Dimaggio v. Super. Ct. of Monterey Cty.

325 Cal.Rptr.3d 74

Nathaniel DIMAGGIO, Petitioner,

v.The SUPERIOR COURT OF MONTEREY COUNTY, Respondent;

The People, Real Party in Interest.

H051516

Court of Appeal, Sixth District.

Filed August 30, 2024

Trial Court: County of Monterey, Trial Judge: Honorable Heidi K. Whilden (Monterey County Super. Ct. No. 22CR004734)

Juliet Peck, Salinas, for Petitioner.

No appearance for Respondent.

Jeannine M. Pacioni, District Attorney, and Glenn Pesenhofer, Deputy District Attorney, for Real Party in Interest.

Danner, J.

Nathaniel DiMaggio brought this petition for writ of mandate (petition) to chal- lenge the denial of a motion to suppress evidence obtained during a search of his cellphone and tablet. DiMaggio contends that, while the trial court correctly found the Monterey County Sheriff’s Office (sheriff’s office) exceeded the scope of the search warrant when executing the search, it erred in finding the sheriff’s office acted in good faith and in denying the motion on that basis. On behalf of real party in interest the People, the Monterey County District Attorney claims the sheriff’s office properly executed the search warrant and acted in good faith.

We agree with DiMaggio and will issue a peremptory writ of mandate directing respondent court to vacate its order denying DiMaggio’s motion to suppress and to enter a new order suppressing any evidence obtained by the sheriff’s office falling outside the date and time limitations set forth in the search warrant.

I. FACTS AND PROCEDURAL BACKGROUND¹

A. Background, Search Warrant, and Charges

Jane Doe accused DiMaggio of sexually assaulting her sometime during the evening of May 7, 2022,² into the morning of May 8, after they had drinks together at a restaurant with Jane Doe’s husband and two of her friends.

Jane Doe called the sheriff’s office on May 9 to report the sexual assault. With Jane Doe’s permission, then-Detective Sergeant Brian Hoskins used Jane Doe’s cellphone to conduct a pretext text exchange with DiMaggio to attempt to elicit an admission from DiMaggio that he sexually assaulted Jane Doe.

On May 16, Detective David Gonzalez, who was at that time assigned to the sexual assault and domestic violence unit, authored an affidavit and statement of probable cause (jointly, the affidavit) to secure a search warrant for DiMaggio’s cellphone and tablet. In the statement of probable cause, Gonzalez set forth his training and experience. He stated that sexual assault perpetrators have been known to take photographs of their victims and store such images on their mobile devices.³ He also observed that image and video files "are often embedded with [metadata]," which can include the date and time the file was downloaded or created.⁴ He cautioned that some image and video files "can have their creation times stripped out of their [metadata] which can make a date range not feasible." Relying on his training and experience, Detective Gonzalez asserted "that often within [sic] a device will have no date and time associated with data" and "that data will have incorrect dates and times associated with data." Thus, he requested in the statement of probable cause a search "for all content with a date and time or with no date and time associated to [sic] the data."

Detective Gonzalez drafted the proposed warrant to search DiMaggio’s cellphone for categories of evidence, including images, related to the sexual assault of Jane Doe. Despite requesting a search for content with and without associated date and time information in the statement of probable cause, Gonzalez drafted the search warrant itself to authorize a search only for images falling within a one-month time period. Gonzalez did not include items without timestamps in the search warrant’s exhibit (exhibit 1B) that listed items to be seized.

A judge of the Monterey County Superior Court found the warrant was supported by probable cause and issued search warrant 22SW000563 (search warrant).⁵ As pertinent here, the search warrant authorized Monterey County peace officers to search DiMaggio’s cellphone and tablet "for the following evidence, for the described time period: [¶] Time Period [[Penal Code] § 1546.1[, subd.] (d)(1)⁶: 4.8.2022 at 0001 hours to 5.9.2022 at 2359 hours (Pacific Daylight Time)[.] [¶] Evidence: All data constituting evidence and instrumentalities of sexual assaults including communications referring or relating to the above-listed criminal offenses, between from 4.8.2022 at 0001 hours to 5.9.2022 at 2359 hours (Pacific Daylight Time) as follows: [¶] (1) All communications content, including email, text (short message service (SMS)/multimedia message service (MMS) or application chats), notes, or voicemail. This data will also include attachments, source and destination addresses, and time and date information, and connection logs, images and any other records that constitute evidence and instrumentalities of sexual assaults, including communications referring or relating to the above-listed criminal offenses, together with indicia of use, ownership, possession, or control of such communications or information found, including deleted data. [¶] [¶] (3) All photographic/video/audio data and associated metadata, including deleted data." The date and time parameters appear in bold font in the search warrant.

As discussed in greater detail post (pt. I.B.), when the sheriff’s office executed the search warrant, it found images of suspected child pornography on DiMaggio’s cellphone. Detective Gonzalez then authored a second search warrant to search DiMaggio’s cellphone, this time "for child pornography."⁷

The Monterey County District Attorney filed an information charging DiMaggio with numerous counts of sexual assault, including three counts of sexual assault of Jane Doe, and one count of possession of matter depicting a minor engaging in sexual conduct (§ 311.11, subd. (a); count 4).

B. Motion to Suppress and Suppression Hearing

DiMaggio filed a motion to suppress evidence obtained by the sheriff’s office when they searched his cellphone and tablet pursuant to the first search warrant. The trial court treated DiMaggio’s motion as three motions, one to quash, one to traverse the search warrant, and one to suppress.⁸ DiMaggio’s motion to suppress requested the "suppression of ‘any electronic information obtained or retained in violation of the Fourth Amendment to the United States Constitution or [the California Electronic Communications Privacy Act (§ 1546 et seq.)],’ " "including the fifteen images that form the basis of count four."

During the hearing on the motion to suppress in September 2023, witnesses described the process by which data on DiMaggio’s cellphone and tablet was accessed, searched, and reviewed both by the sheriff’s office and by DiMaggio’s digital forensics expert witness.

Ryan Acevedo, a digital forensics investigator with the sheriff’s office at the time of the execution of the search warrant in May 2022, extracted the data from DiMaggio’s cellphone. On or about May 16, he received a copy of the search warrant and the exhibits attached thereto but not the statement of probable cause or any information about the case. He confirmed the date and time parameters on the search warrant before performing the extraction using a software program called GrayKey. After GrayKey extracted the data, Acevedo used a software program called Cellebrite Physical Analyzer to "unpack[ ] and parse[ ] out" the raw GrayKey data to present it in a readable format and filter the data to limit it to specific dates and times.⁹

Once the data was "unpacked" in Cellebrite, prior to generating the report, Acevedo checked the search warrant for the start and end dates of the temporal parameters, filtered the data for the timeframe indicated on the search warrant, and selected the option to include items that do not have any metadata. He explained that "[m]etadata is the information that is contained within a picture, and it has information on it, [ ] such as where the picture was taken, the dates and times that it was taken," and later clarified that the option he selected in Cellebrite was "[i]tems without timestamps."

Acevedo explained that representatives from Cellebrite had trained him to check the "items without timestamps" box to "include all the data that you can get from the extraction into the report," even if the data was not within the search warrant parameters. Between February 2019 (when he first became certified to use the Cellebrite program) and May 2022, Acevedo estimated he conducted 200 to 300 extractions of electronically stored information using Cellebrite, including approximately 100 extractions that he performed pursuant to a search warrant. It was his "standard protocol" to include in the search results images that did not contain timestamps, even when performing extractions pursuant to a warrant, regardless of whether "items without timestamps" fell within the scope of the search warrant.

Cellebrite told him it was "best practice" to select the " ‘items without timestamps’ " option because it would allow the capture of data from which metadata had been scrubbed, and the attorneys or detectives would be responsible for determining whether the information fell within the search warrant parameters. He testified that he was "trained that the more information [he] captured in the limited Cellebrite reports, the more likely there would be detection of evidence of a crime," though it is not clear from the record who provided this guidance.

Acevedo followed this same practice when executing the search warrant on DiMaggio’s cellphone. He applied a time filter for the dates indicated in exhibit 1B of the search warrant and selected the option to include items that did not have timestamps. He acknowledged that the enumerated types of evidence in exhibit 1B of the search warrant did not authorize a search for items without timestamps and that it was his job to use the parameters in the search warrant to...