Commonwealth v. Dorelas

Lenk, J.

(dissenting, with whom Duffly and Hines, JJ., join). The architects of art. 14 of the Massachusetts Declaration of Rights and the Fourth Amendment to the United States Constitution had in mind only searches of physical places and seizures of physical objects. Transposing these protections to digital contexts is an ongoing and challenging task, as the matter before us only underscores. I disagree with the court’s resolution of the issues presented here. In my view, the search of the photograph files on the defendant’s Apple iPhone “smart” cellular telephone was not supported by probable cause, and the warrant authorizing that search was not sufficiently particular. Furthermore, even had there been probable cause to support a search of the photograph files, the photographs seized by the police appear to have been outside the permissible scope of the warrant. I write separately for these reasons, and also to express my concern about the future direction of our search and seizure law in a digital context.

In an increasingly digital world, we continue to lean heavily on analogies between digital media and physical spaces and objects, *506such as that between a computer and a closed container. See, e.g., Commonwealth v. McDermott, 448 Mass. 750, 771-772, cert. denied, 552 U.S. 910 (2007). In reality, however, searches of physical spaces for physical objects are akin to searches of digital media for digital information much in the way that “a ride on horseback” resembles “a flight to the moon.” Riley v. California, 134 S. Ct. 2473, 2488 (2014). As a result, if we are to preserve the values that art. 14 and the Fourth Amendment seek to protect, we must view more critically our reliance on physical analogs, which may hamper rather than enhance our analyses; we also must be amenable to considering new paradigms that may advance our thinking. See generally Kerr, An Equilibrium-Adjustment Theory of the Fourth Amendment, 125 Harv. L. Rev. 476 (2011).

1. Probable cause. Probable cause requires “a ‘substantial basis’ ... for concluding that ‘the items sought are related to the criminal activity under investigation, and that they reasonably may be expected to be located in the place to be searched’ ” (citation omitted). Commonwealth v. Kaupp, 453 Mass. 102, 110 (2009). The digital media at issue in this case,1 however, do not fit neatly within this framework. What was the “place” to be searched — the defendant’s iPhone as a whole? Or only certain parts of it? And what were the “items” to be seized — categories of files? Or were they certain files, perhaps specific photographs of evidentiary value? See Kerr, Searches and Seizures in a Digital World, 119 Harv. L. Rev. 531, 551-557 (2005) (Kerr, Digital World) (discussing meaning of digital “search”). See generally Kerr, Executing Warrants for Digital Evidence: The Case for Use Restrictions on Nonresponsive Data, Tex. Tech L. Rev. (forthcoming) (on pages 23-28 of manuscript, discussing meaning of digital “seizure”).

As the court acknowledges, the warrant at issue here does not provide easy answers to these questions. Ante at note 3. The prop*507erty that the warrant authorized the police to search for and seize consisted principally of enumerated categories of files, including “saved and deleted photographs.”2 The warrant stated that these files were located “on an Apple iPhone” described by its physical appearance, which itself was situated at the Boston police department building in the Hyde Park section of Boston. Yet the warrant also incorporated by reference an affidavit that appeared to envision a broader, content-based search of the device. The affidavit concluded that probable cause existed to believe the defendant’s iPhone contained “valuable information” linking the defendant and his interlocutor to the crime.

Given this lack of clarity, the court correctly determines that the warrant for the iPhone describes the place to be searched as the physical device itself, and the items to be seized as the categories of files that it lists. See ante at note 3. The court incorrectly holds, however, that there was probable cause to search the entire set of photograph files on the defendant’s iPhone. In my view, there was not a substantial basis for concluding that the entire set of the defendant’s photograph files, rather than just the subset of photograph files attached to the defendant’s text and multimedia messages, was related to the criminal activity under investigation.3

An affidavit in support of a search warrant must be read “in an ordinary, commonsense manner, without hypertechnical analysis.” See Commonwealth v. Cruz, 430 Mass. 838, 840 (2000), and cases cited. This principle applies even where a search ventures into the vast store of private information available on a device like an iPhone. The probable cause analysis is limited to “the facts recited in the affidavit and any reasonable inferences therefrom.” Kaupp, supra at 107, citing Commonwealth v. Allen, 406 Mass. 575, 578 (1990).

Read in an ordinary, commonsense manner, and without resort*508ing to hypertechnical analysis, the facts in the affidavit and the reasonable inferences to be drawn from them did not provide probable cause to search the entire set of the defendant’s photograph files. In addition to recounting other facts concerning the shooting, the affidavit reported, based on the statements of three individuals, that the defendant had been receiving threatening telephone calls and text messages, and that he had been arguing on the telephone shortly before the shooting. This information provided probable cause to believe only that the iPhone’s files pertaining to calls and text messages would offer evidence of communications linking the defendant to the shooting. The iPhone’s lists of incoming, outgoing, and missed calls could have shed light on the identities of the individuals threatening the defendant and arguing with him. Its text message files could have provided similar information, and also could have revealed the content of some threats made against the defendant. According to the forensic expert, extraction of the text message files also would have retrieved any photographs attached to those messages, see ante at note 15, and the defendant has no quarrel with that fact.

What the affidavit did not provide was reason to believe that the iPhone’s entire set of photograph files, as opposed to only those photograph files attached to calls or text messages, would present evidence related to the shooting. In the abstract, I do not disagree with the court’s statement that “[c]ommunications can come in many forms including photographic.” Ante at 503. Nor, apparently, does the defendant. A photograph depicting a severed horse’s head, for instance, might well be used to communicate a threat (in the mode of “The Godfather” novel and motion picture). But the hypothetical viability of communication by photographic suggestion, even had it been mentioned in the affidavit, would not have supported a reasonable, commonsensical inference that a search of the defendant’s entire set of photograph files was needed to produce the subset of photographs that might at some point have been communicated.

The court reasons that, if a photograph file attached to a text message had been deleted and overwritten by new data, access to the entire set of photograph files on the iPhone might be necessary for a forensic investigator to find another copy of that specific file on the device. Ante at 504. As the court notes, however, there is no argument that the photographs at issue here were “received, taken, or stored long before the events leading up *509to the shooting” — the situation in which, in the ordinary course, photographs that had been attached to text messages would have been most likely to have been deleted and overwritten by new data.4 See ante at note 17.

In sum, the information presented to the magistrate did not create even a “[sjtrong reason to suspect” that the entire set of photograph files on the defendant’s iPhone were related to the criminal activity being investigated, much less a “substantial basis” for such a belief (citations omitted). See Kaupp, supra at 110-111, and cases cited. The search of those files was not supported by probable cause, and consequently it was unconstitutional.5

While there was surely probable cause to believe that there was evidence of the communications described in the affidavit somewhere within the defendant’s iPhone, the essence of the United States Supreme Court’s decision in Riley, supra, was that such devices cannot be treated like ordinary containers. This is because “a cell phone search would typically expose to the government far more than the most exhaustive search of a house.” Riley, supra at 2491. In one commentator’s words, “limiting a search to a particular computer is something like . . . limiting a search to the entire city.” Kerr, Digital Evidence and the New Criminal Procedure, 105 Colum. L. Rev. 279, 303 (2005).

We must not be taken in by the shape and size of a device that permits access to massive stores of information of different kinds. Where possible — recognizing that it not always is — it may be best to treat such a device more like a city than like a packing *510crate. Here, there was no impediment to limiting the search to certain types and categories of files stored in specific sections of the iPhone’s data storage. Because there was no substantial basis for believing that the entire set of photograph files on the defendant’s iPhone contained evidence related to the shooting, that portion of the iPhone should not have been included in the “place” to be searched.

2. Particularity. Article 14 and the Fourth Amendment also require that a warrant identify with particularity the place to be searched and the items to be seized. The requisite particularity, however, was not present in this case.6

Read commonsensically, the affidavit and warrant both envisioned a general search of the entire iPhone, rather than a targeted search for certain types of communications. Based on the facts it presents, the affidavit draws the general conclusion that the defendant’s iPhone “contains valuable information that will link the [defendant] and [another person] to the crime.” The affidavit proceeds to explain that, accordingly, permission is being sought to search the iPhone for a wide variety of categories of files. Several of these, such as the defendant’s “[s]peed dial list,” “[p]hone configuration information and settings,” and “[mjobile Internet browser,” were most unlikely to contain any evidence of the criminal activity under investigation. The warrant, in turn, authorized the seizure of most of the categories of files on the defendant’s iPhone, including all “saved and deleted photographs.”7

Allowing the police to search a broad variety of categories of files, many of which were at most tangentially related to the communications described in the affidavit, was an “end run” around *511the particularity requirement. Particularity should mean more than just a general directive to the police to look until they find something.

Creating particularized limitations beforehand for a search of a device capable of storing hundreds of thousands of files is difficult. But it is not impossible. As the court acknowledges, current search technology already allows forensic examiners to pinpoint their searches. Ante at 504. Accordingly, the warrant could have limited the search only to the iPhone’s call records and text message files — the categories of files most likely to provide evidence of the “threatening phone calls and threatening text messages” that preceded the shooting.8 The warrant also could have limited the search of any image files temporally to include only images stored on the device in the days or weeks leading up to the shooting. Compare United States v. Winn, 79 F. Supp. 3d 904, 921 (S.D. Ill. 2015) (“Most importantly, the warrant should have specified the relevant time frame”). Restrictions of this sort would prevent forensic investigators from exercising greater discretion than art. 14 and the Fourth Amendment allow. As the United States Supreme Court noted in Riley, supra at 2495, the fact that technology now enables an individual to store huge sums of information in his or her pocket “does not make the information any less worthy of the protection for which the Founders fought.”

3. Scope of the search. Finally, the photographs that the defendant seeks to suppress do not seem to have been within the *512scope of the search that the court deems permissible. Two of the four photographs at issue apparently show the defendant in possession of a gun, and two show him wearing a green jacket. It is possible that these images provided some measure of support for the inference that the defendant had participated in the shooting, since witnesses had seen one of the shooters wearing a green shirt or jacket. See ante at 497. The photographs were not, however, the kind of evidence that the police were (according to the court) permitted to be searching for — namely, communications relating to the shooting.

The court accordingly devises the hypothesis that the contested photographs “could well have been sent as a threatening communication to the person or persons who had apparently been threatening [the defendant].” Ante at 505. This hypothesis is implausible. The court’s theory is not rooted in an evaluation of the photographs, given that they are not part of the record before us. The Commonwealth, having examined the photographs, has not suggested that they constituted, singly or together, a “threatening communication” made by the defendant to anyone. Nor does the available information support such an interpretation.

The affidavit described three interviews concerning the communications for which, on the court’s view, the warrant authorized a search. According to the first interview, the defendant “received a [telephone call and started arguing with the caller on the [telephone,” and “left the apartment still arguing with the caller” shortly before the shooting took place. According to the second interview, the defendant “was receiving threatening [telephone calls and threatening text messages on his [telephone.” According to the third interview, the defendant had “been getting a lot of telephone threats because he owe[d] money to people.”

These interviews do not support the view that the photographs in question were included in the communications described. The first interview clearly described a telephone call rather than an exchange of picture messages. While the second and third interviews did not rule out the possibility that the threats described were communicated in photographs, both interviews specified that the threats were received, not sent. Nothing in the affidavit suggests that the defendant was using photographs of himself to threaten others. Moreover, even if the two photographs of the defendant holding a gun were intended as a threat, it strains credulity to assert that photographs of the defendant wearing a green jacket had a similar purpose. In sum, I question whether the *513forensic investigators reasonably could have understood the photographs at issue to be communications related to the shooting. By extension, the photographs would not be ones that the investigators were, on the court’s analysis, permitted to seize.

A corresponding flaw occurring in a physical search could have been cured by the “plain view” doctrine, according to which, “if officers, in the course of conducting a lawful search, discover evidence in plain view, such evidence may be seized.” See McDermott, supra at 777, citing United States v. Gray, 78 F. Supp. 2d 524, 528 (E.D. Va. 1999). Yet, recognizing that “the application of that doctrine to digital file searches may, at times, need to be limited,” ante at note 16, and sources cited, the court resists wholesale importation of the plain view doctrine into the current context.

There is good reason for the court’s caution on this score. Although the search at issue in this case was, according to the court, limited to “evidence of communications that would link the defendant and another person to the shooting,” ante at note 3, the plain view doctrine would render that constraint meaningless, given that “there is no conceivable way” to detect whether a picture is relevant evidence without first looking at it. See ante at 505.

It is an open question whether application of the plain view doctrine to searches of digital media would undermine the constitutional prohibition on general searches.9 This court applied the plain view doctrine to a search of computer files in McDermott, supra at 111. More recently, however, the court expressed concern that a search of digital files could be “joined with the plain view doctrine to enable the Commonwealth to use against defendants inculpatory evidence . . . even though such evidence may not actually fit within the scope of the search warrants obtained.” Preventive Med. Assocs. v. Commonwealth, 465 Mass. 810, 831-832 (2013). This prospect is worrisome because searches of digital information tend to require law enforcement to delve into, and *514carefully sift through, large stores of data. See United States v. Comprehensive Drug Testing, Inc., 621 F.3d 1162, 1176-1177 (9th Cir. 2010). The result is that “rules created to prevent general searches for physical evidence may result in the equivalent of general searches for digital evidence.” Kerr, Digital World, supra at 566.

In Preventive Med. Assocs., supra at 832, this court elected to “leave for another day the question whether use of the plain view doctrine as a justification for admission of evidence should be precluded or at least narrowed in the context of searches for electronic records.” While not today, the day when the court will be called upon to determine more precisely when and how the plain view exception applies to digital searches is likely close at hand.

The photographs that the defendant seeks to suppress were seized as the result of a three-part process. First, soon after the shooting in which the defendant was wounded, police searched his apartment pursuant to a warrant and seized his iPhone, among other items. Next, pursuant to a separate warrant, a Boston police department forensic examiner used a targeted data extraction technique to copy certain categories of files from the iPhone. Finally, the extracted files were studied to determine whether they contained the information sought. The search and seizure at issue here encompass the second and third of these stages, as the first stage was conducted pursuant to a separate warrant, not now contested.

Each photograph on the iPhone is stored in a separate file. The other categories of files listed in the warrant were the iPhone’s “contact list, address book, calendar, date book entries, group list, speed dial list, phone configuration information and settings, incoming and outgoing draft[,] sent, [and] deleted text messages, saved, opened, unopenedf,] draft[,] sent[,] and deleted electronic mail messages, mobile instant message chat logs and contact information[, and] mobile internet browser.”

Review of the denial of a motion to suppress is appropriate where, as here, “the ultimate findings and rulings bear on issues of constitutional dimension.” Commonwealth v. McDermott, 448 Mass. 750, 762, cert. denied, 552 U.S. 910 (2007), quoting Commonwealth v. Haas, 373 Mass. 545, 550 (1977), S.C., 398 Mass. 806 (1986).

In some circumstances, it might be natural to suspect that data deliberately has been concealed from inquiring eyes. See, e.g., United States v. Gray, 78 F. Supp. 2d 524, 527 n.5 (E.D. Va. 1999) (discussing investigation of hacking offenses). The facts set forth in the affidavit circumscribing our analysis, however, did not suggest that data concealment was otherwise a concern in this case. In any event, when an initial search leads a forensic investigator to believe that files have been deleted or otherwise concealed, the investigator of course may seek an additional warrant to perform a more far-reaching search for those files.

The Commonwealth argues that suppression is not warranted even if the search for the defendant’s photograph files was improper. “We have not adopted the ‘good faith’ exception for purposes of art. 14 of the Massachusetts Declaration of Rights or statutory violations, focusing instead on whether the violations are substantial and prejudicial.” Commonwealth v. Hernandez, 456 Mass. 528, 533 (2010). But “all violations of . . . probable cause requirements are substantial.” Commonwealth v. Sheppard, 394 Mass. 381, 389 (1985). See Commonwealth v. Nelson, 460 Mass. 564, 571 (2011).

The court declines to consider the defendant’s particularity arguments to the extent they were not raised in the Superior Court. See ante at note 8. However, these arguments were fairly raised: the defendant argued specifically that “[t]he particularity requirement serves as a safeguard against general exploratory rummaging by the police through a person’s belongings,” quoting Commonwealth v. Freiberg, 405 Mass. 282, 298, cert. denied, 493 U.S. 940 (1989). In addition, he contended that “the warrant became an impermissible general search.” Contrast Commonwealth v. Garcia, 409 Mass. 675, 678-679 (1991) (“An issue not fairly raised before the trial judge will not be considered for the first time on appeal”).

With regard to the reasonableness of the search’s execution, it also may be noted that video recording files were extracted from the iPhone even though those files were not named in the warrant either as places to be searched or as items to be seized. See ante at note 6.

Courts in other jurisdictions have taken this approach. See United States v. Winn, 19 F. Supp. 3d 904, 922 (S.D. Ill. 2015) (deeming warrant overbroad that did not limit seizure to “a very small and specific subset of data” or “describe that data with as much particularity as the circumstances allowed”). See also Matter of Black iPhone 4, 27 F. Supp. 3d 74, 79-80 (D.D.C. 2014) (requiring government to provide greater particularity with respect to procedures that would be used to avoid viewing material outside scope of warrant to search iPhone); State v. Henderson, 289 Neb. 271, 289 (2014), cert. denied, 135 S. Ct. 2845 (2015) (concluding that warrant for search of cellular telephone “must be sufficiently limited in scope to allow a search of only that content that is related to the probable cause that justifies the search”). Cf. Preventive Med. Assocs. v. Commonwealth, 465 Mass. 810, 829 (2013) (permitting use of “taint team” to screen out privileged electronic mail messages prior to review by investigator or prosecutor). The United States Court of Appeals for the Tenth Circuit concluded in United States v. Burgess, 576 F.3d 1078, 1094 (10th Cir.), cert. denied, 558 U.S. 1097 (2009), that review after the fact of the reasonableness of a given search satisfied the particularity requirement, but acknowledged that such review “may be problematic” in some contexts. Requiring a particularized warrant beforehand avoids these potential problems.

See, e.g., United States v. Galpin, 720 F.3d 436, 451 (2d Cir. 2013); United States v. Comprehensive Drug Testing, Inc., 621 F.3d 1162, 1176-1177 (9th Cir. 2010); Note, Digital Searches and the Fourth Amendment: The Interplay Between the Plain View Doctrine and Search-Protocol Warrant Restrictions, 49 Am. Crim. L. Rev. 301 (2012); Note, Computer Seizures and Searches: Rethinking the Applicability of the Plain View Doctrine, 83 Temple L. Rev. 1097 (2011). See also United States v. Ganias, 755 F.3d 125, 137-140 (2d Cir. 2014), rehearing en banc granted, 791 F.3d 290 (2015) (government not permitted to retain indefinitely nonresponsive documents seized in permissible search).