State v. Y. Bao

2024 MT 308, 560 P.3d 1207

Opinion

12/17/2024

DA 24-0139

Case Number: DA 24-0139

IN THE SUPREME COURT OF THE STATE OF MONTANA 2024 MT 308

STATE OF MONTANA, Plaintiff and Appellant,

v.

YANBIN BAO, Defendant and Appellee.

APPEAL FROM: District Court of the Fourth Judicial District, In and For the County of Missoula, Cause No. DC-23-326 Honorable Leslie Halligan, Presiding Judge

COUNSEL OF RECORD:

For Appellant:

Austin Knudsen, Montana Attorney General, Roy Brown, Assistant Attorney General, Helena, Montana

Matt Jennings, Interim Missoula County Attorney Andrea Renee Haney, Katrina Thorness, Deputy County Attorneys, Missoula, Montana

For Appellee:

Jordan Kilby, Stephens Brooke, P.C., Missoula, Montana

Submitted on Briefs: November 6, 2024 Decided: December 17, 2024

Filed:

ir,-6‘A•-if

__________________________________________

Clerk

Justice Laurie McKinnon delivered the Opinion of the Court.

¶1 The State of Montana appeals from a February 16, 2024, Order of the Fourth Judicial District Court, Missoula County, pursuant to § 46-20-103(2)(e), MCA. The District Court ordered the suppression of evidence obtained from four electronic devices because the process of decrypting and extracting the data contained within those devices required more time than allowed by the ten-day time limit for serving warrants established by § 46-5-225, MCA. We reverse and remand for continuation of proceedings.

¶2 The State presents the following issue for review:

Whether the District Court erred when it found that § 46-5-225, MCA, requires the State complete a search of evidence within ten days of the warrant’s issuance.

FACTUAL AND PROCEDURAL BACKGROUND

¶3 The State charged Yanbin Bao (Bao), a foreign national and resident of South Carolina, with seven counts of felony sex trafficking under § 45-5-702(1), MCA, and one count of felony labor trafficking under § 45-5-703(1), MCA. Bao allegedly ran a prostitution operation out of a Missoula, Montana, massage parlor called Soul Massage with her husband, Richard Bushey (Bushey). Bao and Bushey purportedly employed at least three women as prostitutes at Soul Massage, including Jane Doe (JD).

¶4 JD entered the United States in March 2023 and answered an internet advertisement for dog-friendly housing for “only $20 a day.” JD met Bao through the advertisement and she subsequently moved to Missoula on April 26, 2023. The advertised housing was Soul Massage, where JD claims Bao held her in captivity and forced her to engage in sexual acts with customers under the threat of violence.

3

¶5 On May 29, 2023, JD called law enforcement from Soul Massage and accused Bao and Bushey of running a prostitution and sex trafficking operation. Deputies arrested Bao and Bushey. Responding officers performed a search incident to arrest and seized their cellphones. From Bao, deputies seized a silver Apple iPhone in a clear case (Phone 1) and a white Apple iPhone in a purple case (Phone 2). From Bushey, deputies seized an Apple iPhone with a black case (Phone 6). Soul Massage was then searched pursuant to a search warrant and Deputies also seized several other electronic devices: an Apple iPad Pro in a grey case (Tablet 1), a red Apple iPhone with a clear case (Phone 3), a blue Motorola phone (Phone 4), and a black Samsung phone (Phone 5).

¶6 On June 6, 2023, law enforcement arrested another suspect, Hui Wang (Wang), in connection with the allegedly illegal operations at Soul Massage. Law enforcement found four phones on Wang’s person: a black Samsung phone (Phone 7), a Blu V50 cell phone (Phone 8), a Blu Vivo phone (Phone 9), and an Apple iPhone in a “pink/purple case with red staining upon it” (Phone 10). Acting upon a search warrant for Wang’s hotel room, law enforcement seized a black Vortex cell phone (Phone 11) and an Apple iPad (Tablet 2).

¶7 On July 10, 2023, law enforcement obtained another warrant to search all the devices seized from Bao, Bushey, and Wang. The warrant was presented to Forensic Analyst Melanie Thomas (Thomas) on July 11, 2023. Thomas then began the process of decrypting the seized devices to access and copy the data stored on the devices. On July 12, 2023, Thomas accessed Phone 6 using a provided PIN code and began extracting data. Phone 2 was protected by a PIN code and required Thomas to brute force the phone’s

4

encryption with the GrayKey decryption program. On July 13, 2023, Thomas extracted the full filesystem from Phone 4. On July 14, 2023, Thomas extracted the full filesystem from Phone 5. On July 19, 2023, Thomas extracted the full filesystem from Phone 6 and generated a report from the extracted data. On July 20, 2023, Thomas generated her report from the data extracted from Phone 4 and Phone 5, and she began the process of brute forcing the encryption on Tablet 1.

¶8 Thomas required more time to bypass the other devices’ encryption and security mechanisms. As detailed in the application for the July 10, 2023, warrant, the GrayKey software brute forces an electronic device’s encryption to allow “a valid law enforcement agency located in a supported country” to access stored data in a potentially time intensive process. To brute force and decrypt an Android device, a forensic analyst must physically manipulate the screen, power, and buttons on the device to place the device into download mode. Once placed into download mode, GrayKey can recover and download a file if the device is compatible and supported by the GrayKey software. Phone 4, Phone 5, Phone 7, Phone 8, and Phone 11 are Android devices.

¶9 When decrypting an Apple device, the duration of the GrayKey process depends on when the phone was powered off or previously unlocked by the user. An “After First Unlock” (AFU) process allows GrayKey to make 300,000 attempts at decrypting a phone every ten minutes—a “fast brute force”—because the device had been unlocked at some point prior to the seizure by law enforcement and remained powered on, rendering 95% of the device’s data available instantly. Conversely, a “Before First Unlock” (BFU) process

5

is required when the phone was off when seized or “had a power event after” seizure. When a phone is reset, “most of its data, including contacts, messages, and other personal data” is still encrypted. In a “slow brute force” BFU situation, GrayKey can make one attempt to decrypt the phone every ten minutes. An AFU—or a particularly lucky BFU—might render the device accessible to law enforcement within a day. Or a BFU brute force could require up to 23 years to more than 200 years to decrypt a device depending on the method and sophistication of encryption. Phone 1, Phone 2, Phone 3, Phone 6, Phone 10, Tablet 1, and Tablet 2 are Apple devices, and each presents a unique puzzle of decryption.

¶10 On December 1, 2023, the brute force had revealed the PIN protecting Phone 2, allowing Thomas to begin extracting data from the device on December 5, 2024. Thomas encountered obstacles processing this data when the software failed to translate the contained data from Mandarin to English, but she was able to troubleshoot the issue with the extraction software company customer service. She eventually completed the translations and generated a report from the data extracted from Phone 2 on December 28, 2023. On January 4, 2024, Thomas began extracting data from Phone 1. Thomas’s report indicates that the data “obtained from the extraction was significantly large,” delaying the generation of a report from that data until the next day. On January 5, 2024, she extracted and compiled all the data from Phone 3. The record is unclear as to when, if at all, Thomas was able to access data contained on Tablet 1.

¶11 On January 22, 2024, Bao moved to suppress the data obtained from the electronic devices on several grounds. Relevant here, Bao argued the warrant was void when the full

6

forensic analysis of the seized devices was not complete within ten days following issuance of the warrant. The District Court granted Bao’s motion in part, ordering the suppression of evidence obtained from Phone 1, Phone 2, Phone 3, and Tablet 1 because the forensic analysis took longer than ten days in violation of the time limit for serving a warrant imposed by § 46-5-225, MCA. The District Court “interpret[ed] [§ 46-5-225, MCA] to mean that law enforcement had ten days from July 10, 2023, to execute the search” and complete its analysis of the seized electronic devices detailed by the warrant. The State now appeals from the order granting Bao’s motion to suppress.

STANDARD OF REVIEW

¶12 We review the grant or denial of a motion to suppress for clear error as to the findings of fact and de novo as to whether the district court correctly interpreted and applied the governing law. State v. Levine, 2024 MT 169, ¶ 7, 417 Mont. 410, 553 P.3d 416 (citations omitted). The interpretation of a statute is a question of law reviewed de novo. Levine, ¶ 7 (citation omitted).

DISCUSSION

¶13 Section 46-5-225, MCA, the statute we are required to interpret, provides:

When warrant may be served. The warrant may be served at any time of the day or night. The warrant must be served within 10 days from the time of issuance. Any warrant not served within 10 days is void and must be returned to the court or judge issuing the warrant and identified as “not served.”

The statute directs that the warrant must be “served” within ten days of its issuance. Under a related statute, “service of a search warrant is made by exhibiting the original warrant or

7

a duplicate original warrant at the place or to the person to be searched.” Section 46-5-227, MCA (emphasis added). “Serve,” under its plain meaning, refers to making “legal delivery of (a notice or process)” or “to present (a person) with a notice or process as required by law.” Serve, Black’s Law Dictionary (12th ed. 2024); see also Personal Service, Black’s Law Dictionary (12th ed. 2024) (“Actual delivery of the notice or process to the person to whom it is directed.”). Even more colloquially, “service” means “the act of bringing a legal writ, process, or summons to notice actually or constructively as prescribed by law” and “the carrying into effect or execution of a writ or process (as an attachment by seizing the goods or person attached or an execution by levying it upon the goods or person of the defendant).” Service, Webster’s Third International Dictionary (3rd ed. 2002) (emphasis added); see also Personal Service, Webster’s Third International Dictionary (3rd ed. 2002) (“Service of a legal process by delivering it or a copy thereof to the defendant or by statute to an agent of the defendant authorized to receive service in the case at issue.”).

¶14 Other jurisdictions have analogous time limits on service of warrants. The Illinois Code of Criminal Procedure, from which our provision was sourced, § 46-5-225, MCA, Annotations, Comm’rs Note (2016), contains largely identical language: warrants “shall be executed within 96 hours from the time of issuance.” 725 Ill. Comp. Stat. § 5/108-6 (2024). The 96-hour time limit was intended to prevent probable cause from becoming stale, but did not constrain “the execution of search warrants authorizing the search of evidence lawfully seized and lawfully in the possession of the investigating authorities prior to the issuance of the search warrant to be executed.” People v. Shinohara, 872 N.E.2d 498, 517

8

(Ill. Ct. App. 2007). Likewise, Wisconsin recently addressed the same issue as in the instant case and determined a statute requiring the execution of a search warrant within five days did not require law enforcement complete their digital forensic analysis of lawfully seized electronic devices within five days. State v. Drachenberg, 2023 WI App 61, ¶ 38, 998 N.W.2d 566. Other relevant, persuasive authority is consistent with Drachenberg and Shinohara. See State v. Sanchez, 2020-NMSC-017, ¶¶ 13-14, 476 P.3d 889 (Search warrant for data on electronic device “served” for purposes of state statute when device was seized or when the data stored on the device was copied on site.); State v. Nadeau, 2010 ME 71, ¶ 48, 1 A.3d 445 (Warrant to search property lawfully in state custody was effectively executed at the time issued and “there was no danger that a search of the computer conducted after the expiration of the ten-day period would result in a seizure based on stale probable cause.”); State v. Johnson, 831 N.W.2d 917, 925 (Minn. Ct. App. 2013) (“Forensic analysis was not a second search within the meaning of the Fourth Amendment where the hard drive had been validly seized pursuant to a search warrant issued on probable cause” and search occurred after expiration of ten-day deadline to execute warrant.).

¶15 Here, the warrant was served within the § 46-5-225, MCA, ten-day time limit. The warrant issued on July 10, 2023, clearly states that “evidence, contraband, or persons connected with the aforementioned crimes may be found . . . within the devices” seized from Bao, Bushey, and Wang as well as devices found in Soul Massage or Wang’s hotel room “located at the Missoula County Sheriff’s Office secure evidence storage.” The

9

record indicates that Thomas received the request to extract data from the electronic devices and was provided with the signed, valid warrant on July 11, 2023—well within the ten-day limit for service set by § 46-5-225, MCA. “As long as a warrant is executed within ten days from its issuance, as set by our legislature in § 46-5-225, MCA, the warrant itself is not stale.” State v. Neely, 261 Mont. 369, 373, 862 P.2d 1109, 1111 (1993). Thus, the warrant issued on July 10, 2023, was served upon delivery to the forensic analyst already in possession of the lawfully seized devices on July 11, 2023. The process of accessing electronic devices already lawfully seized by the State does not violate the ten-day time limit imposed by § 46-5-225, MCA, on serving a warrant. Accordingly, the District Court’s Order to suppress the evidence gathered from Phone 1, Phone 2, Phone 3, and Tablet 1 is reversed.

¶16 We need not consider Bao’s alternative claims raised in her answer to the State’s opening brief in this interlocutory appeal. Section 46-20-103(1)(e), MCA, allows the State to take an appeal from an order granting a motion to suppress. The scope of this interlocutory appeal is dictated by statute. The District Court’s order granting Bao’s motion to suppress was based solely on its interpretation of § 46-5-225, MCA. Therefore, Bao’s alternative claims are not properly before the Court and Bao must await entry of a final judgment should she choose to appeal a decision of the District Court. Section 46-20-104(1), MCA (“An appeal may be taken by the defendant only from a final judgment of conviction and orders after judgment which affect the substantial rights of the defendant.”).

10

CONCLUSION

¶17 The July 10, 2023, warrant was properly served within the time limits established by § 46-5-225, MCA. The District Court erred in granting Bao’s motion to suppress.

¶18 Reversed and remanded for continuation of proceedings.

/S/ LAURIE McKINNON

We Concur:

/S/ JAMES JEREMIAH SHEA /S/ BETH BAKER /S/ INGRID GUSTAFSON /S/ JIM RICE