United States v. Ganias

12-240-cr (en banc)
United States v. Ganias

UNITED STATES COURT OF APPEALS
FOR THE SECOND CIRCUIT

August Term 2015

(Argued: September 30, 2015 Decided: May 27, 2016)

No. 12-240-cr

––––––––––––––––––––––––––––––––––––

UNITED STATES OF AMERICA,

Appellee,

-v.-

STAVROS M. GANIAS,

Defendant-Appellant.

––––––––––––––––––––––––––––––––––––

Before: KATZMANN, Chief Circuit Judge, JACOBS, CABRANES, POOLER, RAGGI, WESLEY,
HALL, LIVINGSTON, LYNCH, CHIN, LOHIER, CARNEY, and DRONEY, Circuit Judges.

LIVINGSTON and LYNCH, JJ., filed the majority opinion in which
KATZMANN, C.J., JACOBS, CABRANES, RAGGI, WESLEY, HALL, CARNEY, and
DRONEY, JJ., joined in full, and POOLER and LOHIER, JJ., joined in full as to Parts I
and III and in part as to Part II.

LOHIER, J., filed a concurring opinion in which POOLER, J., joined.

CHIN, J., filed a dissenting opinion.

1
 Appeal from the judgment of the United States District Court for the
District of Connecticut (Thompson, J.), convicting Defendant-Appellant Stavros
Ganias of two counts of tax evasion, in violation of 26 U.S.C. § 7201. Ganias
argues that the Government retained non-responsive data on mirrored hard
drives acquired pursuant to a 2003 search warrant in violation of the Fourth
Amendment, and that evidence acquired pursuant to a 2006 search of that data
should thus have been suppressed. Because we find that the Government relied
in good faith on the 2006 warrant, we need not and do not decide whether the
Government violated the Fourth Amendment, and we affirm the judgment of the
district court.

AFFIRMED.

SANDRA S. GLOVER (Sarala V. Nagala, Anastasia Enos
King, Jonathan N. Francis, Assistant United States
Attorneys; Wendy R. Waldron, Senior Counsel, U.S.
Dep’t of Justice, on the brief), for Deirdre M. Daly,
United States Attorney for the District of Connecticut,
for Appellee United States of America.

STANLEY A. TWARDY, JR., Day Pitney LLP, Stamford,
CT (Daniel E. Wenner, John W. Cerreta, Day Pitney
LLP, Hartford, CT, on the brief), for Defendant-Appellant
Stavros Ganias.

(Counsel for amici curiae are listed in Appendix A.)

DEBRA ANN LIVINGSTON and GERARD E. LYNCH, Circuit Judges:

Defendant-Appellant Stavros Ganias appeals from a judgment of the

United States District Court for the District of Connecticut (Thompson, J.)

convicting him, after a jury trial, of two counts of tax evasion in violation of 26

U.S.C. § 7201. He challenges his conviction on the ground that the Government

2
violated his Fourth Amendment rights when, after lawfully copying three of his

hard drives for off-site review pursuant to a 2003 search warrant, it retained

these full forensic copies (or “mirrors”), which included data both responsive

and non-responsive to the 2003 warrant, while its investigation continued, and

ultimately searched the non-responsive data pursuant to a second warrant in

2006. Ganias contends that the Government had successfully sorted the data on

the mirrors responsive to the 2003 warrant from the non-responsive data by

January 2005, and that the retention of the mirrors thereafter (and, by extension,

the 2006 search, which would not have been possible but for that retention)

violated the Fourth Amendment. He argues that evidence obtained in executing

the 2006 search warrant should therefore have been suppressed.

We conclude that the Government relied in good faith on the 2006 warrant,

and that this reliance was objectively reasonable. Accordingly, we need not

decide whether retention of the forensic mirrors violated the Fourth

Amendment, and we AFFIRM the judgment of the district court.

3
 I

A. Background 1

In August 2003, agents of the U.S. Army Criminal Investigation Division

(“Army CID”) received an anonymous tip that Industrial Property Management

(“IPM”), a company providing security for and otherwise maintaining a

government-owned property in Stratford, Connecticut, pursuant to an Army

contract, had engaged in misconduct in connection with that work. In particular,

the informant alleged that IPM, owned by James McCarthy, had billed the Army

for work that IPM employees had done for one of McCarthy’s other businesses,

American Boiler, Inc. (“AB”), and for construction work performed for IPM’s

operations manager at his home residence. The informant told the agents,

including Special Agent Michael Conner, that IPM and AB’s financial books were

maintained by Stavros Ganias, a former Internal Revenue Service (“IRS”) agent,

who conducted business as Taxes International. On the basis of the informant’s

information, as well as extensive additional corroboration, Agent Conner

prepared an affidavit seeking three warrants to search the offices of IPM, AB,

1
These facts are drawn from the district court decision denying Ganias’s motion
to suppress and from testimony at the suppression hearing and at Ganias’s jury trial.
With few exceptions noted herein, the facts in this case are not in dispute.

4
and Taxes International for evidence of criminal activity. 2 Nothing in the record

suggests that Ganias himself was suspected of any crimes at that time.

In a warrant dated November 17, 2003, U.S. Magistrate Judge William I.

Garfinkel authorized the search of Taxes International. The warrant authorized

agents to seize, inter alia, “[a]ll books, records, documents, materials, computer

hardware and software and computer associated data relating to the business,

financial and accounting operations of [IPM] and [AB].” J.A. 433. It further

authorized seizure of “[a]ny of the items described [in the warrant] . . . which are

stored in the form of magnetic or electronic coding on computer media or on

media capable of being read by a computer with the aid of computer-related

equipment, including . . . fixed hard disks, or removable hard disk cartridges,

software or memory in any form.” Id. The warrant also specifically authorized a

number of digital search protocols, though it did not state that only these

2
Specifically, Agent Conner sought evidence relating to violations of 18 U.S.C.
§ 287 (making false claims) and § 641 (stealing government property).

5
protocols were permitted. 3 The warrant authorized seizure of all hardware

relevant to the alleged crimes. 4

3
The warrant specified as follows:

The search procedure of the electronic data contained in computer
operating software or memory devices may include the following
techniques:

(a) surveying various file “directories” and the individual files they
contain (analogous to looking at the outside of a file cabinet for the
markings it contains and opening a drawer believed to contain
pertinent files);
(b) “opening” or cursorily reading the first few “pages” of such files in
order to determine their precise contents;
(c) “scanning” storage areas to discover and possibly recover recently
deleted files;
(d) “scanning” storage areas for deliberately hidden files; or
(e) performing key word searches through all electronic storage areas to
determine whether occurrences of language contained in such storage
areas exist that are intimately related to the subject matter of the
investigation.

J.A. 433-34.
4
In his attached affidavit, Agent Conner offered three reasons why it was
necessary for the agents to take entire hard drives off-site for subsequent search rather
than search the hard drives on-site: First, he stated that computer searches had to be
conducted by computer forensics experts, who “us[ed] . . . investigative techniques” to
both “protect the integrity of the evidence . . . [and] detect hidden, disguised, erased,
compressed, password protected, or encrypted files.” J.A. 448-49. Because of “[t]he
vast array” of software and hardware available, it would not always be possible “to
know before a search which expert is qualified to analyze the [particular] system and its
data.” J.A. 450. Thus, the appropriate experts could not be expected, in all cases, to
accompany agents to the relevant site to be searched. Second, Agent Conner affirmed
that such searches often must occur in “a laboratory or other controlled environment”
given the sensitivity of the digital storage media. J.A. 449-50. And third, he stated that
“[t]he search process can take weeks or months, depending on the particulars of the
hard drive to be searched.” J.A. 449. The district court found, in denying Ganias’s
6
 On November 19, 2003, Army CID agents executed the search warrants.

Because the warrants authorized the seizure of computer hardware and

software, in addition to paper documents, Agent Conner sought the help, in

executing the warrants, of agents from the Army CID’s Computer Crimes

Investigation Unit (“CCIU”), a unit with specialized expertise in digital forensics

and imaging. At Ganias’s office, the CCIU agents — and in particular Special

Agent David Shaver — located three computers. Rather than take the physical

hard drives, which would have significantly impaired Ganias’s ability to conduct

his business, Agent Shaver created mirror images: exact copies of all of the data

stored thereon, down to the bit. 5 Ganias was present at his office during the

creation of the mirrors, spoke with the agents, and was aware that mirrored

motion to suppress, that, as a result of technological limitations in 2003 and the
complexities of searching digital data, “[a] full [on-site] search would have taken
months to complete.” United States v. Ganias, No. 3:08CR00224 (AWT), 2011 WL
2532396, at *2 (D. Conn. June 24, 2011).
5
Hard drives are storage media comprising numerous bits — units of data that
may be expressed as ones or zeros. Mirroring involves using a commercially available
digital software (in the present case, though not always, EnCase) to obtain a perfect,
forensic replica of the sequence of ones and zeros written onto the original hard drive.
During the mirroring, EnCase acquires metadata about the mirroring process, writing
an unalterable record of who creates the copy and when the copy is created. It also
assigns the mirror a “hash value” — a unique code that can be used to verify whether,
upon subsequent examination of the mirror at any later date, even a single one or zero
has been altered from the original reproduction.

7
copies of his three hard drives had been created and taken off-site. 6 There is no

dispute that the forensic mirrors taken from Ganias’s office contained all of the

computerized data maintained by Ganias’s business, including not only material

related to IPM or AB, but also Ganias’s own personal financial records, and the

records of “many other” accounting clients of Ganias: businesses of various sorts

having no connection to the Government’s criminal investigation. 7 J.A. 464, ¶ 14.

6 Testifying at the suppression hearing, Agent Conner explained that the decision
to take mirrors, rather than the hard drives themselves, reflected a desire to mitigate the
burden on Ganias and his business. See J.A. 140-41. The district court credited this
testimony, concluding that the agents “used a means less intrusive to the individual
whose possessions were seized than other means they were authorized to use.” Ganias,
2011 WL 2532396, at *8. The district court, further, explicitly found that the 2003
warrant authorized the Government to take these mirrors, id. at *10, a position Ganias
has not challenged on appeal, and that runs directly counter to the dissent’s seeming
suggestions that the Government somehow acted improperly when it mirrored Ganias’s
hard drives or that this initial seizure went beyond the scope of the 2003 warrant, see,
e.g., Dissent at 3 (noting that “although the Government had a warrant for documents
relating to only two of defendant-appellant Stavros Ganias’s accounting clients, it
seized all the data from three of his computers”); id. at 40 (stating that “the
Government . . . entered Ganias’s premises with a warrant to seize certain papers and
indiscriminately seized — and retained — all papers instead”).
7 Ganias claimed before the district court that when he expressed some concern
about the scope of the data being seized, an agent assured him that the agents were only
looking for files related to AB and IPM, and that irrelevant files “would be purged once
they completed their search” for such files. J.A. 428. The district court made no finding
to this effect, however. It is undisputed, moreover, that Ganias became aware in
February 2006 that the Government retained the mirrors and sought to search them in
connection with Ganias’s own tax reporting. At no time thereafter did Ganias seek
return of the mirrors pursuant to Federal Rule of Criminal Procedure 41(g) or otherwise
contact a case agent to seek their return or destruction.

8
 The next day, Agent Shaver consolidated the eleven mirrored hard drives

from all three searches (including the three from Ganias’s office) onto a single

external hard drive which he provided to Agent Conner. Agent Conner, in turn,

provided this hard drive to the evidence custodian of the Army CID, who stored

it at Fort Devens, Massachusetts. There the consolidated drive remained,

unaltered and untouched, throughout the events relevant to this case. Around

the same time, Agent Shaver created two additional copies of the mirrored drives

on two sets of nineteen DVDs. After providing these DVD sets to Agent Conner,

Agent Shaver then purged the external hard drives onto which he had originally

written the mirrors. At this point, a week after the search, three complete copies

of the mirrors of Ganias’s hard drives existed: an untouched copy stowed away

in an evidence locker and two copies available for forensic analysis. 8

Though internal protocols required that specialized digital forensic

analysts search the mirrored hard drives, the paper files were not subject to such

limitations. Thus, shortly after the November 19 seizure, the Army CID agents

8
These copies were identical digital replicas of Ganias’s hard drives as mirrored
on November 19, 2003. Notably, the original hard drives in Ganias’s computers had
already been significantly altered since the Government mirrored them. Ganias
explains in his brief before this Court that “[t]wo days after the execution of the
November 2003 warrant, [he] reviewed his personal QuickBooks file and . . . . corrected
over 90 errors in earlier journal entries.” Appellant Br. at 15 n.7 (emphasis added).

9
began to analyze the non-digital files seized pursuant to the warrant. These files

suggested that IPM had made payments to a third company whose owner,

according to the Connecticut Department of Labor, was a full-time employee of

an insurance company who received no wages from any source other than that

insurance company. This and other red flags spurred Agent Conner to contact

the Criminal Investigation Division of the IRS, which subsequently joined the

investigation.

In early February 2004, as he and his fellow agents continued to follow

leads from the paper files, Agent Conner sent one of the two DVD sets

containing the forensic mirrors to the Army Criminal Investigation Laboratory

(“ACIL”) in Forest Park, Georgia, accompanied by a copy of one of the three

search warrants. In early June, the ACIL assigned Gregory Norman, a digital

evidence examiner, to perform a forensic analysis. Around the same time,

Special Agent Michelle Chowaniec, who replaced Agent Conner as the primary

case agent for the Army CID in late March, provided the second set of DVDs to

the IRS agent assigned to the case, Special Agent Paul Holowczyk. Agent

Holowczyk in turn, passed it on, by way of intermediaries, to Special Agent Vita

Paukstelis, a computer investigative specialist. By the end of June 2004,

10
computer experts for the Army CID and the IRS — Norman and Agent

Paukstelis, respectively — had received copies of the digital evidence (which, as

the district court found, were “encoded so that only agents with forensic

software not directly available to the case agents could view [them],” Ganias,

2011 WL 2532396, at *7), and forensic examination began.

Norman commenced his analysis in late June by loading the eleven

mirrored drives into EnCase — the same software with which Agent Shaver

initially created the mirrors — so that he could search the data thereon. After

looking at the search warrants, he created a number of keywords, with which he

searched for potentially relevant data. Initially, the search returned far too many

results for practicable review (more than 17,000 hits); thus, Norman requested

new keywords from Agent Chowaniec. On the basis of these new keywords, he

was able to narrow his search and ultimately identify several files he thought

might be of interest to the investigation, all of which he put on a single CD. 9

Some of these files he was able personally to examine, to determine whether they

were responsive to the warrant; a few (including the QuickBooks file labeled

9
The rest of the data remained on the DVDs, where agents would not be able to
access it without specific forensic software. See Ganias, 2011 WL 2532396, at *7.

11
“Steve_ga.qbw,” which was ultimately searched pursuant to the 2006 warrant,

J.A. 467) Norman could not open without a specific software edition of

QuickBooks to which he did not have immediate access. However, as these files

(like the others) contained keywords that were taken from the narrower list and

generated on the basis of the warrant, Norman included the QuickBooks files in

the CD he ultimately sent to Agent Chowaniec along with a report. 10 On July 23,

2004, Chowaniec received this CD. Norman, in turn, returned the nineteen

DVDs to Army CID’s evidence custodian in Boston for safekeeping.

Norman’s counterpart in the IRS, Agent Paukstelis — who, in addition to

receiving the search warrant with her set of DVDs, also received a list of

companies, addresses, and key individuals relating to the investigation, along

with “a handwritten notation next to the name ‘Taxes International’ that stated

‘(return preparer) do not search,’” Ganias, 2011 WL 2532396, at *3 — conducted

her analysis over a period of about four months. Because she worked for the IRS,

she limited her search to the three mirrored drives from Taxes International.

Though Agent Paukstelis used ILook, a different software program, to review

the mirrored hard drives, she too could not open QuickBooks files without the

10
Norman describes the storage device he sent to Chowaniec as a “DVD,”
J.A. 218; the district court described it as a “CD,” Ganias, 2011 WL 2532396, at *4. The
distinction is immaterial.

12
relevant proprietary software. Still, though she could not open these files, she

believed, based on the information to which she had access, that they were

within the scope of the warrant; thus, in October 2004, she copied this data, in

concert with other responsive data, onto a CD, three copies of which she sent to

Agent Holowczyk and Special Agent Amy Hosney, also with the IRS. In light of

the note she had received with her DVD set as well as the list of relevant entities,

Agent Paukstelis avoided, to the degree she could, searching any files of Taxes

International that did not appear to be directly relevant to that list. On

November 30, 2004, Paukstelis also provided a “restoration” of the mirrors of the

Taxes International hard drives to Special Agent George Francischelli, an IRS

computer specialist assigned to the case. 11

Agents Chowaniec and Conner, after receiving Norman’s CD and report in

late July, conducted initial reviews of the data. Like Norman and Agent

Paukstelis, however, they could not open the QuickBooks files. At the same

time, the agents were busy, in the words of Agent Chowaniec, “tracking down

other leads[,] . . . [issuing] grand jury subpoenas, . . . doing interviews of

11
A “restoration” is a software interface that enables a user (potentially a jury) to
view data on a mirror as such data would have appeared to a person accessing the data
on the original storage device at the time the mirror was created. Ganias, 2011 WL
2532396, at *4.

13
subcontractors and identifying subcontractors from the papers that [the agents

had] received from the search warrants.” J.A. 294-95. In October, Agents

Hosney and Chowaniec attempted, together, to review the QuickBooks files, but

again lacked the relevant software to do so. Finally, in November 2004, Agent

Chowaniec, having acquired the appropriate software, opened two IPM

QuickBooks files on her office computer, and then in December, Agents Hosney

and Chowaniec, using the restoration provided by Agent Paukstelis, looked at

additional IPM QuickBooks files. Though they had the entirety of the mirrored

data before them (the only time throughout the investigation that the case agents

had direct access to a software interface permitting them to view essentially all of

the data stored on the mirrors), they carefully limited their search: Agent Hosney

testified that they “only looked at the QuickBooks files for Industrial Property

Management and American Boiler . . . [b]ecause those were the only two

companies named in the search warrant attachment.” J.A. 340. They did,

however, observe that other files existed — both on the CD Norman had

provided and on the restoration — in particular, the files Agent Hosney

ultimately searched in 2006.

14
 Ganias contends that there is no dispute that by this point, the agents had

finished “identifying and segregating the files within the November 2003

warrant’s scope.” Appellant Reply Br. at 5. In actuality, the record is unclear as

to whether the forensic examination of the mirrored computers pursuant to the

initial search warrant had indeed concluded as a forward-looking matter, rather

than from the perspective of hindsight. 12 The district court did not find any facts

decisive to this question. It is, further, undisputed that the investigation into

McCarthy, IPM, and AB was ongoing at this time, and that this investigation

would culminate in an indictment of McCarthy in 2008 secured in large part

through reliance on evidence responsive to the 2003 warrant and located on the

mirrored copies of Ganias’s hard drives. See Indictment, United States v. McCarthy,

12
At the suppression hearing, Agent Chowaniec testified, in response to the
question whether “as of mid-December, [her] forensic analysis was completed”: “That’s
correct, of the computers.” J.A. 322. But when asked later, “[D]id you know [in
December 2004] you wouldn’t need to look at any information that had been provided
by Greg Norman on that CD anymore in the course of this investigation,” Agent
Chowaniec responded, “No,” and when further asked, “Did you know you wouldn’t
require further analysis by Greg Norman or any other examiner at the Army lab in
Georgia after December of 2004,” Agent Chowaniec again responded, “No.” J.A. 324.
Agent Conner similarly answered with uncertainty when asked a related question. See
J.A. 145 (“I didn’t know the entire universe of information that was contained within
the DVDs that were sent to [Norman] for analysis. I knew only what he sent back to me
saying this is what I found off your keyword search.”). The dissent disputes our
conclusion that the record was unclear on this point, arguing, through citation to Agent
Chowaniec’s testimony, that “the record . . . shows otherwise.” Dissent at 19. The
district court found no facts on this issue, and the record, as demonstrated above, is
indeed unclear.

15
No. 3:08cr224 (EBB) (D. Conn. Oct. 31, 2008), ECF No. 1. When asked why, at this

time or any time later, Agent Conner did not return or destroy the data stored on

the mirrors that did not appear directly to relate to the crimes alleged in the

warrant, Agent Conner explained that “[the] investigation was still . . . open” and

that, generally, items would be “released back to the owner” once an

investigation was closed. J.A. 123. He further noted that the Army CID “would

not routinely go into DVDs to delete data, as we’re altering the original data that

was seized.” J.A. 122. 13

Over the next year, the agents continued to investigate IPM and AB.

Analysis of the paper files taken pursuant to the November 2003 search warrant

13
Agent Conner’s explanation for why the Government did not, as a matter of
policy in this or other cases, delete mirrored drives or otherwise require segregation or
deletion of non-responsive data, is not a model of clarity: in addition to citing concerns
of evidentiary integrity and suggesting a policy of non-deletion or return prior to the
end of an investigation, he noted that “you never know what data you may need in the
future,” J.A. 122, and at one point referred to the DVDs as “the government’s property,
not Mr. Ganias’[s] property,” J.A. 146. The dissent seizes on this single sentence during
Agent Conner’s cross-examination as the smoking gun of the Government’s bad faith,
citing it on no fewer than four occasions. See Dissent at 3, 8, 33, 37. The district court,
however, did not find facts explicating Agent Conner’s testimony or placing it within
the context of the explanations that he and other agents offered for retention of the
mirrors. The court did note in its legal analysis that “[a] copy of the evidence was
preserved in the form in which it was taken.” Ganias, 2011 WL 2532396, at *8. Further,
the Government on appeal provides numerous rationales — many echoing those
articulated by Agent Conner throughout his testimony — for why retention of a forensic
mirror may be necessary during the pendency of an investigation, none of which
amounts to the argument that the mirror is simply “government[] property.”

16
revealed potential errors in AB’s tax returns that seemed to omit income reflected

in checks deposited into IPM’s account. Aware that Ganias had prepared these

tax returns and deposited the majority of these checks, Agent Hosney came to

suspect that Ganias was engaged in tax-related crimes. 14 She did not, however,

return to the restoration or otherwise open any of Ganias’s digital financial

documents or files associated with Taxes International. 15 Instead, Agent Hosney

subpoenaed Ganias’s bank records from 1999 to 2003 and accessed his income

14
The dissent suggests that “[w]hat began nearly thirteen years ago as an
investigation by the Army into two of Ganias’s business clients somehow evolved into an
unrelated investigation by the IRS into Ganias’s personal affairs, largely because” the
Government retained the mirrored copies of Ganias’s hard drives. Dissent at 40
(emphasis added). In fact, Agent Hosney’s affidavit in support of the 2006 warrant
explains that the Government suspected Ganias of underreporting his income because
of evidence that Ganias had assisted McCarthy in underreporting income from
McCarthy’s companies — evidence which led to an indictment of both McCarthy and
Ganias for conspiracy to commit tax fraud. Further, when Agent Hosney developed
this suspicion — which was hardly “unrelated” to the initial investigation — she did
not turn to the mirrors, but instead engaged in old-fashioned investigatory work,
“examin[ing Ganias’s tax returns] more closely to determine if his own income was
underreported.” J.A. 465, ¶ 18. She then reviewed deposits in his bank account, cross-
referenced bank records and tax returns, and finally presented this evidence in a proffer
session to Ganias — all without once looking at any non-responsive information on the
mirrors. Only after she had acquired independent probable cause — and only after
extensive evidence suggested Ganias may have committed a crime — did Agent
Hosney seek a second warrant to search the mirrors. It is, in short, no mystery how the
investigation of McCarthy, IPM, and AB came to include Ganias, and, further, an
inaccurate statement of the record to suggest that this “evolution” had anything to do
with the retention of the mirrors.
15
Agent Hosney explained in her testimony: “[W]e couldn’t look at that file
because it wasn’t — Steve Ganias and Taxes International were not listed on the original
Attachment B, items to be seized.” J.A. 348.

17
tax returns for the same period. On July 28, 2005, the IRS — believing Ganias to

be involved both personally and as an accomplice or co-conspirator in tax

evasion — officially expanded the investigation to include him.

On February 14, 2006, Ganias, accompanied by his lawyer, met in a proffer

session with Agent Hosney and others involved in the investigation. 16 That day

or shortly thereafter, Agent Hosney asked Ganias for consent to access his

personal QuickBooks files and those of his business, Taxes International — data

Agent Hosney knew to be present on the forensic mirrors but which she had not

accessed. When, by April 24, 2006 (two and a half months later), Ganias had

failed to respond (either by consenting, objecting, or filing a motion under

Federal Rule of Criminal Procedure 41(g) for return of seized property), Agent

Hosney sought a search warrant to search the mirrored drives again. 17 In her

search warrant affidavit, Agent Hosney pointed to bank records, income tax

forms, and additional evidence to demonstrate that she had probable cause to

16 According to Agent Hosney, in that proffer session Ganias claimed “that he
failed to record income from his own business [to his QuickBook files] as a result of a
computer flaw in the QuickBooks software . . . [but that,] . . . although he attempted to
duplicate the software error, he was unable to do so.” J.A. 467, ¶ 28. Agent Hosney
contacted Intuit, Inc., which released QuickBooks, to determine whether such an error
might have affected, generally, the pertinent version of the software, and was told that
the company was aware of no such “widespread malfunction.” J.A. 469, ¶ 35.
17
U.S. Magistrate Judge William I. Garfinkel, who had authorized the 2003
warrant, authorized this 2006 warrant as well. J.A. 430, 454.

18
believe that Ganias had violated 26 U.S.C. § 7201 (by committing tax evasion)

and § 7206(1) (by making false declarations). 18 She further noted that the items to

be searched were “mirror images of computers seized on November 19, 2003

from the offices of Taxes International,” J.A. 461, ¶ 7; that information material to

the initial investigation had been located on these mirrors and that, “[d]uring

th[at] investigation,” such information had been “analyzed in detail,” J.A. 464,

¶ 15; that Ganias was not, at the time of the initial seizure, under investigation,

J.A. 461, ¶ 3 (“On July 28, 2005, the Government’s investigation was expanded to

include an examination of whether Ganias, McCarthy’s accountant and former

IRS Revenue Agent, violated the federal tax laws.”); and thus that, though Agent

Hosney believed that the second mirrored drive, called TaxInt_2, was “the

primary computer for Taxes International,” J.A. 463, ¶ 13, she could not search

Ganias’s personal or business files as “[p]ursuant to the 2003 search warrant,

only files for [AB] and IPM could be viewed,” J.A. 464, ¶ 14. The magistrate

judge issued the warrant, Agent Hosney searched the referenced data, and

ultimately the Government indicted Ganias for tax evasion.

18
Ganias did not contest before the district court, and does not contest on appeal,
that this evidence — none of which was acquired through search of non-responsive
data on the mirrors — created sufficient probable cause for the 2006 warrant.

19
 B. Procedural History

In February 2010, Ganias moved to suppress the evidence Agent Hosney

acquired pursuant to the 2006 warrant. After a two-day hearing, the district

court denied the motion on April 14, 2010, and issued a written decision on June

24, 2011. In that decision, the district court found, inter alia, that the forensic

examination of the mirrored drives “was conducted within the limitations

imposed by the [2003] warrant” and that “[a] copy of the evidence was preserved

in the form in which it was taken.” Ganias, 2011 WL 2532396, at *8. Judge

Thompson observed that Ganias “never moved for destruction or return of the

data, which could have led to the seized pertinent data being preserved by other

means.” Id. The district court concluded that the Government’s retention of the

mirrored drives — and thus its subsequent search of those drives pursuant to a

warrant — did not violate the Fourth Amendment. Having found no Fourth

Amendment violation, the district court did not reach the question of good faith.

Id. at *9.

At trial, the Government introduced information in Ganias’s QuickBooks

files as evidence against him, in particular highlighting the fact that payments

made to him by clients such as IPM were characterized as “owner’s

20
contributions,” which prevented QuickBooks from recognizing them as income.19

On the basis of this and other evidence, the jury convicted Ganias of two counts

of tax evasion, and the district court sentenced him to two terms of 24 months’

incarceration, to be served concurrently.

Ganias appealed. On review of his conviction, a panel of this Court

concluded, unanimously, that the Government had violated the Fourth

Amendment; in a divided decision, the panel then ordered suppression of the

evidence obtained in executing the 2006 warrant and vacated the jury verdict.

We subsequently ordered this rehearing en banc in regards to, first, the existence

of a Fourth Amendment violation and, second, the appropriateness of

suppression. 20

19
Many of these entries existed only on the QuickBooks files that the Government
had accessed on the mirrors, as a result of Ganias’s amendments to the entries on his
hard drives days after the execution of the 2003 warrant. At trial, Ganias testified that
his characterization of the payments as “owner’s contributions” was simply a good faith
mistake, and not evidence of intent to commit tax evasion, a claim that the Government
labeled implausible in light of Ganias’s extensive experience as an IRS agent and
accountant.
20
Specifically, we asked the parties to brief the following two issues:

(1) Whether the Fourth Amendment was violated when, pursuant to a
warrant, the government seized and cloned three computer hard drives
containing both responsive and non-responsive files, retained the cloned
hard drives for some two-and-a-half years, and then searched the non-
responsive files pursuant to a subsequently issued warrant; and

21
 II

“On appeal from a district court’s ruling on a motion to suppress evidence,

‘we review legal conclusions de novo and findings of fact for clear error.’”

United States v. Bershchansky, 788 F.3d 102, 108 (2d Cir. 2015) (quoting United

States v. Freeman, 735 F.3d 92, 95 (2d Cir. 2013)). We may uphold the validity of a

judgment “on any ground that finds support in the record.” Headley v. Tilghman,

53 F.3d 472, 476 (2d Cir. 1995).

The district court concluded that the conduct of the agents in this case

comported fully with the Fourth Amendment, and thus did not reach the

question whether they also acted in good faith. Because we conclude that the

agents acted in good faith, we need not decide whether a Fourth Amendment

violation occurred. We thus affirm the district court on an alternate ground.

Nevertheless, though we offer no opinion on the existence of a Fourth

Amendment violation in this case, we make some observations bearing on the

reasonableness of the agents’ actions, both to illustrate the complexity of the

questions in this significant Fourth Amendment context and to highlight the

(2) Considering all relevant factors, whether the government agents in this
case acted reasonably and in good faith such that the files obtained from
the cloned hard drives should not be suppressed.

United States v. Ganias, 791 F.3d 290 (2d Cir. 2015) (mem.).
22
importance of careful consideration of the technological contours of digital

search and seizure for future cases.

“The touchstone of the Fourth Amendment is reasonableness . . . .” United

States v. Miller, 430 F.3d 93, 97 (2d Cir. 2005) (alteration omitted) (quoting United

States v. Knights, 534 U.S. 112, 118 (2001)). As relevant here, “searches pursuant

to a warrant will rarely require any deep inquiry into reasonableness.” United

States v. Leon, 468 U.S. 897, 922 (1984) (alteration omitted) (quoting Illinois v.

Gates, 462 U.S. 213, 267 (1983) (White, J., concurring in judgment)). Nevertheless,

both the scope of a seizure permitted by a warrant, 21 and the reasonableness of

21
Specifically, courts have long recognized that a prohibition on “general
warrants” — warrants completely lacking in particularity — was a central impetus for
the ratification of the Fourth Amendment. See, e.g., Riley v. California, 134 S. Ct. 2473,
2494 (2014) (noting, in the context of evaluating the reasonableness of a warrantless
search of a cell phone, that “[o]ur cases have recognized that the Fourth Amendment
was the founding generation’s response to the reviled ‘general warrants’ and ‘writs of
assistance’ of the colonial era, which allowed British officers to rummage through
homes in an unrestrained search for evidence of criminal activity” and that “opposition
to such searches was in fact one of the driving forces behind the Revolution itself”);
Marshall v. Barlow’s, Inc., 436 U.S. 307, 311 (1978) (noting, in the context of evaluating the
reasonableness of warrantless inspections of business premises, that “[t]he particular
offensiveness” of general warrants “was acutely felt by the merchants and businessmen
whose premises and products were inspected” under them); Stanford v. Texas, 379 U.S.
476, 486 (1965) (“[T]he Fourth . . . Amendment[] guarantee[s] . . . that no official . . . shall
ransack [a person’s] home and seize his books and papers under the unbridled
authority of a general warrant . . . .”); United States v. Galpin, 720 F.3d 436, 445 (2d Cir.
2013) (“The chief evil that prompted the framing and adoption of the Fourth
Amendment was the ‘indiscriminate searches and seizures’ conducted by the British
23
government conduct in executing a valid warrant, 22 can present Fourth

Amendment issues. Ganias thus argues that the Government violated the Fourth

Amendment in this case, notwithstanding the two warrants that issued, by

retaining complete forensic copies of his three hard drives during the pendency

of its investigation.

According to Ganias, when law enforcement officers execute a warrant for

a hard drive or forensic mirror that contains data that, as here, cannot feasibly be

‘under the authority of “general warrants.”’” (quoting Payton v. New York, 445 U.S. 573,
583 (1980))).
We agree with the dissent that “the precedents are absolutely clear that general
warrants are unconstitutional.” Dissent at 30. To the degree that the dissent would go
further, however, and find it “absolutely clear” to a reasonable government agent in
2005 that the retention of a lawfully acquired mirror during the pendency of an
investigation and the subsequent search of data on that mirror pursuant to a second
warrant would implicate the ban on general warrants, we respectfully disagree.

22
See, e.g., L.A. Cty. v. Rettele, 550 U.S. 609, 614-16 (2007) (applying the
reasonableness standard to evaluate whether police officers’ manner of executing a
valid warrant violated the Fourth Amendment); Wilson v. Layne, 526 U.S. 603, 611 (1999)
(“[T]he Fourth Amendment does require that police actions in execution of a warrant be
related to the objectives of the authorized intrusion . . . .”); Dalia v. United States, 441 U.S.
238, 258 (1979) (“[T]he manner in which a warrant is executed is subject to later judicial
review as to its reasonableness.”); Terebesi v. Torreso, 764 F.3d 217, 235 (2d Cir. 2014)
(“[T]he method used to execute a search warrant . . . [is] as a matter of clearly
established constitutional law, subject to Fourth Amendment protections . . . .”), cert.
denied sub nom. Torresso v. Terebesi, 135 S. Ct. 1842 (2015) (mem.); Lauro v. Charles, 219
F.3d 202, 209 (2d Cir. 2000) (“[T]he Fourth Amendment’s proscription of unreasonable
searches and seizures ‘not only . . . prevent[s] searches and seizures that would be
unreasonable if conducted at all, but also . . . ensure[s] reasonableness in the manner
and scope of searches and seizures that are carried out.’” (all but first alteration in
original) (quoting Ayeni v. Mottola, 35 F.3d 680, 684 (2d Cir. 1994))).

24
sorted into responsive and non-responsive categories on-site, “the Fourth

Amendment demands, at the very least, that the officers expeditiously complete

their off-site search and then promptly return (or destroy) files outside the

warrant’s scope.” 23 Appellant Br. at 18. Arguing that a culling process took

place here and that it had concluded by, at the latest, January 2005, Ganias faults

the Government for retaining the mirrored drives — including storing one

23
On appeal, Ganias does not question the scope or validity of the 2003 warrant.
The district court found that the 2003 warrant authorized the Government to mirror
Ganias’s hard drives for off-site review, Ganias, 2011 WL 2532396, at *10; that the
warrant, though authorizing such seizure, was sufficiently particularized and not a
“general warrant,” id.; that, absent mirroring for off-site review, on-site review would
have taken months, id. at *2; and that mirroring thus minimized any intrusion on
Ganias’s business, id. at *8; cf. Fed. R. Crim. P. 41(e)(2)(B) (which, as amended in 2009,
permits a warrant to “authorize the seizure of electronic storage media or the seizure or
copying of electronically stored information,” and notes that “[u]nless otherwise
specified, the warrant authorizes a later review of the media or information consistent
with the warrant”); Fed. R. Crim. P. 41(e)(2)(B) advisory committee’s note to 2009
amendments (explaining that, because “[c]omputers and other electronic storage media
commonly contain such large amounts of information that it is often impractical for law
enforcement to review all of the information during execution of the warrant at the
search location[, t]his rule acknowledges the need for a two-step process:  officers may
seize or copy the entire storage medium and review it later to determine what
electronically stored information falls within the scope of the warrant”). Ganias does
not contest these conclusions on appeal but contends, instead, that considerations
underlying the prohibition on general warrants may require that, if the government
lawfully mirrors an entire hard drive containing non-responsive as well as responsive
information for off-site review, it may not then retain the mirror throughout the
pendency of its investigation.

25
forensic copy in an evidence locker for safekeeping. 24 It was this retention, he

argues, that constituted the Fourth Amendment violation — a violation that, in

turn, made the 2006 search of the data itself unconstitutional as, but for this

retention, the search could never have occurred.

To support this argument, Ganias relies principally on United States v.

Tamura, 694 F.2d 591 (9th Cir. 1982), a Ninth Circuit case involving the search

and seizure of physical records. In Tamura (unlike the present case, in which a

warrant specifically authorized the agents to seize hard drives and to search

them off-site) officers armed only with a warrant authorizing them to seize

specific “records” instead seized numerous boxes of printouts, file drawers, and

cancelled checks for off-site search and sorting. Id. at 594-95. After the officers

had clearly sorted the responsive paper documents from the non-responsive

ones, they refused — despite request — to return the non-responsive paper files.

Id. at 596-97. The Ninth Circuit concluded that both the unauthorized seizure of

voluminous material not specified in the warrant and the retention of the seized

24
As already noted, the district court made no finding as to when or whether
forensic examination of the mirrors pursuant to the 2003 warrant was completed.

26
documents violated the Fourth Amendment. 25 Id. at 595, 597; see also Andresen v.

Maryland, 427 U.S. 463, 482 n.11 (1976) (“[W]e observe that to the extent [seized]

papers were not within the scope of the warrants or were otherwise improperly

seized, the State was correct in returning them voluntarily and the trial judge

was correct in suppressing others. . . . In searches for papers, it is certain that

some innocuous documents will be examined, at least cursorily, in order to

determine whether they are, in fact, among those papers authorized to be

seized. . . . [R]esponsible officials [conducting such searches], including judicial

officials, must take care to assure that they are conducted in a manner that

minimizes unwarranted intrusions upon privacy.”); cf. United States v. Matias, 836

F.2d 744, 747 (2d Cir. 1988) (“[W]hen items outside the scope of a valid warrant

are seized, the normal remedy is suppression and return of those items . . . .”).

Because we resolve this case on good faith grounds, we need not decide

the relevance, if any, of Tamura (or, more broadly, the validity of Ganias’s Fourth

Amendment claim). We note, however, that there are reasons to doubt whether

Tamura (to the extent we would indeed follow it) answers the questions before

us. First, on its facts, Tamura is distinguishable from this case, insofar as the

25
The Ninth Circuit declined to reverse the defendant’s conviction, as no
improperly seized document was admitted at trial, and as blanket suppression was not
warranted. See Tamura, 694 F.2d at 597.

27
officers there seized for off-site review records that the warrant did not authorize

them to seize, 26 and retained those records even after their return was requested.

Here, in contrast, the warrant authorized the seizure of the hard drives, not

merely particular records, and Ganias did not request return or destruction of the

mirrors (even after he was indisputably alerted to the Government’s continued

retention of them) by, for instance, filing a motion for such return pursuant to

Federal Rule of Criminal Procedure 41(g). Second, and more broadly, even if the

facts of Tamura were otherwise on point, Ganias’s invocation of Tamura’s

reasoning rests on an analogy between paper files intermingled in a file cabinet

and digital data on a hard drive. Though we do not take any position on the

ultimate disposition of the constitutional questions herein, we nevertheless pause

to address the appropriateness of this analogy, which is often invoked (including

by the dissent) and bears examination.

The central premise of Ganias’s reliance on Tamura is that the search of a

digital storage medium is analogous to the search of a file cabinet. The analogy

has some force, particularly as seen from the perspective of the affected

26
The fact that the officers in Tamura lacked a warrant for the initial seizure was
not incidental to the decision: the Tamura court explicitly found that it was the lack of a
warrant that made the initial seizure — even if otherwise understandable in light of the
voluminous material to be reviewed — a violation of the Fourth Amendment. See 694
F.2d at 596.

28
computer user. Computer users — or at least, average users (in contrast to, say,

digital forensics experts) — typically experience computers as filing cabinets, as

that is precisely how user interfaces are designed to be perceived by such users. 27

Given that the file cabinet analogy (at least largely) thus captures an average

person’s subjective experience with a computer interface, the analogy may shed

light on a user’s subjective expectations of privacy regarding data maintained on

a digital storage device. Because we experience digital files as discrete items, and

because we navigate through a computer as through a virtual storage space, we

may expect the law similarly to treat data on a storage device as comprised of

distinct, severable files, even if, in fact, “[s]torage media do not naturally divide

into parts.” Josh Goldfoot, The Physical Computer and the Fourth Amendment, 16

Berkeley J. Crim. L. 112, 131 (2011). In this case, for example, a person in

27
See Daniel B. Garrie & Francis M. Allegra, Fed. Judicial Ctr., Understanding
Software, the Internet, Mobile Computing, and the Cloud: A Guide for Judges 8-14 (2015)
(contrasting “operating systems . . . [which] hide the hardware resources behind
abstractions to provide an environment that is more user-friendly,” id. at 13, with
machine language, assembly language, high-level languages, data structures, and
algorithms); Josh Goldfoot, The Physical Computer and the Fourth Amendment, 16 Berkeley
J. Crim. L. 112, 117 (2011) (contrasting two perspectives on digital storage media — the
“internal perspective,” or how “the user experiences [such media,] as parcels of
information, grouped into files, or even into smaller units such as spreadsheet rows”
and the “external perspective,” or how the actual computer functions, in which “files
are not . . . ‘things’ at all,” but “groupings of data . . . inseparably tied to the storage
medium,” created by the computer by manipulating “chunks of physical matter [such
as regions on a hard drive] whose state is altered to record information”).
29
Ganias’s situation could well understand the “files” on his hard drives

containing information relating to IPM and AB as separate from the “files”

containing his personal financial information and that of other clients. Indeed,

the very fact that the Government sought additional search authorization via the

2006 warrant when it established probable cause to search Ganias’s personal files

indicates that the Government too understood — and credited — this distinction.

That said, though it may have some relevance to our inquiry, the file

cabinet analogy is only that — an analogy, and an imperfect one. Cf. James

Boyle, The Public Domain 107 (2008) (“Analogies are only bad when they ignore

the key difference between the two things being analyzed.”). Though to a user a

hard drive may seem like a file cabinet, a digital forensics expert reasonably

perceives the hard drive simply as a coherent physical storage medium for

digital data — data that is interspersed throughout the medium, which itself must

be maintained and accessed with care, lest this data be altered or destroyed. 28 See

28
See Eoghan Casey, Digital Evidence and Computer Crime 472, 474-96 (3d ed. 2011)
(highlighting the fact that forensic examination of storage media can create tiny
alterations, which necessitates care on the part of examiners in acquiring, searching, and
preserving that data); id. at 477-78 (describing the importance of protecting digital
storage media from “dirt, fluids, humidity, impact, excessive heat and cold, strong
magnetic fields, and static electricity”); Michael W. Graves, Digital Archaeology: The Art
and Science of Digital Forensics 95 (2014) (“Computer data is extremely volatile and easily
deleted, and can be destroyed, either intentionally or accidentally, with a few mouse
30
Goldfoot, supra, at 114 (arguing digital storage media are physical objects like

“drugs, blood, or clothing”); Wayne Jekot, Computer Forensics, Search Strategies,

and the Particularity Requirement, 7 U. Pitt. J. Tech. L. & Pol’y, art. 5, at 1, 30 (2007)

(“[A] computer does not simply hold data, it is composed of data.”). Even the

most conventional “files” — word documents and spreadsheets such as those the

Government searched in this case — are not maintained, like files in a file

cabinet, in discrete physical locations separate and distinct from other files. They

are in fact “fragmented” on a storage device, potentially across physical

locations. Jekot, supra, at 13. “Because of the manner in which data is written to

the hard drive, rarely will one file be stored intact in one place on a hard drive,”

id.; so-called “files” are stored in multiple locations and in multiple forms, see

clicks.”); Bill Nelson et al., Guide to Computer Forensics and Investigations 160 (5th ed.
2015) (emphasizing the importance of “maintain[ing] the integrity of digital evidence in
the lab” by creating a read-only copy prior to analysis); Jonathan L. Moore, Time for an
Upgrade: Amending the Federal Rules of Evidence to Address the Challenges of Electronically
Stored Information in Civil Litigation, 50 Jurimetrics J. 147, 153 (2010) (“[All electronically
stored information is] prone to manipulation[;] . . . [such] alteration can occur
intentionally or inadvertently.”); Int’l Org. for Standardization & Int’l Electrotechnical
Comm’n, Guidelines for Identification, Collection, Acquisition, and Preservation of Digital
Evidence 17 (2012) [hereinafter ISO/IEC, Guidelines] (emphasizing the importance of
careful storage and transport techniques and noting that “[s]poliation can result from
magnetic degradation, electrical degradation, heat, high or low humidity exposure, as
well as shock and vibration”).

31
Goldfoot, supra, at 127-28. 29 And as a corollary to this fragmentation, the

computer stores unseen information about any given “file” — not only metadata

about when the file was created or who created it, see Michael W. Graves, Digital

Archaeology: The Art and Science of Digital Forensics 94-95 (2014), but also prior

versions or edits that may still exist “in the document or associated temporary

files on [the] disk” — further interspersing the data corresponding to that “file”

across the physical storage medium, Eoghan Casey, Digital Evidence and Computer

Crime 507 (3d ed. 2011).

”Files,” in short, are not as discrete as they may appear to a user. Their

interspersion throughout a digital storage medium, moreover, may affect the

degree to which it is feasible, in a case involving search pursuant to a warrant, to

fully extract and segregate responsive data from non-responsive data. To be

clear, we do not suggest that it is impossible to do so in any particular or in every

case; we emphasize only that in assessing the reasonableness, for Fourth

Amendment purposes, of the search and seizure of digital evidence, we must be

29 See Goldfoot, supra (“Storage media do not naturally divide into parts,” id. at
131; “it is difficult to agree . . . on where the subcontainers begin and end,” id. at 113.);
Orin S. Kerr, Searches and Seizures in a Digital World, 119 Harv. L. Rev. 531, 557 (2005)
(“[V]irtual files are not robust concepts. Files are contingent creations assembled by
operating systems and software.”); see also Orin S. Kerr, Executing Warrants for Digital
Evidence: The Case for Use Restrictions on Nonresponsive Data, 48 Tex. Tech L. Rev. 1, 32
(2015) (“What does it mean to ‘delete’ data?”).

32
attuned to the technological features unique to digital media as a whole and to

those relevant in a particular case — features that simply do not exist in the

context of paper files.

These features include an additional complication affecting the validity of

the file cabinet analogy: namely, that a good deal of the information that a

forensic examiner may seek on a digital storage device (again, because it is a

coherent and complex forensic object and not a file cabinet) does not even

remotely fit into the typical user’s conception of a “file.” See Daniel B. Garrie &

Francis M. Allegra, Fed. Judicial Ctr., Understanding Software, the Internet, Mobile

Computing, and the Cloud: A Guide for Judges 39 (2015) (“Forensic software gives a

forensic examiner access to electronically stored information (ESI) that is

otherwise unavailable to a typical computer user.”). Forensic investigators may,

inter alia, search for and discover evidence that a file was deleted as well as

evidence sufficient to reconstruct a deleted file — evidence that can exist in so-

called “unallocated” space on a hard drive. See Casey, supra, at 496; Orin S. Kerr,

Searches and Seizures in a Digital World, 119 Harv. L. Rev. 531, 542, 545 (2005); Fed.

Judicial Ctr., supra, at 40 (“A host of information can lie in the interstices between

the allocated spaces.”). They may seek responsive metadata about a user’s

33
activities, or the manner in which information has been stored, to show such

things as knowledge or intent, or to create timelines as to when information was

created or accessed. 30 Forensic examiners will sometimes seek evidence on a

storage medium that something did not happen: “If a defendant claims he is

innocent because a computer virus committed the crime, the absence of a virus

on his hard drive is ‘dog that did not bark’ negative evidence that disproves his

story. . . . To prove something is not on a hard drive, it is necessary to look at

every place on the drive where it might be found and confirm it is not there.” 31

Goldfoot, supra, at 141; see also United States v. O'Keefe, 461 F.3d 1338, 1341 (11th

Cir. 2006) (“[The government’s expert] testified that the two viruses he found on

[the defendant’s] computer were not capable of ‘downloading and uploading

child pornography and sending out advertisements.’”). 32

30
See Fharmacy Records v. Nassar, 379 F. App’x 522, 525 (6th Cir. 2010) (describing
testimony of a digital forensics expert in a copyright case that the number and physical
location of a file on an Apple Macintosh — which saves files sequentially on its storage
medium — demonstrated that the file had been back-dated).
31
Indeed, in this very case, as already noted, see supra note 16, Ganias at one
point claimed that a “software error” or “computer flaw” prevented him from
recording certain income in his QuickBooks files. J.A. 467, ¶ 28. Data confirming the
existence, or non-existence, of an error affecting the particular installation of a program
on a given digital storage device could be, in a hypothetical case, relevant to the probity
of information otherwise located thereupon.
32
We note that some of these inferences may be limited to — or at least of more
relevance to — traditional magnetic disk drives, which have long been the primary
34
 Finally, because of the complexity of the data thereon and the manner in

which it is stored, the nature of digital storage presents potential challenges to

parties seeking to preserve digital evidence, authenticate it at trial, and establish

its integrity for a fact-finder — challenges that materially differ from those in the

paper file context. First, the extraction of specific data files to some other

digital storage technology. “Generally when data is deleted from a [traditional hard
disk drive], the data is retained until new data is written onto the same location. If no
new data is written over the deleted data, then the forensic investigator can recover the
deleted data, albeit in fragments.” Alastair Nisbet et al., A Forensic Analysis and
Comparison of Solid State Drive Data Retention with TRIM Enabled File Systems,
Proceedings of the 11th Australian Digital Forensics Conference 103 (2013). In contrast,
the technology used in solid state drives “requires a cell to be completely erased or
zeroed-out before a further write can be committed,” id. at 104, and in part because such
erasure can be time consuming, solid state drives incorporate protocols which “zero-
delete data locations . . . as a matter of course,” thereby “reduc[ing] the data that can be
retrieved from the drive by [a] forensic investigator,” id. at 103. See also Graeme B. Bell
& Richard Boddington, Solid State Drives: The Beginning of the End for Current Practice in
Digital Forensic Recovery?, 5 J. Digital Forensics, Sec. & L., no. 3, 2010, at 1, 12 (stating
that, in connection with such storage devices, “evidence indicating ‘no data’ does not
authoritatively prove that data did not exist at the time of capture”). That is not to say
that studies indicate that deleted information is never recoverable from any model of
solid state drive. See, e.g., Christopher King & Timothy Vidas, Empirical Analysis of Solid
State Disk Data Retention When Used with Contemporary Operating Systems, 8 Digital
Investigation 111, 113 (2011) (citing a study suggesting that data deleted from a
particular solid state drive was recoverable in certain contexts); Gabriele Bonetti et al., A
Comprehensive Black-Box Methodology for Testing the Forensic Characteristics of Solid-State
Drives, Proceedings of the 29th Annual Computer Security Applications Conference 277
(2013) (observing that, though several tested solid state drives contained no recoverable
deleted data, one model contained “high[ly] recoverab[le]” quantities of such data).
The point is simply that there may be material differences among different varieties of
storage media that, in turn, make certain factors cited herein more or less relevant to a
given inquiry.

35
medium can alter, omit, or even destroy portions of the information contained in

the original storage medium. Preservation of the original medium or a complete

mirror may therefore be necessary in order to safeguard the integrity of evidence

that has been lawfully obtained or to authenticate it at trial. Graves, supra, at 95-

96 (“[The investigator] must be able to prove that the information presented

came from where he or she claims and was not altered in any way during

examination, and that there was no opportunity for it to have been replaced or

altered in the interim.”); see also Casey, supra, at 480 (“Even after copying data

from a computer or piece of storage media, digital investigators generally retain

the original evidential item in a secure location for future reference.”). 33 The

preservation of data, moreover, is not simply a concern for law enforcement.

33
We do not suggest that authentication of evidence from computerized records
is impossible absent retention of an entire hard drive or mirror. Authentication is
governed by Federal Rule of Evidence 901, which requires only that “the proponent
must produce evidence sufficient to support a finding that the item is what the
proponent claims it is.” Fed. R. Evid. 901(a). As we have stated, “[t]his requirement is
satisfied ‘if sufficient proof has been introduced so that a reasonable juror could find in
favor of authenticity or identification.’” United States v. Pluta, 176 F.3d 43, 49 (2d Cir.
1999) (citation omitted) (quoting United States v. Ruggiero, 928 F.2d 1289, 1303 (2d Cir.
1991)). “[T]he burden of authentication does not require the proponent of the evidence
to rule out all possibilities inconsistent with authenticity, or to prove beyond any doubt
that the evidence is what it purports to be. Rather, the standard for authentication, and
hence for admissibility, is one of reasonable likelihood.” Id. (alteration omitted)
(quoting United States. v. Holmquist, 36 F.3d 154, 168 (1st Cir. 1994)). The weight of
digital evidence admitted at trial, however, may be undermined by challenges to its
integrity — challenges which proper preservation might have otherwise avoided.

36
Retention of the original storage medium or its mirror may also be necessary to

afford criminal defendants access to that medium or its forensic copy so that,

relying on forensic experts of their own, they may challenge the authenticity or

reliability of evidence allegedly retrieved. See, e.g., United States v. Kimoto, 588

F.3d 464, 480 (7th Cir. 2009) (quoting the defendant’s motion as stating: “Upon

beginning their work, [digital analysis experts] advised [the defendant’s]

Counsel that the discovery provided to the defense did not appear to be a

complete forensic copy, and that such was necessary to verify the data as

accurate and unaltered.”). 34 Defendants may also require access to a forensic

copy to conduct an independent analysis of precisely what the government’s

forensic expert did — potentially altering evidence in a manner material to the

case — or to locate exculpatory evidence that the government missed. 35

34
Where, as in this case, a mirror containing responsive data has been lawfully
seized from a third-party custodian, this concern cannot be avoided simply by
returning the original medium to the party from whom it was seized. A third-party
custodian may need to utilize a hard drive in ways that will alter the data, and will
likely have no incentive to retain a mirrored copy of drives as they once existed but that
are of no further use to the custodian.
35
See Kimoto, 588 F.3d at 480-81 (“[The defendant] argued that the failure to
provide him with a complete forensic copy of all digital files impaired his ability to
prepare a defense. . . . [The defendant] submitted that he should not be punished
‘because the Government failed to properly preserve or maintain a digital forensic copy
of the data.’”); Casey, supra, at 510-11 (discussing a case study in which, due to forensic
investigators’ own mistakes, discovery of digital evidence confirming a murder
37
 Notwithstanding any other distinctions between this case and Tamura,

then, the Government plausibly argues that, because digital storage media

constitute coherent forensic objects with contours more complex than — and

materially distinct from — file cabinets containing interspersed paper

documents, a digital storage medium or its forensic copy may need to be

retained, during the course of an investigation and prosecution, to permit the

accurate extraction of the primary evidentiary material sought pursuant to the

warrant; to secure metadata and other probative evidence stored in the

interstices of the storage medium; and to preserve, authenticate, and effectively

present at trial the evidence thus lawfully obtained. To be clear, we do not

decide the ultimate merit of this argument as applied to the circumstances of this

case. 36 Nor do we gainsay the privacy concerns implicated when the

suspect’s alibi was greatly delayed); see also id. at 508-510 (detailing the importance of
experts reporting their processes); Fed. Judicial Ctr., supra, at 41 (“The forensic
examiner . . . generate[s] reports, detailing the protocols and processes that he or she
followed . . . . The forensic reports must provide enough data to allow an independent
third-party examiner to recreate the exact environment that yielded the report’s
findings and observations.”); Darren R. Hayes, A Practical Guide to Computer Forensics
Investigations 116 (2015) (“[B]ecause forensics is a science, the process by which the
evidence was acquired must be repeatable, with the same results.”); ISO/IEC, Guidelines,
supra, at 7 (emphasizing the importance of repeatability and reproducibility).
That said, it is important to correct a misunderstanding in the dissent’s
36

analysis, as it pertains to these factors and their application here. The dissent suggests
that the Government can have had no interest in retention, as “[t]he agents could not
38
government retains a hard drive or forensic mirror containing personal

information irrelevant to the ongoing investigation, even if such information is

never viewed. We discuss the aptness and limitations of Ganias’s analogy and

have been keeping non-responsive files [in order to authenticate and defend the probity
of responsive files] for the purpose of proceeding against Ganias, as [in December 2004]
they did not yet suspect [him] of criminal wrongdoing.” Dissent at 22. This argument
misunderstands the Government’s position: the Government was not retaining the
mirrors in late 2004 and 2005 in the hopes of proceeding against Ganias; it was retaining
the mirrors as part of its ongoing investigation of James McCarthy and his two
companies, AB and IPM — an investigation that would culminate in an indictment of
McCarthy in 2008 secured through extensive reliance on responsive data recovered
from the mirrored copies of Ganias’s hard drives. The dissent’s focus on Ganias, the
owner of the hard drives the Government mirrored, and not McCarthy, a third-party
defendant, thus permits the dissent to dismiss out-of-hand Government interests that,
properly viewed, are significant — whether or not ultimately dispositive. See Dissent at
24 (“As a practical matter, a claim of data tampering would easily fall flat where, as
here, the owner kept his original computer and the Government gave him a copy of the
mirror image.”); id. at 25-26 (dismissing the Government’s Brady concern by noting that
“[t]he Government is essentially arguing that it must hold on to the materials so that it
can give them back to the defendant,” a concern that the dissent argues “can be
obviated simply by returning the non-responsive files to the defendant in the first
place”). Perhaps in some situations, in which the owner of computerized data seized
pursuant to a search warrant is the expected defendant in a criminal proceeding,
problems of authentication or probity could be handled by stipulations, and Brady
issues might be mooted by the return of the data to the defendant — though we express
no view on those questions. As this case illustrates, however, when the owner of hard
drives mirrored by the government is a third party who is not the expected target of the
investigation, the government’s interests in retention take on an additional layer of
complexity. A stipulation with Ganias about the authenticity or probity of data
extracted from his computers would not have affected the ability of the original targets
of the investigation to raise challenges to authenticity or probity. Nor would returning
the mirrors to Ganias — who at that point, absent a stipulation to the contrary, could
presumably have destroyed or altered them, intentionally or accidentally — have
protected the interests of those anticipated defendants in conducting their own forensic
examination of the data in search of exculpatory evidence or to replicate and criticize
the Government’s inspection procedures.

39
the Government’s response simply to highlight the complexity of the relevant

questions for future cases and to underscore the importance, in answering such

questions, of engaging with the technological specifics. 37

37
Of course, engaging with the specifics requires acknowledging and
emphasizing that technologies rapidly evolve, and that the specifics change. See John
Sammons, The Basics of Digital Forensics 170 (2012) (commenting that digital forensics
faces the “blinding speed of technology [and] new game-changing technologies such as
cloud computing and solid state hard drives . . . just to name a few”). In discussing the
technological specifics of computer hard drives, we have primarily addressed a
particular form of electronic storage that has become conventional. See supra note 32.
Newer forms of emerging storage technology, or future developments, may work
differently and thus present different challenges. See, e.g., Bell & Boddington, supra, at
3, 6, 14 (observing that “the peculiarity of ‘deleted, but not forgotten’ data which so
often comes back to haunt defendants in court is in many ways a bizarre artefact of hard
drive technology” and that increasingly popular solid state drives can “modify
themselves very substantially without receiving instructions to do so from a computer,”
and thus predicting that “recovery of deleted files and old metadata will become
extremely difficult, if not impossible” as solid state storage devices utilizing a particular
deletion protocol called “TRIM” become more prevalent); King & Vidas, supra, at 111
(“We show that on a TRIM-enabled [solid state drive], using an Operating System (OS)
that supports TRIM, . . . in most cases no data can be recovered.”); id. at 113 (“[M]ost
[solid state drive] manufacturers have a TRIM-enabled drive model currently on the
market.”). But see Bonetti et al., supra, at 270-71, 278 (making clear that solid state
drives, which differ considerably among models and vendors, may yield differing
levels of deleted-file recoverability, depending upon their utilization of TRIM and other
deletion protocols, erasing patterns, compression, and wear leveling protocols). Solid
state drives, of course, are just one example. Cf. Bell & Boddington, supra, at 3 (“It is . . .
in the nature of computing that we perceive regular paradigm shifts in the ways that we
store and process information.”). The important point is that considerations discussed
in this opinion may well become obsolete at some future point, the challenges facing
forensic examiners and affected parties may change, and courts dealing with these
problems will need to become conversant with the particular forms of technology
involved in a given case and the evidentiary challenges presented by those forms.

40
 In emphasizing such specifics, we reiterate that we do not mean to thereby

minimize or ignore the privacy concerns implicated when a hard drive or

forensic mirror is retained, even pursuant to a warrant. The seizure of a

computer hard drive, and its subsequent retention by the government, can give

the government possession of a vast trove of personal information about the

person to whom the drive belongs, much of which may be entirely irrelevant to

the criminal investigation that led to the seizure. Indeed, another weakness of

the file cabinet analogy is that no file cabinet has the capacity to contain as much

information as the typical computer hard drive. In 2005, Professor Orin Kerr

noted that the typical personal computer hard drive had a storage capacity of

about eighty gigabytes, which he estimated could hold text files equivalent to the

“information contained in the books on one floor of a typical academic library.”

Kerr, Searches and Seizures in a Digital World, supra, at 542. By 2011, computers

were being sold with one terabyte of capacity — about twelve times the size of

Professor Kerr’s library floor. Paul Ohm, Response, Massive Hard Drives, General

Warrants, and the Power of Magistrate Judges, 97 Va. L. Rev. In Brief 1, 6 (2011). The

New York Times recently reported that commercially available storage devices can

hold “16 petabytes of data, roughly equal to 16 billion thick books.” Quentin

41
Hardy, As a Data Deluge Grows, Companies Rethink Storage, N.Y. Times, Mar. 15,

2016, at B3.

Moreover, quantitative measures fail to capture the significance of the data

kept by many individuals on their computers. Tax records, diaries, personal

photographs, electronic books, electronic media, medical data, records of internet

searches, banking and shopping information — all may be kept in the same

device, interspersed among the evidentiary material that justifies the seizure or

search. Cf. Riley v. California, 134 S. Ct. 2473, 2489-90 (2014) (explaining that even

microcomputers, such as cellphones, have “immense storage capacity” that may

contain “every piece of mail [people] have received for the past several months,

every picture they have taken, or every book or article they have read,” which

can allow the “sum of an individual’s private life [to] be reconstructed”); United

States v. Galpin, 720 F.3d 436, 446 (2d Cir. 2013) (“[A]dvances in technology and

the centrality of computers in the lives of average people have rendered the

computer hard drive akin to a residence in terms of the scope and quantity of

private information it may contain.”). While physical searches for paper records

or other evidence may require agents to rummage at least cursorily through

much private material, the reasonableness of seizure and subsequent retention

42
by the government of such vast quantities of irrelevant private material was

rarely if ever presented in cases prior to the age of digital storage, and has never

before been considered justified, or even practicable, in such cases. Even as we

recognize that search and seizure of digital media is, in some ways, distinct from

what has come before, we must remain mindful of the privacy interests that

necessarily inform our analysis. 38

We note, however, that parties with an interest in retained storage media

are not without recourse. As noted above, Ganias never sought the return of any

seized material, either by negotiating with the Government or by motion to the

court. Though negotiated stipulations regarding the admissibility or integrity of

evidence may not always suffice to satisfy reasonable interests of the government

38 The dissent extensively addresses these privacy interests. As this opinion
makes clear, we do not disagree with the proposition that the seizure and retention of
computer hard drives or mirrored copies of those drives implicate such concerns and
raise significant Fourth Amendment questions. We do not agree, however, for reasons
we have also discussed at length, with the dissent’s dismissal of the countervailing
government concerns. However these issues are ultimately resolved, we believe that
the Government’s arguments are, at a minimum, sufficiently forceful that it is unwise to
try to reach definitive conclusions about the constitutional issues in a case that can be
decided on other grounds.

43
in retention during the pendency of an investigation, 39 such stipulations may

make return feasible in a proper case, and can be explored.

A person from whom property is seized by law enforcement may move for

its return under Federal Rule of Criminal Procedure 41(g). 40 Rule 41(g) permits a

defendant or any “person aggrieved” by either an unlawful or lawful deprivation

of property, see United States v. Comprehensive Drug Testing, Inc., 621 F.3d 1162,

1173 (9th Cir. 2010) (en banc) (per curiam), to move for its return, Fed. R. Crim. P.

41(g). Evaluating such a motion, a district court “must receive evidence on any

factual issue necessary to decide the motion,” and, in the event that the motion is

granted, may “impose reasonable conditions to protect access to the property

and its use in later proceedings.” Id. Since we resolve this case on other

39
For instance, as we have previously noted, where, as here, the owner of the
records is not (at least at the time of the seizure) the target of the investigation, a
stipulation from that party may not serve the government’s need to establish the
authenticity or integrity of evidence it may seek to use, and access to the records by that
party will not necessarily satisfy the need of potential future defendants to test the
processes used by the government to extract or accurately characterize data culled from
a hard drive. In some cases, however, negotiated solutions may be practicable.
40
Rule 41(g) provides as follows:
Motion to Return Property. A person aggrieved by an unlawful search
and seizure of property or by the deprivation of property may move for
the property's return. The motion must be filed in the district where the
property was seized. The court must receive evidence on any factual issue
necessary to decide the motion. If it grants the motion, the court must
return the property to the movant, but may impose reasonable conditions
to protect access to the property and its use in later proceedings.

44
grounds, we need not address whether Ganias’s failure to make such a motion

forfeited any Fourth Amendment objection he might otherwise have had to the

Government’s retention of the mirrors. But we agree with the district court that,

as a pragmatic matter, such a motion “would have given a court the opportunity

to consider ‘whether the government’s interest could be served by an alternative

to retaining the property,’ and perhaps to order the [mirrors] returned to Ganias,

all while enabling the court to ‘impose reasonable conditions to protect access to

the property and its use in later proceedings.’” Ganias, 2011 WL 2532396, at *8

(citation omitted) (first quoting In re Smith, 888 F.2d 167, 168 (D.C. Cir. 1989) (per

curiam); then quoting Fed. R. Crim. P. 41(g)).

Rule 41(g) thus provides a potential mechanism, in at least some contexts,

for dealing with the question of retention at a time when the government may be

expected to have greater information about the data it seeks and the best process

through which to search and present that data in court. It is worth observing,

then, that Rule 41(g) constitutes a statutory solution (as opposed to a purely

judicially constructed one) to at least one facet of the retention problem. 41

41
The advisory committee notes to the 2009 amendments to Federal Rule of
Criminal Procedure 41(e)(2)(B) contemplate that Rule 41(g) may indeed constitute such
a solution. Regarding specifically the seizure of electronic storage media or the search
45
Statutory approaches, of course, do not relieve courts from their obligation to

interpret the Constitution; nevertheless, such approaches have, historically,

provided one mechanism for safeguarding privacy interests while, at the same

time, addressing the needs of law enforcement in the face of technological

change. Indeed, when Congress addressed wiretapping in the Omnibus Crime

Control and Safe Streets Act of 1968, the Senate Judiciary Committee issued a

report reflecting precisely this ambition — to provide a framework through

which law enforcement might comport with the demands of the Constitution

and meet important law enforcement interests. See S. Rep. No. 90-1097, at 66-76

(1968) (describing the construction of the then-Omnibus Crime Control and Safe

Streets of Act of 1967, which laid out comprehensive rules for when and how law

enforcement could intercept wire and oral communications through electronic

surveillance, as a Congressional attempt to respond to and synthesize, first,

technological change, id. at 67, second, ineffective or unclear state statutory

of electronically stored information, the advisory committee notes observe that though
the rule does not create
a presumptive national or uniform time period within which . . . off-site
copying or review of . . . electronically stored information would take
place, . . . [i]t was not the intent of the amendment to leave the property
owner without . . . a remedy[:] . . . Rule 41(g) . . . provides a process for the
“person aggrieved” to seek an order from the court for a return of the
property, including storage media or electronically stored information,
under reasonable circumstances.

46
regimes, id. at 69, third, evolving Supreme Court precedent, id. at 74-75, and

fourth, law enforcement concerns, id. at 70); see also id. at 66 (“Title III has as its

dual purpose (1) protecting the privacy of wire and oral communications, and

(2) delineating on a uniform basis the circumstances and conditions under which

the interception of wire and oral communications may be authorized.”). The Act

did not seek to supplant the role of the courts, nor could it have done so, but it

did demonstrate the intuitive proposition that Congress can and should be a

partner in the process of fleshing out the contours of law-enforcement policy in a

shifting technological landscape. In acknowledging the role of Rule 41(g), then,

we seek also to suggest that search and seizure of electronic media may, no less

than wiretapping, merit not only judicial review but also legislative analysis;

courts need not act alone.

As we have said, we need not resolve the ultimate question whether the

Government’s retention of forensic copies of Ganias’s hard drives during the

pendency of its investigation violated the Fourth Amendment. We conclude,

moreover, that we should not decide this question on the present record, which

does not permit a full assessment of the complex and rapidly evolving

technological issues, and the significant privacy concerns, relevant to its

47
consideration. 42 Having noted Ganias’s argument, we do not decide its merits.

We instead turn to the question of good faith.

42
The dissent faults us for our caution in this regard, suggesting that “the
prevailing scholarly consensus has been that the [original Ganias] panel largely got it
right.” Dissent at 5 n.5. With respect, the dissent mischaracterizes the scholarly
response. As an initial matter, the dissent cites Professor Kerr as having concluded that
the panel “largely got it right.” Id. In fact, Kerr’s analysis of the original panel opinion
is generally critical, not complimentary. See Kerr, Executing Warrants for Digital
Evidence, supra, at 32 (critiquing the panel for going too far and thus offering a
“particularly strong version” of Kerr’s approach). Assessing the original panel’s
analysis, Kerr first concludes that, given the technological contours of electronic media,
an affirmative obligation to delete could be “difficult to implement,” just as it could be
difficult to ascertain at what point in the process such a “duty [would be] triggered.” Id.
Second, Kerr concludes that — to the degree that restrictions should be placed upon
what the government may do with non-responsive data that must, for pragmatic
reasons, be retained — a restriction preventing the government from viewing data
pursuant to a search warrant acquired with independent probable cause is unnecessary
“to restore the basic limits of search warrants in a world of digital evidence.” Id. at 33.
Apart from this citation to Kerr and to two student notes (which reach differing
conclusions about the merits of the panel opinion), the articles the dissent cites (as is
evident from the carefully worded parentheticals the dissent itself provides) are not
evaluations of the original panel opinion, but instead provide largely descriptive
accounts of the opinion and its relation to other case law in the context of making other
points. The signed article that comes the closest to providing a normative critique of the
panel’s opinion concludes that “perhaps the panel’s answer is broadly the right answer,”
but rejects the panel’s — and the dissent’s — reasoning. Stephen E. Henderson, Fourth
Amendment Time Machines (and What They Might Say About Police Body Cameras), 18 U.
Pa. J. Const. L. 933, 948 (2016) (emphasis added); see id. at 947 (concluding that, because
“in 2003 and in 2006 the government obtained a warrant demonstrating particularized
suspicion towards Ganias’s data, and in each instance agents thereafter only looked for
the responsive data,” it was inapt for the original panel to conclude that the
Government’s position would transform a warrant for electronic data into a “general
warrant”). We do not opine on these issues here, but we see no scholarly consensus on
the complicated questions implicated in this case that would suggest caution is ill-
advised in a matter where these questions need not be answered to reach a resolution.
Caution, although not always satisfying, is sometimes the most appropriate approach.
48
 III

The Government argues that, because it acted in good faith throughout the

pendency of this case, any potential violation of the Fourth Amendment does not

justify the extraordinary remedy of suppression. See Davis v. United States, 564

U.S. 229, 237 (2011) (noting the “heavy toll” exacted by suppression, which

“requires courts to ignore reliable, trustworthy evidence,” and characterizing

suppression as a “bitter pill,” to be taken “only as a ‘last resort’” (quoting Hudson

v. Michigan, 547 U.S. 586, 591 (2006))); accord United States v. Clark, 638 F.3d 89, 99

(2d Cir. 2011). In particular, the Government urges that its “reliance on the 2006

warrant,” which it obtained after disclosing to the magistrate judge all relevant

facts regarding its retention of the mirrored files, “fits squarely within the

traditional Leon exception for conduct taken in reliance on a search warrant

issued by a neutral and detached magistrate judge.” 43 Government Br. at 59; see

Leon, 468 U.S. at 922. For the following reasons, we agree.

43
The Government also contends: (1) that it relied in good faith on the 2003
warrant in retaining the mirrors; and (2) that its behavior was in no way culpable,
rendering exclusion inappropriate, see Government Br. at 51; see also Herring v. United
States, 555 U.S. 135, 144 (2009) (“[T]he exclusionary rule serves to deter deliberate,
reckless, or grossly negligent conduct, or in some circumstances recurring or systemic
negligence.”); accord Davis, 546 U.S. at 237. Given our conclusion that the Government
relied in good faith on the 2006 warrant, we need not address these additional
arguments.

49
 In Leon, the Supreme Court determined that the exclusion of evidence is

inappropriate when the government acts “in objectively reasonable reliance” on

a search warrant, even when the warrant is subsequently invalidated. 468 U.S. at

922; see also Clark, 638 F.3d at 100 (“[I]n Leon, the Supreme Court strongly

signaled that most searches conducted pursuant to a warrant would likely fall

within its protection.”). Such reliance, however, must be objectively reasonable.

See Leon, 468 U.S. at 922-23 (“[I]t is clear that in some circumstances the officer

will have no reasonable grounds for believing that the warrant was properly

issued.” (footnote omitted)). Thus, to assert good faith reliance successfully,

officers must, inter alia, disclose all potentially adverse information to the issuing

judge. See United States v. Reilly, 76 F.3d 1271, 1280 (2d Cir.) (“The good faith

exception to the exclusionary rule does not protect searches by officers who fail

to provide all potentially adverse information to the issuing judge . . . .”), aff’d and

amended, 91 F.3d 331 (2d Cir. 1996) (per curiam); see also United States v. Thomas,

757 F.2d 1359, 1368 (2d Cir. 1985) (finding good faith reliance on a warrant, under

Leon, where officers, first, committed a constitutional violation they did not

reasonably know, at the time, was unconstitutional — a warrantless canine sniff

— and second, in relying on evidence from this sniff in a warrant application,

50
fully revealed the fact of the canine sniff to a magistrate judge), cert. denied by

Fisher v. United States, 474 U.S. 819 (1985) and Rice v. United States, 479 U.S. 818

(1986).

Ganias argues that reliance on the 2006 warrant is misplaced for two

reasons. First, he urges that the alleged constitutional violation here (unlawful

retention of the mirrored drives) had “long since” ripened into a violation by

April 2006, when the second warrant was obtained, Appellant Br. at 55-56, and

attests that “[n]othing [in Leon] suggests that the police, after they engage in

misconduct, can then ‘launder their prior unconstitutional behavior by

presenting the fruits of it to a magistrate,’” id. at 56 (quoting State v. Hicks, 707

P.2d 331, 333 (Ariz. Ct. App. 1985)). Second, Ganias argues that, even if “a

subsequent warrant can ever appropriately purge the taint of an earlier violation,

the agent must, at the very least, ‘provide all potentially adverse information’

regarding the earlier illegality ‘to the issuing [magistrate] judge,’” a requirement

that he argues was not satisfied here. Id. at 58 (quoting Reilly, 76 F.3d at 1280).

Ganias’s arguments are unavailing.

First, Ganias relies on this Court’s decision in Reilly to argue categorically

that agents who have engaged in a predicate Fourth Amendment violation may

51
not rely on a subsequently issued warrant to establish good faith. Reilly,

however, stands for no such thing. In Reilly, officers unlawfully intruded on the

defendant’s curtilage, discovering about twenty marijuana plants, before they

departed and obtained a search warrant based on a “bare-bones” description of

their intrusion and resulting observations which this Court found “almost

calculated to mislead.” Reilly, 76 F.3d at 1280; see also id. (“[The affidavit]

simply . . . stated that [the officers] walked along Reilly’s property until they

found an area where marijuana plants were grown. It did not describe this area

to the Judge[,] . . . [and it] gave no description of the cottage, pond, gazebo, or

other characteristics of the area. . . . [The omitted information] was crucial.

Without it, the issuing judge could not possibly make a valid assessment of the

legality of the warrant that he was asked to issue.”). We rejected the

government’s argument that the officers were entitled to rely on the warrant,

noting that the officers had “undert[aken] a search that caused them to invade

what they could not fail to have known was potentially . . . curtilage,” and that

they thereafter “failed to provide [the magistrate issuing the warrant] with an

account of what they did,” so that the magistrate was unable to ascertain

whether the evidence on which the officers relied in seeking the warrant was

52
“itself obtained illegally and in bad faith.” Id. at 1281. In such circumstances,

Leon did not — and does not — permit good faith reliance on a warrant. See

Leon, 468 U.S. at 923 (observing that an officer’s reliance on a warrant is not

objectively reasonable if he “misled [the magistrate with] information in an

affidavit that [he] knew was false or would have known was false except for his

reckless disregard of the truth”).

The present case, however, is akin not to Reilly, but to this Court’s decision

in Thomas, which the Reilly panel carefully distinguished, while reaffirming. See

Reilly, 76 F.3d at 1281-82. In Thomas, an agent, acting without a warrant, used a

dog trained to detect narcotics to conduct a “canine sniff” at a dwelling. 757 F.2d

at 1367. The agent presented evidence acquired as a result of the sniff to a

“neutral and detached magistrate” who, on the basis of this and other evidence,

determined that the officer had probable cause to conduct a subsequent search of

the dwelling in question. Id. at 1368. The defendant moved to suppress the

evidence found in executing the search warrant, arguing that the antecedent

canine sniff constituted a warrantless, unconstitutional search and that the

evidence acquired from that sniff was dispositive to the magistrate judge’s

finding of probable cause. See id. at 1366. This Court agreed on both counts: first

53
deciding, as a matter of first impression in our Circuit, that the canine sniff at

issue constituted a search, id. at 1367, and second determining that, absent the

evidence acquired from this search, the warrant was not supported by probable

cause, id. at 1368. The Thomas panel nevertheless concluded that suppression

was inappropriate because the agent’s reliance on the warrant was objectively

reasonable: “The . . . agent brought his evidence, including [a factual description

of the canine sniff], to a neutral and detached magistrate. That magistrate

determined that probable cause to search existed, and issued a search warrant.

There is nothing more the officer could have or should have done under these

circumstances to be sure his search would be legal.” Id.

Reilly carefully distinguished Thomas, and in a manner that makes

apparent that it is Thomas that is dispositive here. First, the Reilly panel noted

that Thomas was unlike Reilly, in that the agent in Thomas disclosed all crucial

facts for the legal determination in question to the magistrate judge. Reilly, 76

F.3d at 1281. Then, the Reilly panel articulated another difference: while in Reilly,

“the officers undertook a search that caused them to invade what they could not

fail to have known was potentially Reilly’s curtilage,” in Thomas, the agent “did

not have any significant reason to believe that what he had done [conducting the

54
canine sniff] was unconstitutional.” Id.; see also id. (“[U]ntil Thomas was decided,

no court in this Circuit had held that canine sniffs violated the Fourth

Amendment.”). Thus, the predicate act in Reilly tainted the subsequent search

warrant, whereas the predicate act in Thomas did not. The distinction did not

turn on whether the violation found was predicate, or prior to, the subsequent

search warrant on which the officers eventually relied, but on whether the

officers’ reliance on the warrant was reasonable.

Contrary to Ganias’s argument, then, it is not the case that good faith

reliance on a warrant is never possible in circumstances in which a predicate

constitutional violation has occurred. The agents in Thomas committed such a

violation, but they had no “significant reason to believe” that their predicate act

was indeed unconstitutional, Reilly, 76 F.3d at 1281, and the issuing magistrate

was apprised of the relevant conduct, so that the magistrate was able to

determine whether any predicate illegality precluded issuance of the warrant. In

such circumstances, invoking the good faith doctrine does not “launder [the

agents’] prior unconstitutional behavior by presenting the fruits of it to a

magistrate,” as Ganias suggests. Appellant Br. at 56 (quoting Hicks, 707 P.2d at

333). In such cases, the good faith doctrine simply reaffirms Leon’s basic lesson:

55
that suppression is inappropriate where reliance on a warrant was “objectively

reasonable.” Leon, 468 U.S. at 922. 44

Such is the case here. First, Agent Hosney provided sufficient information

in her affidavit to apprise the magistrate judge of the pertinent facts regarding

the retention of the mirrored copies of Ganias’s hard drives — the alleged

constitutional violation on which he relies. Agent Hosney explained that the

mirror images in question had been “seized on November 19, 2003 from the

offices of Taxes International,” J.A. 461, ¶ 7; that information material to the

initial investigation of a third party had been located on the mirrors and

“analyzed in detail,” J.A. 464, ¶ 15; that Ganias was not, at the time of the

original seizure, under investigation, J.A. 461, ¶ 3; that, “[p]ursuant to [that initial

warrant],” Agent Hosney could not search Ganias’s personal or business files as

44
Insofar as Ganias argues that Thomas’s and Reilly’s holdings are limited to
when the alleged predicate violation is a search that taints the warrant, but do not
extend to circumstances in which the alleged predicate violation is a seizure or unlawful
retention, we discern no justification for this distinction. But for the canine search in
Thomas — the predicate violation — there would have been no subsequent warrant
pursuant to which the government searched the dwelling and on whose legality it
relied in conducting that search. But for the retention in this case — the alleged
predicate violation — there could have been no subsequent search warrant pursuant to
which the Government searched the relevant evidence and on whose legality the
Government relied in conducting that search. To credit Ganias’s distinction would be
to replace the underlying directive that reliance on a warrant be “objectively
reasonable,” Leon, 468 U.S. at 922, with an arbitrary formalism.

56
the warrant authorized search only of “files for [AB] and IPM,” J.A. 464, ¶ 14;

and that Ganias’s personal data — which Agent Hosney was not authorized to

search — was on those mirrored drives, J.A. 467, ¶ 27, and thus, a fortiori, had been

there for the past two and a half years. The magistrate judge was thus informed

of the fact that mirrors containing data non-responsive to the 2003 warrant had

been retained for several years past the initial execution of that warrant and, to

the degree it was necessary, that data responsive to the 2003 warrant had been

analyzed in detail. The magistrate therefore had sufficient information on which

to determine whether such retention precluded issuance of the 2006 warrant. Cf.

Thomas, 757 F.2d at 1368 (“The magistrate, whose duty it is to interpret the law,

determined that the canine sniff could form the basis for probable cause . . . .”).

Ganias disagrees, arguing, in particular, that, though Agent Hosney

alerted the magistrate that the mirrors had been retained for several years; that

data responsive to the original warrant had been both located and extensively

analyzed; and that those of Ganias’s QuickBooks files that Agent Hosney wanted

to search were non-responsive to the original warrant, the Hosney affidavit did

not go far enough in that it failed to disclose that the agents “had been retaining

the non-responsive records for a full 16 months after the files within the

57
November 2003 warrant’s scope had been identified.” Appellant Br. at 60. As an

initial matter, the Government did alert the magistrate that it had located

responsive data on the mirrors and conducted extensive analysis of that

responsive material, and it is not clear what else the Government should have

said: the district court did not determine — nor does the record show — that by

January 2005, as Ganias contends, the Government had determined, as a

forward-looking matter, that it had performed all forensic searches of data

responsive to the 2003 warrant that might prove necessary over the course of its

investigation. Compare J.A. 322 (Q: “So it’s fair to say that as of mid-December

[2004], your forensic analysis was completed at that time?” Agent Chowaniec:

“That’s correct, of the computers.”), with J.A. 324 (Q: “Did you know you

wouldn’t require further analysis by Greg Norman or any other examiner at the

Army lab in Georgia after December of 2004?” Agent Chowaniec: “No.”); see

supra note 12. Nor would it be reasonable to expect additional detail in the

affidavit on this point, even assuming Ganias’s contention to be correct that the

Government had both finished its segregation and provided insufficient facts to

alert the magistrate judge to that reality, given the dearth of precedent

suggesting its relevance. Cf. Clark, 638 F.3d at 105 (“[W]here the need for

58
specificity in a warrant or warrant affidavit on a particular point was not yet

settled or was otherwise ambiguous, we have declined to find that a well-trained

officer could not reasonably rely on a warrant issued in the absence of such

specificity.”); cf. Reilly, 76 F.3d at 1280 (noting that the affidavit in that case, in

clear contrast to the affidavit in this one, was “almost calculated to mislead”).

Second, here, as in Thomas, it is also clear that the agents, as the panel put it

in Reilly, “did not have any significant reason to believe that what [they] had

done was unconstitutional,” Reilly, 76 F.3d at 1281 — that their retention of the

mirrored hard drives, while the investigation was ongoing, was anything but

routine. At the time of the retention, no court in this Circuit had held that

retention of a mirrored hard drive during the pendency of an investigation could

violate the Fourth Amendment, much less that such retention would do so in the

circumstances presented here. See id. (noting that suppression was inappropriate

in Thomas in part because no relevant precedent established that canine sniffs of a

dwelling “violated the Fourth Amendment”). 45 Moreover, as noted above, the

45
The closest decision Ganias can locate is United States v. Tamura, 694 F.2d at
594-95, an out-of-circuit case that concerned intermingled paper files, the removal of
which was unauthorized and the return of which had been vigorously sought by the
affected parties. Whatever relevance that case may have by analogy, it is not sufficient
to alert a reasonable agent to the existence of a serious Fourth Amendment problem: for
to suggest that a holding applicable to retaining intermingled paper files specifically
59
2003 warrant authorized the lawful seizure not merely of particular records or

data, but of the hard drives themselves, or in the alternative the creation of

mirror images of the drives to be removed from the premises for later forensic

evaluation, and set no greater limit on the Government’s retention of those

materials than on any other evidence whose seizure it authorized.

Finally, the record here is clear that the agents acted reasonably

throughout the investigation. They sought authorization in 2003 to seize the

hard drives and search them off-site; they minimized the disruption to Ganias’s

business by taking full forensic mirrors; they searched the mirrors only to the

extent authorized by, first, the 2003 warrant, and then the warrant issued in 2006;

they were never alerted that Ganias sought the return of the mirrors; and they

alerted the magistrate judge to these pertinent facts in applying for the second

warrant. In short, the agents acted reasonably in relying on the 2006 warrant to

search for evidence of Ganias’s tax evasion. This case fits squarely within Leon so

that, assuming, arguendo, that a Fourth Amendment violation occurred,

suppression was not warranted.

demanded to be returned clearly resolves a question about retention of a physical digital
storage medium (the return of which had been neither suggested nor requested) would
be “like saying a ride on horseback is materially indistinguishable from a flight to the
moon.” Riley, 134 S. Ct. at 2488.

60
 * * *

We conclude that the Government relied in good faith on the 2006 search

warrant and thus AFFIRM the judgment of the district court. Given this

determination, we do not reach the specific Fourth Amendment question posed

to us today.

61
LOHIER, Circuit Judge, joined by POOLER, Circuit Judge, concurring:

I concur fully in Part I of the majority opinion, which accurately recites the

facts, and Part III, which affirms based on the narrow ground that the

Government relied in good faith on the 2006 search warrant obtained in this case.

It bears emphasizing that Part III contains the only holding in the majority

opinion. I also concur insofar as the majority opinion clarifies that under

appropriate circumstances it may be helpful for litigants to use the mechanism

provided by Rule 41(g) of the Federal Rules of Criminal Procedure when faced

with the Government’s retention of electronic data.

CHIN, Circuit Judge, dissenting: 

I respectfully dissent. 

Over two hundred fifty years ago, agents of the King of England, 

with warrant in hand, entered the home of John Entick.  They rummaged 

through boxes and trunks, cabinets and bureaus.  They were looking for 

evidence of known instances of seditious libel, but they took ʺall the papers and 

books without exception.ʺ  Entick v. Carrington, 19 How. St. Tr. 1029, 1064 (C.P. 

1765).  In holding that Entickʹs rights were violated, the court explained:   

Papers are the ownerʹs goods and chattels:  they 
are his dearest property; and are so far from enduring a 
seizure, that they will hardly bear an inspection; and 
though the eye cannot by the laws of England be guilty 
of a trespass, yet where private papers are removed and 
carried away, the secret nature of those goods will be an 
aggravation of the trespass, and demand more 
considerable damages in that respect.  Where is the 
written law that gives any magistrate such a power?  I 
can safely answer, there is none; and therefore it is too 
much for us without such authority to pronounce a 
practice legal, which would be subversive of all the 
comforts of society. 

Id. at 1066. 

Entick was not lost on the Framers.  As the Supreme Court has noted, 

ʺits propositions were in the minds of those who framed the fourth amendment 

to the constitution, and were considered as sufficiently explanatory of what was 
meant by unreasonable searches and seizures.ʺ  Boyd v. United States, 116 U.S. 

616, 626‐27 (1886).  And enshrined in the Fourth Amendment is the foundational 

principle that the Government cannot come into oneʹs home looking for some 

papers and, without suspicion of broader criminal wrongdoing, indiscriminately 

take all papers instead.   

In this case, the Government argues that when those papers are 

inside a computer, the result is different.  It argues that when computers are 

involved, it is free to overseize files for its convenience, including files outside the 

scope of a warrant, and retain them until it has found a reason for their use.  In 

essence, the Government contends that it is entitled to greater latitude in the 

computer age.  I disagree.  If anything, the protections of the Fourth Amendment 

are even more important in the context of modern technology, for the 

Government has a far greater ability to intrude into a personʹs private affairs.1 

  1 See, e.g., United States v. Galpin, 720 F.3d 436, 446 (2d Cir. 2013) 
(ʺ[A]dvances in technology and the centrality of computers in the lives of average 
people have rendered the computer hard drive akin to a residence in terms of the scope 
and quantity of private information it may contain.ʺ); United States v. Otero, 563 F.3d 
1127, 1132 (10th Cir. 2009) (ʺThe modern development of the personal computer and its 
ability to store and intermingle a huge array of oneʹs personal papers in a single place 
increases law enforcementʹs ability to conduct a wide‐ranging search into a personʹs 
private affairs . . . .ʺ); Orin S. Kerr, Searches and Seizures in a Digital World, 119 Harv. L. 
Rev. 531, 569 (2005) (explaining that computers have become the equivalent of ʺpostal 

2 
 Here, although the Government had a warrant for documents 

relating to only two of defendant‐appellant Stavros Ganiasʹs accounting clients, it 

seized all the data from three of his computers, including wholly unrelated 

personal files and files of other clients.  The Government did so solely as a matter 

of convenience, and not because it suspected Ganias or any of his other clients of 

wrongdoing.  The Government was able to extract the responsive files some 

thirteen months later.  But instead of returning the non‐responsive files, the 

investigators retained them, because, as one agent testified, they ʺviewed the data 

as the governmentʹs property, not Mr. Ganiasʹs property.ʺ  J. App. 146.2  Some 

sixteen months later, almost two‐and‐a‐half years after the files were first seized, 

the Government found an unrelated reason to prosecute Ganias ‐‐ his personal 

tax evasion ‐‐ and it sought judicial authorization to reexamine the data that was 

still in its possession.  The Government contends that this conduct did not violate 

the Fourth Amendment, and that, even if it did, suppression was not warranted 

because its agents acted in good faith. 

services, playgrounds, jukeboxes, dating services, movie theaters, daily planners, 
shopping malls, personal secretaries, virtual diaries, and moreʺ). 
   2 Throughout this dissent I refer as a matter of convenience to data on 
Ganiasʹs hard drive as ʺfilesʺ or ʺdocuments.ʺ  Of course, computers contain a variety of 
types of data, including data that we do not utilize as discrete ʺfilesʺ or ʺdocumentsʺ 
(e.g., metadata, the operating system, the BIOS). 

3 
 I disagree.  I would hold, as the panel held unanimously, that the 

Government violated Ganiasʹs Fourth Amendment rights when it retained 

Ganiasʹs non‐responsive files for nearly two‐and‐a‐half years and then 

reexamined the files for evidence of additional crimes.  United States v. Ganias, 

755 F.3d 125, 133‐40 (2d Cir. 2014).  I would also hold, as two members of the 

panel did, that the Governmentʹs actions are not excused by the good faith 

exception.  Id. at 140‐41.  But see id. at 141 (Hall, J., dissenting in part).3  

Accordingly, I dissent.   

I. 

I consider first whether Ganiasʹs Fourth Amendment rights were 

violated.  The majority addresses the question at length, with some twenty‐five 

pages of scholarly discussion about the Fourth Amendment in the digital age, but 

it reaches no conclusion.  E.g., Maj. Op. at 3, 22, 27, 38, 45, 47‐48.  Although we 

reheard the case en banc (at our own request and not at the request of any party), 

and despite the benefit of additional briefing and oral argument from the parties 

3   The third member of the panel was the Honorable Jane A. Restani of the 
United States Court of International Trade, who sat by designation.  Judge Restani was 
not eligible to participate in the en banc proceedings.  See 28 U.S.C. § 46(c). 

4 
as well as eight amicus briefs,4 the Court declines to rule on the question, 

ʺoffer[ing] no opinion on the existence of a Fourth Amendment violation in this 

case.ʺ  Id. at 22.  I would reach the question, and I would hold, as did the panel, 

that the Fourth Amendment was indeed violated.5 

   4 All eight amici urged that we find a Fourth Amendment violation.  Brief 
for Amicus Curiae Center for Constitutional Rights as Amicus Curiae in Support of 
Appellant, Ganias, No. 12‐240‐cr (July 29, 2015), 2015 WL 4597942; Brief for Amici Curiae 
Center for Democracy & Technology, ACLU, et al. in Support of Defendant‐Appellant, 
Ganias, No. 12‐240‐cr (July 29, 2015), 2015 WL 4597943; Brief of Amici Curiae Electronic 
Privacy Information Center in Support of Appellant and Urging Affirmance, Ganias, 
No. 12‐240‐cr (July 29, 2015), 2015 WL 4610149; Brief on Rehearing En Banc for Amici 
Curiae Federal Public Defenders Within the Second Circuit in Support of Appellant 
Stavros M. Ganias, No. 12‐240‐cr (July 29, 2015), 2015 WL 4597956; Brief of Google Inc. 
as Amicus Curiae Supporting Defendant‐Appellant, Ganias, No. 12‐240‐cr (July 29, 
2015), 2015 WL 4597960; Amicus Curiae Brief of the National Assʹn of Criminal Defense 
Lawyers in Support of Defendant‐Appellant and Urging Reversal , Ganias, No. 12‐240‐cr 
(July 29, 2015), 2015 WL 4597959; Brief for Amicus Curiae New York Council of Defense 
Lawyers in Support of Appellant, Ganias, No. 12‐240‐cr (July 29, 2015), 2015 WL 
4597958; Brief of Amicus Curiae Restore the Fourth, Inc. in Support of Defendant‐
Appellant Stavros M. Ganias, Ganias, No. 12‐240‐cr (July 29, 2015), 2015 WL 4597961. 
   5 I note also that the prevailing scholarly consensus has been that the panel 
largely got it right with its Fourth Amendment approach.  E.g., Stephen E. Henderson, 
Fourth Amendment Time Machines (and What They May Say About Police Body Cameras), 18 
U. Pa. J. Const. L. 933, 947 (2016) (ʺI agree, though I differ from the panelʹs reasoning.ʺ); 
Orin S. Kerr, Executing Warrants for Digital Evidence:  The Case for Use Restrictions on 
Nonresponsive Data, 48 Tex. Tech L. Rev. 1, 30‐33 (2015) (concluding that ʺ[t]he basic 
approach mirrors the ongoing seizure approach recommended in this Articleʺ and that 
ʺGanias properly focuses on the reasonableness of the ongoing seizure of the 
nonresponsive files,ʺ while labeling the panel opinion as ʺa particularly strong versionʺ 
that ʺcourts could adoptʺ); see also Recent Case, Second Circuit Creates A Potential ʺRight 
to Deletionʺ of Imaged Hard Drives. ‐‐ United States v. Ganias, 755 F.3d 125 (2d Cir. 2014), 
128 Harv. L. Rev. 743, 747‐50 (2014) (concluding that ʺ[t]he Ganias courtʹs opinion 
properly held that Ganiasʹs Fourth Amendment rights were violated, and it rightly 

5 
 A. 

The facts are largely undisputed.  Ganias was providing tax and 

accounting services to individuals and small businesses, including Industrial 

Property Management, Inc. (ʺIPMʺ) and American Boiler.  In November 2003, the 

Army, as part of an investigation of those two entities, subpoenaed from Ganias:  

All books, records, documents, materials, 
computer hardware and software and computer  
associated data relating to the business, financial and 
accounting operations of [IPM] and American 
Boiler . . . . 

recognized the importance of the particularity requirement in the context of electronic 
evidence,ʺ but arguing that the panel could have ʺissued a narrower opinionʺ).  But see 
Note, Digital Duplications and the Fourth Amendment, 129 Harv. L. Rev. 1046, 1059‐64 
(2016) (arguing the retention at issue should have been considered as a ʺsearchʺ and not 
a ʺseizureʺ).  Others have likewise commented that the panel opinion fits with current 
Supreme Court jurisprudence, including, in particular, Riley v. California, 134 S. Ct. 1473.  
E.g., Alan Butler, Get a Warrant:  The Supreme Courtʹs New Course for Digital Privacy 
Rights After Riley v. California, 10 Duke J. Const. L. & Pub. Polʹy 83, 112‐13 (2014) (ʺThe 
rule adopted in Ganias is consistent with the scope of privacy interests in digital data 
outlined in Riley, and other courts will be more likely to adopt the rule in light of the 
Supreme Courtʹs decision.ʺ); Laura K. Donohue, Section 702 and the Collection of 
International Telephone and Internet Content, 38 Harv. J.L. & Pub. Polʹy 117, 238‐41 (2015) 
(commenting that, like the panel opinion, Riley ʺsimilarly supports a Fourth 
Amendment use restriction on lawfully obtained informationʺ and concluding that 
ʺ[e]ven though the government might have legally obtained the information at the front 
end, it could not search the information for evidence of criminal activity absent a 
warrant, supported by probable causeʺ); Paul Ohm, The Life of Riley (v. California), 48 
Tex. Tech L. Rev. 133, 138‐39 (2015) (anticipating that future courts could find Ganias 
supportable under Riley).  

6 
J. App. 433.  Two Army computer specialists and another Army investigator 

came to Ganiasʹs office, and they saw three computers.  They made identical 

copies of the hard drives of those computers to take with them ‐‐ that is, they 

cloned the hard drives by making exact replicas (ʺmirror imagesʺ) on blank hard 

drives.  In the course of doing so, they took data and files not ʺrelating to the 

business, financial and accounting operations of [IPM] and American Boiler.ʺ  Id.  

In fact, they took from those hard drives all of Ganiasʹs data, including files 

relating to his personal affairs.   

Back in their offices, the Army investigators copied the data taken 

from Ganiasʹs computers onto ʺtwo sets of 19 DVDs,ʺ one of which was 

ʺmaintained as evidenceʺ while the other was kept as a ʺworking copy.ʺ  Special 

App. 11.  It took the Army Criminal Investigation Division some seven months to 

begin reviewing the files, but before it began doing so, it invited the Internal 

Revenue Service (the ʺIRSʺ) to join the investigation.  The Army and the IRS 

thereafter proceeded separately, reviewing the mirror images for files responsive 

to the warrant.   

By December 2004, approximately thirteen months after the seizure, 

some four months of which was spent locating a copy of the off‐the‐shelf 

7 
consumer software known as QuickBooks, Army and IRS investigators were able 

to isolate and extract the files covered by the warrant, that is, the files relating to 

IPM and American Boiler.  The investigators were aware that, because of the 

constraints of the warrant, they were not permitted to review any other computer 

records.  Indeed, the investigators were careful, at least until later, to review only 

data covered by the November 2003 warrant.   

The investigators did not, however, purge or delete or return the 

non‐responsive files.  To the contrary, they retained the files because they 

ʺviewed the data as the governmentʹs property, not Mr. Ganiasʹs property.ʺ  J. 

App. 146.6  Their view was that while items seized from an owner will be 

returned after an investigation closes, all of the electronic data here was evidence 

that was to be protected and preserved.  As one agent testified, ʺ[W]e would not 

routinely go into DVDs to delete data, as weʹre altering the original data that was 

seized.  And you never know what data you may need in the future. . . .  I donʹt 

   6 The majority suggests that I ʺseize[] on this single sentence . . . as the 
smoking gun of the Governmentʹs bad faith.ʺ  Maj. Op. at 16 n.13.  The testimony is 
what it is:  a statement under oath by a law enforcement officer explaining the 
Governmentʹs actions.  Moreover, as discussed below, there is more than just this single 
sentence to show the lack of good faith.  See infra Part II.B. 

8 
normally go into electronic data and start deleting evidence off of DVDs stored in 

my evidence room.ʺ  Id. at 122.    

In late 2004, IRS investigators discovered accounting irregularities 

regarding transactions between IPM and American Boiler in the documents 

taken from Ganiasʹs office.  After subpoenaing and reviewing the relevant bank 

records in 2005, they began to suspect that Ganias was not properly reporting 

American Boilerʹs income.  Accordingly, on July 28, 2005, some twenty months 

after the seizure of his computer files, the Government officially expanded its 

investigation to include possible tax violations by Ganias.  Further investigation 

in 2005 and early 2006 indicated that Ganias had been improperly reporting 

income for both his clients, leading the Government to suspect that he also might 

have been underreporting his own income.   

At that point, the IRS case agent wanted to review Ganiasʹs personal 

financial records, and she knew, from her review of the seized computer records, 

that they were among the files in the DVD copies of Ganiasʹs hard drives.  The 

case agent was aware, however, that Ganiasʹs personal financial records were 

beyond the scope of the November 2003 warrant, and consequently she did not 

9 
believe that she could review the non‐responsive files, even though they were 

already in the Governmentʹs possession.  

In February 2006, the Government asked Ganias and his counsel for 

permission to access certain of his personal files that were contained in the 

materials seized in November 2003.  Ganias did not respond, and thus, on April 

24, 2006, the Government obtained another warrant to search the preserved 

mirror images of Ganiasʹs personal financial records taken in 2003.  At that point, 

the mirror images had been in the Governmentʹs possession for almost two‐and‐

a‐half years.   

B. 

ʺ[T]he ultimate touchstone of the Fourth Amendment is 

ʹreasonableness.ʹʺ  Brigham City v. Stuart, 547 U.S. 398, 403 (2006).  In adopting the 

Fourth Amendment, the Framers were principally concerned about 

ʺindiscriminate searches and seizuresʺ conducted ʺunder the authority of ʹgeneral 

warrants.ʹʺ  United States v. Galpin, 720 F.3d 436, 445 (2d Cir. 2013) (quoting 

Payton v. New York, 445 U.S. 573, 583 (1980)).  General warrants were ones ʺnot 

grounded upon a sworn oath of a specific infraction by a particular individual, 

and thus not limited in scope and application.ʺ  Maryland v. King, 133 S. Ct. 1958, 

10 
1980 (2013).  The Fourth Amendment guards against this practice by providing 

that a warrant will issue only if:  (1) the Government establishes probable cause 

to believe the search will uncover evidence of a specific crime; and (2) the 

warrant states with particularity the areas to be searched and the items to be 

seized.  Galpin, 720 F.3d at 445‐46.   

The latter requirement, in particular, ʺmakes general searches . . . 

impossibleʺ because it ʺprevents the seizure of one thing under a warrant 

describing another.ʺ  Id. at 446 (quoting Marron v. United States, 275 U.S. 192, 196 

(1927)).  This restricts the Governmentʹs ability to remove all of an individualʹs 

papers for later examination because it is generally unconstitutional to seize any 

item not described in the warrant.  See Horton v. California, 496 U.S. 128, 140 

(1990); United States v. Tamura, 694 F.2d 591, 595 (9th Cir. 1982).  Certain 

exceptions have been made in those ʺcomparatively rare instances where 

documents [we]re so intermingled that they [could not] feasibly be sorted on 

site.ʺ  Tamura, 694 F.2d at 595‐96.  These circumstances might occur, for example, 

where potentially relevant documents are interspersed through a large number 

of boxes or file cabinets.  See id. at 595.  But in those cases, the off‐site review had 

11 
to be monitored by a neutral magistrate and non‐responsive documents were to 

be returned after the relevant items were identified.  Id. at 596‐97. 

In the computer age, off‐site review has become much more 

common.  The ability of computers to store massive volumes of information 

presents logistical problems in the execution of search warrants, and files on a 

computer hard drive are often ʺso intermingled that they cannot feasibly be 

sorted on site.ʺ  Id. at 595.  Forensic analysis of electronic data may take weeks or 

months to complete, and it would be impractical for agents to occupy an 

individualʹs home or office, or retain an individualʹs computer, for such extended 

periods of time.  It is now also unnecessary.  Today, advancements in technology 

enable the Government to create a mirror image of an individualʹs hard drive, 

which can be searched as if it were the actual hard drive but without otherwise 

interfering with the individualʹs use of his home, office, computer, or files.  

Indeed, the Federal Rules of Criminal Procedure now provide that a warrant for 

computer data presumptively ʺauthorizes a later review of the media or 

information consistent with the warrant.ʺ  Fed. R. Crim. P. 41(e)(2)(B).  

But these practical necessities must still be balanced against our 

possessory and privacy interests, which have become more susceptible to 

12 
deprivation in the computer age.  A computer does not consist simply of 

ʺpapers,ʺ but now contains the quantity of information found in a personʹs 

residence or greater.  See Riley v. California, 134 S. Ct. 2473, 2489 (2014); Galpin, 

720 F.3d at 446.  Virtually the entirety of a personʹs life may be captured as data:  

family photographs, correspondence, medical history, intimate details about how 

a person spends each passing moment of each day.  GPS‐enabled devices reveal 

our whereabouts.  A personʹs internet search history may disclose her mental 

deliberations, whether or not those thoughts were favored by the Government, 

the public at large, or even that personʹs own family.  Smartphones ʺcould just as 

easily be called cameras, video players, rolodexes, calendars, tape recorders, 

libraries, diaries, albums, televisions, maps, or newspapers.ʺ  Riley, 134 S. Ct. at 

2489; see also Michael D. Shear, David E. Sanger & Katie Benner, In the Apple Case, 

a Debate Over Data Hits Home, N.Y. Times (Mar. 13, 2016) (ʺIt is a minicomputer 

stuffed with every detail of a person’s life:  photos of children, credit card 

purchases, texts with spouses (and nonspouses), and records of physical 

movements.ʺ).  From a mere data storage device, a forensic analyst could 

reconstruct a ʺconsiderable chunk of a personʹs life.ʺ  Kerr, supra note 1, at 569.  

13 
All of this information is captured when the Government, in executing a search 

warrant, makes a mirror image of a hard drive. 

We know only general descriptions of what was in Ganiasʹs three 

hard drives ‐‐ ʺpersonal and financial information,ʺ including information on 

other tax and accounting clients (e.g., social security numbers) that was private to 

them ‐‐ but the Fourth Amendment requires us to consider broadly the 

ramifications of computer seizures.  J. App. 428.  If Ganias were a doctor, his 

computer might have contained the entire medical history of hundreds of 

individuals.  If Ganias were a teacher, his computer could have contained 

educational information on dozens of students and communications with their 

families.  If Ganias were not an individual but a corporation like Apple, Dropbox, 

Google, or Microsoft that stores individualsʹ information in the ʺcloud,ʺ the 

Government would have captured an untold vastness of information on millions 

of individuals.  See Jim Kerstetter, Microsoft Goes on Offensive Against Justice 

Department, N.Y. Times (Apr. 15, 2016) (ʺWhen customer information is stored in 

a giant data center run by companies like Google, Apple and Microsoft, 

investigators can go straight to the information they need, even getting a judge to 

order the company to keep quiet about it.ʺ); see also Andrew Keane Woods, 

14 
Against Data Exceptionalism, 68 Stan. L. Rev. 729, 743 (2016) (ʺTwenty years ago, a 

kidnapper might have confessed to a crime by writing in his diary. . . .  Today the 

same admission is just as likely to be stored online. . . .ʺ). 

To safeguard individualsʹ possessory and privacy interests, when 

the Government seeks to review mirror images off‐site, we are careful to subject 

the Governmentʹs conduct to the rule of reasonableness.  See, e.g., United States v. 

Ramirez, 523 U.S. 65, 71 (1998) (ʺThe general touchstone of reasonableness which 

governs Fourth Amendment analysis governs the method of execution of the 

warrant.ʺ (citation omitted)).  The advisory committeeʹs notes to the 2009 

amendment of the Federal Rules of Criminal Procedure shed some light on what 

is ʺreasonableʺ in this context.  Specifically, the committee rejected ʺa 

presumptive national or uniform time period within which any subsequent off‐

site copying or review of the media or electronically stored information would 

take place.ʺ  Fed. R. Crim. P. 41(e)(2)(B) advisory committeeʹs notes to 2009 

amendments.  The committee noted that several variables ‐‐ storage capacity of 

media, difficulties created by encryption or electronic booby traps, and 

computer‐lab workload ‐‐ influence the duration of a forensic analysis and 

counsel against a ʺone size fits allʺ time period.  Id.  In combination, these factors 

15 
might justify an off‐site review lasting for a significant period of time.  They do 

not, however, provide an ʺindependent basisʺ for retaining any electronic data 

ʺother than [those] specified in the warrant.ʺ  United States v. Comprehensive Drug 

Testing, Inc. (CDT), 621 F.3d 1162, 1171 (9th Cir. 2010) (en banc) (per curiam). 

Hence, for these practical considerations, the Government may, 

consistent with the Fourth Amendment, overseize electronically stored data 

when executing a warrant.  But overseizure is exactly what it sounds like.  It is a 

seizure that exceeds or goes beyond what is otherwise authorized by the Fourth 

Amendment.  It is an overseizure of evidence that may be reasonable, in light of 

the practical considerations.   

But once the Government is able to extract the responsive 

documents, its right to the overseizure of evidence comes to an end.  This 

obvious principle has long been adhered to in the context of physical documents, 

such as when the Government seizes entire file cabinets for off‐site review.  See 

Tamura, 694 F.2d at 596‐97 (ʺWe likewise doubt whether the Governmentʹs refusal 

to return the seized documents not described in the warrant was proper.ʺ); see 

also Andresen v. Maryland, 427 U.S. 463, 482 n.11 (1976) (ʺ[T]o the extent such 

papers were not within the scope of the warrants or were otherwise improperly 

16 
seized, the State was correct in returning them voluntarily . . . .ʺ).  By logical 

extension, at least in a situation where responsive computer files can be extracted 

without harming other government interests, this principle would apply with 

equal force.  See CDT, 621 F.3d at 1175‐76 (using ʺfile cabinetsʺ as a starting 

analogy for analyzing digital privacy issues).  Once responsive files are 

segregated or extracted, the retention of non‐responsive documents is no longer 

reasonable, and the Government is obliged, in my view, to return or dispose of 

the non‐responsive files within a reasonable period of time.  See CDT, 621 F.3d at 

1179 (Kozinski, J., concurring) (ʺOnce the data has been segregated . . . any 

remaining copies should be destroyed or . . . returned . . . .ʺ).  At that point, the 

Governmentʹs overseizure of files and continued retention of non‐responsive 

documents becomes the equivalent of an unlawful general warrant.  See CDT, 621 

F.3d at 1176 (majority opinion) (noting ʺserious risk that every warrant for 

electronic information will become, in effect, a general warrant, rendering the 

Fourth Amendment irrelevantʺ); cf. United States v. Jones, 132 S. Ct. 945, 955‐56 

(2012) (Sotomayor, J., concurring) (warning that ʺGovernment can store . . . 

records and efficiently mine them for information years into the futureʺ).   

17 
 In the circumstances here, the Government violated Ganiasʹs right 

against unreasonable searches and seizures.  The Government overseized 

Ganiasʹs data in November 2003, taking both responsive and non‐responsive 

documents.  By December 2004, the responsive documents had been segregated 

and extracted.  Yet, instead of returning or deleting the non‐responsive files, the 

Government retained them for another year and a half, until it finally developed 

a justification to search them again for unrelated reasons.  Without some 

independent basis for retaining the non‐responsive documents in the interim, 

however, in my view the Government clearly violated Ganiasʹs rights under the 

Fourth Amendment.   

The majority comments that it is ʺunclearʺ whether the Government 

had segregated the files relating to IPM and American Boiler from non‐

responsive files by December 2004.  Maj. Op. at 15‐16 & n.12.  But the record 

shows that by October 2004, the Government had placed files thought to be 

responsive onto a CD.  Referring to this event at rehearing en banc, the 

Government stated: 

There does come a point where we often identify a 
subset of documents that are responsive, and you could 
even call it segregating.  In this case, they put them onto a 

18 
 separate disc as working copies and sent [them] to the 
case agents.   

Oral Arg. 32:12‐43 (emphasis added).  And as an agent then testified, ʺas of mid‐

December, [the] forensic analysis was completed.ʺ  J. App. 322.  In other words, 

the responsive files were segregated. 

The majority posits that perhaps the agents did not consider the 

forensic analysis as to IPM and American Boiler completed ʺas a forward‐looking 

matterʺ as of December 2004.  Maj. Op. at 15, 58.  The record, however, shows 

otherwise, and, at a minimum, it is clear that the segregation of the files was 

essentially complete at that point.  Moreover, this factual distinction is both 

speculative and irrelevant.  The Fourth Amendment should not be held in 

abeyance on the off‐chance that later developments might cause agents to want 

to reexamine documents preliminarily determined to be non‐responsive.  Indeed, 

the Fourth Amendment recognizes that some degree of perfection must be 

sacrificed to safeguard liberties.  By barring the Government from simply taking 

everything through the use of a general warrant, the Fourth Amendment 

contemplates that investigators may miss something.  With computers, another 

search term can always be concocted and data can always be further crunched.  

But the fact that another iota of evidence might be uncovered at some point 

19 
down the road does not defeat the rights protected by the Fourth Amendment.  

Cf. Riley, 134 S. Ct. at 2491 (ʺ[T]he Founders did not fight a revolution to gain the 

right to government agency protocols.ʺ). 

C. 

I next turn to the Governmentʹs arguments as to why the Fourth 

Amendment was not violated.  The Government offers several ʺlegitimate 

governmental interestsʺ that it contends permit it to hold onto data long after it 

has been seized, sorted, and segregated, even though the data includes 

irrelevant, personal information.  See Govʹt Br. 29.  During the en banc process, the 

Government suggested that these interests permit it to retain data for the 

duration of the prosecution.  See id. at 17, 29; Oral Arg. 27:38‐57.7 

At the outset, in evaluating the legitimacy of these reasons in 

relation to this case, I note what is not implicated here.  This is not a case where 

the defendantʹs non‐responsive files had independent evidentiary value ‐‐ for 

instance, in a prosecution where the charge was that evidence had been 

   7 In contrast, before the original panel, the Government argued:  ʺWhere the 
warrant does not specify a time period in which the review must be conducted ‐‐ like 
the November 2003 warrant ‐‐ this Court has allowed the government to retain 
computer material indefinitely and ʹwithout temporal limitation.ʹʺ  First Govʹt Br. 30 
(quoting United States v. Anson, 304 F. Appʹx 1, 3 (2d Cir. 2008)). 

20 
destroyed, e.g., 18 U.S.C. § 1519, it would be relevant that certain documents 

were not on the hard drive.8  This is also not a case where the manner in which a 

responsive file was stored could be used to prove knowledge or intent, as might 

be the situation in a child pornography prosecution.  And this is not a case where 

the physical hard drive itself is of evidentiary value ‐‐ the fact that Ganiasʹs files 

were actually found inside a computer did not make his guilt more or less 

probable.  Finally, this is not a case where the Government seized Ganiasʹs hard 

drive to proceed against him.  Instead, the Government retained Ganiasʹs hard 

drive for some two‐and‐a‐half years without suspecting him of criminal 

wrongdoing, and the agency that ultimately suspected him of illicit tax activity 

(the IRS) was not even involved at the outset. 

The Government argues that it has the right to retain non‐responsive 

files so that, at trial, responsive files will be more easily authenticated or of greater 

evidentiary weight.  Once again, the Governmentʹs argument obscures the issues 

   8 The majority twice relatedly suggests that the entire mirror image might 
be relevant here because Ganias made allusion to a ʺcomputer flawʺ or ʺsoftware errorʺ 
in QuickBooks that did not allow him to properly split deposited checks.  See Maj. Op. 
at 18 n.16, 34 n.31.  The issue surely could be resolved by retaining only the responsive 
files and a copy of the pertinent version of QuickBooks.  Moreover, even assuming there 
is some speculative value to retaining entire mirror images to prove the non‐existence of 
a glitch, it would hardly be reasonable to rule that these practical frustrations of 
everyday technology provide the Government license to keep everything. 

21 
in this case.  The agents could not have been keeping non‐responsive files for the 

purpose of proceeding against Ganias, as they did not yet suspect Ganias of 

criminal wrongdoing.   

Further, even if the authentication concern is genuine, ʺ[t]he bar for 

authentication of evidence is not particularly high.ʺ  United States v. Gagliardi, 506 

F.3d 140, 151 (2d Cir. 2007).  Indeed, as long as a reasonable juror could find that 

evidence was authentic we permit that evidence to be introduced.  Id.; see Fed. R. 

Evid. 901(a).  Meeting this minimal burden is not difficult ‐‐ all the Government 

need do is to introduce as a trial witness one of its agents who handled the data.  

See Tamura, 694 F.2d at 597.   

The Government presses the point by arguing that by keeping the 

hard drives, it could more easily preserve the chain of custody and authenticate by 

ʺcalculat[ing] . . . a ʹhash valueʹ for the original and th[e] [mirror] image.ʺ  Govʹt 

Br. 30.  A ʺhash valueʺ is an alphanumeric marker (e.g., ʺABC123ʺ) for data that 

stays the same if and only if the data is not altered.  Thus, if a hard drive and its 

mirror image have the same hash value, the files in the mirror image are exact 

replicas; whereas if the Government purges data from the mirror image, then 

22 
hash values would not match.  Hash values thus make authentication easy.  See 

Fed. R. Evid. 901(b)(4).   

The hashing argument, however, is not persuasive.  First, the 

Government would have to call an expert just to explain to a jury what a hash 

value was, as it did here.  See Fed. R. Evid. 702(a); Trial Tr. 128‐30.  This is no less 

burdensome than simply having an agent testify as to the chain of custody.  

Second, as the Government acknowledged at rehearing en banc, it can hash 

individual files that it has segregated.  See Oral Arg. 31:08‐30.  This practice is not 

a hypothetical possibility:  the Government has done so before, see, e.g., United 

States v. Hock Chee Koo, 770 F. Supp. 2d 1115, 1123 (D. Or. 2011), and the 

Government did so in this very case for Ganiasʹs QuickBooks files, see Trial Tr. 

147‐54.  See generally Richard P. Salgado, Fourth Amendment Search and the Power of 

the Hash, 119 Harv. L. Rev. F. 38, 40‐41 (2005) (ʺMany digital analysis tools can be 

configured to calculate separate hash values of each individual file . . . .ʺ).  The 

Governmentʹs ability to authenticate individual files by hashing them undercuts 

its assertion that it must retain non‐responsive files to authenticate responsive 

ones.  Hashing appears to make it easier for the Government to comply with the 

Fourth Amendment, not harder. 

23 
 Next, the Government contends that it has an interest in retaining 

computer evidence in its ʺoriginal formʺ to preserve ʺthe integrity and usefulness 

of computer evidence during a criminal prosecution.ʺ  Govʹt Br. 32.  This 

contention is unpersuasive.  The Government can always preserve a copy of the 

responsive files to protect against degradation ‐‐ indeed, the Government points to 

no reason why a hard drive with all of Ganiasʹs files would be less prone to 

degradation than a hard drive with some of his files.  Moreover, even assuming 

there is some slight prosecutorial advantage gained by being able to show juries 

what a computer interface looked like in its ʺoriginal form,ʺ this benefit surely 

does not justify a violation of basic Fourth Amendment rights.   

In a similar vein, the Government argues that retention of mirror 

images ʺpreserves the evidentiary value of computer evidence itselfʺ and might 

ʺrefute claims . . . of data tampering.ʺ  Govʹt Br. 31‐34.  As a practical matter, a 

claim of data tampering would easily fall flat where, as here, the owner kept his 

original computer and the Government gave him a copy of the mirror image.9  

More generally, the Government can argue in every case that overseized 

   9 Though the record is silent as to this point, the Government told the Court 
at rehearing en banc that it gave Ganias a copy of the forensic mirror image so that he 
could conduct his own analysis.  See Oral Arg. 30:28‐31:05. 

24 
evidence will have some bearing on the ʺevidentiary valueʺ of other, properly 

seized evidence at trial.  When the Government makes authorized seizures of 

folders of financial information from a file cabinet, it could argue that it is 

entitled to seize the entire cabinet to demonstrate to a jury that folders were 

preserved in their original form.  Or the Government might like to seize nearby, 

carefully organized folders of medical information to rebut a claim of 

incompleteness by showing how meticulous the defendant was.  Or the 

Government might seek to seize a folder of childrenʹs report cards to show that 

the defendant normally kept information from a certain time period.  Permitting 

the Government to keep non‐responsive files merely to strengthen the 

evidentiary value of responsive files would eviscerate the Fourth Amendment. 

Remarkably, the Government also argues that it should be allowed 

to hold on to overseized data for the defendantʹs benefit ‐‐ so that it can comply 

with its discovery obligations and duty to disclose exculpatory materials under 

Brady.  See generally Brady v. Maryland, 373 U.S. 83 (1963).  The Government is 

essentially arguing that it must hold on to the materials so that it can give them 

back to the defendant.  Of course, this is not a genuine concern ‐‐ the problem can 

25 
be obviated simply by returning the non‐responsive files to the defendant in the 

first place. 

The Government further argues that it should be permitted to retain 

forensic mirror images so that it may search the images for material responsive to 

a warrant ʺas the case evolves.ʺ  Govʹt Br. 35.  At base, this is a blanket assertion 

that the Government can seize first and investigate later.  See CDT, 579 F.3d at 

998 (criticizing approach as:  ʺLetʹs take everything back to the lab, have a good 

look around and see what we might stumble upon.ʺ).  This is the equivalent of a 

general warrant, and the Fourth Amendment simply does not permit it.  

Finally, the Government suggests that the availability of Federal 

Rule of Criminal Procedure 41(g) weighs in favor of the reasonableness of its 

actions.  Rule 41(g) provides that a person aggrieved by an unlawful seizure 

ʺmay move for the propertyʹs return.ʺ  This rule, however, cannot shift the 

Governmentʹs burden under the Fourth Amendment onto the defendant.  

Pointing fingers at Ganias does not help the Government meet its own obligation 

to be reasonable.   

The Governmentʹs arguments thus fail.  In my view, Ganiasʹs Fourth 

Amendment rights were violated when the Government unreasonably continued 

26 
to hold on to his non‐responsive files long after the responsive files had been 

extracted to reexamine when it subsequently saw need to do so.   

II. 

Instead of ruling on the question of whether the Governmentʹs 

actions violated the Fourth Amendment, the majority relies on the good faith 

exception to the exclusionary rule, and concludes that suppression was not 

warranted because the Government relied in good faith on the 2006 warrant and 

that this reliance was objectively reasonable.  See Maj. Op. at 3. 

A. 

Even where a search or seizure violates the Fourth Amendment, the 

Government is not automatically precluded from using the unlawfully obtained 

evidence in a criminal prosecution.  United States v. Julius, 610 F.3d 60, 66 (2d Cir. 

2010).  ʺTo trigger the exclusionary rule, police conduct must be sufficiently 

deliberate that exclusion can meaningfully deter it, and sufficiently culpable that 

such deterrence is worth the price paid by the justice system.ʺ  Herring v. United 

States, 555 U.S. 135, 144 (2009).   

To balance these interests, we have adopted the ʺgood faithʺ 

exception, in certain circumstances, as a carve‐out to the exclusionary rule.  See 

27 
Davis v. United States, 564 U.S. 229, 237‐39 (2011).  When a warrant is present, an 

agentʹs objectively reasonable good faith reliance on and abidance by the warrant 

generally makes exclusion an inappropriate remedy.  See United States v. Leon, 

468 U.S. 897, 922 (1984).  Likewise, government agents act in good faith when 

they perform ʺsearches conducted in objectively reasonable reliance on binding 

appellate precedent.ʺ  Davis, 564 U.S. at 232.  When agents act in good faith, the 

exclusionary rule will usually not apply.  See United States v. Aguiar, 737 F.3d 251, 

259 (2d Cir. 2013).  ʺThe burden is on the government to demonstrate the 

objective reasonableness of the officersʹ good faith reliance.ʺ  United States v. 

Voustianiouk, 685 F.3d 206, 215 (2d Cir. 2012) (quoting United States v. George, 975 

F.2d 72, 77 (2d Cir. 1992)).   

Furthermore, evidence will be suppressed only where the benefits of 

deterring the Governmentʹs unlawful actions appreciably outweigh the costs of 

suppressing the evidence ‐‐ ʺa high obstacle for those urging . . . applicationʺ of 

the rule.  Herring, 555 U.S. at 141 (quoting Pa. Bd. of Prob. & Parole v. Scott, 524 U.S. 

357, 364‐65 (1998)); see Davis, 564 U.S. at 232.  ʺWhen the police exhibit 

ʹdeliberate,ʹ ʹreckless,ʹ or ʹgrossly negligentʹ disregard for Fourth Amendment 

rights, the deterrent value of exclusion is strong and tends to outweigh the 

28 
resulting costs.ʺ  Davis, 564 U.S. at 238 (quoting Herring, 555 U.S. at 144).  ʺThe 

principal cost of applying the [exclusionary] rule is, of course, letting guilty and 

possibly dangerous defendants go free ‐‐ something that ʹoffends basic concepts 

of the criminal justice system.ʹʺ  Herring, 555 U.S. at 141 (quoting Leon, 468 U.S. at 

908). 

B. 

The Government contends that it relied in good faith both on the 

2003 warrant and the 2006 warrant.  The majority, without supporting its holding 

with the 2003 warrant, concludes that the agents acted reasonably in relying on 

the 2006 warrant to search for evidence of Ganiasʹs tax evasion, and that 

suppression therefore was not warranted.  See Majority Op. at 44‐55.  I disagree, 

and would hold that neither warrant provided a good faith basis for retaining the 

non‐responsive files long after the responsive files had been extracted. 

(1) 

I first turn to the 2003 warrant.  The Governmentʹs retention of 

Ganiasʹs non‐responsive files pursuant to the 2003 warrant was hardly lawful or 

in good faith.  The Government, in keeping the entirety of the mirror images, 

kept substantial amounts of ʺcomputer associated dataʺ that did not ʺrelat[e] to 

29 
the business, financial and accounting operations of [IPM] and American Boiler.ʺ  

J. App. 433.  This sort of retention following a ʺwidespread seizureʺ was not 

explicitly authorized by the 2003 warrant, United States v. Shi Yan Liu, 239 F.3d 

138, 140 (2d Cir. 2000) (quoting United States v. Matias, 836 F.2d 744, 748 (2d Cir. 

1988)), and, as discussed, amounted to a general search.  Likewise, the 

Government points to no binding appellate precedent that allows it to retain files 

outside the scope of a warrant when the responsive files can be feasibly 

extracted.  Instead the Fourth Amendment baseline is that the Government may 

not take and then keep papers without a warrant ʺparticularly describing . . . the 

persons or things to be seized.ʺ  U.S. Const. amend. IV.   

The Government argues nonetheless that the agents had an 

objectively reasonable good faith belief that their post‐warrant conduct was 

lawful, because no precedent held that they could not do what they did.  The 

argument fails, in my view, for the precedents are absolutely clear that general 

warrants are unconstitutional and that government agents authorized to come 

into oneʹs home to seize papers for a limited purpose may not indiscriminately 

seize and retain all papers instead.  Any agent who professes to have the ability 

to do so merely because computers are involved is not acting in good faith.  

30 
 Moreover, the Governmentʹs formulation of ʺthe ʹgood faithʹ 

exception w[ould] swallow the exclusionary rule.ʺ  Davis, 564 U.S. at 258 (Breyer, 

J., dissenting).  The Government is essentially arguing that the absence of 

binding appellate precedent addressing the overseizure and retention of 

computer files excuses the agentsʹ actions.  But it has always been the case that 

agents must rely on something for their reliance to be objective.  That is, officers 

must ʺlearn ʹwhat is required of themʹ . . . and . . . conform their conduct to these 

rules.ʺ  Davis, 564 U.S. at 241 (majority opinion) (quoting Hudson v. Michigan, 547 

U.S. 586, 599 (2006)); see also id. at 250 (Sotomayor, J., concurring) (ʺ[W]hen police 

decide to conduct a search or seizure in the absence of case law (or other 

authority) specifically sanctioning such action, exclusion of the evidence 

obtained may deter Fourth Amendment violations . . . .ʺ).  Here, the basic 

principles were well settled and provided ample guidance.  And even if the 

warrant and our precedent were unclear as to what was allowed, the answer was 

not for agents to venture alone into uncharted constitutional territory.  See United 

States v. Johnson, 457 U.S. 537, 561 (1982) (ʺ[I]n close cases, law enforcement 

officials would have little incentive to err on the side of constitutional behavior.ʺ).  

Rather, the answer was for the agents to seek out a magistrate to authorize the 

31 
continued retention of Ganiasʹs non‐responsive files.  See CDT, 621 F.3d at 1179 

(Kozinski, J., concurring).  Once the responsive files were extracted, the 

Government could have asked to keep non‐responsive files for use during a 

prosecution or for the purpose of trial and allowed a magistrate to balance the 

Governmentʹs need against Ganiasʹs Fourth Amendment interests.  See Leon, 468 

U.S. at 916 (noting we would not ʺpunish the errors of judges and magistratesʺ).  

The Government did not do that, but instead retained the non‐responsive files for 

another year and a half before seeking judicial guidance.   

More troublingly, the agents here knew what they were supposed to 

do ‐‐ their actions were ʺdeliberate.ʺ  Davis, 564 U.S. at 238 (quoting Herring, 555 

U.S. at 144).  The agents knew they were supposed to return or delete overseized 

data.  When asked whether he was ʺto return those items or destroy those items 

that donʹt pertain to your lawful authority to seize those particular itemsʺ after a 

ʺreasonable periodʺ of off‐site review, the testifying agent answered, ʺYes, sir.ʺ  J. 

App. 145‐46; see also id. at 428 (Ganias corroborating that the agent ʺassured me 

that those materials and files not authorized under the warrant and not 

belonging to American Boiler and IPM would be purged once they completed 

their searchʺ).  Instead of following this protocol, that agent testified that the 

32 
investigators ʺviewed the data as the governmentʹs property, not Mr. Ganiasʹ 

property.ʺ  Id. at 146; see also id. at 122 (ʺAnd you never know what data you may 

need in the future.ʺ).  In other words, the agents ʺknew that limits of the warrant 

w[ere] not be[ing] honored.ʺ  United States v. Foster, 100 F.3d 846, 852 (10th Cir. 

1996).  This knowledge of the need to return or delete non‐responsive files 

compels a conclusion that the agents did not rely in good faith on the 2003 

warrant or any appellate precedent (binding or non‐binding) and that the 

deterrence value of suppression here is substantial. 

(2) 

I next turn to the 2006 warrant.  On April 24, 2006, the Government 

sought a warrant ‐‐ seeking to search ʺImages of three (3) hard drives seized on 

November 19, 2003 from the offices of Steve M. Ganiasʺ ‐‐ to investigate him 

personally.  J. App. 455.  A magistrate judge issued the warrant, and the 

Government searched the mirror images.   

For the purpose of deterring Fourth Amendment violations, the 

relevant inquiry is whether the agents acted in good faith when they committed 

the violation.  See Leon, 468 U.S. at 916 (ʺ[T]he exclusionary rule is designed to 

deter police misconduct . . . .ʺ).  The agents here could not have relied in good 

33 
faith on the 2006 warrant because it was issued almost two‐and‐a‐half years after 

the files were first overseized, and some sixteen months after the responsive files 

had been extracted.  That is, the agents did not rely on the 2006 warrant to retain 

non‐responsive files because that warrant came into being only after the Fourth 

Amendment violation occurred.  An agent can only rely on something that exists 

ʺat the time of the search.ʺ  Aguiar, 737 F.3d at 259; see Davis, 131 S. Ct. at 2418 

(asking if search was in ʺobjectively reasonable reliance on binding judicial 

precedentʺ as of ʺthe time of the searchʺ).   

In other words, the later 2006 warrant could not cure the prior illegal 

retention of Ganiasʹs data when agents did not rely on it to retain that data.  A 

warrant is not a Band‐Aid that the Government may seek when it realizes its 

Fourth Amendment violation has been discovered.  See Wayne R. LaFave, Search 

and Seizure:  A Treatise on the Fourth Amendment § 1.3(f) (5th ed. 2015) (ʺWhen the 

magistrate issued the warrant, he did not endorse past activity; he only 

authorized future activity.ʺ).  As we have previously held, ʺGood faith is not a 

magic lamp for police officers to rub whenever they find themselves in trouble.ʺ  

United States v. Reilly, 76 F.3d 1271, 1280 (2d Cir. 1996). 

34 
 The Government and the majority rely on a line of cases that 

includes United States v. Reilly, 76 F.3d 1271, and its predecessor, United States v. 

Thomas, 757 F.2d 1359 (2d Cir. 1985).  In Reilly, we affirmed the Thomas principle 

that illegally obtained evidence need not be excluded where the agents later 

obtained a warrant by providing a magistrate ʺthe details of their dubious pre‐

warrant conductʺ and where ʺʹthere was nothing more the officer could have or 

should have done under the[] circumstances to be sure his search would be 

legal.ʹʺ  Reilly, 76 F.3d at 1282 (alterations omitted) (quoting Thomas, 757 F.2d at 

1368).  We required, however, that the officer ʺdid not have any significant reason 

to believe that what he had done was unconstitutional.ʺ  Id. at 1281.10 

In this case, the agents did not present to the magistrate judge all of 

ʺthe details of their dubious pre‐warrant conduct.ʺ  Id. at 1282.  Though the 

majority points out that the agents disclosed to the magistrate judge in 2006 that 

the mirror images were seized in November 2003, that Ganias was not then 

10 As an initial observation, the Thomas principle is not free from doubt.  
Reilly acknowledged that Thomas is difficult to square with the holdings of many of our 
sister circuits without attempting to reconcile conflicting case law.  See id. at 1282 
(ʺOther courts have criticized Thomas . . . .ʺ); e.g., United States v. McGough, 412 F.3d 1232, 
1240 (11th Cir. 2005); United States v. OʹNeal, 17 F.3d 239, 243 (8th Cir. 1994); United 
States v. Scales, 903 F.2d 765, 768 (10th Cir. 1990); United States v. Vasey, 834 F.2d 782, 789 
(9th Cir. 1987).  Indeed, the language that exclusion may be avoided when the 
Government ʺdid not have any significant reason to believe that what [it] had done was 
unconstitutional,ʺ Reilly, 76 F.3d at 1282, may one day prove to be too lax. 

35 
under investigation, and that the mirror images included files outside the scope 

of the original warrant, this information was not sufficient on its own to permit 

the magistrate judge to evaluate whether the relevant constitutional violation 

occurred.  See Maj. Op. at 56‐57.  The agents did not disclose that they had 

segregated responsive files from non‐responsive files and extracted the 

responsive files and that for some time they did not have other, anticipated uses 

for the non‐responsive files.  Without this information relating to whether the 

Government still had a legitimate use for the mirror image during the retention, 

it simply would not have been feasible for a magistrate judge to consider the 

legitimacy of the continued retention of the mirror image.  See United States v. 

Vasey, 834 F.2d 782, 789 (9th Cir. 1987) (ʺTypically, warrant applications are 

requested and authorized under severe time constraints.ʺ).  

Likewise, unlike in Thomas, there was more that the Government 

could have done prior to 2006 to ensure that its conduct was legal.  See Thomas, 

757 F.2d at 1368.  As noted above, it could have gone to a magistrate judge much 

earlier for permission to retain the non‐responsive computer files. 

Finally, the Government did have significant reason to believe that 

its conduct was unconstitutional.  As noted, an agent testified that he knew he 

36 
was supposed to ʺreturn those items or destroy those items that d[idnʹt] pertain 

to [his] lawful authority to seize those particular items.ʺ  J. App. 145‐46.  And any 

reasonable law enforcement agent would have understood that it was 

unreasonable to ʺview[] [private property] as the governmentʹs propertyʺ or to 

treat the 2003 warrant as a general warrant.  Id. at 146.  Furthermore, the 

language of the 2003 warrant clearly set parameters for what was lawful:  only 

data ʺrelating toʺ IPM and American Boiler could be kept.  Id. at 433.   

At bottom, in holding that the Government acted with objectively 

reasonable reliance on the 2006 warrant, the majority condones creative uses of 

government power to interfere with individualsʹ possessory interests and to 

invade their privacy.  Without specifically opining on whether the Government 

can retain overseized, non‐responsive files, the majority has crafted a formula for 

the Government to do just that.  The Government only needs to:  obtain a 

warrant to seize computer data, overseize by claiming files are intermingled 

(they always will be), keep overseized data until the however distant future, and 

then (when probable cause one day develops) ask for another warrant to search 

what it has kept.  The rule that we have fashioned does nothing to deter the 

Government from continually retaining papers that are, though initially properly 

37 
seized, not responsive to or particularly described in a warrant.  Instead of 

deterring future violations, we have effectively endorsed them. 

The Government bears the burden of proving ʺthe objective 

reasonableness of the officersʹ good faith reliance.ʺ  Voustianiouk, 685 F.3d at 215 

(quoting George, 975 F.2d at 77).  It has not met that burden here.  To the contrary, 

the agents exhibited a deliberate or reckless or grossly negligent disregard for 

Ganiasʹs rights, see Davis, 564 U.S. at 238, and, in my view, the benefits of 

deterring the Governmentʹs unlawful actions here appreciably outweigh the 

costs of suppression, see Herring, 555 U.S. at 141; see also Davis, 564 U.S. at 232; Pa. 

Bd. of Prob. & Parole, 524 U.S. at 364‐65.   

III. 

In the discussion of lofty constitutional principles, we sometimes 

forget the impact that our rulings and proceedings may have on individuals and 

their families.  Here, there has been a cloud hanging over Ganiasʹs head for 

nearly thirteen years, impacting every aspect of his life and the lives of those 

around him.  The cloud is still there now. 

The wheels of justice have spun ever so slowly in this case.  The 

Government seized Ganiasʹs files in November 2003, nearly thirteen years ago.  

38 
He was indicted, in 2008, some eight years ago.  He waited two‐and‐a‐half years 

for a trial, and after he was found guilty, he waited roughly another ten months 

to be sentenced.  He appealed his conviction, but it took another year for his 

appeal to be heard, and then another year for the appeal to be decided. 

The panel issued its decision on June 17, 2014.  The panel held that 

the Government violated Ganiasʹs Fourth Amendment rights and rejected its 

reliance on the good faith exception.  On August 15, 2014, the Government filed a 

petition for rehearing, seeking panel rehearing only, not rehearing en banc, and 

seeking rehearing only with respect to the good faith exception.  In other words, 

the Government did not seek rehearing on whether the Fourth Amendment was 

violated, and it did not seek rehearing en banc on either issue.   

Yet, on June 29, 2015, more than a year after the panel decision, more 

than a year after Ganias thought he had won a substantial victory, this Court, on 

its own initiative, elected to rehear the case en banc ‐‐ with respect to both issues.  

The Court did so ostensibly to provide guidance in a novel and difficult area of 

law.  But, after a year‐long en banc process, no guidance has come forth.  The 

Court took on an issue at Ganiasʹs expense and then quickly retreated, relying 

instead on an issue that was not worthy of en banc review. 

39 
 Ganiasʹs non‐responsive files are in the Governmentʹs custody still.  

What began nearly thirteen years ago as an investigation by the Army into two of 

Ganiasʹs business clients somehow evolved into an unrelated investigation by the 

IRS into Ganiasʹs personal affairs, largely because the Government did precisely 

what the Fourth Amendment forbids:  it entered Ganiasʹs premises with a 

warrant to seize certain papers and indiscriminately seized ‐‐ and retained ‐‐ all 

papers instead. 

I respectfully dissent. 

40 
 Appendix A

Amici Curiae

Alan R. Friedman (counsel of record), Samantha V. Ettari, Noah Hertz-
Bunzl, Kramer Levin Naftalis & Frankel LLP, New York, NY, for Amicus
Curiae the Center for Constitutional Rights, in support of Defendant-Appellant.

Tanya L. Forsheit, Baker & Hostetler LLP, Los Angeles, CA, and William
W. Hellmuth, Baker & Hostetler LLP, Washington, DC (representing Amicus
Curiae Center for Democracy & Technology); Alex Abdo, Nathan Freed
Wessler, Jason D. Williamson, American Civil Liberties Union Foundation,
New York, NY; Dan Barrett, American Civil Liberties Union of
Connecticut, Hartford, CT; Faiza Patel, Brennan Center for Justice at NYU
School of Law, New York, NY; Hanni Fakhoury, Electronic Frontier
Foundation, San Francisco, CA; Laura M. Moy, Open Technology
Institute/New America, Washington, DC, for Amici Curiae Center for
Democracy & Technology, American Civil Liberties Union, American Civil
Liberties Union of Connecticut, Brennan Center for Justice at NYU School of
Law, Electronic Frontier Foundation, and New America’s Open Technology
Institution, in support of Defendant-Appellant.

Marc Rotenberg (counsel of record), Alan Butler, Electronic Privacy
Information Center, Washington, DC, for Amicus Curiae Electronic Privacy
Information Center, in support of Defendant-Appellant.

Colleen P. Cassidy (of counsel), Federal Defenders of New York, Inc.,
Southern District of New York, New York, NY; James Egan, Office of the
Federal Public Defender, Northern District of New York, Syracuse, NY, for
Amicus Curiae Federal Public Defenders Within the Second Circuit, in support of
Defendant-Appellant.

1
Todd M. Hinnen, Perkins Coie LLP, Seattle, WA, and Amanda Andrade,
Perkins Coie LLP, Washington, DC, for Amicus Curiae Google Inc., in support
of Defendant-Appellant.

Miranda E. Fritz, Eli B. Richlin, Thompson Hine LLP, New York, NY;
Richard D. Willstatter, Green & Willstatter, White Plains, NY; Joel B.
Rudin, Law Offices of Joel B. Rudin, P.C., New York, NY, for Amicus Curiae
National Association of Criminal Defense Lawyers, in support of Defendant-
Appellant.

Michael L. Yaeger, Barry A. Bohrer, Schulte Roth & Zabel LLP, New York,
NY, for Amicus Curiae New York Council of Defense Lawyers, in support of
Defendant-Appellant.

Mahesha P. Subbaraman, Subbaraman PLLC, Minneapolis, MN, for Amicus
Curiae Restore the Fourth, Inc., in support of Defendant-Appellant.

2