State v. Mansor

381 P.3d 930, 279 Or. App. 778, 2016 Ore. App. LEXIS 952

• Court: Washington County Circuit Court, Oregon
• Decided: July 27, 2016
• Docket: C111376CR; A153124
• Status: Published

Opinion

HASELTON, S. J.

Defendant, who was convicted of multiple offenses, including murder by abuse, ORS 163.115(1)(c), following the death of his infant son, appeals. Defendant contends that the trial court erred in (1) denying his motion to suppress material discovered as the result of a warranted search of his home computers, and (2) admitting evidence of a medical diagnosis of “abusive head trauma.”¹ As amplified below, we conclude that the warrant authorizing the seizure and forensic examination of defendant’s home computers was imper-missibly overbroad, violating the particularity requirement of Article I, section 9, of the Oregon Constitution. Accordingly, the trial court erred in denying defendant’s motion to suppress, and, because that error was not harmless, we reverse and remand.²

Except as specifically noted, the circumstances material to our assessment of the lawfulness of the search of defendant’s computers are undisputed. On the afternoon of June 12, 2011, at about 2:22 p.m., defendant made a 9-1-1 call to report that his 11-week-old son, B, had stopped breathing. Emergency medical personnel responded within minutes, followed shortly thereafter by Detective Rookhuyzen of the child abuse unit of the Washington County Sheriffs Office. After the baby had been taken by ambulance to the hospital, Rookhuyzen interviewed defendant.

Rookhuyzen ultimately applied for, and obtained, the warrant pursuant to which the challenged seizure and search of defendant’s computers was undertaken. In his affidavit submitted in support of the warrant application, Rookhuyzen recounted the following:

At the beginning of the interview, Rookhuyzen noted that defendant was “non-emotive” — which, in Rookhuyzen’s training and experience, was “highly unusual” in such circumstances because “[p]arents are usually crying, sobbing, and exhibiting signs of sadness or anxiety.” Defendant told Rookhuyzen that he had been home alone with B and his twin brother, while his wife was working. According to defendant, as he had been feeding B a mixture of formula and liquid vitamins, the mixture had started to come out of the baby’s nose and the baby had started coughing, so defendant had turned him over, shaken him, and “smacked” him on the back. The baby’s eyes became “fixed” and “droopy,” and his breathing became “very much labored.” Defendant told Rookhuyzen that he then shook B more, and the baby began going “a minute or two between breaths.”

Defendant did not call 9-1-1 at that point. Instead, he told Rookhuyzen, he “went online” on a computer in the baby’s room to conduct research about what he should do.³ When, after 15 minutes, the baby’s condition did not improve, defendant called 9-1-1.

Defendant did not call his wife during that period— and, indeed, had not attempted to contact her by the time Rookhuyzen began to interview him. In Rookhuyzen’s experience, that was “extremely unusual”: “[W]ith these kind of incidents, spouses want to call each other instantly, even before speaking with law enforcement.”

Rookhuyzen’s affidavit further recounted that, at the hospital, B was examined by a pediatrician, Dr. Lindsay, who determined that the baby had no brain activity and would die soon. Lindsay further determined, inter alia, that the baby had experienced head trauma resulting in a skull fracture, bi-lateral retinal hemorrhages, and an “old rib fracture.” In Lindsay’s opinion, defendant’s account was not consistent with the baby’s condition, and he ultimately rendered a diagnosis of “shaken baby syndrome” as a result of intentionally inflicted abuse.

After Dr. Lindsay’s examination, and still on June 12, Rookhuyzen prepared an application for a search warrant to be executed at defendant’s residence. In the affidavit in support of that application, Rookhuyzen, as noted, recited the circumstances just recounted. Further, as specifically pertinent to the lawfulness of the seizure and search of defendant’s computers, the affidavit included the following averment:

“I know based upon my training and experience that computers can be connected to the internet to find information using computer software that browse internet sites for information. Internet search engine sites such as Google and Yahoo! are often used to search the internet for information related to a user’s requests. I know that the computer will retain a history of internet sites visited and the search terms used on the internet. I know that to retain the integrity of a computer’s memory and how the system was used, the computer needs to be searched in a laboratory and carefully examined by a trained computer forensic examiner in order to ensure that the data is not corrupted, damaged, or otherwise changed from the time when the machine was seized. [Defendant] told me that he searched the internet between the time he noticed [B] was having difficulty breathing and the time he called emergency dispatch. He told me that he was using a computer to search the internet for advice on what he should do. When I was in the residence, I saw two laptop computers and two desktop computers. [Defendant] did not specify which computer he was using just before he called 911.”

The affidavit also included a detailed description of defendant’s residence. Finally, in a section titled “Conclusion,” the affidavit stated Rookhuyzen’s belief that there was probable cause to seize and search 11 types of evidence, including “[t]wo laptop computers in the residence” and “[t]wo desktop computer towers located in the office/baby room.”⁴

Along with his affidavit, Rookhuyzen prepared and submitted “ATTACHMENT A/” subcaptioned, “ITEMS TO BE SEARCHED FOR, TO BE SEIZED, AND TO BE ANALYZED” (Attachment A), which, on a single page, reiterated verbatim the list of 11 types of evidence set out in the “Conclusion” section of the affidavit. The text of Rookhuyzen’s affidavit does not itself refer to Attachment A.

Finally, Rookhuyzen also prepared and submitted a one-page form of search warrant. Under the heading “Premise described as:”, the warrant reiterated the description of defendant’s residence from Rookhuyzen’s affidavit, and, under the heading “You are to seize and search and forensically examine the following objects:”, the warrant stated simply and without elaboration: “See attachment A.” Thus, the warrant did not specify any protocol for the forensic examination of the computers, including prescribing temporal constraints on the material to be examined.

On the evening of June 12, the trial court issued the search warrant, and officers immediately executed the warrant, seizing, among other items, the four computers listed in Attachment A. Under the direction of detectives, a digital evidence forensic examiner then accessed and analyzed the data on the computers’ hard drives. In searching defendant’s desktop computer, as well as the other devices, the examiner began by focusing on internet searches done on June 12, 2011, that employed or referred to certain terms “specific to aiding an infant that was in trouble, references to calling 911, that sort of thing.”⁵ Those terms included “baby,” “dad,” and “abuse.”⁶ Ultimately, however, the examiner’s search encompassed all data on the hard drives, including data dating back more than 10 years, long antedating B’s birth.

With respect to the afternoon of June 12, the examination of the search history on defendant’s personal desktop computer included Google searches by user “Kaliq” at 2:07 p.m. for “baby pulse no breathing” and at 2:14 p.m. for “baby not breathing, strong pulse.”

As noted, the forensic examination was not limited to the 15-minute period preceding defendant’s 9-1-1 call on June 12, or even to the entirety of June 12. Consequently, the search of defendant’s desktop computer disclosed at least ostensibly inculpatory material antedating June 12 relating to prior internet searches by a person logging in with the user name “Kaliq.” Specifically, the examination disclosed internet searches on: (1) April 19, 2011, for “infant abuse” and “infant abuse symptoms”; (2) April 30, for “signs of abused infant”; (3) May 19, for “signs of newborn abuse”; and (4) May 22, for “abused newborn symptoms” and “abused newborns.” Finally, the examination disclosed Google searches on June 9 for the terms “newborn abuse,” “abuser therapy,” “Oregon child abuse laws,” “father hates infant,” “afraid of abusing my baby,” “how do I deal with a screaming baby,” and “baby, swelling, back of head.”⁷ The examination also disclosed that, on June 9, the user had visited a website and clicked on a file titled “Can therapy help an abuser?”⁸

Even as the forensic examination of the computers was being undertaken, defendant was charged by indictment with multiple crimes, including two counts of murder by abuse, ORS 163.115(1)(c), one count of felony murder, ORS 163.115(1)(b), one count of first-degree assault, ORS 163.185, three counts of third-degree assault, ORS 163.165, and three counts of first-degree criminal mistreatment, ORS 163.205.

Defendant subsequently moved, under Article I, section 9, of the Oregon Constitution and the Fourth Amendment to the United States Constitution, to suppress all evidence obtained from the seizure and search of the computers.⁹ In so moving, defendant contended, in part, that “the warrant authorizing the search was worded so broadly as to constitute a general warrant” and was otherwise defective.

Specifically, in his written motion to suppress/ memorandum, defendant posited several independent, but interrelated, challenges. First, the warrant was facially invalid, as unconstitutionally “general,” because it did not specify the crime for which evidence was sought or impose any other limitation on the scope of the forensic examination of the computers. Further, that facial deficiency could not be cured by reference to the content of Rookhuyzen’s affidavit, because, defendant asserted, the affidavit was neither “attached to,” nor incorporated by reference in, the warrant when it was executed.¹⁰ Second, in all events and regardless of any reference to the affidavit, the warrant was insufficiently particular because, inter alia, it failed to specifically identify the computer files that were lawfully subject to forensic examination. Third, the warrant also violated the particularity requirement, as being unconstitutionally overbroad, because it did not limit the forensic examination to those files or subjects for which (again, even assuming reference to Rookhuyzen’s affidavit) there was probable cause to search. In that regard, defendant asserted that, even assuming that the content of the affidavit substantiated probable cause to search the computers for evidence of defendant’s internet searches in the fifteen minutes preceding the 9-1-1 call, the warrant authorized — without any temporal or substantive qualification — the search of the computers’ entire contents, including matters long antedating B’s birth.

In its written response to the suppression motion, the state did not address defendant’s assertion that Rookhuyzen’s affidavit had not been attached to, or otherwise incorporated with, the warrant when it was executed. The state asserted that the warrant itself, including its incorporation of Attachment A, was not unconstitutionally general, because the warrant specifically described defendant’s residence as the “place” to be searched and (in Attachment A) particularly described the “things” to be seized and examined, including the computers. The state further remonstrated that Oregon law did not prescribe heightened standards of particularity with respect to the examination of electronic devices pursuant to a search warrant — and that, to the extent federal courts had sometimes mandated special protocols for such searches, those pertained to the protection of “innocent third parties]” and not the subjects of criminal investigations.

At the suppression hearing, the state introduced, as a single exhibit (Exhibit 1), certified copies of Rookhuyzen’s affidavit, with Attachment A appended, the signed search warrant, and the signed “Return of Search Warrant”; all of those documents bore an identical time stamp, corresponding to the time they were filed with trial court clerk’s office on June 17, 2011, several days after the execution of the warrant at defendant’s residence. Neither party presented testimony as to whether Rookhuyzen’s affidavit had, in fact, been attached or otherwise incorporated as of the time the computers had been seized from defendant’s residence.¹¹

Instead, defendant’s presentation focused on the asserted unlawfulness of examining the computers for any material unrelated to the 15 minutes preceding the 9-1-1 call and on the lack of any constraints, including search protocols, in the warrant, precluding a roving search of the computers’ contents.¹² In making that argument, counsel stated, “the only guidance about what they were looking for in the computers came from the Affidavit to the Search Warrant,” and that “that 15 minutes’ worth of search could have been pulled up on-site and photographed by the police.” Defense counsel subsequently reiterated that defendant did not “contest the 15 minutes prior to the 911 call that was discussed.”

The state, conforming to the defense presentation and argument, emphasized that reported Oregon appellate decisions had not prescribed, or even endorsed, search protocols for the examination of electronic devices. The state further remonstrated that the examination of the browser histories on defendant’s computers was “targeted” on search items pertinent to “the crime under the investigation” and that, if the trial court was “inclined to in any way to [temporally] circumscribe * * * the scope of the warrant, * * * the warrant in this case certainly describes sufficient probable cause to go back to the day [B and his twin brother] were born.”

The trial court, for reasons set out in a careful and comprehensive letter opinion, denied the motion to suppress. As pertinent to our analysis that follows, the trial court began by observing that defendant has “conceded that the search warrant properly permitted law enforcement officials to search [the computers] for internet searches relating to the fifteen minutes prior to defendant’s placement of the 911 call” and that “this concession narrow[ed] the scope of the defense’s theory of suppression.” The trial court further determined that, although Rookhuyzen’s affidavit did not establish probable cause to search the computers for evidence of crimes “other than those relating to [B’s injuries] caused on June 12, 2011,”¹³ the warrant was not imper-missibly general, in that neither Article I, section 9, nor the Fourth Amendment required the specification of search protocols in these circumstances.

At defendant’s trial before a jury, the state presented evidence of the results of the forensic examination of defendant’s computers, recounting the internet search history described above. See 279 Or App at 782-83. The jury found defendant guilty of all charges.

On appeal, defendant contends that the warrant authorizing the seizure and search of the computers, including his desktop computer, was unconstitutionally “general,” as violating the particularity requirement, for either or both of two reasons: (1) the warrant was nonspecific in that it failed to identify the predicate crime and did not describe the electronic files or data that the police were authorized to search; and (2) the warrant was overbroad as permitting, without any limitations, the search of the computers’ entire contents without predicate probable cause. Defendant contends that, in this case, the assessment of purported lack of particularity is properly limited to the face of the warrant itself, without reference to the contents of the warrant application affidavit, because (in defendant’s view) the state failed to prove that the affidavit was attached to, or otherwise incorporated in, the warrant. Further, defendant contends, even if the content of Rookhuyzen’s affidavit can be considered, it fails to supply necessary particularity or to cure overbreadth.

The state counters that the warrant was facially valid, because it specifically identified the computers as among the items to be seized and searched and probable cause supported the search of the computers. Further, even if greater specificity and limitation of putative overbreadth were required, “the supporting affidavit cured that defect.” The state repeatedly invokes State v. Rose, 264 Or App 95, 330 P3d 680 (2014), which we address in detail below, as “highly similar” — and at least implicitly controlling — precedent.

We begin, as a logical and practical matter, with the question of whether our review of the warrant’s validity is properly limited to the face of the warrant itself or also encompasses the content of Rookhuyzen’s affidavit. See, e.g., State v. Radford, 223 Or App 406, 409-10, 196 P3d 23 (2008), rev den, 346 Or 362 (2009) (noting precedent precluding reliance on warrant application affidavit where affidavit was “neither attached to nor incorporated by reference to the warrant”).

The premise of defendant’s position is that, to the extent the state now seeks to rely on Rookhuyzen’s affidavit to supplement the facial content of the warrant, it was incumbent upon the state to establish at the suppression hearing that the affidavit was, in fact, attached to the warrant.¹⁴ Proceeding from that premise, defendant asserts that the state failed to do so — and, indeed, relied solely on the face of the warrant without reference to the affidavit in responding to defendant’s nonspecificity and overbreadth challenges — and, given that failure, the state’s reliance on the affidavit for the first time on appeal constitutes an unreviewable alternative basis for affirmance. See Outdoor Media Dimensions Inc. v. State of Oregon, 331 Or 634, 659-60, 20 P3d 180 (2001) (for appellate court to affirm on alternative basis, the record must “materially be the same one that would have been developed had the prevailing party raised the alternative basis for affirmance” before the trial court).

The state’s primary response, as we understand it, is that the record developed in the trial court substantiates that the affidavit was, in fact, attached to the warrant. In that regard, the state points to suppression hearing Exhibit 1 described above, 279 Or App at 785-86, which, as noted, included certified true copies of the originals of (a) the warrant return, (b) the warrant, and (c) Rookhuyzen’s affidavit, as filed with the clerk’s office shortly after the execution of the warrant. Each of those documents bears an identical time stamp corresponding to its filing; Attachment A is appended to the certified true copy of Rookhuyzen’s affidavit as filed with the clerk’s office. The state posits that, given the combination of the warrant’s cross-reference to Attachment A and the fact that Attachment A was appended to Rookhuyzen’s affidavit and not to the warrant, Exhibit 1 evinced that the affidavit was attached to the warrant when it was executed. Further, the state asserts, if defendant wished to dispute that proof, it was incumbent on him to do so before the trial court — and, because he did not, he cannot now contend that the affidavit’s content is inapposite to our review.

In sum, each party’s position is, in many respects, a mirror image of the other’s, with each proceeding on obverse premises as to the allocation of burdens of production and persuasion. We conclude that, on this record, the state is correct.

Although the state bears the burden of establishing the lawfulness of a warrantless search, “the defendant bears the burden of proving the unlawfulness of a warranted search.” State v. Walker, 350 Or 540, 554, 258 P3d 1228 (2011). That allocation of the burden of proof “derives from the presumption of regularity that arises out of the fact that, in a warranted search, an independent magistrate already has determined that probable cause exists.” State v. Johnson, 335 Or 511, 521, 73 P3d 282 (2003). Further—and significantly here—that burden pertains even when a defendant asserts that circumstances rendered a search effectively “warrantless.” As the court in Walker explained:

“Defendant argues for a different allocation of the burden of proof. She contends that, when, as in this case, a defendant asserts that a search exceeded the scope of a warrant, the burden should remain with the state to show that the search was valid. Defendant reasons that, if the search exceeded the scope of the warrant, the result is that it was essentially warrantless. The problem with defendant’s argument is that it confuses the effect of prevailing on an argument with the burden of proving it in the first place. A defendant, for example, could challenge the validity of the warrant itself, and, if successful, the result would be that the search at issue was essentially warrantless. Yet, in such cases, the burden of proving the invalidity of that warrant rests squarely with the defendant. * * * The same is true in this case.”

350 Or at 554-55 (emphasis in original) (citations omitted).

Here, the seizure and forensic examination of the computers was undertaken pursuant to the warrant. Consequently, in challenging the lawfulness of that seizure and search, defendant bore the burden of establishing facts pertaining to his “challenge [to] the validity of the warrant itself.” Id. at 555. Whether Rookhuyzen’s affidavit was attached to, or otherwise sufficiently accompanied, the warrant when it was executed was such a fact. Accordingly, defendant bore the burden of proving that that circumstance did not exist. However, as noted, 279 Or App at 786, defendant adduced no proof on that matter at the suppression hearing — and, thus, failed to meet that burden.

Further, regardless of the burden of production and ultimate persuasion, the state did submit evidence at the suppression hearing — Exhibit 1 — pertaining to sufficient attachment. As the state contends, that exhibit, by way of permissible, albeit hardly indubitable, inference, constituted prima facie proof that Rookhuyzen’s affidavit had been attached to the warrant at the time of execution. Defendant never disputed that evidence.

Finally, even if, as defendant asserts, the state’s contention regarding reference to Rookhuyzen’s affidavit is akin to an alternative basis of affirmance — a characterization that is far from patent — that contention is properly reviewable because it is unlikely that the record would have been materially different if that contention had been urged in the trial court. See, e.g., Gutierrez v. Nooth, 275 Or App 171, 179-80, 364 P3d 725 (2015), rev den, 359 Or (2016). That appears to be so for at least two reasons. First, as noted, even after the state submitted Exhibit 1, defendant presented no evidence of purported “nonattachment.” Second, defendant’s position at the suppression hearing presumed that the affidavit properly supplemented the warrant’s facial content. As noted, 279 Or App at 786, at the beginning of argument on that motion, defense counsel stated, “The only guidance about what they were looking for in the computer came from the affidavit for the search warrant.” Moreover, defense counsel twice explicitly conceded the lawfulness of a search of the computers with respect to the 15 minutes preceding the 9-1-1 call. Because the warrant on its face simply listed the computers without any elaboration, the lawfulness of such a search depended (at least under defendant’s own premises) on reference to the content of Rookhuyzen’s affidavit. Thus, defendant’s concession at the suppression hearing was irreconcilable with a contention that, because of some failure to attach or incorporate, the affidavit’s content was inapposite to the lawfulness of the search.¹⁵

In sum, on this record, our review of the lawfulness of the warranted search of the computers encompasses, and is informed by, the content of Rookhuyzen’s affidavit. With that baseline understanding, we proceed to the particulars of defendant’s particularity and overbreadth challenges.

The fundamental purpose of the constitutional particularity requirement is “to protect the citizen’s interest in freedom from governmental intrusion through the invasion of his privacy.” State v. Blackburn/Barber, 266 Or 28, 34, 511 P2d 381 (1973); see also Arizona v. Gant, 556 US 332, 345, 129 S Ct 1710, 173 L Ed 2d 485 (2009) (“[T]he central concern underlying the Fourth Amendment [is] the concern about giving police officers unbridled discretion to rummage at will among a person’s private effects.”); Maryland v. Garrison, 480 US 79, 84, 107 S Ct 1013, 94 L Ed 2d 72 (1987) (noting that the particularity requirement “ensures that the search will be carefully tailored to its justifications, and will not take on the character of the wide-ranging exploratory searches the Framers intended to prohibit”).

Thus, under Article I, section 9, as well as the Fourth Amendment,

“the command to seize must be sufficiently particular to guide the officer to the thing intended to be seized and to minimize the danger of unwarranted invasion of privacy by unauthorized seizures.”

Rose, 264 Or App at 107 (internal quotation marks omitted); see also State v. Reid, 319 Or 65, 71, 872 P2d 416 (1994) (“[A] warrant must be definite enough to identify with a reasonable degree of certainty what is to be searched.”). Further,

“[i]f the search warrant describes premises in such a way that it makes possible the invasion of [the] interest in privacy without the foundation of probable cause for the search, the warrant is too broad and therefore constitutionally defective.”

Blackburn/Barber, 266 Or at 34. See generally State v. Ingram, 313 Or 139, 144-46, 831 P2d 674 (1992) (summarizing particularity inquiry and concluding that warrant authorizing search of “all vehicles * * * associated with the occupants of said premises” was invalid as overbroad, in that executing officers “could invade privacy interests not intended by the magistrate to be invaded and could conduct searches not supported by probable cause”).

Ultimately, the requisite “degree of specificity *** depends on the circumstances and the nature of the property to be seized and may also be affected by the nature of the right which is protected.” Rose, 264 Or App at 107 (internal quotation marks omitted); accord State v. Massey, 40 Or App 211, 214, 594 P2d 1274, rev den, 287 Or 409 (1979) (“The objective is that the search be as precise as the circumstances allow and that undue rummaging be avoided.”).

Thus, the constitutional particularity requirement implicates two analytically distinct, but frequently practically intertwined, concepts. First, the warrant, as supplemented by any attached or incorporated supporting documents, must so clearly describe the place to be searched and the items to be seized and examined that officers can, “with reasonable effort, ascertain” that place and those items to “a reasonable degree of certainty.” Blackburn/Barber, 266 Or at 34-35. Second, the warrant must, to the extent reasonably possible, be drawn in such a way as to preclude seizures and searches not supported by probable cause.

Those two concepts — specificity and overbreadth— again, have independent significance. For example, a warrant can precisely and unambiguously identify items to be forensically examined, satisfying the specificity concern, but nevertheless be invalid as overbroad if there is no probable cause to examine some of those items. However, the two can, and frequently do, conflate. That is, failure to identify with sufficient specificity the place to be searched or the items to be seized and examined can sanction invasions of protected privacy unsupported by probable cause. See, e.g., State v. Castagnola, 145 Ohio St 3d 1, 17, 46 NE3d 638, 656 (2015) (noting “overlap” of those concepts with respect to warranted searches of electronic devices).

Here, defendant’s challenge appears to encompass both of those concepts. As we understand it, defendant argues alternatively that (1) the warrant (even in combination with Rookhuyzen’s affidavit) was impermissibly imprecise, because it failed to identify the information on the computers’ hard drives for which the police were authorized to search; and (2) in all events, the warrant was overbroad as authorizing examination of material on the computers beyond that pertaining to defendant’s internet searches during the 15-minute period preceding the 9-1-1 call.

The fundamental premise of defendant’s challenge is that, given the unique functionality and capacity of computers and similar electronic devices, as recognized in, for example, Riley v. California, _ US _, 134 S Ct 2473, 189 L Ed 2d 430 (2014), warrants authorizing the forensic examination of such devices must specifically identify and carefully circumscribe the information authorized to be examined.¹⁶ Under that construct, the electronic device corresponds, broadly, to the “place” to be searched — which, in turn, requires that the “items” within that “place” (e.g., data and files on the computer) be identified with constitutionally sufficient particularity. See, e.g., United States v. Galpin, 720 F3d 436, 446 (2d Cir 2013) (“[AJdvances in technology and the centrality of computers in the lives of average people have rendered the computer hard drive akin to a residence in terms of the scope and quantity of private information it may contain.”); Com. v. Dorelas, 473 Mass 496, 499 n 3, 501-05, 43 NE3d 306, 311-14 (2016) (given distinctions between “the physical world” and “the virtual world,” electronic devices are properly deemed to be analogous to residences for purposes of particularity analysis; concluding that warrant, albeit “awkwardly written,” satisfied constitutional requirements).¹⁷

Defendant’s thesis is not without reason — or support. Indeed, several other courts, including other state courts, have concluded that warranted searches of computers were unlawful because the predicate warrants were insufficiently specific or impermissibly overbroad. See, e.g., Galpin, 720 F3d at 448 (concluding that warrant was facially overbroad, but remanding for reconsideration of, inter alia, alleged severability of the warrant); United States v. Otero, 563 F3d 1127 (10th Cir 2009) (warrant authorizing seizure and examination of “any and all information and/ or data” stored on computer was invalid as violating particularity requirement, but application of federal “good faith” exception to exclusionary rule precluded suppression); State v. Henderson, 289 Neb 271, 854 NW 2d 616 (2014) (same); Castagnola, 145 Ohio St 3d at 18-24, 46 NE3d at 657-61 (warrant that “did not contain any description or qualifiers of the ‘records and documents stored on the computer’” was impermissibly general as failing to “guide and control the searcher and to sufficiently narrow the category of records or documents subject to seizure”).¹⁸

Wheeler v. State, 135 A3d 282, (Del 2016), is exemplary. In Wheeler, the defendant was the subject of a witness tampering investigation in potential civil litigation involving alleged incidents of juvenile sexual abuse in the 1980’s. Id. at 284-85. In connection with that investigation, police obtained warrants, derived as a “cut-and-paste” from child pornography investigation warrants, which authorized the seizure and search of, inter alia, “la\ny personal computer [or] computer system” and the forensic examination of “[a]ny and all data *** stored by whatever means” on such devices. Id. at 289-92 (emphasis in original). The consequent, unrestricted forensic examination of the defendant’s devices disclosed “image files” and “video files” that disclosed inculpatory titles associated with child pornography. Based on that discovery, the police obtained another warrant to search the devices for evidence of child pornography, which, in turn, yielded the evidence that resulted in the defendant being indicted on multiple child pornography charges. Id. at 291. The defendant unsuccessfully moved to suppress that evidence, arguing that the initial warrants were invalid as impermissibly general under the state and federal constitutions, and he was subsequently convicted. Id. at 291-92.

The Delaware Supreme Court reversed and remanded, concluding that the trial court had erred in denying suppression. The court began by acknowledging the practical difficulties and detriment of prescribing “specific computer search protocols,” given “the propensity of criminals to disguise files.” Id. at 300-01. Nevertheless, those concerns could not serve to excuse “unrestrained general searches.” Id. at 301. Instead, “the proper metric of sufficient specificity is whether it was reasonable to provide a more specific description of the items [of information on the computer] at that juncture of the investigation.” Id. Consistently with that principle, and after canvassing other authority including Galpin and Castagnola, the court concluded that “warrants, in order to satisfy the particularity requirement, must describe what investigating officers believe will be found on electronic devices with as much specificity as possible under the circumstances.” Id. at 304. The court further determined that an integral feature of that standard was temporal — that is, that, to the extent reasonably possible, the warrant must include “temporal constraints,” limiting the search “to the relevant time frame.” Id.

Applying that standard, the court determined that the predicate witness tampering warrants were impermis-sibly general because their temporal scope was not circumscribed, so as to correspond to the period, within the investigator’s knowledge, corresponding to the alleged tampering conduct. Id. at 305-06. The court further determined that it was “likely” that the warrants were invalid because of their “substantive” scope:

“[B]y their terms, the Witness Tampering Warrants permitted the State to search for anything — from child pornography to medical records, to consumer information to tax returns. In short, they permitted the species of wide-ranging, exploratory searches the Framers intended to prohibit.”

Id. at 307; see also State v. Keodara, 191 Wash App 305, 317, 364 P3d 777, 783 (2015), rev den, 185 Wash 2d 1028 (2016) (warrant authorizing search of contents of cell phone held to be impermissibly general as allowing “phone to be searched for items that had no association with any criminal activity and for which there was no probable cause whatsoever,” where warrant authorized examination of, inter alia, “all call history logs,” “all text messages,” and “all documents, chat and internet activity,” with “no limit on the topics of information for which police could search” and without “limit-ting] the search to information generated close in time to incidents for which the police had probable cause”).

Under the reasoning of those decisions, the warrant here might well have been invalid. Although Rookhuyzen’s affidavit described defendant’s internet searches on June 12, 2011, nothing in the affidavit referred to any other searches or, by way of competent expertise, substantiated a likelihood that parents who physically abuse their children are likely to have engaged in prior internet searches pertaining to such conduct. Certainly, Rookhuyzen’s affidavit did not purport to confine the requested forensic examination of the computers’ content to information bearing on the events of June 12 — or even to events occurring during B’s brief lifetime. Further, although, as noted, Rookhuyzen’s affidavit did include general averments about internet search histories, see 279 Or App at 780-81, the content of the affidavit did not limit the forensic examination to internet search history, precluding examination of other files located in the hard drives.¹⁹ In sum, under the rationale of those cases, it is at least doubtful that the scope of the warrant here was limited, temporally and substantively, “with as much specificity as possible under the circumstances.” Wheeler, 135 A3d at 304. Concomitantly, the warrant here might well be deemed to be overbroad.

The reasoning of those authorities is not without appeal. Nevertheless, we are bound by our own precedent. Thus, our consideration necessarily begins with whether, as the state urges, Rose is, effectively, dispositive.

In Rose, the 16-year old victim informed the police, in mid-July 2010, that she and the defendant had been communicating “over the last few months via telephone, e-mails, and instant-messaging chats online,” and that those communications had included “sexually explicit details.” 264 Or App at 98. The victim also told the police that, sometime in June or July 2010, as part of those communications, she had offered to send the defendant a photograph of her bare breasts, and — after he had responded by sending her a photograph of his bare chest — she had twice emailed him photographs of her breasts. Id. at 97. Based on those circumstances, as recited in a supporting affidavit, the police applied for a search warrant directed to Yahoo! Inc. (Yahoo), the defendant’s (and the victim’s) email service provider, compelling Yahoo to produce, and authorizing the police to search, “[a]ny and all contents of electronic files that [the defendant] has stored in [his] Yahoo! Account.” Id. at 98.

The trial court issued the requested warrant, which stated that there was probable cause to believe that evidence of the crimes of using a child in a display of sexually explicit conduct and encouraging child sexual abuse would be found in the requested account records. Id. The warrant did not limit the requested account information to “the last few months” before the warrant issued — which would have corresponded to the period of potentially inculpatory email communication between the defendant and the victim, as recited in the supporting affidavit. Nor did the warrant limit the search to the defendant’s communications with the victim. Yahoo complied, producing “large quantities of email.” Id. at 99. In examining that information, the police “concentrat[ed] on” emails from June and July 2010 — and ultimately found the two emails with the photographs of the victim’s bare breasts.²⁰ Id.

The defendant unsuccessfully moved to suppress that evidence on several grounds, including that the warrant was “insufficiently particular.” Id. He was ultimately convicted of using a child in a display of sexually explicit conduct, ORS 163.670.

On appeal, the defendant assigned error to the denial of the suppression motion, renewing his particularity challenge.²¹ In pressing that challenge, the defendant contended, as pertinent here, that, although

“the police had probable cause to believe that the victim had e-mailed defendant photographs of her bare breasts in June or July 2010, * * * the warrant authorized a search of ‘any and all contents of electronic files’ stored on his Yahoo account and did not limit the search by any time period or subject matter, such as a search for photographs of bare breasts.”

264 Or App at 107.²²

We rejected that challenge. First, with respect to specificity, we concluded:

“The warrant stated that the police could search for, and seize, evidence of the crimes of using a child in a display of sexually explicit conduct and encouraging child sexual abuse located in the electronic files stored in defendant’s Yahoo account. Thus, the warrant was limited to a particular location, and the description of the items to be seized left the officers with no discretion in the matter.”

Id. at 109.

Second, with respect to overbreadth, relating to insufficient temporal and substantive constraints, we noted that, contrary to the defendant’s premise, “the two photographs sent by the victim to defendant was not the only evidence of [the] crimes that could exist in defendant’s Yahoo account.” Id. In that regard, we pointed to the victim’s statements to the police that, in her on-line “conversations” with the defendant, they had “discussed sexually explicit details.” Id. Consequently, those facts “indicated that possible evidence of defendant’s crimes, aside from the two photographs ***, [was] being stored by defendant in his e-mail account.” Id.

Ultimately, the determination of whether Rose is dispositive here, or can be materially distinguished from this case, turns on the scope of our holding there— and, especially, of our conclusion that the warrant was not overbroad. If we, in fact, held in Rose that — as a general matter — the lack of any temporal or substantive limitation corresponding to matters supported by probable cause (beyond a generic identification of the predicate crime) did not render the warrant there overbroad, then Rose would almost certainly control here. If, however, our holding in Rose was narrowly case-specific, as rejecting the defendant’s overbreadth contention because its premise — viz., that the only potentially relevant evidence in the email accounts was the two photographs — was erroneous, then Rose is not conclusive of defendant’s general overbreadth challenge here.

In truth, Rose is less than clear in that regard. Our holding that the warrant “was sufficiently particular,” 264 Or App at 97, 109, is unqualified. However, our description of the defendant’s challenge, and our rejection of the overbreadth contention, both refer explicitly to the two photographs. Id. at 107, 109. Upon careful review of the appellant’s brief in Rose, we conclude that the defendant’s overbreadth contention there was, in fact, much narrower than defendant’s challenge here. The gravamen of that spare argument was simply that the police had probable cause only with respect to the two photographs/emails, necessarily rendering a warrant authorizing the search of other emails overbroad. Given that framing, our opinion in Rose is most reasonably understood as rejecting the defendant’s overbreadth contention on its own narrow terms: Because the defendant’s “two photographs only” premise was false, the argument failed.

Thus, Rose is not dispositive here — at least with respect to alleged overbreadth.²³ That is, defendant’s over-breadth challenge, predicated on the unique functionality and capacity of electronic devices, as recognized in Riley and other contemporaneous decisions, presents a matter of first impression for this court.

We conclude that the warrant in this case was impermissibly overbroad, rendering the warranted search of the contents of defendant’s computers unlawful under Article I, section 9.²⁴ We appreciate that relying on “physical analogs” in characterizing digital media and information “may hamper rather than enhance our analysis,” because such analogies are necessarily imperfect. Dórelas, 473 Mass at 505-06, 43 NE3d at 315.²⁵ Nevertheless, on balance, we believe that, for purposes of the constitutional particularity requirement, personal electronic devices are more akin to the “place” to be searched than to the “thing” to be seized and examined. Concomitantly, that requires that the search of that “place” be limited to the “thing(s)” — the digital data — for which there is probable cause to search. See Reid, 319 Or at 71 (“[A] warrant may not authorize a search that is broader than the supporting affidavit supplies probable cause to justify.”).

As other courts have readily acknowledged, striking a constitutionally principled but workable balance between “protecting against generality and overbreadth” and not unduly impairing “the legitimate pursuit of prosecuting criminal activity” presents special challenges in this context. Wheeler, 135 A3d at 305; accord United States v. Stabile, 633 F3d 219, 237 (3d Cir), cert den, 565 US 942, 132 S Ct 399 (2011) (noting both that criminal suspects frequently hide or mislabel digital data and that “granting the Government a carte blanche to search every file on the hard drive imper-missibly transforms a limited search into a general one” (emphasis in original)). Consequently — and consistently with the precept that “[t]he objective is that the search be as precise as the circumstances allow” Massey, 40 Or App at 214 (emphasis added) — we are mindful that, when substantiated by competent representations in a warrant submission, potential concealment or manipulation of digital data may justify an encompassing examination of a device’s contents. Still, the touchstone is probable cause, as substantiated by the affidavit(s) submitted with the warrant application.

The warrant here was overbroad. Certainly, Rookhuyzen’s affidavit established probable cause with respect to internet searches during the 15-minute period preceding the 9-1-1 call—and, arguably, with respect to all electronic communications and photos during the entire time that B was in defendant’s care on June 12, 2011. However, nothing in Rookhuyzen’s affidavit established probable cause that a temporally unlimited examination of the contents of defendants’ computers, including of files and functions unrelated to internet searches and emails, would yield other evidence of the events of June 12, 2011, or of any other crime. Accord Wheeler, 135 A3d at 305 (“The Affidavits [authorizing temporally unlimited search of contents of the defendant’s electronic devices] contain [ed] no facts suggesting that any [witness] tampering might have occurred prior to July 2013. Yet, the Witness Tampering Warrants were boundless as to time.”); Keodara, 191 Wash App at 316, 364 P3d at 783 (“Nor did the warrant [authorizing search of contents of the defendant’s cell phone] limit the search to information generated close in time to incidents for which the police had probable cause.”).²⁶

The warrant, even as permissibly supplemented by Rookhuyzen’s affidavit, was so unbounded as to sanction the sort of “undue rummaging” that the particularity requirement was enacted to preclude. Massey, 40 Or App at 214. Thus, the warrant in this case was invalid as impermissibly overbroad, rendering the forensic examination of the contents of defendants’ computers unlawful under Article I, section 9. Accordingly, the trial court erred in denying defendant’s motion to suppress. Given the content of the evidence disclosed as a result of the forensic examination, see 279 Or App at 782-83, that error was not harmless.

Reversed and remanded.

1 Defendant had also initially assigned error to the trial court’s entry of separate convictions for murder by abuse and felony murder, rather than merging the guilty verdicts into a single conviction, but withdrew that assignment after the court entered an amended judgment, pursuant to ORS 138.083, remedying that matter.

2 That disposition obviates any consideration of defendant’s second assignment of error. We note, without implying any view as to the propriety of the admission of the challenged diagnosis during defendant’s trial, that, in the event of a retrial on remand, the record pertaining to the admissibility of such testimony may be materially different.

3 There were two laptops and two desktop computers in that room, which also served as home office space. Defendant did not tell Rookhuyzen which of those computers he had used before calling 9-1-1.

4 The listed items also included defendant’s and his wife’s cellphones. The probable cause justification for the search of those items was predicated on Rookhuyzen’s “training and experience”-based averments that “parents of young children often give one another updates on the condition of their babies when one is absent” and that “parents of injured children often call one another when their child is hurt, and sometimes call one another before requesting emergency assistance.” Defendant does not contend that the seizure and search of the cellphones pursuant to the warrant was unlawful.

5 The examiner testified that, for that device, “there was one unique user, which the user name was ‘Kaliq’” (defendant’s first name).

6 Other search terms that detectives provided over time to the examiner included the following:

“bruise, police, child abuse investigation, rib fracture, broken rib, colic, * * * twin, breath, breathing, rescue, rescue breathing, CPR, care abuse, and physical abuse * * * father, anger, or angry, crying, hurt or hurting, infant, evidence, explaining, and injuries.”

7 The forensic examination also disclosed an internet search for the query, “How do I stop abusing my baby?” However, testimony at trial did not specify the date of that inquiry.

8 The search of the content of mother’s computers disclosed no “concerning” internet search terms or history.

9 As pertinent here, Article I, section 9, provides: “[N]o warrant shall issue but upon probable cause, supported by oath, or affirmation, and particularly describing the place to be searched, and the person or thing to be seized.” The Warrant Clause of the Fourth Amendment is identical except for nonsubstantive variations in capitalization and use of certain plural, not singular, nouns (e.g., “Warrants,” “persons or places”).

10 “Attachment” for these purposes appears to be a broadly functional concept under federal law, encompassing not only actual physical connection but also, more broadly, circumstances in which supporting documents are present and available for immediate reference when the warrant is executed. See, e.g., Groh v. Ramirez, 540 US 551, 557-58, 124 S Ct 1284, 157 L Ed 2d (2004) (noting that neither the affidavit nor the application accompanied the warrant when it was executed, and, thus, were not “available for * * * inspection” by “the person whose home [was] being searched”); United States v. SDI Future Health, Inc., 553 F3d 1246, 1258 (9th Cir 2009) (one condition of the Ninth Circuit’s “cure by affidavit” principle requires that supporting affidavit must be “attached physically to the warrant or at least accompany[y] the warrant while agents execute the search”).

As nearly as we can discern, reported Oregon decisions have involved only cases in which an affidavit or other supporting document was physically affixed to the warrant, see, e.g, State v. Trax, 335 Or 597, 600, 75 P3d 440 (2003) (affidavit submitted with warrant application was “attached to” the warrant) or those in which the supporting documents were not physically appended, without any indication as to whether they accompanied the warrant when executed and were available for immediate reference and examination, see, e.g., State v. Bush, 174 Or App 280, 284, 25 P3d 368 (2001), rev den, 334 Or 491 (2002). In State v. Davis, 106 Or App 546, 548 n 1, 552, 809 P2d 125 (1991), an en banc majority concluded that, where the warrant application affidavit was not physically affixed to the warrant, the affiant executing officer’s “personal knowledge” could not cure a facial ambiguity in the warrant. See also id. at 553 (Warren, J., dissenting). However, in that case, there was no suggestion that the affidavit itself actually accompanied the warrant and was available for immediate reference at the time of execution, and, thus, the court had no occasion to consider the federal construct.

11 Only one witness testified at the suppression hearing — a computer expert, called by the defense, who testified as to forensic examination processes and the availability and feasibility of search protocols.

12 Defense counsel referred to Groh, parenthetically describing its holding. However, defense counsel did not contend at argument that the affidavit in this case had not been attached or otherwise sufficiently incorporated and that, consequently under Groh, Rookhuyzen’s affidavit could not supplement the facial content of the warrant itself.

13 In that regard, the court concluded that, although Rookhuyzen’s affidavit established probable cause that defendant had caused the “old rib fracture” noted by Dr. Lindsay, the affidavit did not substantiate a “nexus between the older offense and information contained in the defendant’s computers.”

14 Defendant argues, for the first time on appeal, that, under the Ninth Circuit’s conjunctive “cure by affidavit” formulation, see, e.g., SDI Future Health, Inc., 553 F3d at 1258-59, the state was required to establish not only attachment, but also express incorporation by reference. However, defendant never invoked the Ninth Circuit’s formulation before the trial court; rather — and to the contrary — defendant’s motion to suppress stated, “If the affidavit was not attached or referenced in the warrant, then this Court cannot construe the warrant in light of the affidavit, under the Oregon and federal constitutions * * (Emphasis added.)

15 As noted, 279 Or App 786-87, the trial conrt regarded that concession as substantially “narrow[ing] the scope of the defense’s theory of suppression.” Thus, this is not a case in which a defendant raised a contention in the written suppression motion and then merely failed to reiterate that contention during the suppression hearing. Accord Walker, 350 Or at 550 (“This court has never required that each and every argument that has been asserted in writing must be repeated orally in court in order for the argument to be preserved.”).

16 In Riley, the Court held that the search incident to arrest exception to the warrant requirement was inapplicable to a warrantless search of digital data stored on the defendant’s cell phone and that “officers must generally secure a warrant before conducting such a search.”_US at_, 134 S Ct at 2485. In so holding, the Court observed that “[c]ell phones differ in both a quantitative and a qualitative sense from other objects that might be carried on an arrestee’s person,” including with respect to “their immense storage capacity.” Id. at_, 134 S Ct at 2489.

The Court described at some length the functionality of such devices- — e.g., “They could just as easily be called cameras, video players, rolodexes, calendars, tape recorders, libraries, diaries, albums, televisions, maps, or newspapers.” Id. at_, 134 S Ct at 2489. In that regard, the Court highlighted, as among the qualitative differences from “physical records,” the ability to derive from a personal electronic device “an Internet search and browsing history,” which “could reveal an individual’s private interests or concerns.” Id. at_, 134 S Ct at 2490. The Court concluded that, in contrast to historical observations that a search of a person’s pockets was far less intrusive than a search of a residence,

“a cell phone search would typically expose to the government far more than the most exhaustive search of a house: A phone not only contains in digital form many sensitive records previously found in the home; it also contains a broad array of private information never found in a home in any form— unless the phone is.”

Id. at _, 134 S Ct at 2491; see also State v. Bellar, 231 Or App 80, 103-04, 217 P3d 1094 (2009), rev den, 348 Or 291 (2010) (Sercombe, J., dissenting) (noting that personal computer’s function and capacity encompassed virtual equivalents of “calendars, financial records, letters, diary entries, photographic albums, and other private information”).

17 See also Dorelas, 473 Mass at 505, 507, 43 NE3d at 314, 316 (Lenk, J., dissenting) (stating that “the court correctly determines that the warrant for the iPhone describes the place to be searched as the physical device itself, and the items to be seized as the categories of files that it lists,” but concluding that warrant was overbroad as authorizing without probable cause “the entire set of photograph files on the defendant’s iPhone”).

18 In this context, application of the “good faith” exception to suppression for violations of the Fourth Amendment has yielded disparate results. Compare Otero and Henderson (both holding that “good faith” exception applied and precluded suppression) with Castagnola, 145 Ohio St 3d at 23,46 NE3d at 660 (“good faith” exception did not apply to search of computer where “the search warrant did not describe the items to be searched on the computer with as much specificity as the detective’s knowledge and the circumstances allowed”); cf. State v. Johnson, 120 Or App 151, 156, 851 P2d 116, rev den, 318 Or 26 (1993) (“Article I, section 9, does not have a ‘good faith’ exception.”).

19 Nothing in Rookhuyzen’s affidavit referred to, much less substantiated, any likelihood that defendant had somehow included or hidden inculpatory data in files or functions unrelated to internet search history. Accord United States v. Richards, 659 F3d 527, 538-39 (6th Cir 2011), cert den, _ US _, 132 S Ct 2726 (2012) (noting, in context of child pornography investigation, potential for perpetrators to “hide, mislabel or manipulate files to conceal criminal activity”) (internal quotation marks omitted).

20 Our opinion in Rose does not refer to any other inculpatory material obtained from the search.

21 The defendant also argued, inter alia, that there was no statutory authority to issue an “out-of-state search warrant,” which was directed to Yahoo’s legal compliance team, located in Sunnyvale, California. We rejected that contention. 264 Or App at 99-106.

22 The defendant also raised, and we rejected, a contention that the First Amendment required application of a standard of “scrupulous exactitude” of particularity because of the expressive content of email communications. Id. at 107-08.

23 Given our analysis and disposition as to overbreadth, which follows, we need not address whether Rose would be conclusive as to the specificity of the warrant in this case.

24 Given that dispositive conclusion, we forgo, as a prudential matter, addressing the validity of the warrant under the Fourth Amendment and the potential application in these circumstances of the federal “good faith” exception to suppression. See 279 Or App at 795 n 18.

25 Accord Riley, US at , 134 S Ct at 2488 (rejecting government’s contention that search of content of cellphone is “materially indistinguishable” from search of physical items that are commonly the objects of searches incident to arrest: “That is like saying a ride on horseback is materially indistinguishable from a flight to the moon. Both are ways of getting from point A to point B, but little else justifies lumping them together.”).

26 Cf. State v. Beagles, 143 Or App 129, 131, 136, 923 P2d 1244, rev den, 324 Or 487 (1996) (rejecting argument that warrant was impermissibly overbroad as permitting seizure of evidence pertaining to controlled substances other than methamphetamine; noting that supporting affidavit, in addition to establishing probable cause to search for methamphetamine, also included “training and experience”-based averment that when persons engage in unlawful possession, manufacture, or use of controlled substances, “frequently, and in almost all cases, more than one controlled substance is found in their residence or possession”).