b. The Device Warrant Was an Unlawful General Warrant
The Device Warrant was an unconstitutional general warrant because it was completely lacking in particularity and as a result an overbroad' general warrant of the type "abhorred by the colonists" that lead to the creation of the Fourth Amendment and the particularity clause. Coolidge v. New Hampshire, 467, 91 S.Ct. 2022, 2038 (1971); see also Carpenter v. United States, 138 S.Ct. 2206, 2239-2240 (2018). Specifically, the warrant here failed to identify the data to be seized from the electronic devices or even the crime for which the police were required to restrict its search.
The amount of particularity required in a warrant can fluctuate depending on the nature of the case, evidence sought, and information known to police. See Andresen v. Maryland, 427 U.S. 463, 481 n. 10 & 11 (1976); United States v. Strand, 761 F.2d 449, 453 (8th Cir. 1985); United States v. Regan, 706 F.Supp. 1102, 1113 (S.D.N.Y.1989). However, one thing is clear-warrants must, at a bare minimum, state the crimes for which evidence is being sought. United States v. Cioffi, 668 F.Supp.2d 385, 390 (E.D.N.Y 2009); United States v. Otero, 563 F.3d 1127, 1132 (10th Cir. 2009); United States v. Rosa, 626 F.3d 56 (2d Cir. 2010); United States v. Zemlyansky, 945 F.Supp.2d 438 (2d Cir. 2013); United States v. Riccardi, 405 F.3d 852 (10th Cir. 2005); United States v. Clough, 246 F.Supp.2d 84 (D.M.E. 2003); United States v. Mink, 613 F.3d 995 (10th Cir. 2010); United States v. Hunter, 13 F.Supp.2d 574 (D. V.T. 1998); cf. United States v. Christie, 717 F.3d 1156 (10th Cir. 2013); United States v. George, 975 F.2d 72, 76 (2d Cir. 1992); United States v. Romain, 678 Fed.Appx. 23 (2d Cir 2017). This means the specific crime for which probable cause is found and not just a category of crime, as "[a]n unadorned reference to a broad federal statute does not sufficiently limit the scope of a search warrant." United States v. Leary, 846 F.2d 592, 602 (10th Cir. 1988); see also United States v. Spilotro, 800 F.2d 959, 965 (9th Cir.1986) (finding that search warrant violated particularity requirement where only limitation on scope of search was items to be seized had to be evidence of violation of one of thirteen statutes); United States v. Roche, 614 F.2d 6, 8 (1st Cir. 1980) (finding that search warrant violated particularity requirement where only limitation was reference to the mail fraud statute); Cassady v. Goering, 567 F.3d 628, 636 (10th Cir.2009); United States v. Clark, 31 F.3d 831, 836 (9th Cir. 1994). This is especially true where the statute is broad or language like "any or all data" accompanies the restriction. United States v. Winn, 79 F. Supp. 3d 904, 919 (S.D. Ill. 2015). This rule applies because, "whatever new challenges computer searches pose in terms of particularity, it is always necessary – and hardly onerous – to confine any search to evidence of particular crimes." Cioffi, 668 F. Supp. 2d at 392.
The search here was unlimited in that it allowed a search of any computer or computer storage device for the following:
any and all evidence of dominion and control over the computer, specifically, but not limited to, a computer possessing MAC address "EC:4F:82:29:84:03" or IP address "72.9.123.215"; peer to peer file trading software; any and all information pertaining to dates and times of access to the computer; any and all information pertaining to internet searches pertaining to posts regarding threats of violence directed towards schools or public officials; records and other items which evidence ownership or use of computer equipment found in the above residence; including but not limited to sales receipts, bills for internet access and handwritten notes, records evidencing occupancy or ownership of the premises described above including but not limited to utility and telephone bills, mail envelopes or address correspondence. Search Warrant, 18-MR-40 (emphasis added) (Exhibit F).
This does not limit the search to evidence of the threatening post. The language specifically "includes but is not limited to" the subsequent clauses which provide an illustrative but non-exclusive list of what the government may search for and seize. See In Matter of Black iPhone 4, 27 F.Supp.3d 74 (E.D.D.C. 2014) (Lists are illustrative rather than exclusionary where they include precursors like “[a]ll records...including" and then list different types of data). Lists of evidence that are illustrative rather than exclusionary or exhaustive should be heavily scrutinized. United States v. Wey, 2017 WL 257402 at *21-22 (S.D.N.Y. 2017). This is because those phrases "make the seizure list broader than the categories specifically listed." In Matter of Black iPhone 4, 27 F.Supp.3d at 78. Where such lists "merely identify generic classes of items and permit the seizure of virtually all conceivable documents" they cannot render an otherwise un-particularized warrant sufficiently particular. People v. Melamed, 178 A.D.3d 1079 (2d Dept. 2019).
The warrant did not limit the searches of any of the devices to any particular category(s) of information for example: web browser history, cookies, photographs, emails, etc. See e.g. Winn, 79 F. Supp. 3d at 919; United States v. Hunter, 13 F.Supp.2d,574, 581 (D. V.T. 1998). It did not provide temporal limitations on the search. See e.g. United States v. Abboud, 438 F.3d 554, 576 (6th Cir. 2006) ("Failure to limit broad descriptive terms by relevant dates, when such dates are available to the police, will render a warrant overbroad."); United States v. Kow, 58 F.3d 423, 427 (9th Cir. 1995) (warrant "not sufficiently particular" in part because the "government did not limit the scope of the seizure to a time frame within which the suspected criminal activity took place"); United States v. Abrams, 615 F.2d 541, 545 (1st Cir. 1980) (deeming warrant insufficiently particularized and noting, among other things, that "[a] time frame should also have been incorporated into the warrant"). Instead, the Device Warrant authorized an unfettered search of every device in the household "not limited to" an illustrative list of categories of information.
Warrants for "any and all files" that "include[] but [are] not limited to" an illustrative list of various types of data found on a phone are patently unconstitutional. Winn, 79 F. Supp. 3d at 919. In Winn the Southern District Court of Illinois noted "[t]he major, overriding problem with the description of the object of the search--"any or all files"--is that the police did not have probable cause to believe that everything on the phone was evidence of the crime of public indecency. Id. Instead there "was probable cause to believe that only two categories of data could possibly be evidence of the crime: photos and videos." Id. Furthermore even "[w]ith respect to the categories of data for which the police did have probable cause--the photos and the videos-the warrant was not as particular as could be reasonably expected given the nature of the crime and the information the police possessed. The warrant merely described the category of data, rather than specific items, which allowed the police to seize all of the photos and videos on Winn's phone, as opposed to specific photos and videos..." but "Detective Lambert knew the precise identity and content of the photos/videos sought. However, he failed to mention the characteristics that made those photos/videos easily identifiable and distinguished them from others that were irrelevant. For example, the warrant could have described the location of the incident as well as the subjects of the images-children at a swimming pool, or more specifically young girls in swimsuits at the Mascoutah Public Pool." Id. at 920. The court further noted that there were no temporal limitations and the only limit implied by the warrant was an unadorned reference to a criminal statute. Id. at 921.
Here the Device Warrant uses the same "any and all" language as Winn, the additional broad phrase "including but not limited to," followed by an illustrative list of various types of data. This illustrative list includes types of data for which there is not probable cause. It imposes no temporal limitations and fails to even impose the minimal restriction from Winn limiting the search to evidence of a specific criminal statute. The Device Warrant, at one point, makes an oblique reference to something resembling the facts in the case when it states "any and all information pertaining to internet searches pertaining to posts regarding threats of violence directed towards schools or public officials." However, that clause is in and of itself both overbroad and insufficiently particular. The affidavit did not contain any information establishing threats to public officials or towards schools in general. Had they actually connected Daugherty to that post (which they did not) the only possible thing they could investigate him for was the March 16, 2018, threat "FUCK YOU YOU STALKING MOTHER FUCKERS. I'LL SHOW YOU WHO IS AUSTIC. I'LL GO TO FUCKING MEMORIAL ELEMENTARY SCHOOL AND MAKE SANDY HOOK LOOK LIKE A SUNDAY SCHOOL PICNIC" posted on hateandflame.com. This is a basic tenant of probable cause and particularity a search for evidence of one crime does not allow a search for evidence of other crimes. United States v. Wey, 2017 WL 257402 at *18 (S.D.N.Y. 2017). Furthermore, there is no reason to believe they would find information relevant to their investigation in the form of an "internet search" as there were no facts that established any reason to believe an "internet search" was done for public officials or schools. Therefore, this clause (if it could be considered a clause at all) was both overly broad and lacking in particularity.
Similarly, the warrant mentions "peer to peer file trading software" this is both overbroad and insufficiently particularized. There is no mention of peer-to-peer file sharing in the affidavit for the device warrant. Therefore, it is overbroad. Similarly, it places no limits on what kind of peer-to-peer file sharing evidence the government may collect. Therefore, it is insufficiently particularized.
Finally, the warrant includes an "indicia of ownership" clause that allows for "records and other items which evidence ownership or use of computer equipment found in the above residence." Warrants allowing for searches of "indicia of ownership" have been rejected by courts across the country because they turn an otherwise valid warrant into a general warrant. See State v. Bock, 310 Or.App. 329 (Ct. Ap. Or. 2021); People v. Coke, 461 P.3d 508 (Colo. Sup. Ct. 2020); State v. Hamilton, No. 6:18-CR-57- REW-10, 2019 WL 4455997 (E.D. Ky. August 30, 2019); see also People v Herrera, 357 P.3d 1227 (Colo. Sup. Ct. 2015) (rejecting the use of such clauses to justify broad searches); United States v. Ford, 184 F.3d 566, 586 (6th Cir. 1999) (rejecting the use of similar clauses that would potentially allow limitless seizures of financial information).
In Bock, the Oregon Court of Appeals suppressed evidence recovered from a cell phone in part because of a clause allowing the government to search for "any evidence identifying the owner/user of the device." Bock, 310 Or.App. at 332. The court held that "regardless of whether the command to search for evidence of the owner or user of the device included a temporal limitation on the material subject to seizure... the search command violates the particularity requirement." Id. at 334. This is because "there is little information on the device that the state could not use to identify the defendant given the right circumstances and background information. Under such circumstances, the officer performing the search has the discretion to rummage freely throughout the device and seize nearly everything the exact practice that the particularity requirement was adopted to prohibit." Id. at 335. Similarly, in Hamilton, the District Court rejected the government's argument that broad
warrants are lawful because, "anything and everything in the Facebook account could be used to prove identity of the Facebook user and control of the account..." Hamilton, 2019 WL 4455997 at *5. The court reasoned that "[t]aken to its logical conclusion, this argument nearly obviates the particularity requirement altogether; almost anything in someone's social media data can be used to show they did (or did not) own and control that account." Id. The court elaborated, explaining that the government was
"certainly entitled to search for this information to a reasonable extent; for example, the registered user, email addresses, birth date, telephone number, physical address, and IP addresses associated with the account are likely to show ownership and control of the account. The breadth of information the search warrant required Facebook to disclose, however, amounted to "a general, exploratory rummaging" in [the defendant's] digital life that did not comport with the particularity requirement of the Fourth Amendment." Id.
The same logic from Bock and Hamilton applies to, and invalidates, the indicia of ownership "clause" here. One can only begin to imagine what might constitute "records and other items which evidence ownership or use of computer equipment found in the above residence." Nude photographs of the defendant, communications regarding his political affiliations, sexual orientation, medical history etc. could all demonstrate ownership of the computer equipment. As could IP addresses, web browser history, cookies, and text files. However, the warrant provides no explanation as to what the government may seize. Thus, the boundaries of this clause are left only to the imagination of the executing officer as they come across previously unidentified evidence during their unrestrained search. This is "the exact practice that the particularity requirement was adopted to prohibit." Bock, 310 Or.App. at 335.
The Device Warrant was a hopelessly unparticular and overbroad general warrant. Therefore, it violates the Fourth Amendment and Article I, Section 6 of the Illinois Constitution and any evidence obtained as a result of the warrant must be suppressed.
The Device Warrant was an unconstitutional general warrant because it was completely lacking in particularity and as a result an overbroad' general warrant of the type "abhorred by the colonists" that lead to the creation of the Fourth Amendment and the particularity clause. Coolidge v. New Hampshire, 467, 91 S.Ct. 2022, 2038 (1971); see also Carpenter v. United States, 138 S.Ct. 2206, 2239-2240 (2018). Specifically, the warrant here failed to identify the data to be seized from the electronic devices or even the crime for which the police were required to restrict its search.
The amount of particularity required in a warrant can fluctuate depending on the nature of the case, evidence sought, and information known to police. See Andresen v. Maryland, 427 U.S. 463, 481 n. 10 & 11 (1976); United States v. Strand, 761 F.2d 449, 453 (8th Cir. 1985); United States v. Regan, 706 F.Supp. 1102, 1113 (S.D.N.Y.1989). However, one thing is clear-warrants must, at a bare minimum, state the crimes for which evidence is being sought. United States v. Cioffi, 668 F.Supp.2d 385, 390 (E.D.N.Y 2009); United States v. Otero, 563 F.3d 1127, 1132 (10th Cir. 2009); United States v. Rosa, 626 F.3d 56 (2d Cir. 2010); United States v. Zemlyansky, 945 F.Supp.2d 438 (2d Cir. 2013); United States v. Riccardi, 405 F.3d 852 (10th Cir. 2005); United States v. Clough, 246 F.Supp.2d 84 (D.M.E. 2003); United States v. Mink, 613 F.3d 995 (10th Cir. 2010); United States v. Hunter, 13 F.Supp.2d 574 (D. V.T. 1998); cf. United States v. Christie, 717 F.3d 1156 (10th Cir. 2013); United States v. George, 975 F.2d 72, 76 (2d Cir. 1992); United States v. Romain, 678 Fed.Appx. 23 (2d Cir 2017). This means the specific crime for which probable cause is found and not just a category of crime, as "[a]n unadorned reference to a broad federal statute does not sufficiently limit the scope of a search warrant." United States v. Leary, 846 F.2d 592, 602 (10th Cir. 1988); see also United States v. Spilotro, 800 F.2d 959, 965 (9th Cir.1986) (finding that search warrant violated particularity requirement where only limitation on scope of search was items to be seized had to be evidence of violation of one of thirteen statutes); United States v. Roche, 614 F.2d 6, 8 (1st Cir. 1980) (finding that search warrant violated particularity requirement where only limitation was reference to the mail fraud statute); Cassady v. Goering, 567 F.3d 628, 636 (10th Cir.2009); United States v. Clark, 31 F.3d 831, 836 (9th Cir. 1994). This is especially true where the statute is broad or language like "any or all data" accompanies the restriction. United States v. Winn, 79 F. Supp. 3d 904, 919 (S.D. Ill. 2015). This rule applies because, "whatever new challenges computer searches pose in terms of particularity, it is always necessary – and hardly onerous – to confine any search to evidence of particular crimes." Cioffi, 668 F. Supp. 2d at 392.
The search here was unlimited in that it allowed a search of any computer or computer storage device for the following:
any and all evidence of dominion and control over the computer, specifically, but not limited to, a computer possessing MAC address "EC:4F:82:29:84:03" or IP address "72.9.123.215"; peer to peer file trading software; any and all information pertaining to dates and times of access to the computer; any and all information pertaining to internet searches pertaining to posts regarding threats of violence directed towards schools or public officials; records and other items which evidence ownership or use of computer equipment found in the above residence; including but not limited to sales receipts, bills for internet access and handwritten notes, records evidencing occupancy or ownership of the premises described above including but not limited to utility and telephone bills, mail envelopes or address correspondence. Search Warrant, 18-MR-40 (emphasis added) (Exhibit F).
This does not limit the search to evidence of the threatening post. The language specifically "includes but is not limited to" the subsequent clauses which provide an illustrative but non-exclusive list of what the government may search for and seize. See In Matter of Black iPhone 4, 27 F.Supp.3d 74 (E.D.D.C. 2014) (Lists are illustrative rather than exclusionary where they include precursors like “[a]ll records...including" and then list different types of data). Lists of evidence that are illustrative rather than exclusionary or exhaustive should be heavily scrutinized. United States v. Wey, 2017 WL 257402 at *21-22 (S.D.N.Y. 2017). This is because those phrases "make the seizure list broader than the categories specifically listed." In Matter of Black iPhone 4, 27 F.Supp.3d at 78. Where such lists "merely identify generic classes of items and permit the seizure of virtually all conceivable documents" they cannot render an otherwise un-particularized warrant sufficiently particular. People v. Melamed, 178 A.D.3d 1079 (2d Dept. 2019).
The warrant did not limit the searches of any of the devices to any particular category(s) of information for example: web browser history, cookies, photographs, emails, etc. See e.g. Winn, 79 F. Supp. 3d at 919; United States v. Hunter, 13 F.Supp.2d,574, 581 (D. V.T. 1998). It did not provide temporal limitations on the search. See e.g. United States v. Abboud, 438 F.3d 554, 576 (6th Cir. 2006) ("Failure to limit broad descriptive terms by relevant dates, when such dates are available to the police, will render a warrant overbroad."); United States v. Kow, 58 F.3d 423, 427 (9th Cir. 1995) (warrant "not sufficiently particular" in part because the "government did not limit the scope of the seizure to a time frame within which the suspected criminal activity took place"); United States v. Abrams, 615 F.2d 541, 545 (1st Cir. 1980) (deeming warrant insufficiently particularized and noting, among other things, that "[a] time frame should also have been incorporated into the warrant"). Instead, the Device Warrant authorized an unfettered search of every device in the household "not limited to" an illustrative list of categories of information.
Warrants for "any and all files" that "include[] but [are] not limited to" an illustrative list of various types of data found on a phone are patently unconstitutional. Winn, 79 F. Supp. 3d at 919. In Winn the Southern District Court of Illinois noted "[t]he major, overriding problem with the description of the object of the search--"any or all files"--is that the police did not have probable cause to believe that everything on the phone was evidence of the crime of public indecency. Id. Instead there "was probable cause to believe that only two categories of data could possibly be evidence of the crime: photos and videos." Id. Furthermore even "[w]ith respect to the categories of data for which the police did have probable cause--the photos and the videos-the warrant was not as particular as could be reasonably expected given the nature of the crime and the information the police possessed. The warrant merely described the category of data, rather than specific items, which allowed the police to seize all of the photos and videos on Winn's phone, as opposed to specific photos and videos..." but "Detective Lambert knew the precise identity and content of the photos/videos sought. However, he failed to mention the characteristics that made those photos/videos easily identifiable and distinguished them from others that were irrelevant. For example, the warrant could have described the location of the incident as well as the subjects of the images-children at a swimming pool, or more specifically young girls in swimsuits at the Mascoutah Public Pool." Id. at 920. The court further noted that there were no temporal limitations and the only limit implied by the warrant was an unadorned reference to a criminal statute. Id. at 921.
Here the Device Warrant uses the same "any and all" language as Winn, the additional broad phrase "including but not limited to," followed by an illustrative list of various types of data. This illustrative list includes types of data for which there is not probable cause. It imposes no temporal limitations and fails to even impose the minimal restriction from Winn limiting the search to evidence of a specific criminal statute. The Device Warrant, at one point, makes an oblique reference to something resembling the facts in the case when it states "any and all information pertaining to internet searches pertaining to posts regarding threats of violence directed towards schools or public officials." However, that clause is in and of itself both overbroad and insufficiently particular. The affidavit did not contain any information establishing threats to public officials or towards schools in general. Had they actually connected Daugherty to that post (which they did not) the only possible thing they could investigate him for was the March 16, 2018, threat "FUCK YOU YOU STALKING MOTHER FUCKERS. I'LL SHOW YOU WHO IS AUSTIC. I'LL GO TO FUCKING MEMORIAL ELEMENTARY SCHOOL AND MAKE SANDY HOOK LOOK LIKE A SUNDAY SCHOOL PICNIC" posted on hateandflame.com. This is a basic tenant of probable cause and particularity a search for evidence of one crime does not allow a search for evidence of other crimes. United States v. Wey, 2017 WL 257402 at *18 (S.D.N.Y. 2017). Furthermore, there is no reason to believe they would find information relevant to their investigation in the form of an "internet search" as there were no facts that established any reason to believe an "internet search" was done for public officials or schools. Therefore, this clause (if it could be considered a clause at all) was both overly broad and lacking in particularity.
Similarly, the warrant mentions "peer to peer file trading software" this is both overbroad and insufficiently particularized. There is no mention of peer-to-peer file sharing in the affidavit for the device warrant. Therefore, it is overbroad. Similarly, it places no limits on what kind of peer-to-peer file sharing evidence the government may collect. Therefore, it is insufficiently particularized.
Finally, the warrant includes an "indicia of ownership" clause that allows for "records and other items which evidence ownership or use of computer equipment found in the above residence." Warrants allowing for searches of "indicia of ownership" have been rejected by courts across the country because they turn an otherwise valid warrant into a general warrant. See State v. Bock, 310 Or.App. 329 (Ct. Ap. Or. 2021); People v. Coke, 461 P.3d 508 (Colo. Sup. Ct. 2020); State v. Hamilton, No. 6:18-CR-57- REW-10, 2019 WL 4455997 (E.D. Ky. August 30, 2019); see also People v Herrera, 357 P.3d 1227 (Colo. Sup. Ct. 2015) (rejecting the use of such clauses to justify broad searches); United States v. Ford, 184 F.3d 566, 586 (6th Cir. 1999) (rejecting the use of similar clauses that would potentially allow limitless seizures of financial information).
In Bock, the Oregon Court of Appeals suppressed evidence recovered from a cell phone in part because of a clause allowing the government to search for "any evidence identifying the owner/user of the device." Bock, 310 Or.App. at 332. The court held that "regardless of whether the command to search for evidence of the owner or user of the device included a temporal limitation on the material subject to seizure... the search command violates the particularity requirement." Id. at 334. This is because "there is little information on the device that the state could not use to identify the defendant given the right circumstances and background information. Under such circumstances, the officer performing the search has the discretion to rummage freely throughout the device and seize nearly everything the exact practice that the particularity requirement was adopted to prohibit." Id. at 335. Similarly, in Hamilton, the District Court rejected the government's argument that broad
warrants are lawful because, "anything and everything in the Facebook account could be used to prove identity of the Facebook user and control of the account..." Hamilton, 2019 WL 4455997 at *5. The court reasoned that "[t]aken to its logical conclusion, this argument nearly obviates the particularity requirement altogether; almost anything in someone's social media data can be used to show they did (or did not) own and control that account." Id. The court elaborated, explaining that the government was
"certainly entitled to search for this information to a reasonable extent; for example, the registered user, email addresses, birth date, telephone number, physical address, and IP addresses associated with the account are likely to show ownership and control of the account. The breadth of information the search warrant required Facebook to disclose, however, amounted to "a general, exploratory rummaging" in [the defendant's] digital life that did not comport with the particularity requirement of the Fourth Amendment." Id.
The same logic from Bock and Hamilton applies to, and invalidates, the indicia of ownership "clause" here. One can only begin to imagine what might constitute "records and other items which evidence ownership or use of computer equipment found in the above residence." Nude photographs of the defendant, communications regarding his political affiliations, sexual orientation, medical history etc. could all demonstrate ownership of the computer equipment. As could IP addresses, web browser history, cookies, and text files. However, the warrant provides no explanation as to what the government may seize. Thus, the boundaries of this clause are left only to the imagination of the executing officer as they come across previously unidentified evidence during their unrestrained search. This is "the exact practice that the particularity requirement was adopted to prohibit." Bock, 310 Or.App. at 335.
The Device Warrant was a hopelessly unparticular and overbroad general warrant. Therefore, it violates the Fourth Amendment and Article I, Section 6 of the Illinois Constitution and any evidence obtained as a result of the warrant must be suppressed.