deleted from that directory.
SA Rovelli seized all software properties, including information relating to Microsoft Word, the Destroy-it program, the Microsoft Outlook program and a software program called CleanSweep. SA Rovelli’s keyword search of the csdrvmap.dat file identified the programs and files that were on the computer system on the date the program was run and provided links to data files that were then on the system.
Finally, SA Rovelli seized user configurations which provided evidence of users who had access to the computer.
On October 17, 2000, SA Rovelli filed the search warrant return. The inventory indicated that he seized “a mirror image of the hard drive to review for evidence as noted on Attachment B.” This language did not, and was not intended to mean that he seized the entire contents of the hard drive.
The warrant authorized him to take weeks or months to conduct the search and the defendants were not prejudiced by the fact that the return was not filed before October 17, 2000.
The defendants were given a record or inventory, in either hard copy or electronic form on CDs, of everything seized pursuant to Attachment B of the warrant.
SA Rovelli understood that by filing the warrant he indicated he had completed what the warrant authorized him to do.
After he filed the return, SA Rovelli continued his forensic examination of the hard drive by running software programs and utilities, opening and viewing files that he had seized, and restoring the image. He did not keep detailed notes of his activities after October 17, 2000, but his print-outs show approximate dates of when he restored the image.
SA Rovelli restored the mirror image after the warrant was returned so that he could look at data and documents in their original form and context and continue his forensic examination of the seized evidence.
For instance, in December 2000, he executed the Destroy-it program to conduct further analysis of its functionality, characteristics, and footprints.
On December 14, 2000, and in July, 2001 he used a program called Norton Disk Editor to review the directory structures of items identified as seized and the unfiltered slack space.
In September, 2001, he ran a program that allowed him to view the internals of the active file links that were seized.
SA Rovelli complied with the court’s July 10, 2001, order to preserve existing and future “working copies.” Prior to this court order, SA Rovelli was not required to maintain any restored images.
The laptop computer was owned by Triumph. It was assigned to Spadoni for his exclusive use.
Spadoni kept the laptop computer in his sole custody and under his sole control. Spadoni states in an affidavit that he used the laptop computer in his private Triumph offices in Boston and Hartford and carried it with him when he traveled between offices. When he left the Hartford office for the day he either took it with him or stored it in a locked file cabinet. When he left the Boston office for the day he either took it with him or locked it in his private office.
There is no evidence that McCarthy had any personal expectation of privacy in the laptop computer.
Based on the foregoing findings of fact, the court makes the following conclusions of law.
The protections of the Fourth Amendment attach to people, not places. See Rakas v. Illinois, 439 U.S. 128, 99 S.Ct. 421, 58 L.Ed.2d 387 (1978).
To challenge a search and seizure of property, a person must have an actual, subjective expectation of privacy that society is prepared to recognize as reasonable. See id. at 143 n. 12, 99 S.Ct. 421. Such a showing is made when the individual shows ownership, lawful possession or lawful control of the place searched. See id.; United States v. Paulino, 850 F.2d 93, 96 (2d Cir.1988).
The burden of establishing standing is on the person seeking suppression. See United States v. Galante, 547 F.2d 733, 739 (2d Cir.1976).
The evidence shows that the laptop computer was owned by Triumph and was assigned to Spadoni for his exclusive use. McCarthy did not present any evidence to establish an actual or objectively reasonable expectation of privacy in the laptop computer.
There is no evidence that McCarthy had any personal or proprietary interest in the laptop computer or evidence that it contained any material covered by McCarthy’s personal attorney-client privilege. To the contrary, uncontradicted evidence presented by Spadoni establishes that the laptop computer was assigned to him for his exclusive use and that it was always in his exclusive custody and/or control.
McCarthy does not have standing merely because he is a codefendant. See Rakas v. Illinois, 439 U.S. at 134, 99 S.Ct. 421. McCarthy also does not have standing by virtue of his ownership interest in or managerial position at Triumph. Shareholders of a corporation do not have standing merely because they are shareholders, nor can they vicariously assert the corporation’s Fourth Amendment rights. They must establish some personal expectation of privacy in the corporate records at issue. See United States v. Mohney, 949 F.2d 1397, 1403-04 (6th Cir.1991); Williams v. Kunze, 806 F.2d 594, 599 (5th Cir.1986); Lagow v. United States, 159 F.2d 245 (2d Cir.1946).
Because he has shown no personal or proprietary interest in the laptop computer, McCarthy lacks standing to challenge the search of the hard drive.
A grand jury subpoena is presumed to have a proper purpose. See United States v. Salameh, 152 F.3d 88, 109 (2d Cir.1998), cert. denied sub nom. Abouhalima v. United States, 525 U.S. 1112, 119 S.Ct. 885, 142 L.Ed.2d 785 (1999).
The burden is on the defendants to show that the grand jury exceeded its legal powers. See United States v. R. Enters., Inc., 498 U.S. 292, 301, 111 S.Ct. 722, 112 L.Ed.2d 795 (1991) (holding that a grand jury subpoena issued through normal procedures is presumptively reasonable and that the burden of showing unreasonableness is on the party asking to avoid compliance). To sustain that burden, a defendant must present particularized proof of an improper purpose. See United States v. Salameh, 152 F.3d at 109 (citing United States v. Mechanik, 475 U.S. 66, 75, 106 S.Ct. 938, 89 L.Ed.2d 50 (1986)).
The defendants have failed to show that the government had an improper purpose in using the forthwith subpoena. See United States v. Re, 313 F.Supp. 442, 449 (S.D.N.Y. 1970).
A grand jury subpoena must also not be used in such a way as to impinge on Fourth Amendment rights. See Boyd v. United States, 116 U.S. 616, 6 S.Ct. 524, 29 L.Ed. 746 (1886). To determine if a subpoena impinges on a defendant’s Fourth Amendment rights, the focus is on the level of compulsion used when the subpoena was served, and whether the government’s actions constitute an abuse of process. See United States v. Lartey, 716 F.2d 955, 966 (2d Cir.1983) (upholding the use of a forthwith subpoena where there was no threat or compulsion); United States v. Barr, 605 F.Supp. 114, 117 (S.D.N.Y.1985); United States v. Re, 313 F.Supp. at 449.
In this case there is no evidence that the government used any coercion, compulsion or aggressive tactics when the subpoena was served on Triumph’s counsel. Accord, United States v. Wilson, 614 F.2d 1224 (9th Cir.1980) (upholding use of forthwith subpoena in the absence of evidence of abuse of process or that it was used as a ploy to facilitate office interrogation by U.S. attorneys). Cf. In re Nwamu, 421 F.Supp. 1361, 1365-66 (S.D.N.Y.1976) (ordering the return of evidence obtained through forthwith subpoena where executing agents used coercive methods that constituted an unlawful search and seizure).
The totality of the circumstances show that the defendants’ compliance with the forthwith subpoena was voluntary, not coerced.
The facts that the subpoena was served on Triumph’s defense attorney, who is experienced in criminal matters, and that she did not file a motion challenging its validity, support the conclusion that defendants voluntarily complied and that the use of the subpoena did not amount to an unlawful seizure. See United States v. Susskind, 965 F.2d 80, 87 (6th Cir.1992), United States v. Lartey, 716 F.2d at 966. Triumph’s counsel could not reasonably have been unaware of the options that were available to resist the subpoena.
The FAT is similar to a road map or a table of contents. The computer’s operating system uses the FAT to track the specific cluster or clusters that are allocated to each active file and the clusters that are free, or available for storage of new data. When a document or data is stored in an active file, the FAT assigns a number to each cluster that is allocated to that document or file. When the user opens that document or file, the FAT tells the operating system the numbers of the clusters that contain, or store the document or file and gathers the clusters into one contiguous file that the user can open.
Deleted data, or remnants of deleted data can be found in the slack space at the end of an active file and may consist of relatively small, non-contiguous and unrelated fragments that may have come from any number of previously deleted files. A normal computer user does not see slack space when he opens an active file. Forensic tools are required to extract and view slack space.
The data in a deleted file remains in a cluster’s slack space until it is overwritten by new data. Unless there is sufficient data in a new document or file to overwrite all of the deleted data in the cluster, the cluster will contain remnants of formerly deleted data in the cluster’s “slack space” — the space between the end of the new data and the end of the cluster. When all the clusters of a deleted file remain unused by the computer’s operating system, it is possible to recover the deleted file in its entirety. Portions of deleted files may be recovered even if portions of the clusters the file occupied are being used by new files.