U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014)

U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) ' KeyCite Yellow Flag • Negative Treatment Declined to Extend by United States v. Hassanshahi, D.D.C., December 1, 2014 990 F.Supp.2d 536 United States District Court, D. Maryland, Southern Division. UNITED STATES of America v. Ali SABOONCHI, et al. Criminal Case No. PWG-13—too. J Signed April 7, of the sovereign to protect itself by stopping and examining persons and property crossing into the country, are reasonable, within meaning of the Fourth Amendment, simply by virtue of the fact that they occur at the border. U.S.C.A. Const.Amend. 4. Cases that cite this headnote 121 Customs Duties 2014. aaGrounds or cause for stop, search, or seizure Synopsis Background: Defendant, indicted for multiple counts of unlawful export to an embargoed country and one count of conspiracy to export to an embargoed country, in violation of the International Emergency Economic Powers Act (IEEPA) and the Iranian Transactions and Sanctions Regulations (ITSR), moved to suppress evidence obtained during warrantless forensic searches of his smartphones and flash drive. Holdings: The District Court, Paul W. Grimm, J., held that: (I) reasonable suspicion was required for performance of forensic searches of digital devices taken from defendant at border, and (2) reasonable suspicion existed to support such search. Motion denied. West Headnotes (19) Ill Customs Duties oiSearches and Seizures Government's interest in preventing the entry of unwanted persons and effects is at its zenith at the international border, and thus searches made at the border, pursuant to the long-standing right Routine searches of the persons and effects of entrants at a border are not subject to any requirement of reasonable suspicion, probable cause, or warrant. U.S.C.A. Const.Amend. 4. Cases that cite this headnote PI Customs Duties i•Searches and Seizures Even at the border, Fourth Amendment continues to protect against unreasonable searches and seizures. U.S.C.A. Const.Amend. 4. Cases that cite this headnote Customs Duties iiSearches and Seizures At the border, routine searches become reasonable within meaning of the Fourth Amendment because the interest of the Government is far stronger and the reasonable expectation of privacy of an individual seeking entry is considerably weaker. U.S.C.A. Const.Amend. 4. Cases that cite this headnote WestlawNext" © 2015 Thomson Reuters. No claim to original U.S. Government Works. 1 EFTA01207766 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) PI Customs Duties p-Grounds or cause for stop, search, or seizure lel When a border search stretches beyond the routine, it must rest on reasonable, particularized suspicion, which is significantly less demanding than the showing of probable cause required to secure a warrant for a domestic search. U.S.C.A. Const.Amend. 4. Cases that cite this headnote Searches and Seizures 6Scope, Conduct, and Duration of Warrantless Search Under the Fourth Amendment, mere fact that a search includes computer files does not transform it from routine to nonroutine. U.S.C.A. Const.Amend. 4. Cases that cite this headnote Customs Duties Jaime and distance factors; checkpoints Under the Fourth Amendment, a border search need not take place at the border. U.S.C.A. Const.Amend. 4. Cases that cite this headnote Customs Duties p-rime and distance factors; checkpoints Customs Duties 4,Airports and airplanes Under the Fourth Amendment, border searches may in certain circumstances take place not only at the border itself, but at its functional equivalents as well; the functional equivalent of a border may include an established station near the border, at a point marking the confluence of two or more roads that extend from the border, or the search of passengers and cargo arriving at an airport within the United States after a nonstop flight from abroad. U.S.C.A. Const.Amend. 4. Cases that cite this headnote Pi Customs Duties 411'ime and distance factors; checkpoints Extended border search doctrine has been applied to entry border searches conducted some time after the border was crossed. Cases that cite this headnote Customs Duties faTime and distance factors; checkpoints Unlike searches that actually occur at a border or the functional equivalent thereof, an extended border search requires reasonable suspicion with respect to the criminal nature of the person or thing searched as well as reasonable suspicion that the subject of the search has crossed a border within a reasonably recent time. U.S.C.A. Const.Amend. 4. I Cases that cite this headnote Irrt Customs Duties f'-Time and distance factors; checkpoints Government agents' search of defendant's electronic devices was not an extended border search within meaning of the Fourth Amendment; the devices did not enter the country with defendant, but were returned to him at a later date. U.S.C.A. Const.Amend. 4. WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 2 EFTA01207767 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) searches. U.S.C.A. Const.Amend. 4. Cases that cite this headnote Cases that cite this headnote 1121 Customs Duties v-Time and distance factors; checkpoints A border search of a computer is not transformed into an extended border search under the Fourth Amendment simply because the device is transported and examined beyond the border. U.S.C.A. Const.Amend. 4. 2 Cases that cite this headnote Customs Duties 4-Grounds or cause for stop, search, or seizure A forensic border search of a computer or electronic device should be considered a nonroutine search for which reasonable suspicion is required under the Fourth Amendment. U.S.C.A. Const.Amend. 4. 3 Cases that cite this headnote Customs Duties iaPersonal, skin, or strip searches; pat•down Even the border search power cannot justify a strip search without any particularized suspicion. U.S.C.A. Const.Amend. 4. Cases that cite this headnote I151 Customs Duties Ii0Grounds or cause for stop, search, or seizure A border search that goes beyond the routine is justified merely by reasonable suspicion, a lesser standard than required for analogous non-border 116) Searches and Seizures 4-Scope, Conduct, and Duration of Warrantless Search Even if a search is not destructive or damaging, if it is sufficiently invasive or intrusive, or butts up against other Fourth Amendment values, it may be nonroutine. U.S.C.A. Const.Amend. 4. Cases that cite this headnote Customs Duties oilScope and Nature; Successive or Secondary Searches Under the Fourth Amendment, a routine border search may include a conventional inspection of electronic media and a review of the files on them just as it may include physical papers. U.S.C.A. Const.Amend. 4. 2 Cases that cite this headnote filet Customs Duties 0-Time and distance factors; checkpoints Reasonable suspicion was required for forensic search of imaged hard drives of digital devices taken from defendant at the border and subjected to forensic examination at later time; search would result in exposure of intimate details and abrogate defendant's reasonable expectations of privacy in his most personal and confidential affairs. U.S.C.A. Const.Amend. 4. 1 Cases that cite this headnote WestlawNexi © 2015 Thomson Reuters. No claim to original U.S. Government Works. 3 EFTA01207768 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) Customs Duties e'-Grounds or cause for stop, search, or seizure Reasonable suspicion supported forensic search of smartphone and flash drive taken from defendant as he crossed border; defendant's name had come up in connection with two different investigations of export violations, information received in response to previously -issued subpoenas showed that he had purchased two cyclone separators after representing that they would be used domestically, and then shipped them overseas, understating their value in a manner consistent with an attempt to avoid scrutiny, and investigation had determined that the recipient of the separators was linked to a company in Iran. U.S.C.A. Const.Amend. 4. Cases that cite this headnote Attorneys and Law Firms *538 Christine Manueliart, Rod J. Rosenstein, Office of the United States Attorney, Baltimore, MD, for United States of America. *539 Elizabeth Genevieve Oyer, Office of the Federal Public Defender, Baltimore, MD, for Ali Saboonchi, et al. MEMORANDUM OPINION PAUL W. GRIMM, District Judge. Defendant Ali Saboonchi is alleged to have violated U.S. export restrictions on trade with the Islamic Republic of Iran. On July I 8, 2013, Saboonchi moved to suppress the fruits of warrantless forensic searches of his smartphones and flash drive performed under the authority of the border search doctrine after they were seized at the U.S.—Canadian border. At a hearing on September 23, 2013, I issued an oral opinion denying the motion but stated that, in light of the difficult issues raised by a forensic search of digital devices seized at the border, I would be issuing a written opinion further explaining my reasoning. Supplemental briefing was requested and permitted. I now hold that, under the facts presented by this case, a forensic computer search cannot be performed under the border search doctrine in the absence of reasonable suspicion. Because the officials here reasonably suspected that Saboonchi was violating export restrictions, Defendant's Motion to Suppress is denied. I. BACKGROUND Defendant Ali Saboonchi is a dual citizen of the United States and the Islamic Republic of Iran. Gov't Opp'n 3, ECF No. 65. On March 4, 2013, Saboonchi was indicted by a grand jury on four counts of unlawful export to an embargoed country and one count of conspiracy to export to an embargoed country, in violation of the International Emergency Economic Powers Act ("IEEPA"), 50 U.S.C. §§ 1702 & 1705, and the Iranian Transactions and Sanctions Regulations ("ITSR"), 31 C.F.R. § 560.203-204. See Indictment, ECF No. 1. On August 22, 2013, the grand jury returned a superseding indictment that added more alleged co-conspirators, an additional count, and additional acts in furtherance of the alleged conspiracy, and revised the alleged start of the conspiracy from November 2009 to September 2009. Superseding Indictment, ECF No. 66.E On July IS, 2013, Saboonchi filed several motions including a Motion to Suppress Evidence, ECF No. 58. Most of the basic facts are undisputed. Saboonchi and his wife were stopped by United States Customs and Border Protection ("CBP") agents on March 31, 2012 at the Rainbow Bridge outside of Buffalo, New York when returning from a daytrip to the Canadian side of Niagara Falls. Def.'s Mot. 2. Saboonchi and his wife were questioned separately, and Saboonchi was questioned in a locked room where he was "required to remain in the room and directed to answer questions by a federal agent." Id. "Without Defendant's knowledge and consent, all electronics were seized with intent to search." Id. at 3. Eventually, Saboonchi and his wife were allowed to reenter the United States, but an Apple iPhone, a Sony Xperia phone, and a Kingston DT101 G2 USB flash drive (the "Devices") were seized; Saboonchi claims that "no clear justification was given for" keeping the Devices. Id. Saboonchi was given a "Detention Notice and Custody Receipt for Detained Property," CBP Form 605 ID, listing the devices. CBP Form 6051D, Defs Mot. Ex. B, ECF No. 58-2. *540 On April 4, 2012, a Homeland Security Investigations ("HSI") special agent imaged each of the Devices, see ICE Report of Investigation Continuation WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 4 EFTA01207769 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) (the "ICE Reports"), Def.'s Mot. Ex. A, ECF No. 58-1.2 Thereafter, the image of each device was forensically searched using specialized software. Id. On April 13, 2012, Saboonchi met with two HSI agents in Baltimore who returned the Devices to him. Def.'s Mot. 6; Gov't Opp'n 25. At that time, a conversation occurred that Saboonchi characterized as an "interrogat[ion]," Def.'s Mot. 6, and that, at the very least, confirmed that Saboonchi owned two of the Devices and included questioning about an internship Saboonchi once had with an Iranian company and his knowledge of restrictions on doing business with Iran, Gov't Opp'n 25. Saboonchi moved to suppress any evidence obtained from the Devices, any statements that he made to CBP on March 31, 2012, and any statements that he made to HSI on April 13, 2012. See Def.'s Mot. Saboonchi's motion relied on his argument that the warrantless search of the Devices at the border—and their later forensic search—violated the Fourth Amendment's prohibition of unreasonable searches and seizures, hi. at 7—8, that any statements made on March 31 were obtained in violation of the Fifth Amendment's Self—Incrimination Clause, id. at 6-7, and that any statements made on April 13 resulted from the improper search of Saboonchi's Devices, id., and therefore are the "fruit of the poisonous tree," Nardone v. United States, 308 U.S. 338, 341, 60 S.Ct. 266, 84 L.Ed. 307 (1939). The Government responded, taking the position that the search of the Devices was a routine border search that required neither a warrant nor particularized suspicion and that Saboonchi's statements did not result from custodial interrogation. Gov't Opp'n 28-29. Shortly before the hearing on the motion to suppress, I sent a letter to the parties seeking additional briefing as to certain matters, Letter to Counsel (Sept. 13, 2013), ECF No. 73, and the parties responded shortly thereafter, see Gov't Supp. Mots. Resp., ECF No. 75; Def.'s Supp. Briefing Submission, ECF No. 76. A hearing was held before me on September 23, 2013, at which the Government presented testimony from two witnesses: CBP Officer Kenneth Burkhardt, see Hr'g Tr., Testimony of Kenneth Burkhardt ("Burkhardt Tr."), ECF No. 85, and HSI Special Agent Kelly Baird, see Hr'g Tr., Testimony of Kelly Baird ("Baird Tr."), ECF No. 84. A. Testimony of Kenneth Burkhardt Officer Burkhardt was one of the officers who performed a secondary screening on Saboonchi when he re-entered the United States via the Rainbow Bridge in Niagara Falls, New York on March 31, 2013, Burkhardt Tr. 6:4-9, and his testimony primarily relied on his recollection as refreshed by his report of the events of March 31, 2012, as well as his knowledge of standard practices at the Rainbow Bridge facility. According to Burkhardt, people traveling by car go through primary screening in one of about seventeen lanes. Id. at 6:17-21. Although Burkhardt lacked firsthand knowledge of Saboonchi's primary inspection, it was his understanding that Saboonchi arrived at *541 the Rainbow Bridge facility at 9:47 p.m., id. at 22:11, and was referred to secondary inspection because his name had produced a "hit" in the TECS database during primary screening, id. at 38:11-17.2 In general, once a car is diverted to secondary inspection, it is approached by one or more officers, with weapons holstered, to escort the car to secondary inspection. Id. at 7:13-8:15. When the car reaches the main CBP building, a "stop stick" tire deflation device is placed between the front and back tires of the car to prevent flight. Id. at 17:20-23. The passengers are escorted inside and a secondary inspection typically is conducted in a room off of the building's lobby called the "medium secondary." Id. at 9:11-16. The medium secondary is reached through a locked door, which is operated remotely to buzz people in or out. Id. at 15:17-16:5. The room contains several chairs and a metal table, id. at 15:7-16:5; Hr'g Ex. 1F-1H, and has windows that are tinted on their bottom portion. See Hr'g Ex. 1F-1H. Saboonchi and his wife were taken into the secondary inspection area and Officer Burkhardt took their passports and Saboonchi's wife's visa. Burkhardt Tr. 18:8-19:24. Burkhardt ran his own query of TECS and discovered two flags on Saboonchi, one out of Washington, D.C. and one out of Baltimore. Id. at 20:5-7. Because of those flags, at 9:52 p.m., Burkhardt contacted HSI Special Agent Kelly Baird about Saboonchi; Baird told him to detain Saboonchi's Devices. Id. at 20:8-23; 22:11-12. At 10:00 p.m., Burkhardt interviewed Saboonchi and his wife. Id. at 22:15. The interview consisted of routine questions regarding their citizenship, their reason for traveling to Canada, and other information relevant to their readmission to the United States. Id. at 23:21-24:10. The interview did not last more than thirty minutes, and may have been as short as ten to fifteen minutes. Id. at 29:3-20. Burkhardt did not give Miranda warnings to Saboonchi or his wife, id. at 31:7-9, and testified that they are allowed to refuse to answer questions, but until we determine their admissibility, I mean, a WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 5 EFTA01207770 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) thorough search of the car, a thorough search of them, I mean, we arc going to, so to speak, get to the bottom of what we want to—I mean, 99.9 percent of people answer questions. Id. at 68:2-6. Although Burkhardt did not recall the details of questioning Saboonchi and his wife, he stated that his standard practice would be to separate a car's passengers and question them separately. Id. at 33:11-14. At this time they also would have been asked to empty their pockets, known as a "pocket dump," id. at 21:14-18, 65:16-21, but they probably were not subjected to a pat-down or other more invasive search of their persons, id. at 30:16-22. At approximately 10:30 p.m., a "seven-point exam," which is a detailed examination of Saboonchi's car, was performed. Id. at 22:18-23:2. Saboonchi and his wife were not free to leave during this process. Id. at 46:17-47:14. *542 The HSI duty agent at the Rainbow Bridge, Cornelius O'Rourke, was contacted at 10:55 p.m. and responded at 11:20 p.m. Id. at 23:9-12. At 11:55 p.m., HSI Special Agent Kelly Baird requested that all of the Saboonchis' information be turned over to the local Joint Terrorism Task Force ("JTTF") agent, Jeff Alrich. Id. at 23:12-15. The local chief was informed of all that had transpired at 12:15 a.m. on April I, 2013, and Saboonchi and his wife were released at 12:25 a.m. on April I. Id. at 23:16-17. From when they were stopped until they were cleared to enter the United States, over two and one-half hours had elapsed. Although Saboonchi and his wife were allowed to re-enter the country, the Devices were not returned to them at that time and Saboonchi was given a CBP 605 ID receipt for the detention of the Devices. CBP Form 605ID. Burkhardt said that it was not normal practice to look at the contents of electronic media found on a person during inspection, id. at 41:4-43:25, and neither he nor any other CBP officer attempted even a cursory inspection of the contents of the Devices at the Rainbow Bridge, id. at 59:13-60:1. "Duty Agent O'Rourke departed the station with the two cell phones and the thumb drive." Id. at 24:19-20. In Burkhardt's view, what happened at the screening was "[a]bsolutely routine." Id. at 28:23. B. Testimony of Kelly Baird Special Agent Kelly Baird testified on three main issues: the factual basis underlying the flags on Saboonchi in the TECS database, the forensic searches of the Devices, and her April 13, 2012 meeting with Saboonchi to return the Devices. Baird testified that Saboonchi first came to the attention of federal authorities in the Fall of 2010, when "the FBI received information that there had been an inquiry to a company in Vermont regarding specialized technology that has applications with industrial medical or military applications" by "a person named Ali," whose telephone number eventually led to Saboonchi. Baird Tr. 10:21-11:2. Around December 2011, another HSI agent contacted Baird to inform her that Saboonchi's name had come up again in the context of another investigation into export violations. Id. at 11:19-23. This led HSI to issue a number of subpoenas seeking credit card and shipping records that were returned in early March 2012. Id. at 11:24-12:2. 4 In response to HSI's subpoenas, Baird received a Federal Express ("FedEx") airbill that showed that Ali Saboonchi, through a business called Ace Electric, had shipped a cyclone separator to an Arash Rashti at a company called General DSAZ in the United Arab Emirates. Id. at 12:2-7, 29:1-4, 30:22-24.s An investigation into General DSAZ, using the contact information gleaned from the airbill, revealed that *543 it was linked to another company in Iran dealing with "industrial parts and things of that nature." Id. at 12:8-12. Shortly thereafter on March 29, 2012, Baird conducted interviews with individuals at a company called Geiger Pumps, which confirmed that it had sold two cyclone separators to Saboonchi based on his representation that "the end user was domestic use only." Id. at 12:13-22. Baird also noted that the airbill had listed the value of the cyclone separators as $100 but that their actual value was over $2,100. Id. at 15:21-16:2. Although reporting requirements only apply to items worth at least $2,500, Baird testified, based upon her training and experience, that "when people tend to undervalue stuff, it's to keep things below the radar." Id. at 16:6—8. On March 30, 2012, Baird conducted interviews with another supplier, RG Group, from which Saboonchi also had made purchases. Id. at 12:23-13:4, 31:9-20. Somewhere around this time, Baird caused Saboonchi's information to be entered into TECS as a person of interest. Id. at 4:7-11.6 Also based on her investigation, Baird testified that when she was contacted by Burkhardt, she asked him to detain Saboonchi's electronic media and to search his vehicle to take advantage of the Government's border search authority. See id. at 5:6-9; 33:4-14. WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 6 EFTA01207771 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) With respect to the Devices, Baird testified that she received them in a Fed& package from Agent O'RourIce and immediately handed them over to her computer forensics agent, Agent Mycel. Baird Tr. 7:21-8:1. Baird told O'Rourke not to examine the Devices and had not examined them herself, so that she could give them to a specialist in the preservation of computer evidence. See id. at 8:22-9:10. Images were made of the hard drives of both phones and of the USB drive, but the image of the Sony phone later was deleted after it was determined that it was not Saboonchi's. Id. at 24:7-25:6. Among the files that were searched, Baird found evidence of telephone contact with an employee of Geiger Pumps and a copy of Saboonchi's résumé that showed that he had interned with an Iranian company. Id. at 15:11-20. On April 13, 2012, after the Devices had been imaged, Baird arranged for Saboonchi to come to the U.S. Custom House in Baltimore so that she could return the Devices to him. Id. at 20:20-22. Saboonchi pulled his car up outside the Custom House, and Baird and another agent came out to meet him. Id. at 20:21-23. In addition to turning over the devices, Baird asked Saboonchi whether he was aware of the sanctions in place with respect to Iran and Saboonchi responded that he was aware that there were some restrictions in place, that he knew people who had had difficulties receiving money from family in Iran, and that he believed that United States residents were not permitted to use Iranian airlines. Id. at 21:2-15. Baird advised Saboonchi that he would need to get permission from the Office of Foreign Asset Control ("OFAC") if he wished to conduct business with entities in Iran. Id. at 21:16-24. Baird also asked questions about Saboonchi's internship with an Iranian company but did not ask if he was *544 exporting products to Iran. Id. at 38:14-40:7. Saboonchi asked Baird why his wife had not received her Permanent Resident Card and Baird offered to look into it, taking down Saboonchi's wife's information to aid in her inquiry. Id. at 22:23-23:1. The entire interaction between Baird and Saboonchi took place on the street, at Saboonchi's car. Id. at 20:20-23. Although Baird was carrying a weapon, it was concealed, id. at 22:10-12, and Baird testified that Saboonchi was free to leave at any time, id. at 22:13-16. C. Supplemental Briefing At the conclusion of the hearing, I resolved the Fifth Amendment issue, finding that neither the initial questioning of Saboonchi by CBP nor his conversation with Special Agent Baird were custodial for the purposes of Miranda, relying in part upon United States v. FNU LNU, 653 F.3d 144, 153-54 (2d Cir.201 I) (noting that the likelihood that those entering the country expect some degree of confinement and questioning reduces the likelihood that such restrictions would be perceived as custodial); see also Hr'g Tr., Argument and Rulings (the "Ruling Tr."), 14:19-19:1. 7 With respect to the seizure' and subsequent search of the Devices, I found that current state of the law provides considerably less clarity. Although it seemed that the seizure of Saboonchi and the Devices was supported by reasonable suspicion, the Government had taken the position that its actions constituted a routine border search for which no suspicion was required, Gov't Opp'n 26-29, and I noted that the nature and extent of the authority to image and forensically search those devices was unclear. See Ruling Tr. 31:4-20. Because this is an unsettled area of the law, and one that increasingly is important as ever greater aspects of our lives involve the use of digital devices, I stated my intention to issue a written opinion setting forth the reasons for my decision. Id. at 36:25-37:14. The Government requested, and I granted, the opportunity to provide supplemental briefing in light of the importance of the issue and the paucity of other opinions addressing it. See id. at 40:11-41:4. That briefing now has been completed, see Gov't Supp. Mem., ECF No. 87; Def.'s Rap. Mem., ECF No. 90, and I can turn now to addressing the issues raised in Defendant's motion. II. THE BORDER SEARCH DOCTRINE A. Types of Border Searches III 121 Any analysis of a border search must begin from the proposition that •545 "[t]he Government's interest in preventing the entry of unwanted persons and effects is at its zenith at the international border." United States v. Flores—Montano, 541 U.S. 149, 152, 124 S.Ct. 1582, 158 L.Ed.2d 311 (2004). It therefore is well-established "[t]hat searches made at the border, pursuant to the long-standing right of the sovereign to protect itself by stopping and examining persons and property crossing into this country, are reasonable simply by virtue of the fact that they occur at the border." United States v. Ramsey, 431 U.S. 606, 616, 97 S.Ct. 1972, 52 L.Ed.2d 617 (1977). "Routine searches of the persons and effects of entrants are not subject to any requirement of reasonable suspicion, probable cause, or warrant ...." United States v. Montoya de Hernandez, 473 U.S. 531, 538, 105 S.Ct. WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 7 EFTA01207772 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) 3304, 87 L.Ed.2d 381 (1985). PI Hi PI But even at the border, the Fourth Amendment continues to protect against unreasonable searches and seizures; the only difference is that, at the border, routine searches become reasonable because the interest of the Government is far stronger and the reasonable expectation of privacy of an individual seeking entry is considerably weaker. See Carroll it United States, 267 U.S. 132, 154, 45 S.Ct. 280, 69 L.Ed. 543 (1925) ("Travelers may be [ ] stopped in crossing an international boundary because of national self-protection reasonably requiring one entering the country to identify himself as entitled to come in, and his belongings as effects which may lawfully be brought in."). But cf. United States v. Verdugo-Urquidez, 494 U.S. 259, 274-75, 110 S.Ct. 1056, 108 L.Ed.2d 222 (1990) (holding that the Fourth Amendment does not apply to non-citizens searched or seized outside of the United States). When a search stretches beyond the routine, it must rest on reasonable, particularized suspicion, Montoya de Hernandez, 473 U.S. at 541, 105 S.Ct. 3304, which is significantly less demanding than the showing of probable cause required to secure a warrant for a domestic search, see U.S. Const. amend. IV. It is not so easy to divine precisely where a border search falls along the continuum from reasonable to unreasonable, particularly when the search involves imaging the entire contents of two smartphones and a flash drive. The Supreme Court has not addressed the issue often, but it has laid out the broad strokes of what constitutes a routine, versus a nonroutine, search. On the one hand, in United States v. Flores—Montano, the Court held that "the Government's authority to conduct suspicionless inspections at the border includes the authority to remove, disassemble, and reassemble a vehicle's fuel tank." 541 U.S. at 155, 124 S.Ct. 1582. In so holding, the Court found that the privacy interest in the contents of a person's gas tank was less than that in the contents of a passenger compartment, that such searches were relatively brief, and that the possibility of permanent damage to a car was so remote that it did not implicate a legitimate property interest, particularly because an owner of a damaged car might be entitled to recover damages. Id. at 154-55, 124 S.Ct. 1582 (citing Carroll, 267 U.S. at 154, 45 S.Ct. 280). On the other hand, United States v. Montoya de Hernandez presents an extreme factual situation that clearly exceeded a mere routine search or seizure, in which a defendant suspected of smuggling drugs in her alimentary canal was told that she would not be released into the United States until she submitted to an x-ray or "produced a monitored bowel movement that would confirm or rebut the inspectors' suspicions." 473 U.S. at WestlawNext" © 2015 Thomson Reuters. No claim to original U.S 534-35, 105 S.Ct. 3304. As a result, she "was detained incommunicado *546 for almost 16 hours before inspectors sought a warrant." Id. at 542, 105 S.Ct. 3304. In holding that the detention required, and in that particular case was justified by, reasonable suspicion, id. at 541, 105 S.Ct. 3304, the Court expressly refrained from defining "what level of suspicion, if any, is required for nonroutine border searches such as strip, body cavity, or involuntary x-ray searches," id. at 541 n. 4, 105 S.Ct. 3304. 161 The principal case on border searches in the Fourth Circuit is United States v. Ickes, 393 F.3d 501 (4th Cir.2005), which, like this case, dealt with a computer search—although not a forensic examination of an identical image of the entire contents of the computer's hardware. In Ickes, the defendant was selected for secondary inspection at the U.S.—Canadian border because the large amount of property he had in his van seemed inconsistent with his claim that he was returning from a vacation. Id. at 502. In a routine secondary inspection, the inspector found a video camera with "a tape of a tennis match which focused excessively on a young ball boy." Id. The agents searched the van more thoroughly and turned up marijuana seeds and pipes, a copy of a Virginia warrant for Ickes's arrest, and "several albums containing photographs of provocatively -posed prepubescent boys, most nude or semi-nude." Id. at 503. The Customs agents placed Ickes under arrest but continued to search the van, discovering a computer and approximately seventy-five disks containing child pornography. Id. The Fourth Circuit concluded that the search was a routine border search that did not require a showing of reasonable suspicion, id. at 505-06, even though the officers likely had reasonable suspicion before they viewed the contents of the disks. Thus under Ickes, the mere fact that a search includes computer files does not transform it from routine to nonroutine. B. Location of Border Searches 171 PI A border search need not take place at the border—indeed, here it appears that Saboonchi's Devices were seized at a border but actually were searched in Baltimore, well within the territory of the United States. Courts have recognized two different ways that a search may fall within the border search doctrine even though it does not occur at a physical border. First, border searches "may in certain circumstances take place not only at the border itself, but at its functional equivalents as well." Almeida-Sanchez v. United States, 413 U.S. 266, 272, 93 S.Ct. 2535, 37 L.Ed.2d 596 (1973). The "functional Government Works. 8 EFTA01207773 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) equivalent" of a border may include "an established station near the border, at a point marking the confluence of two or more roads that extend from the border," or the search of passengers and cargo arriving at an airport within the United States after a nonstop flight from abroad. Id. at 273, 93 S.Ct. 2535. As these locations are the functional equivalent of a border, the analysis is no different from a search at an actual, physical border and no additional suspicion is required. See id. Isl " Second, courts have permitted " `extended border searches,' under which `border' is given a geographically flexible reading within limits of reason related to the underlying constitutional concerns to protect against unreasonable searches." United States v. Bilir, 592 F.2d 735, 740 (4th Cir.1979). "[T]he `extended border search' doctrine has been applied to entry border searches conducted some time after the border was crossed." United States v. Cardona, 769 F.2d 625, 628 (9th Cir.I985) (citing United States v. Caicerlo-Guarnizo, 723 F.2d 1420, 1422 (9th Cir.1984)). An extended border search may be necessary *547 because the first contact with a customs official occurs away from the border, or because officers have elected to allow a suspect to pass through the border in order to perform a search at a later time. Bilir. 592 F.2d at 740. Unlike searches that actually occur at a border or the functional equivalent thereof, an extended border search requires reasonable suspicion with respect to the criminal nature of the person or thing searched as well as reasonable suspicion that the subject of the search has crossed a border "within a reasonably recent time." Id. III. DISCUSSION At the outset, it is important to understand what takes place during a forensic computer search, and what distinguishes it from what may usefully be regarded as a "conventional" search of a computer or digital device. Though every search is different, a forensic search has certain hallmarks by which it can be identified. First, "the computer forensics process always begins with the creation of a perfect 'bitstream' copy or `image' of the original storage device saved as a 'read only' file." Orin S. Kerr, Searches and Seizures in a Digital World, 119 Harv. L.Rev. 531, 540 (2005). Then, a computer forensics expert will use specialized software to comb through the data, often over the course of days, weeks, or even months, id. at 537-38, searching the full contents of the imaged hard drive, examining the properties of individual files, and probing the drive's unallocated "slack space" to reveal deleted files, id. at 542-43. Although directed by a forensic examiner, an integral part of a forensic examination is the use of technology -assisted search methodology, where the computer searches vast amounts of data that would exceed the capacity of a human reviewer to examine in any reasonable amount of time. The techniques used during a forensic search can be distinguished from a conventional computer search, in which a Customs officer may operate or search an electronic device in much the same way that a typical user would use it. As I will explain, a conventional computer search can be deeply probing and, much like any search of personal effects at the border, has the potential to be invasive. Yet these concerns do not bring a conventional computer search outside of the broad authority granted under the border search doctrine any more than a suitcase is immunized from search because it may contain a personal diary. Despite the vast amounts of data available in an electronic device, a conventional search is limited by the amount of time one Customs officer has to devote to reviewing the contents of digital evidence at the border while its owner awaits the outcome of the search. Even if that review may take a matter of hours, the amount of data searched will be a mere fraction of what is on the device, given the storage capacity of modem electronic devices. And in any event, though such a search may last hours, it will not last days. There is only so much time that a Customs officer has to devote to the border search of a computer. No matter how thorough or highly motivated the agent is, a manual search of a computer or digital device will never result in the human visualization of more than a fraction of the content of the device. In contrast, a forensic examination of a computer or other electronic device using sophisticated technology -assisted search methodologies can exceed vastly the capacity of a human searching and viewing files. Moreover, this type of search exposes a class of data that raises novel privacy concerns, including files that a user had *548 marked as "deleted"' and location data that may provide information about activities in the home and away from the border. For this reason, a forensic search of an electronic device differs significantly from a conventional search not merely in degree, but in kind. Accordingly, as explained below, a forensic search of an electronic device seized at the border cannot be performed absent reasonable, articulable suspicion. A. Analytical Framework I") The framework established by the Supreme Court and the Fourth Circuit allows for three possible ways to analyze the seizure and search of Saboonchi's Devices. WestlawNext" © 2015 Thomson Reuters. No claim to original U.S. Government Works. 9 EFTA01207774 U.S. v. Saboonchl, 990 F.Supp.2d 536 (2014) The Government has taken the position that the detention, seizure, imaging, and forensic search of the Devices should be viewed as a routine border search, so that no suspicion was required and the search clearly was permissible under any facts. Gov't Opp'n 26. Saboonchi has argued that, because the actual search of the Devices took place at a field office in Baltimore, several hundred miles from where Saboonchi crossed the border, it is best viewed as an extended border search for which reasonable suspicion was required. Def.'s Reply 2. In the alternative, Saboonchi argues that, unlike a conventional search of a digital device such as viewing a video or booting up a computer at the border, the act of seizing and imaging an electronic device and thereafter—perhaps days or weeks later—performing a forensic search crosses the line from a routine search to a nonroutine search, and therefore requires reasonable suspicion irrespective of where it is performed. Id. at 2, 5-6. The facts here are distinct from cases that found an extended border search had occurred. In United States v. Bilir, for example, DEA agents declined to act immediately on information that heroin was concealed on a Turkish ship that would be entering several American ports, and instead followed the ship from port to port in hopes of apprehending the suspects. 592 F.2d 735, 737 (4th Cir.1979). The agents allowed the suspects to debark the ship in Baltimore in order to follow them, and the suspects eventually were stopped and searched at Baltimore Penn Station. Id. at 738. The Fourth Circuit upheld the search as an extended border search. Id. at 739. Similarly, in United States v. Guzman-Padilla, 573 F.3d 865 (9th Cir.2009), a Border Patrol agent used a controlled tire deflation device to stop a vehicle that already was in the United States but that the agent reasonably believed had entered the United States recently from Mexico. Id. at 875. Although it did not need to decide the issue, the Ninth Circuit noted that this might qualify as an extended border search. Id. at 877-78. In both of these cases, no search or seizure took place until after the suspects had cleared the border and were within the United States. "21 The searches of the Devices in this case cannot be an extended border search because Saboonchi was not allowed to bring them across the border. See United States v. Stewart, 729 F.3d 517, 525 (6th Cir.2013) (finding no extended border search under similar circumstances "because [defendant's] laptop computers never cleared the border"). The seizure of the Devices occurred at the border itself. •549 They then were shipped to Baltimore and were transferred from CBP to HSI, both of which play a role in securing the border. And once the devices were cleared for entry, they were returned, in Baltimore, to Saboonchi. "A border search of a computer is not WestlawNexi © 2015 Thomson Reuters. No claim to original U.S transformed into an extended border search simply because the device is transported and examined beyond the border." United States v. Cotterman, 709 F.3d 952, 961 (9th Cir.2013). Thus, I find that this was not an extended border search; to the contrary, Saboonchi's Devices were not permitted to enter into the United States until they were returned to him in Baltimore, and any searches of those devices were pursuant to the general border search doctrine. "31 Therefore, the level of suspicion required depends on whether the forensic search of the Devices was a routine search or a nonroutine search. Although I hold that a forensic search of a computer or electronic device should be considered a nonroutine search for which reasonable suspicion is required, I do so only after thorough analysis of the relevant law and factual considerations. B. Routine Venus Nonroutine Searches Generally Unsurprisingly, the overwhelming majority of searches that one would expect to encounter at the border fall into the category of conventional, routine border searches. This includes pat-downs, pocket-dumps, and even searches that require moving or adjusting clothing without disrobing, and also may include scanning, opening, and rifling through the contents of bags or other closed containers. But a routine search also may go beyond what a traveler othenvise may consider routine. For example, a routine search may extend to the inside of an automobile gas tank, United States v. Flores-Montano, 541 U.S. 149, 155, 124 S.O. 1582, 158 L.Ed.2d 311 (2004), to the contents of photograph albums or information encoded on video tapes, United States v. Ickes, 393 F.3d 501, 502-03 (4th Cir.2005), or to password protected or locked items, United States V. McAuley, 563 F.Supp.2d 672, 678 (W.D.Tex.2008). Insofar as the "touchstone of the Fourth Amendment is reasonableness," Florida v. Jimeno, 500 U.S. 248, 250, III S.Ct. 1801, 114 L.Ed.2d 297 (1991) (citing Katz v. United States, 389 U.S. 347, 360, 88 S.Ct. 507, 19 L.Ed.2d 576 (1967)), it does not require Napoleonic insight to see how the power to conduct searches of this kind on a routine basis, without suspicion, is the sine qua non of customs and border enforcement; otherwise there would be nothing to stop travelers or commercial shippers from dodging our customs laws with impunity so long as they avoid drawing attention. See, e.g., United States v. Johnson, 991 F.2d 1287, 1292 (7th Cir.1993) ("A customs official might have to rummage through any border entrant's luggage to ascertain whether all items have been declared properly."). Government Works. 10 EFTA01207775 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) A wide range of searches of persons also have been upheld as routine even if they involve some level of indignity or intrusiveness, so long as they fall short of a strip search and do not expose the cavities of the body. See, e.g., Bradley v. United States, 299 F.3d 197, 203 (3d Cir.2002) (holding that patdowns are routine searches that do not require reasonable suspicion); United States it Kelly 302 F.3d 291, 294-95 (5th Cir.2002) (dog sniff was a routine border search even where dog made brief contact with suspect's groin); United States v. Charleus, 871 F.2d 265, 266-67 (2d Cir.1989) (touching defendant's back and, upon discovering a bump, lifting the back of his shirt was a routine search); United States v. Brown, 499 F.2d 829, 833 (7th Cir.1974) (lifting an *550 ankle-length skirt to just above a female suspect's knees in a room with only women constituted a routine search). lul 1151 On the other hand, United States v. Ramsey left open the possibility that "a border search might be deemed 'unreasonable' because of the particularly offensive manner in which it is carried out." 431 U.S. 606, 618 n. 13, 97 S.Ct. 1972, 52 L.Ed.2d 617 (1977). For example, there is a general consensus that even the border search power cannot justify a strip search without any particularized suspicion. See, e.g., Montoya de Hernandez, 473 U.S. at 541 n. 4, 105 S.Ct. 3304 (listing a category of "nonroutine border searches" including a strip or body cavity search); United States v. Rodriguez, 592 F.2d 553, 556 (9th Cir. 1 979) ("While anyone at a border may be stopped for questioning and subject to an inspection of luggage, handbags, pockets, wallets, without any suspicion at all on the part of customs officials, 'real suspicion' is required before a strip search may be conducted ...." (citations omitted)); United States v. Asbury, 586 F.2d 973, 975-76 (2d Cir.1978) (a strip search is "such an extensive invasion of privacy, [a border official] should have a suspicion of illegal concealment that is based upon something more than the border crossing, and the suspicion should be substantial enough to make the search a reasonable exercise of authority"); United States v. Himmelviright, 551 F.2d 991, 994-95 (5th Cir.I 977) (holding that reasonable suspicion, but nothing more, is required to justify a strip search at the border). "[A] border search that goes beyond the routine is nevertheless justified merely by reasonable suspicion, a lesser standard than required for analogous non-border searches." United States v. Oriakhi, 57 F.3d 1290, 1297 (4th Cir.I 995) (citing Montoya de Hernandez, 473 U.S. at 541, 105 S.Ct. 3304). Courts have struggled to define a clear dividing line between routine and nonroutine searches. In United States v. Burks, 842 F.2d 509 ( 1 st Cir.I 988), the First Circuit listed the following relevant factors: WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. (i) whether the search results in the exposure of intimate body parts or requires the suspect to disrobe; (ii) whether physical contact between Customs officials and the suspect occurs during the search; (iii) whether force is used to effect the search; (iv) whether the type of search exposes the suspect to pain or danger; (v) the overall manner in which the search is conducted; and (vi) whether the suspect's reasonable expectations of privacy, if any, are abrogated by the search. 842 F.2d at 512 (footnotes omitted). These factors did not represent "an exhaustive list of equally-weighted concerns," and each search was a fact-specific inquiry in which those factors were among the relevant considerations. Id. at 513. Other courts have focused specifically on familiar touchstones such as the exposure of intimate body parts and details, as well as a suspect's reasonable expectations of privacy. In United States v. Vega—Barvo, 729 F.2d 1341 (11th Cir.1984), the Eleventh Circuit, considering the permissibility of an x-ray search of a person, observed: To determine the "intrusiveness" level of the internal body searches involved in today's cases, it is necessary to decide whether intrusiveness is to be defined in terms of whether one search will reveal more than another, or whether intrusiveness is to be interpreted in terms of the indignity that will be suffered by the person being searched. For example, is an x-ray more intrusive than a cavity search because it will reveal more than *551 the cavity search, or less intrusive because it does not infringe upon human dignity to the same extent as a search of private parts? A person can retain some degree of dignity during an x-ray, but it is virtually impossible during a rectal probe, despite the more limited scope of such a search. Id. at 1345. Although the Eleventh Circuit held that the 11 EFTA01207776 U.S. v. Saboonchl, 990 F.Supp.2d 538 (2014) true touchstone is "personal indignity," id. at 1346, the distinction did not seem to make much difference, as the Eleventh Circuit held that an x-ray search is "more intrusive than a frisk, [though] no more intrusive than a strip search," and therefore required reasonable sus