FOR PUBLICATION UNITED STATES COURT OF APPEALS FOR THE NINTH CIRCUIT
UNITED STATES OF AMERICA, No. 05-50219 Plaintiff-Appellee, D.C. No. v. CR-02-01289-AK- JUSTIN BARRETT HILL, 01 Defendant-Appellant. OPINION
Appeal from the United States District Court for the Central District of California Alex Kozinski, Circuit Judge, Presiding
Argued and Submitted January 12, 2006—Pasadena, California
Filed August 11, 2006
Before: Mary M. Schroeder, Chief Judge, Alfred T. Goodwin and Raymond C. Fisher, Circuit Judges.
Opinion by Judge Fisher
9373 9376 UNITED STATES v. HILL
COUNSEL
Carlton F. Gunn, Deputy Federal Public Defender, Los Ange- les, California, for the defendant-appellant.
Michael R. Wilner (argued) and Thomas P. O’Brien, Assis- tant United States Attorneys, and Los Angeles, California, for the plaintiff-appellee. UNITED STATES v. HILL 9377 OPINION
FISHER, Circuit Judge:
Justin Hill conditionally pled guilty to possession of child pornography subject to his challenge to the admission of evi- dence that he contends was seized in violation of the Fourth Amendment. His appeal involves the validity of a warrant to search his computer and storage media for evidence that he possessed pornographic (i.e., lascivious) images of children. We must also decide whether it was reasonable under the Fourth Amendment for the police to take all of Hill’s com- puter storage media from his home (they did not find his com- puter) so they could conduct their search offsite in a police laboratory, rather than carrying out the search onsite and tak- ing only whatever evidence of child pornography they might find. As we recently discussed in United States v. Adjani, ____ F.3d ____, 2006 WL 1889946 (9th Cir. July 11, 2006), because computers typically contain so much information beyond the scope of the criminal investigation, computer- related searches can raise difficult Fourth Amendment issues different from those encountered when searching paper files. Judge Kozinski, sitting as the district court in this case, thoughtfully addressed some of these issues in a published opinion upholding the validity of the search warrant and its execution. United States v. Hill, 322 F. Supp. 2d 1081, 1092 (C.D. Cal. 2004). We affirm the district court’s ruling in most but not all respects for the reasons Judge Kozinski stated; to the extent we do agree with that reasoning, we adopt it verba- tim in this opinion. In sum, we affirm the district court’s denial of the defendant’s motion to suppress evidence.
I. Background
As the district court explained:
A computer technician was repairing defendant’s computer when she discovered what she believed to 9378 UNITED STATES v. HILL be child pornography. She called Long Beach police, and the detective who took the call obtained a search warrant from a judge of the Long Beach Superior Court. The warrant authorized a search of the com- puter repair store and seizure of the computer, any work orders relating to the computer, “all storage media belonging to either the computer or the indi- vidual identifying himself as defendant at the loca- tion,” and “all sexually explicit images depicting minors contained in the storage media.” By the time the detective arrived at the store to execute the war- rant, defendant had picked up his computer. . . . [T]he detective [submitted an affidavit, which included the computer technician’s sworn statement describing the images. On the basis of this affidavit, the officer obtained] a second warrant, this one directed at defendant’s home, authorizing seizure of the same items.
The affidavit on which the warrants were based described “two images of child pornography”:
Image 1
Is a color picture of a female, white, approximately 15 years old, with long dark brown hair. The female is in a room standing between a couch and a coffee table. There is a framed picture on the wall above the couch. She is wearing only a long blouse and pair of socks. The blouse is open and she is exposing her breast and pubic area to the camera, which she is facing while leaning to her left.
Image 2
Is a color picture of a [sic in affidavit] two females, white, approximately 7-9 years of age, both with dirty blond hair. These females are standing on a UNITED STATES v. HILL 9379 beach during the daytime. The shorter of the two females is standing to the right of the picture while the other female is standing behind her. Both females are facing the camera askew and wearing only a robe, which is open exposing the undeveloped breast and pubic area of both girls. They both are turning their faces away from the camera preventing the viewer from seeing their faces.
Officers executed the search warrant but did not find the computer in defendant’s apartment.1 In what appeared to be defendant’s bedroom, they found and seized computer storage media[, specifically: 22 5.25-inch floppy disks, two CD-ROMs, 124 3.5-inch floppy disks and six zip disks.] [Two of the zip disks] were eventually determined to contain images of child pornography; [officers] also seized other evidence consistent with the warrant. Defendant was subsequently charged with one count of possession of child pornography,2 in violation of 18 U.S.C. 1 Or anywhere else: The computer was never found. 2 18 U.S.C. § 2256(8) defines “child pornography” as any visual depiction, including any photograph, film, video, pic- ture, or computer or computer-generated image or picture, whether made or produced by electronic, mechanical, or other means, of sexually explicit conduct, where — (A) the production of such visual depiction involves the use of a minor engaging in sexually explicit conduct; (B) such visual depiction is a digital image, computer image, or computer-generated image that is, or is indistinguishable from, that of a minor engaging in sexually explicit conduct; or (C) such visual depiction has been created, adapted, or modi- fied to appear that an identifiable minor is engaging in sexu- ally explicit conduct. Section 2256(2)(B)(iii) defines “sexually explicit conduct” as “graphic or simulated lascivious exhibition of the genitals or pubic area of any person.” Thus, the lascivious exhibition of the genitals or pubic area of a minor constitutes child pornography. A portion of section 2256(8) that is irrelevant to the issues raised in these motions was held unconstitutional in Ashcroft v. Free Speech Coalition. See 535 U.S. 234 (2002). 9380 UNITED STATES v. HILL § 2252A(a)(5)(B).3
Hill, 322 F. Supp. 2d at 1083-84 (alterations in original).
In the district court, the defendant moved to suppress the evidence recovered from the two zip disks on the grounds that, (1) contrary to the magistrate’s finding, the warrant affi- davit did not establish probable cause to believe the defendant was guilty of criminal activity; and (2) the warrant was over- broad in allowing seizure of all discovered computer storage media with no regard to whether such media contained child pornography, and in placing no limitation on the police offi- cers’ search of the seized disks. Id. at 1084.4 The district court denied the motion to suppress and the defendant conditionally pled guilty to the charge, reserving the right to appeal the dis- trict court’s evidentiary ruling.5 This timely appeal followed. 3 Section 2252A(a)(5)(B) prohibits: knowingly possessing any book, magazine, periodical, film, vid- eotape, computer disk, or any other material that contains an image of child pornography that has been mailed, or shipped or transported in interstate or foreign commerce by any means, including by computer, or that was produced using materials that have been mailed, or shipped or transported in interstate or for- eign commerce by any means, including by computer. 4 The defendant did not challenge the warrant affidavit on the ground that it included only a written description of the images and not the images themselves. Cf. United States v. Battershell, ___ F.3d ___, ___, slip op. at 9271 (9th Cir. Aug. 10, 2006) (“It would have been preferable if the affiant in this case had included copies of the photographs [to which the affiant had access] in the warrant application. But failing to include a pho- tograph in a warrant application is not fatal to establishing probable cause. (citing United States v. Smith, 795 F.2d 841, 847 (9th Cir. 1986))). 5 In the district court, the defendant also argued that in order to prepare a defense his counsel and his expert were entitled to “mirror image” copies of the computer media the government seized. The district court agreed and ordered the government to provide defendant with copies. Hill, 322 F. Supp. 2d at 1091-92. That ruling is not contested here. UNITED STATES v. HILL 9381 II. Standard of Review
We review de novo the district court’s denial of a motion to suppress evidence. United States v. Meek, 366 F.3d 705, 711 (9th Cir. 2004). We review for clear error a magistrate’s finding of probable cause to issue a search warrant and give “great deference” to such a finding. United States v. Hay, 231 F.3d 630, 634 n.4 (9th Cir. 2000).
III. Discussion
A. Probable Cause
The defendant argues first that the affidavit submitted in support of the search warrant was insufficient to establish probable cause to believe the defendant was guilty of criminal activity. We do not agree.
[1] “[N]o Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.” U.S. Const. amend. IV. The Constitution is clear; a magistrate may authorize a search of a location only if offi- cers establish probable cause to believe evidence of a crime may be found there. Probable cause means only a “fair proba- bility,” not certainty, and requires consideration of the totality of the circumstances. Illinois v. Gates, 462 U.S. 213, 238 (1983). Accordingly, we must determine whether the officer’s affidavit, which described the two images from the defen- dant’s computer as showing three different, minor girls with their breasts and pubic areas exposed, established a fair proba- bility that there was child pornography or evidence thereof to be found in computer hardware or software at the defendant’s home. We agree with the district court that the affidavit did establish probable cause, but reach that conclusion somewhat differently. 9382 UNITED STATES v. HILL [2] Child pornography is a particularly repulsive crime, but not all images of nude children are pornographic. For exam- ple, “a family snapshot of a nude child bathing presumably would not” be criminal. Hill, 322 F. Supp. 2d at 1086. More- over, the law recognizes that some images of nudity may merit First Amendment protection because they serve artistic or other purposes, and possessing those images cannot be criminal. See Osborne v. Ohio, 495 U.S. 103, 112-13 (1990) (upholding Ohio’s child pornography law because it had been interpreted to criminalize possession of images depicting not just nudity, but “nudity constitut[ing] a lewd exhibition”); New York v. Ferber, 458 U.S. 747, 765 n.18 (1982) (“[N]udity, without more[,] is protected expression.”). Images depicting “minor[s] engag[ed] in sexually explicit conduct” are, however, prohibited. 18 U.S.C. § 2256(8)(A). “[S]exually explicit conduct,” in turn, is defined to include “graphic or simulated lascivious exhibition of the genitals or pubic area of any person.” 18 U.S.C. § 2256(2)(A)(v) (emphasis added). Thus the more precise question we must answer is whether the officer’s affidavit established probable cause that the images on the defendant’s computer were — as described — lascivious.6 See Hill, 322 F. Supp. 2d at 1084. In answering that question, it is important to remember that in issuing the search warrant, the magistrate had to make a practical, com- monsense decision, based on the totality of the circumstances 6 We stress that in this case the state court judge who issued the warrant made his determination based upon a written description of the images. The officer presenting that description of the images had a duty, of course, to do so in good faith, providing all relevant information to the magistrate. See United States v. Mendonsa, 989 F.2d 366, 369 (9th Cir. 1993) (“Suppression remains an appropriate remedy, however, when a magis- trate is misled by information in the affidavit, which the affiant knows, or should know, is false.”); see also Baldwin v. Placer County, 405 F.3d 778, 782 (9th Cir.), amended by 418 F.3d 966 (9th Cir. 2005) (refusing to grant an officer qualified immunity because “[t]he plaintiffs’ established civil rights were violated by presentation of [a] false affidavit”). If the magis- trate had been able to view the two images for himself, his analysis and our subsequent review might be different. UNITED STATES v. HILL 9383 presented to him in the affidavit, that there was a “fair proba- bility” that the images were lascivious. See United States v. Gourde, 440 F.3d 1065, 1069 (9th Cir. 2006) (en banc).7
[3] Various courts have attempted to articulate a test for determining lasciviousness. Many have relied upon a six- factor test originated in United States v. Dost:
(1) whether the focal point of the visual depiction is on the child’s genitalia or pubic area;
(2) whether the setting of the visual depiction is sexually suggestive, i.e., in a place or pose generally associated with sexual activity;
(3) whether the child is depicted in an unnatural pose, or in inappropriate attire, considering the age of the child;
(4) whether the child is fully or partially clothed, or nude;
(5) whether the visual depiction suggests sexual coyness or a willingness to engage in sexual activity;
(6) whether the visual depiction is intended or designed to elicit a sexual response in the viewer. 7 The defendant challenges only whether there was probable cause to believe the images described were lascivious, i.e., whether there was a fair probability that the defendant possessed evidence of a crime (child por- nography). Assuming he loses the lasciviousness argument, he does not argue there was no probable cause to believe that such evidence could be found on his computer (or storage media). Cf. Gourde, 440 F.3d at 1069 (“We conclude that the affidavit contained sufficient facts to support the magistrate judge’s finding that there was a ‘fair probability’ that Gourde’s computer contained evidence that he violated 18 U.S.C. §§ 2252 or 2252A.” (emphasis added)). 9384 UNITED STATES v. HILL 636 F.Supp. 828, 832 (S.D. Cal. 1986), aff’d sub nom. United States v. Wiegand, 812 F.2d 1239 (9th Cir. 1987); see also United States v. Brunette, 256 F.3d 14, 18 (1st Cir. 2001) (adopting and applying Dost factors); United States v. Villard, 885 F.2d 117, 122 (3d Cir. 1989) (same).
The district court, analyzing each of these six factors, found Dost to be “not particularly helpful” in determining whether a given image is lascivious — generally or as applied to the images here. See Hill, 322 F.Supp.2d at 1086. Instead, the court fashioned a new test that would create a presumption of lasciviousness, and therefore probable cause, “[i]f an image of a minor displays the minor’s naked genital area . . . [,] unless there are strong indicators that [the image] is not lascivious.”8 Id. at 1086-87. Although we appreciate the district court’s careful analysis and critique of Dost, we do not think it neces- sary to adopt a new test or to deny the utility of Dost in the context of this case.
[4] The Dost factors can be a starting point for judges to use in determining whether a particular image is likely “so presented by the photographer as to arouse or satisfy the sex- ual cravings of a voyeur.” Wiegand, 812 F.2d at 1244. But the factors are neither exclusive nor conclusive. Dost itself acknowledged that it did not seek to offer “a comprehensive definition of . . . lasciviousness,” because a determination of 8 The district court’s test might be an improvement over the Dost six- factor inquiry, at least when the magistrate can see and evaluate the images first hand. However, when (as here) the magistrate does not have the images, the judge would have to determine whether “there are strong indicators that [the image] is not lascivious” based on the information the attesting officer (or, as in this case, a third-party witness) includes in the description. It is not clear that officers would be as able to decide and articulate what is relevant mitigating information (from the unrepresented target’s viewpoint) as in making their affirmative showing of lascivious- ness under existing doctrine. Cf. Hill, 322 F. Supp. 2d at 1085-86 (discuss- ing the government’s and the defendant’s starkly differing views of the images during the suppression hearing). UNITED STATES v. HILL 9385 lasciviousness “ha[s] to be made based on the overall content of the visual depiction.” 636 F. Supp. at 832. The factors are merely “general principles as guides for analysis.” Id. For instance, we have already recognized that, in some instances, the factors may be “over generous” to defendants. Wiegand, 812 F.2d at 1244; see also United States v. Amirault, 173 F.3d 28, 32 (1st Cir. 1999) (“We believe that the Dost factors are generally relevant and provide some guidance in evaluating whether the display in question is lascivious. We emphasize, however, that these factors are neither comprehensive nor necessarily applicable in every situation. Although Dost pro- vides some specific, workable criteria, there may be other fac- tors that are equally if not more important in determining whether a photograph contains a lascivious exhibition. The inquiry will always be case-specific.”).
[5] Ultimately, probable cause is a fluid and nontechnical conception not readily susceptible to multifactor tests or rebuttable presumptions. See Maryland v. Pringle, 540 U.S. 366, 370-71 (2003) (“[T]he probable-cause standard is a . . . nontechnical conception . . . . [and] a fluid concept — turning on the assessment of probabilities in particular factual con- texts — not readily, or even usefully, reduced to a neat set of legal rules . . . . [It] is incapable of precise definition or quan- tification . . . .” (internal quotation marks and citation omit- ted).) The magistrate, relying on Dost as a guidepost or on some other test for lasciviousness, need only make a “practi- cal, common-sense decision” that the description presented in the affidavit demonstrates a “fair probability” that the images are lascivious. Gates, 462 U.S. at 238; see also Gourde, 440 F.3d at 1071; Wiegand, 812 F.2d at 1244 (“The definition of ‘lasciviousness’ is a matter of law . . . .”).
[6] Based on our independent review of the affidavit describing the two images, we are satisfied that the state judge’s finding of probable cause was well within his discre- tion. There was a fair probability that the images were “so presented by the photographer as to arouse or satisfy the sex- 9386 UNITED STATES v. HILL ual cravings of a voyeur.” Wiegand, 812 F.3d at 1244; see also id. (“Necessarily in deciding whether the district court erred as to the facts [in determining that the images were las- civious], we must view the pictures ourselves and must inter- pret the statutory term.”). The affidavit described in some detail the images of three partially nude children, who were provocatively and unnaturally dressed in light of the photo- graphs’ settings. The girls’ clothing was opened so as to reveal their breasts and pubic areas, with the girls appearing in sexually suggestive poses.9 Moreover the descriptions themselves did not raise doubts that the images served some purpose other than that proscribed in Wiegand.10 Cf. Batter- shell, ___ F.3d at ___, slip op. at 9267 (holding that an affida- vit describing “a young female (8-10 YOA) naked in a bath- tub” is insufficient to establish probable cause to believe the image is lascivious). The affidavit was sufficient to create “a substantial basis for concluding that probable cause existed” to believe that evidence of a violation of 18 U.S.C. § 2252A(a)(5)(B) could be found on the defendant’s com- puter. See Gates, 462 U.S. at 238-39 (internal quotation marks and alterations omitted).
B. Overbreadth
1. Seizure of All Computer Media
The defendant argues that the search warrant was over- broad because it authorized the officers to seize and remove from his home his computer and storage media without first 9 Although the defendant at trial might have been able to present evi- dence supporting innocent explanations for the content of the pictures, that does not negate the images’ prima facie appearance of lasciviousness — which is the issue relevant to probable cause. 10 In contrast to the concerns we raised in footnote 8, supra, the defen- dant does not argue that the affidavit’s description of the images was incomplete in any way; nor does he claim that the attesting officer was aware of but failed to disclose mitigating facts that would tend to show the images were not lascivious. UNITED STATES v. HILL 9387 determining whether they actually contained child pornogra- phy. Given the nature of computers and storage media, this argument sweeps too broadly, as the district court explained in addressing the defendant’s suggested limitations on the nature and scope of the search:
Search warrants must be specific. “Specificity has two aspects: particularity and breadth. Particularity is the requirement that the warrant must clearly state what is sought. Breadth deals with the requirement that the scope of the warrant be limited by the proba- ble cause on which the warrant is based.” United States v. Towne, 997 F.2d 537, 544 (9th Cir. 1993) (internal quotation marks and citations omitted). A warrant describing a category of items is not invalid if a more specific description is impossible. United States v. Spilotro, 800 F.2d 959, 963 (9th Cir. 1986). The level of specificity required “varies depending on the circumstances of the case and the type of items involved.” Id.
The warrant here commanded the officers to search for and seize: “1) An IBM ‘clone’ medium tower personal computer . . . 3) All storage media belong- ing to either item # 1 or the individual identifying himself as defendant at the location. 4) All sexually explicit images depicting minors contained in item # 3.” Defendant argues the warrant was overbroad because it authorized seizure of storage media whether or not they contained child pornography. He suggests it should have authorized seizure only of media containing child pornography. But it is impos- sible to tell what a computer storage medium con- tains just by looking at it. Rather, one has to examine it electronically, using a computer that is running the appropriate operating system, hardware and soft- ware. The police had no assurance they would find such a computer at the scene — nor did they, for that 9388 UNITED STATES v. HILL matter — or that, if they found one, they could bypass any security measures and operate it.
Defendant suggests that the police could have brought their own laptop computer: Having probable cause to seize only computer storage media that con- tained certain types of files, the police should have been required to bring with them the equipment nec- essary to separate the sheep from the goats. Defen- dant’s argument raises an important question about how police must execute seizures pursuant to a war- rant. Because seizable materials are seldom found neatly separated from their non-seizable counter- parts, how much separating must police do at the scene to avoid taking items that are neither contra- band nor evidence of criminal activity?
As always under the Fourth Amendment, the stan- dard is reasonableness. To take an extreme example, if police have probable cause to seize business records, the warrant could not authorize seizure of every piece of paper on the premises on the theory that the police conducting the search might not know how to read. . . .
[T]he court concludes that the police were not required to bring with them equipment capable of reading computer storage media and an officer com- petent to operate it. Doing so would have posed sig- nificant technical problems and made the search more intrusive. To ensure that they could access any electronic storage medium they might find at the scene, police would have needed far more than an ordinary laptop computer. Because computers in common use run a variety of operating systems — various versions or flavors of Windows, Mac OS and Linux, to name only the most common — police would have had to bring with them a computer (or UNITED STATES v. HILL 9389 computers) equipped to read not only all of the major media types, but also files encoded by all major operating systems. Because operating systems, media types, file systems and file types are continu- ally evolving, police departments would frequently have to modify their computers to keep them up-to- date. This would not be an insuperable obstacle for larger police departments and federal law enforce- ment agencies, but it would pose a significant burden on smaller agencies.
Even if the police were to bring with them a properly equipped computer, and someone competent to oper- ate it, using it would pose two significant problems. First, there is a serious risk that the police might damage the storage medium or compromise the integrity of the evidence by attempting to access the data at the scene. As everyone who has accidentally erased a computer file knows, it is fairly easy to make mistakes when operating computer equipment, especially equipment one is not intimately familiar with. The risk that the officer trying to read the sus- pect’s storage medium on the police laptop will make a wrong move and erase what is on the disk is not trivial. Even if the officer executes his task flaw- lessly, there might be a power failure or equipment malfunction that could affect the contents of the medium being searched. For that reason, experts will make a back-up copy of the medium before they start manipulating its contents. Various other techni- cal problems might arise; without the necessary tools and expertise to deal with them, any effort to read computer files at the scene is fraught with difficulty and risk.
Second, the process of searching the files at the scene can take a long time. To be certain that the medium in question does not contain any seizable 9390 UNITED STATES v. HILL material, the officers would have to examine every one of what may be thousands of files on a disk — a process that could take many hours and perhaps days. Taking that much time to conduct the search would not only impose a significant and unjustified burden on police resources, it would also make the search more intrusive. Police would have to be pres- ent on the suspect’s premises while the search was in progress, and this would necessarily interfere with the suspect’s access to his home or business. If the search took hours or days, the intrusion would con- tinue for that entire period, compromising the Fourth Amendment value of making police searches as brief and non-intrusive as possible.
Hill, 322 F. Supp. 2d at 1087-89 (alteration in original and internal citation omitted).
[7] We agree with the district court that under the circum- stances here, the warrant was not fatally defective in failing to require an onsite search and isolation of child pornography before removing storage media wholesale. That does not mean, however, that the government has an automatic blank check when seeking or executing warrants in computer- related searches. Although computer technology may in the- ory justify blanket seizures for the reasons discussed above, the government must still demonstrate to the magistrate factu- ally why such a broad search and seizure authority is reason- able in the case at hand. There may well be situations where the government has no basis for believing that a computer search would involve the kind of technological problems that would make an immediate onsite search and selective removal of relevant evidence impracticable. Thus, there must be some threshold showing before the government may “seize the hay- stack to look for the needle.”
Our cases illustrate this principle. In United States v. Hay, for example, we held permissible a “generic classification” UNITED STATES v. HILL 9391 authorizing seizure of an “entire computer system and virtu- ally every document in [the defendant’s] possession without referencing child pornography or any particular offense con- duct” because, although officers “knew that [a party] had sent 19 images [of child pornography] directly to [the defendant’s] computer, [they] had no way of knowing where the images were stored.” 231 F.3d 630, 637 (9th Cir. 2000). Similarly United States v. Lacy allowed “blanket seizure” of the defen- dant’s “entire computer system.” 119 F.3d 742, 746 (9th Cir. 1997). We reasoned that “no more specific description of the computer equipment sought was possible,” because the agents “did not know whether the images were stored on the hard drive or on one or more of [the defendant’s] many computer disks.” Id.; accord United States v. Upham, 168 F.3d 532, 535 (1st Cir. 1999) (holding, in a child pornography case, that “the seizure and subsequent off-premises search of the computer and all available disks was about the narrowest definable search and seizure reasonably likely to obtain the images”). Significantly, in both Hay and Lacy we carefully noted the critical role played by the officers’ affidavits supporting the warrants. See Hay, 231 F.3d at 637 (“[T]he affidavit explained why it was necessary to seize the entire computer system in order to examine the electronic data for contraband. It also justified taking the entire system off site because of the time, expertise, and controlled environment required for a proper analysis.”); Lacy, 119 F.3d at 746-47 (“In the affidavit supporting the search warrant application, a Customs agent explained there was no way to specify what hardware and software had to be seized to retrieve the images accurately.”).
[8] By contrast, although the warrant in this case authorized a wholesale seizure, the supporting affidavit did not explain why such a seizure was necessary. See United States v. Adjani, ___ F.3d at ___ , 2006 WL 1889946 at *7 n.7 (noting favorably an affidavit’s computer search and seizure protocol explaining when a computer had to be searched offsite, because “[s]uch specificity increases our confidence that the magistrate judge was well aware of what he was authorizing 9392 UNITED STATES v. HILL and that the agents knew the bounds of their authority in exe- cuting the search”); U.S. Dep’t of Justice, Searching and Seiz- ing Computers and Obtaining Electronic Evidence in Criminal Investigations 43, 69 (July 2002) (recommending that “if agents expect that they may need to seize a personal computer and search it off-site to recover the relevant evi- dence, the affidavit should explain this expectation and its basis to the magistrate judge. The affidavit should inform the court of the practical limitations of conducting an on-site search, and should articulate the plan to remove the entire computer from the site if it becomes necessary.”); cf. United States v. Tamura, 694 F.2d 591, 596 (9th Cir. 1982) (“If the need for transporting the documents is known to the officers prior to the search, they may apply for specific authorization for large-scale removal of material, which should be granted by the magistrate issuing the warrant only where on site sort- ing is infeasible and no other practical alternative exists.”).11
[9] We do not approve of issuing warrants authorizing blanket removal of all computer storage media for later exam- ination when there is no affidavit giving a reasonable explana- tion, such as that provided in Hay and Lacy, as to why a wholesale seizure is necessary.12 See Tamura, 694 F.2d at 595 (“[T]he wholesale seizure for later detailed examination of records not described in a warrant is significantly more intru- 11 In retrospect, it is clear that not all the storage media needed to be seized as evidence of criminal activity; of the 154 disks seized, only two zip disks contained lascivious images of children. There is no evidence or allegation that the officers knew of this result before they searched and seized. 12 As the defendant pointed out during oral argument, the magistrate must be made aware of what officers are contemplating and why they are doing so. For some people, computer files are the exclusive means of man- aging one’s life — such as maintaining a calendar of appointments or pay- ing bills. Thus, there may be significant collateral consequences resulting from a lengthy, indiscriminate seizure of all such files. As noted earlier, however, in this case the district court granted the defendant the right to “mirror copies” of the seized storage media. See supra n. 5. UNITED STATES v. HILL 9393 sive, and has been characterized as ‘the kind of investigatory dragnet that the fourth amendment was designed to prevent” (quoting United States v. Abrams, 615 F.2d 541, 543 (1st Cir. 1980))). Without such individualized justification being pres- ented to the magistrate, we cannot be sure that the judge was aware of the officers’ intent and the technological limitations meriting the indiscriminate seizure — and thus was intelli- gently able to exercise the court’s oversight function. An explanatory statement in the affidavit also assures us that the officers could not reasonably describe the objects of their search with more specificity. See United States v. Kow, 58 F.3d 423, 427 (9th Cir. 2005) (“Generic classifications in a warrant are acceptable only when a more precise description is not possible.” (internal quotation marks and citation omit- ted)); see also Upham, 168 F.3d at 535 (“Of course, if the [seized] images themselves could have been easily obtained through an on-site inspection, there might have been no justi- fication for allowing the seizure of all computer equipment, a category potentially including equipment that contained no images and had no connection to the crime.”). Accordingly, we hold that the warrant here was overbroad in authorizing a blanket seizure in the absence of an explanatory supporting affidavit, which would have documented the informed endorsement of the neutral magistrate. See Tamura, 694 F.2d at 596 (“The essential safeguard required is that wholesale removal must be monitored by the judgment of a neutral, detached magistrate.”).13
[10] Nonetheless, as in Tamura, we conclude that suppres- sion of the evidence of child pornography found on the defen- dant’s seized zip disks is not an appropriate remedy. Tamura involved an indiscriminate seizure of all files found in an 13 The district court found no violation because it assumed the state judge must have known it was not technologically feasible to search onsite, and therefore the affidavit did not need to so provide. See Hill, 322 F. Supp. 2d at 1090. We do not think the record is so clear, and our case law requires more. 9394 UNITED STATES v. HILL office even though the warrant authorized the officers to search for only three categories of records for evidence of var- ious alleged crimes. See id. at 594-95. Although we refused to sanction the “wholesale seizure for later detailed examina- tion of records not described in a warrant,” id. at 595, we held that “the exclusionary rule does not require the suppression of evidence within the scope of a warrant simply because other items outside the scope of the warrant were unlawfully taken as well,” id. at 597. See also id. (“Regardless of the illegality of the Government’s seizure and retention of documents not covered by the warrant, however, reversal is not compelled in this case.”).
[11] Similarly, the pornographic images from the defen- dant’s zip disks that he sought to exclude as evidence at trial was “seized and retained lawfully because described in and therefore taken pursuant to the valid search warrant.” Id. As we have discussed above, the officers’ wholesale seizure was flawed here because they failed to justify it to the magistrate, not because they acted unreasonably or improperly in execut- ing the warrant. Because the officers were “motivated by con- siderations of practicality rather than by a desire to engage in indiscriminate ‘fishing,’ we cannot say . . . that the officers so abused the warrant’s authority that the otherwise valid war- rant was transformed into a general one, thereby requiring all fruits to be suppressed.” Id. See also Hudson v. Michigan, 547 U.S. ____, 126 S.Ct. 2159, 2163 (2006) (“Suppression of evi- dence . . . has always been our last resort, not our first impulse,”and is appropriate “only ‘where its remedial objec- tives are thought most efficaciously served.’ ” (quoting United States v. Calandra, 414 U.S. 338, 348 (1974)).
[12] Therefore, we hold that the district court properly admitted the evidence of child pornography found on the defendant’s computer storage media notwithstanding the lack of a sufficiently detailed supporting affidavit describing the need for wholesale seizure of such media. UNITED STATES v. HILL 9395 2. Absence of Search Protocol
[13] The defendant also argues that the search warrant was overbroad because it did not include a search protocol to limit the officers’ discretion as to what they could examine when searching the defendant’s computer media, nor did the affida- vit explain why such a protocol was unnecessary. We, like the district court, find no error in the search warrant on this ground and adopt the district court’s analysis:
Defendant also argues that the warrant was over- broad because it did not define a “search methodolo- gy.” He claims that the search should have been limited to certain files that are more likely to be associated with child pornography, such as those with a “.jpg” suffix (which usually identifies files containing images) or those containing the word “sex” or other key words.
Defendant’s proposed search methodology is unrea- sonable. “Computer records are extremely suscepti- ble to tampering, hiding, or destruction, whether deliberate or inadvertent.” United States v. Hunter, 13 F. Supp. 2d 574, 583 (D. Vt. 1998). Images can be hidden in all manner of files, even word process- ing documents and spreadsheets. Criminals will do all they can to conceal contraband, including the simple expedient of changing the names and exten- sions of files to disguise their content from the casual observer.
Forcing police to limit their searches to files that the suspect has labeled in a particular way would be much like saying police may not seize a plastic bag containing a powdery white substance if it is labeled “flour” or “talcum powder.” There is no way to know what is in a file without examining its con- tents, just as there is no sure way of separating tal- 9396 UNITED STATES v. HILL cum from cocaine except by testing it. The ease with which child pornography images can be disguised — whether by renaming sexyteenyboppersxxx.jpg as sundayschoollesson.doc, or something more sophis- ticated — forecloses defendant’s proposed search methodology.
Hill, 322 F. Supp. 2d at 1090-1091; see also Adjani, ___ F.3d at ___, 2006 WL 1889946 at *7 (rejecting defendants’ argu- ment that officers should have looked at only specified areas of certain email programs for enumerated keywords because “[t]o require such a pinpointed computer search, restricting the search to an email program or to specific search terms, would likely have failed to cast a sufficiently wide net to cap- ture the evidence sought”).
[14] Moreover, in contrast to our discussion of the over- broad seizure claim above, there is no case law holding that an officer must justify the lack of a search protocol in order to support issuance of the warrant. As we have noted, we look favorably upon the inclusion of a search protocol; but its absence is not fatal. We have also held that even though a warrant authorizing a computer search might not contain a search protocol restricting the search to certain programs or file names, the officer is always “limited by the longstanding principle that a duly issued warrant, even one with a thorough affidavit, may not be used to engage in a general, exploratory search.” Id. The reasonableness of the officer’s acts both in executing the warrant and in performing a subsequent search of seized materials remains subject to judicial review. See United States v. Rettig, 589 F.2d 418, 423 (9th Cir. 1978) (“Where evidence is uncovered during a search pursuant to a warrant, the threshold question must be whether the search was confined to the warrant’s terms. . . . [T]he search must be one directed in good faith toward the objects specified in the warrant or for other means and instrumentalities by which the UNITED STATES v. HILL 9397 crime charged had been committed. It must not be a general exploratory search . . . .” (internal quotation marks omitted)).14
IV. Conclusion
We realize that judicial decisions regarding the application of the Fourth Amendment to computer-related searches may be of limited longevity. Technology is rapidly evolving and the concept of what is reasonable for Fourth Amendment pur- poses will likewise have to evolve. See Kyllo v. United States, 533 U.S. 27, 33-34 (2001) (“It would be foolish to contend that the degree of privacy secured to citizens by the Fourth Amendment has been entirely unaffected by the advance of technology.”); cf. id. at 41, 51 (Stevens, J., dissenting) (expressing concern with “the supposedly ‘bright-line rule’ the Court has created in response to its concerns about future technological developments” as it “is unnecessary, unwise, and inconsistent with the Fourth Amendment” and comment- ing that “[i]t would be far wiser to give legislators an unim- peded opportunity to grapple with these emerging issues [of technology] rather than to shackle them with prematurely devised constitutional constraints”). New technology may become readily accessible, for example, to enable more effi- cient or pinpointed searches of computer data, or to facilitate onsite searches. If so, we may be called upon to reexamine the 14 As we noted in Adjani, ____ F.3d at ____, 2006 WL 1889946 at *9, like the Tenth Circuit in United States v. Carey, 172 F.3d 1268 (10th Cir. 1999), we recognize that computer files are often intermingled and offi- cers who have a warrant to seize evidence of a specific crime may come across evidence that implicates the defendant in another crime. See also United States v. Walser, 275 F.3d 981 (10th Cir. 2001). The proper steps for the officer to take in such a situation — when dealing with computer files — have not been clearly defined, and this case does not provide occa- sion to do so. Cf. Tamura, 694 F.2d at 595-96 (“In the comparatively rare instances where documents are so intermingled that they cannot feasibly be sorted on site, we suggest that the Government and law enforcement officials generally can avoid violating fourth amendment rights by sealing and holding the documents pending approval by a magistrate of a further search . . . .”). 9398 UNITED STATES v. HILL technological rationales that underpin our Fourth Amendment jurisprudence in this technology-sensitive area of the law.
That said, for the reasons set forth in this opinion, the search here was supported by probable cause and, notwith- standing the shortcomings of the search warrant affidavit, the manner of its execution does not mandate suppression of the fruits of that search. The district court’s denial of the defen- dant’s motion to suppress is therefore AFFIRMED.