In re Search of Info. Associated With Email Addresses Stored at Premises Controlled by the Microsoft Corp.

212 F.Supp.3d 1023

IN THE MATTER OF the SEARCH OF INFORMATION ASSOCIATED WITH EMAIL ADDRESSES STORED AT PREMISES CONTROLLED BY THE MICROSOFT CORPORATION.

Case No. 16-MJ-8036

United States District Court, D. Kansas.

Signed September 28, 2016

MEMORANDUM AND ORDER

CARLOS MURGUIA, United States District Judge

On March 4, 2016, the government submitted to Magistrate Judge David J. Waxse an Application and Affidavit in Support of a Search Warrant to search three email accounts hosted by Microsoft ("Hotmail Accounts"). The government suspects these Hotmail Accounts are being used to further criminal activity. On March 29, 2016, Judge Waxse issued a Memorandum and Order Denying Application for Search Warrant (the "Order") (Doc. 2).

In denying the government's application, Judge Waxse concluded the warrant did not meet the probable cause and particularity requirements of the Fourth Amendment to the United States Constitution and that requests for the entirety of an individual's email account too closely resembled a general search. Judge Waxse, however, suggested these concerns could be remedied with "court-issued ex ante instructions" and advised the government to resubmit its application including either "a search protocol that addresses the concerns expressed in this opinion" or one of the other ex ante limitations recommended in the Order. Judge Waxse also expressed concern as to whether or not there was sufficient probable cause to include four individuals/identifiers in the warrant application. The government now seeks review of the Order, arguing that Judge Waxse's decision is clearly erroneous and contrary to existing law. For the reasons set forth below, the court both overrules and affirms Judge Waxse's decision and declines to grant the government's warrant in its current form.

I. Procedural History

As part of its investigation into possible violations of 18 U.S.C. §§ 371 (conspiracy), 1029 (access device fraud), 1030 (computer intrusion), 1343 (wire fraud), and 2319 (copyright infringement), the government applied for a search warrant seeking records related to three Hotmail Accounts. The government requested the Hotmail Account records from the email provider, Microsoft ("the Provider"), under 18 U.S.C. § 2703, also known as the Stored Communications Act ("SCA"). Pursuant to the warrant application, the Provider was required to disclose content from the three Hotmail Accounts including:

The contents of all emails associated with the account, including stored or preserved copies of emails sent to and from the account, draft emails, deleted emails, archived emails, the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email, as well as the entirety of header information for each email;

All records or other information regarding the identification of the account, to include full name, physical address, telephone numbers and other identifiers, records of session times and durations, the date on which the account was created, the length of service, the IP address used to register the account, log-in IP addresses associated with session times and dates, account status, alternative email addresses provided during registration, methods of connecting, log files, and means and source of payment (including any credit or bank account number);

The types of service utilized and/or associated with this account to include all identifiers for these services and any connection logs associated with the usage of these services;

All records or other information stored at any time by an individual using the account, including address books, contact and buddy lists, calendar data, pictures, and files; andAll records pertaining to communications between the Provider and any person regarding the account, including contacts with support services and records of actions taken.

Once the information was obtained from the Provider, the warrant application sought authorization for "government-authorized persons" to review the records to seize items that:

constitute fruits, contraband, evidence, and instrumentalities of violations of 18 U.S.C. §§ 371 (conspiracy), 1029 (access device fraud), 1030 (computer intrusion), 1343 (wire fraud), and 2319 (copyright infringement), those violations involving [redacted],¹ and others known and unknown, and occurring since September 7, 2008, including, for each account or identifier listed above, information pertaining to the following matters:

a. Evidence of the scanning or theft of intellectual property to include copyright-protected material and those bearing trademarks;

b. Evidence of using access drive(s) to fraudulently obtain intellectual property;

c. Evidence of developing, using, or distributing tools or code to circumvent copy controls associated with intellectual property;

d. Evidence of developing, using, or distributing software, code, or script as part of a "man-in-the-middle" computer intrusion;

e. Evidence indicating how and when the email account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crime under investigation and to the email account owner;

f. Evidence indicating the email account owner's state of mind as it relates to the crime under investigation;

g. The identity of the person(s) who created or used the user ID, including records that help reveal the whereabouts of such person(s);

h. The identity of the person(s) who communicated with the user ID about matters relating to the scanning or theft of intellectual property, or the various means to steal the intellectual property such as access device fraud, computer intrusion, or circumventing copy controls, including records that help reveal their whereabouts.

As part of its application, the government included an affidavit outlining the suspected criminal activity and the reasons why the specific Hotmail Accounts were under investigation.

After reviewing the application, Judge Waxse issued a Memorandum And Order Denying Application for Search Warrant (Doc. 2). In issuing his decision, Judge Waxse focused on the origins of the Fourth Amendment and the Framers' intent to prevent general searches. Judge Waxse noted the Fourth Amendment's particularity clause was included to prevent general searches and to enable the court to "ensure that the search will be carefully tailored to its justifications, and will not take on the character of the wide-ranging exploratory searches the Framers intended to prohibit." Id. at 8 (quoting Maryland v. Garrison , 480 U.S. 79, 84, 107 S.Ct. 1013, 94 L.Ed.2d 72 (1987) ).

In deciding whether the present warrant met the Fourth Amendment particularity requirements, Judge Waxse first acknowledged that little case law existed regarding the government's attempt to seize and search the entire contents of an individual email account. He noted that in the few cases that did exist, courts often found warrants for the entirety of an email account were not overly broad. Judge Waxse, however, expressed his disagreement with such decisions, believing these courts had not fully considered an individual's right to privacy in the contents of their email accounts.

After establishing a right to privacy in one's email, Judge Waxse found the most reasonable approach to considering the government's application to search the entirety of these Hotmail Accounts was to utilize a balancing test, weighing equally "the individual's right to privacy against the government's ability to prosecute suspected criminals effectively." Id. at 16. He reviewed the present application by separating it into two parts based on Rule 41 of the Federal Rules of Criminal Procedure : the place to be searched and the things to be seized.

Judge Waxse began by reviewing whether the warrant was sufficiently particular in the things to be seized, or, the evidence the government sought to retain during its search of the contents of the Hotmail Accounts. He found that, although the government established probable cause to seize information related to violations of the specific statutes or to certain individuals/identifiers named, the government had not established probable cause to seize any non-responsive information it received from the Provider. Judge Waxse expressed concern that in searching the vast amount of information that may be found in the entirety of an email account, the government may be exposed to far more information than it needs for its investigation, thus violating the individual's privacy. Importantly, he also found the government had not established probable cause as to four of the individuals/identifiers listed in the warrant application—[redacted]—and that including the phrase "and others known and unknown" was not sufficiently particular.

As for the place to be searched, Judge Waxse expressed concerns regarding whether the contents of an individual's email account met the Fourth Amendment's particularity requirement. He found that although the government identified a specific place to be searched—the individual email account—the disclosure of the entirety of that account may allow the government to view, and potentially use, information for which it did not have probable cause. Judge Waxse, however, noted that although an entire email account was not a sufficiently particular description of the place to be searched, the government could remedy this by providing a search protocol "explaining to the Court how it intends [to] search the overseized-[electronically stored information, or "ESI"] and what it will do with the non-responsive data once the search has been completed." Id. at 37.

In addition to the search protocols, Judge Waxse also suggested a variety of other ex ante instructions² for the government to consider that would bring the warrant within the allowed parameters of the Fourth Amendment. He noted "in its previous email opinions, the Court left the suggestion of ex ante...