State v. Y. Bao

2024 MT 308, 560 P.3d 1207

Opinion

12/17/2024

DA 24-0139 Case Number: DA 24-0139

IN THE SUPREME COURT OF THE STATE OF MONTANA

2024 MT 308

STATE OF MONTANA,

Plaintiff and Appellant,

v.

YANBIN BAO,

Defendant and Appellee.

APPEAL FROM: District Court of the Fourth Judicial District, In and For the County of Missoula, Cause No. DC-23-326 Honorable Leslie Halligan, Presiding Judge

COUNSEL OF RECORD:

For Appellant:

Austin Knudsen, Montana Attorney General, Roy Brown, Assistant Attorney General, Helena, Montana

Matt Jennings, Interim Missoula County Attorney Andrea Renee Haney, Katrina Thorness, Deputy County Attorneys, Missoula, Montana

For Appellee:

Jordan Kilby, Stephens Brooke, P.C., Missoula, Montana

Submitted on Briefs: November 6, 2024

Decided: December 17, 2024

Filed: ir,-6‘A•-if __________________________________________ Clerk Justice Laurie McKinnon delivered the Opinion of the Court.

¶1 The State of Montana appeals from a February 16, 2024, Order of the Fourth Judicial

District Court, Missoula County, pursuant to § 46-20-103(2)(e), MCA. The District Court

ordered the suppression of evidence obtained from four electronic devices because the

process of decrypting and extracting the data contained within those devices required more

time than allowed by the ten-day time limit for serving warrants established by § 46-5-225,

MCA. We reverse and remand for continuation of proceedings.

¶2 The State presents the following issue for review:

Whether the District Court erred when it found that § 46-5-225, MCA, requires the State complete a search of evidence within ten days of the warrant’s issuance.

FACTUAL AND PROCEDURAL BACKGROUND

¶3 The State charged Yanbin Bao (Bao), a foreign national and resident of South

Carolina, with seven counts of felony sex trafficking under § 45-5-702(1), MCA, and one

count of felony labor trafficking under § 45-5-703(1), MCA. Bao allegedly ran a

prostitution operation out of a Missoula, Montana, massage parlor called Soul Massage

with her husband, Richard Bushey (Bushey). Bao and Bushey purportedly employed at

least three women as prostitutes at Soul Massage, including Jane Doe (JD).

¶4 JD entered the United States in March 2023 and answered an internet advertisement

for dog-friendly housing for “only $20 a day.” JD met Bao through the advertisement and

she subsequently moved to Missoula on April 26, 2023. The advertised housing was Soul

Massage, where JD claims Bao held her in captivity and forced her to engage in sexual acts

with customers under the threat of violence. 2 ¶5 On May 29, 2023, JD called law enforcement from Soul Massage and accused Bao

and Bushey of running a prostitution and sex trafficking operation. Deputies arrested Bao

and Bushey. Responding officers performed a search incident to arrest and seized their

cellphones. From Bao, deputies seized a silver Apple iPhone in a clear case (Phone 1) and

a white Apple iPhone in a purple case (Phone 2). From Bushey, deputies seized an Apple

iPhone with a black case (Phone 6). Soul Massage was then searched pursuant to a search

warrant and Deputies also seized several other electronic devices: an Apple iPad Pro in a

grey case (Tablet 1), a red Apple iPhone with a clear case (Phone 3), a blue Motorola phone

(Phone 4), and a black Samsung phone (Phone 5).

¶6 On June 6, 2023, law enforcement arrested another suspect, Hui Wang (Wang), in

connection with the allegedly illegal operations at Soul Massage. Law enforcement found

four phones on Wang’s person: a black Samsung phone (Phone 7), a Blu V50 cell phone

(Phone 8), a Blu Vivo phone (Phone 9), and an Apple iPhone in a “pink/purple case with

red staining upon it” (Phone 10). Acting upon a search warrant for Wang’s hotel room,

law enforcement seized a black Vortex cell phone (Phone 11) and an Apple iPad (Tablet 2).

¶7 On July 10, 2023, law enforcement obtained another warrant to search all the

devices seized from Bao, Bushey, and Wang. The warrant was presented to Forensic

Analyst Melanie Thomas (Thomas) on July 11, 2023. Thomas then began the process of

decrypting the seized devices to access and copy the data stored on the devices. On July 12,

2023, Thomas accessed Phone 6 using a provided PIN code and began extracting data.

Phone 2 was protected by a PIN code and required Thomas to brute force the phone’s

3 encryption with the GrayKey decryption program. On July 13, 2023, Thomas extracted

the full filesystem from Phone 4. On July 14, 2023, Thomas extracted the full filesystem

from Phone 5. On July 19, 2023, Thomas extracted the full filesystem from Phone 6 and

generated a report from the extracted data. On July 20, 2023, Thomas generated her report

from the data extracted from Phone 4 and Phone 5, and she began the process of brute

forcing the encryption on Tablet 1.

¶8 Thomas required more time to bypass the other devices’ encryption and security

mechanisms. As detailed in the application for the July 10, 2023, warrant, the GrayKey

software brute forces an electronic device’s encryption to allow “a valid law enforcement

agency located in a supported country” to access stored data in a potentially time intensive

process. To brute force and decrypt an Android device, a forensic analyst must physically

manipulate the screen, power, and buttons on the device to place the device into download

mode. Once placed into download mode, GrayKey can recover and download a file if the

device is compatible and supported by the GrayKey software. Phone 4, Phone 5, Phone 7,

Phone 8, and Phone 11 are Android devices.

¶9 When decrypting an Apple device, the duration of the GrayKey process depends on

when the phone was powered off or previously unlocked by the user. An “After First

Unlock” (AFU) process allows GrayKey to make 300,000 attempts at decrypting a phone

every ten minutes—a “fast brute force”—because the device had been unlocked at some

point prior to the seizure by law enforcement and remained powered on, rendering 95% of

the device’s data available instantly. Conversely, a “Before First Unlock” (BFU) process

4 is required when the phone was off when seized or “had a power event after” seizure. When

a phone is reset, “most of its data, including contacts, messages, and other personal data”

is still encrypted. In a “slow brute force” BFU situation, GrayKey can make one attempt

to decrypt the phone every ten minutes. An AFU—or a particularly lucky BFU—might

render the device accessible to law enforcement within a day. Or a BFU brute force could

require up to 23 years to more than 200 years to decrypt a device depending on the method

and sophistication of encryption. Phone 1, Phone 2, Phone 3, Phone 6, Phone 10, Tablet 1,

and Tablet 2 are Apple devices, and each presents a unique puzzle of decryption.

¶10 On December 1, 2023, the brute force had revealed the PIN protecting Phone 2,

allowing Thomas to begin extracting data from the device on December 5, 2024. Thomas

encountered obstacles processing this data when the software failed to translate the

contained data from Mandarin to English, but she was able to troubleshoot the issue with

the extraction software company customer service. She eventually completed the

translations and generated a report from the data extracted from Phone 2 on December 28,

2023. On January 4, 2024, Thomas began extracting data from Phone 1. Thomas’s report

indicates that the data “obtained from the extraction was significantly large,” delaying the

generation of a report from that data until the next day. On January 5, 2024, she extracted

and compiled all the data from Phone 3. The record is unclear as to when, if at all, Thomas

was able to access data contained on Tablet 1.

¶11 On January 22, 2024, Bao moved to suppress the data obtained from the electronic

devices on several grounds. Relevant here, Bao argued the warrant was void when the full

5 forensic analysis of the seized devices was not complete within ten days following issuance

of the warrant. The District Court granted Bao’s motion in part, ordering the suppression

of evidence obtained from Phone 1, Phone 2, Phone 3, and Tablet 1 because the forensic

analysis took longer than ten days in violation of the time limit for serving a warrant

imposed by § 46-5-225, MCA. The District Court “interpret[ed] [§ 46-5-225, MCA] to

mean that law enforcement had ten days from July 10, 2023, to execute the search” and

complete its analysis of the seized electronic devices detailed by the warrant. The State

now appeals from the order granting Bao’s motion to suppress.

STANDARD OF REVIEW

¶12 We review the grant or denial of a motion to suppress for clear error as to the

findings of fact and de novo as to whether the district court correctly interpreted and applied

the governing law. State v. Levine, 2024 MT 169, ¶ 7, 417 Mont. 410, 553 P.3d 416

(citations omitted). The interpretation of a statute is a question of law reviewed de novo.

Levine, ¶ 7 (citation omitted).

DISCUSSION

¶13 Section 46-5-225, MCA, the statute we are required to interpret, provides:

When warrant may be served. The warrant may be served at any time of the day or night. The warrant must be served within 10 days from the time of issuance. Any warrant not served within 10 days is void and must be returned to the court or judge issuing the warrant and identified as “not served.”

The statute directs that the warrant must be “served” within ten days of its issuance. Under

a related statute, “service of a search warrant is made by exhibiting the original warrant or

6 a duplicate original warrant at the place or to the person to be searched.” Section 46-5-227,

MCA (emphasis added). “Serve,” under its plain meaning, refers to making “legal delivery

of (a notice or process)” or “to present (a person) with a notice or process as required by

law.” Serve, Black’s Law Dictionary (12th ed. 2024); see also Personal Service, Black’s

Law Dictionary (12th ed. 2024) (“Actual delivery of the notice or process to the person to

whom it is directed.”). Even more colloquially, “service” means “the act of bringing a

legal writ, process, or summons to notice actually or constructively as prescribed by law”

and “the carrying into effect or execution of a writ or process (as an attachment by seizing

the goods or person attached or an execution by levying it upon the goods or person of the

defendant).” Service, Webster’s Third International Dictionary (3rd ed. 2002) (emphasis

added); see also Personal Service, Webster’s Third International Dictionary (3rd ed. 2002)

(“Service of a legal process by delivering it or a copy thereof to the defendant or by statute

to an agent of the defendant authorized to receive service in the case at issue.”).

¶14 Other jurisdictions have analogous time limits on service of warrants. The Illinois

Code of Criminal Procedure, from which our provision was sourced, § 46-5-225, MCA,

Annotations, Comm’rs Note (2016), contains largely identical language: warrants “shall be

executed within 96 hours from the time of issuance.” 725 Ill. Comp. Stat. § 5/108-6 (2024).

The 96-hour time limit was intended to prevent probable cause from becoming stale, but

did not constrain “the execution of search warrants authorizing the search of evidence

lawfully seized and lawfully in the possession of the investigating authorities prior to the

issuance of the search warrant to be executed.” People v. Shinohara, 872 N.E.2d 498, 517

7 (Ill. Ct. App. 2007). Likewise, Wisconsin recently addressed the same issue as in the

instant case and determined a statute requiring the execution of a search warrant within

five days did not require law enforcement complete their digital forensic analysis of

lawfully seized electronic devices within five days. State v. Drachenberg, 2023 WI

App 61, ¶ 38, 998 N.W.2d 566. Other relevant, persuasive authority is consistent with

Drachenberg and Shinohara. See State v. Sanchez, 2020-NMSC-017, ¶¶ 13-14, 476 P.3d

889 (Search warrant for data on electronic device “served” for purposes of state statute

when device was seized or when the data stored on the device was copied on site.); State v.

Nadeau, 2010 ME 71, ¶ 48, 1 A.3d 445 (Warrant to search property lawfully in state

custody was effectively executed at the time issued and “there was no danger that a search

of the computer conducted after the expiration of the ten-day period would result in a

seizure based on stale probable cause.”); State v. Johnson, 831 N.W.2d 917, 925 (Minn.

Ct. App. 2013) (“Forensic analysis was not a second search within the meaning of the

Fourth Amendment where the hard drive had been validly seized pursuant to a search

warrant issued on probable cause” and search occurred after expiration of ten-day deadline

to execute warrant.).

¶15 Here, the warrant was served within the § 46-5-225, MCA, ten-day time limit. The

warrant issued on July 10, 2023, clearly states that “evidence, contraband, or persons

connected with the aforementioned crimes may be found . . . within the devices” seized

from Bao, Bushey, and Wang as well as devices found in Soul Massage or Wang’s hotel

room “located at the Missoula County Sheriff’s Office secure evidence storage.” The

8 record indicates that Thomas received the request to extract data from the electronic

devices and was provided with the signed, valid warrant on July 11, 2023—well within the

ten-day limit for service set by § 46-5-225, MCA. “As long as a warrant is executed within

ten days from its issuance, as set by our legislature in § 46-5-225, MCA, the warrant itself

is not stale.” State v. Neely, 261 Mont. 369, 373, 862 P.2d 1109, 1111 (1993). Thus, the

warrant issued on July 10, 2023, was served upon delivery to the forensic analyst already

in possession of the lawfully seized devices on July 11, 2023. The process of accessing

electronic devices already lawfully seized by the State does not violate the ten-day time

limit imposed by § 46-5-225, MCA, on serving a warrant. Accordingly, the District

Court’s Order to suppress the evidence gathered from Phone 1, Phone 2, Phone 3, and

Tablet 1 is reversed.

¶16 We need not consider Bao’s alternative claims raised in her answer to the State’s

opening brief in this interlocutory appeal. Section 46-20-103(1)(e), MCA, allows the State

to take an appeal from an order granting a motion to suppress. The scope of this

interlocutory appeal is dictated by statute. The District Court’s order granting Bao’s

motion to suppress was based solely on its interpretation of § 46-5-225, MCA. Therefore,

Bao’s alternative claims are not properly before the Court and Bao must await entry of a

final judgment should she choose to appeal a decision of the District Court. Section

46-20-104(1), MCA (“An appeal may be taken by the defendant only from a final judgment

of conviction and orders after judgment which affect the substantial rights of the

defendant.”).

9 CONCLUSION

¶17 The July 10, 2023, warrant was properly served within the time limits established

by § 46-5-225, MCA. The District Court erred in granting Bao’s motion to suppress.

¶18 Reversed and remanded for continuation of proceedings.

/S/ LAURIE McKINNON

We Concur:

/S/ JAMES JEREMIAH SHEA /S/ BETH BAKER /S/ INGRID GUSTAFSON /S/ JIM RICE