United States v. Kim, — F.Supp.3d (2015)

United States v. Kim, — F.Supp.3d (2015) 2015 WL 2148070 Only the Westlaw citation is currently available. United States District Court, District of Columbia. United States of America v. Jae Shik Kim, Karham Eng. Corp., Defendants. Crim. Action No. 13—oloo (ABJ) J Signed May 8, 2015 Synopsis Background: Defendant charged with violating export control laws moved to suppress evidence discovered during warrantless search of laptop computer that was seized as he was departing from the United States for his home country of Korea. Holdings: The District Court, Amy Berman Jackson, J., held that: In mere fact that alien may have previously participated in unlawful export of controlled articles to Iran in violation of export control laws did not provide special agent of the Department of Homeland Security (DHS) with reasonable suspicion of any ongoing or imminent criminal activity, of kind sufficient to support seizure and search of contents of alien's laptop computer as he was departing for his home country of Korea following his most recent visit to the United States; (2) in assessing reasonableness of search„ it was not appropriate for court to simply categorize the laptop as "container," of kind which may be subjected to warrantless search at border; and P) search was supported by so little suspicion of ongoing or imminent criminal activity, and was so invasive of defendant's privacy and so disconnected from not only the considerations underlying the breadth of government's authority to search at border, but also the actual border itself, that it was unreasonable and violative of Fourth Amendment. Motion granted. West Headnotes (14) Arrest 4-Reasonableness; reason or founded suspicion, etc Law enforcement officer has reasonable suspicion of criminal activity, of kind sufficient to support investigatory stop, if officer can point to specific and articulable facts which, when considered together with rational inferences that can be drawn from those facts, indicate that criminal activity may be afoot. U.S. Const. Amend. 4. Cases that cite this headnote Arrest oiFReasonableness; reason or founded suspicion, etc Court's determination of whether officer had reasonable suspicion of criminal activity, of kind required to support investigatory stop, must be based on totality of the circumstances. U.S. Const. Amend. 4. Cases that cite this headnote PI Arrest (iReasonableness; reason or founded suspicion, etc Reasonable suspicion of criminal activity, of kind required to support investigatory stop, is reasonable suspicion of ongoing or imminent crime. U.S. Const. Amend. 4. Cases that cite this headnote WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 1 EFTA01207793 United States v. Kim, — F.Supp.3d (2015) Customs Duties ii-Particular Objects or Products Mere fact that alien may have previously participated in unlawful export of controlled articles to Iran in violation of export control laws did not provide special agent of the Department of Homeland Security (DHS) with reasonable suspicion of any ongoing or imminent criminal activity, of kind sufficient to support seizure and search of contents of alien's laptop computer as he was departing for his home country of Korea following his most recent visit to the United States, where alien had business interests in the United States sufficient to explain his frequent visits, where prior incident in which alien allegedly participated in unlawful export of controlled articles to Iran did not involve his travel to the United States, and where special agent conducted no surveillance of alien while he was in the United States on his latest trip and uncovered nothing during his encounter with alien in airport to suggest any ongoing or imminent violation of export laws. U.S. Const. Amend. 4. Cases that cite this headnote Arrest 4-Reasonableness; mason or founded suspicion, etc Evidence of prior criminal conduct alone is insufficient to give rise to reasonable suspicion of ongoing or imminent criminal activity, of kind required to support investigatory stop. U.S. Const. Amend. 4. Cases that cite this headnote 1'1 Aliens, Immigration, and Citizenship 6.-Border Stops and Inspections Customs Duties 4-Searches and Seizures Government's interest in preventing the entry of unwanted persons and effects is at its zenith at international border. U.S. Const. Amend. 4. Cases that cite this headnote 171 Customs Duties 6-Grounds or cause for stop, search, or seizure Routine searches of the persons and effects of entrants at international border are not subject to any requirement of reasonable suspicion, probable cause, or warrant. U.S. Const. Amend. 4. Cases that cite this headnote IBI Searches and Seizures it-Fourth Amendment and reasonableness in general Ultimate touchstone of validity of search under the Fourth Amendment is reasonableness. U.S. Const. Amend. 4. Cases that cite this headnote 191 Searches and Seizures P-Necessity of and preference for warrant, and exceptions in general When search is undertaken by law enforcement officials to discover evidence of criminal wrongdoing, reasonableness generally requires the obtaining of judicial warrant. U.S. Const. Amend. 4. Cases that cite this headnote Ira Searches and Seizures 4-Necessity of and preference for warrant, and exceptions in general WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 2 EFTA01207794 United States v. Kim, — F.Supp.3d (2015) In the absence of warrant, search is reasonable only if it falls within a specific exception to warrant requirement. U.S. Const. Amend. 4. Cases that cite this headnote Ittl Customs Duties ti-Particular Objects or Products In assessing the reasonableness, for Fourth Amendment purposes, of law enforcement agent's conduct in seizing laptop computer of alien suspected of having violated export laws in the past before alien boarded aircraft to return to his home country of Korea, and in having hard drive copied so that it could be subjected to search of indefinite duration using specialized computer software, it was not appropriate for court to simply categorize the laptop as "container," of kind which may be subjected to warrantless search at border, especially given the wealth of personal information that could be stored on laptop and fact that actual examination and analysis of contents of laptop's hard drive occurred over period of weeks at location far removed from border; rather, to determine constitutionality of agent's conduct, district court had to proceed by assessing, on the one hand, the degree to which search intruded on alien's privacy and, on the other, the degree to which it was necessary for promotion of legitimate governmental interests. U.S. Const. Amend. 4. Cases that cite this hcadnotc 1121 Aliens, Immigration, and Citizenship eBorder Stops and Inspections Customs Duties ti•Searches and Seizures Government's power to conduct warrantless searches at the border arises out of the sovereign's right and need to protect its territorial integrity and national security; searches made at the border, pursuant to longstanding right of the sovereign to protect itself by stopping and examining persons crossing into the country, are reasonable simply by virtue of fact that they occur at the border. U.S. Const. Amend. 4. Cases that cite this headnote Itrl Customs Duties iTime and distance factors; checkpoints Customs Duties ti.Scope and Nature; Successive or Secondary Searches Law enforcement agent's imaging and search of entire contents of alien's laptop computer, aided by specialized forensic software, over period of unlimited duration and conducting examination of unlimited scope, for the purpose of gathering evidence of pre-existing export violation, was supported by so little suspicion of ongoing or imminent criminal activity, and was so invasive of alien's privacy and so disconnected from not only the considerations underlying the breadth of government's authority to search at border, but also the actual border itself, that it was unreasonable and violative of alien's Fourth Amendment rights. U.S. Const. Amend. 4. Cases that cite this headnote Ildj Aliens, Immigration, and Citizenship tiiheckpoints Customs Duties i•Time and distance factors; checkpoints Concept of "border" search, for Fourth Amendment purposes, extends beyond the physical boundary itself to the functional equivalent of border, which may include an established station near the border or other nearby convenient locations. U.S. Const. Amend. 4. Cases that cite this headnote WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 3 EFTA01207795 United States v. Kim, — F.Supp.3d (2015) border to protect the homeland is the beginning and end of the matter. Attorneys and Law Firms Frederick Walton Yette, U.S. Attorney's Office, Washington, DC, for United States of America. MEMORANDUM OPINION AND ORDER AMY BERMAN JACKSON, United States District Judge *I In this case involving the enforcement of export control laws and the trade embargo with Iran, defendant Jae Shik Kim has moved to suppress the evidence the United States harvested from a laptop computer it seized from him when he was departing the country through Los Angeles International Airport. Kim is a Korean businessman with business operations in both Korea and California, and in October of 2012, investigators with the Department of Homeland Security obtained information that he was involved in a previous shipment of controlled articles to a Chinese businessman in Korea, who then forwarded them to customers in Iran. The Special Agent handling the investigation decided to search Kim's laptop computer for evidence the next time Kim came to the United States, and in December 2012, he obtained the computer from Kim before permitting him to board his flight home. The next day, the laptop was shipped to an agency forensic specialist in San Diego, who created an identical copy of the hard drive, which was then searched using specialized software and a list of keywords. The thousands of files that were extracted from the keyword search were then burned onto a DVD and returned to the case agent for further review. After incriminating emails were uncovered through that process, the agent sought and obtained a warrant based upon the content of the emails to conduct the search of the hard drive that had already been completed and to seize the emails that had already been reviewed. Those emails now form a part of the basis of this prosecution, and Kim moves to suppress that evidence, arguing that his rights under the Fourth Amendment of the Constitution have been violated. The government points to its plenary authority to conduct warrantless searches at the border. It posits that a laptop computer is simply a "container" that was examined pursuant to this authority, and it submits that the government's unfettered right to search cargo at the WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. But to apply those principles under the facts of this case would mean that the border search doctrine has no borders. The search of the laptop began well after Kim had already departed, and it was conducted approximately 150 miles away from the airport. The government engaged in an extensive examination of the entire contents of Kim's hard drive after it had already been secured, and it accorded itself unlimited time to do so. There was little or no reason to suspect that criminal activity was afoot at the time Kim was about to cross the border, and there was little about this search—neither its location nor its scope and duration—that resembled a routine search at the border. The fundamental inquiry required under the Fourth Amendment is whether the invasion of the defendant's right to privacy in his papers and effects was reasonable under the totality of the circumstances, and the Court finds that it was not. PROCEDURAL HISTORY On March 28, 2013, Kim and his company, Karham Eng. Corp. ("Karham"), were indicted for violations of a number of statutes, including the International Emergency Economic Powers Act ("IEEPA"), 50 U.S.0 § 1701 et seq., the Arms Export Control Act ("AECA"), 22 U.S.C. § 2778, and the International Traffic in Arms Regulation ("ITAR"), 22 C.F.R. pts. 120-30. Indictment [Dkt. N I]. These laws and regulations govern economic sanctions imposed by the United States against certain countries, such as Iran, and the export of certain "defense articles" from the United States. The United States alleges that from around December 2007 through March 2010, defendants conspired to export defense articles without the required export licenses for sale to intermediaries in China and Korea and ultimate customers in Iran. Indictment ¶ 17. The defense articles at issue—six Q—Flex Accelerometers, Models QA-2000-10, QA-2000-20, or QA-3000—are aircraft parts manufactured by Honeywell Aerospace which are used in aircraft and missile navigation systems. Indictment TT 3, 16(1), 17(3). They appear on the export control list, and an export license is required before they may be exported legally from the United States. 22 U.S.C. § 2778(bX2); 22 C.F.R. pt. 123.1(a). *2 On March 2, 2015, defendants filed the instant motion to suppress. Dots.' Mot to Suppress Evidence [Dkt. # 35] ("Defs.' Mot."). The parties briefed the motion, Gov't's Opp. to Defs.' Mot. [Dkt. # 37] ("Gov't Opp."); Defs.' 4 EFTA01207796 United States v. Kim, — F.Supp.3d (2015) Reply in Supp. of Defs.' Mot. [Dkt. # 38] ("Defs.' Reply"), and the Court held an evidentiary hearing on April 7 and 8, 2015, at which the following facts were established. FACTUAL BACKGROUND A. The Government's Investigation of Bin Yang In 2011, Special Agent Kevin Hamako of the Department of Homeland Security ("DHS") Homeland Security Investigations office was investigating a Chinese national, Bin Yang, also known as Raymond Yang, for export control violations, specifically the unlawful export of accelerometers to China and Iran. Mots. Hr'g Tr., April 7, 2015 ("4/7 Tr.") at 7. As part of the investigation, Special Agent Hamako worked with an undercover agent who communicated with Yang by email and telephone. 4/7 Tr. at 14. On April I, 2011, Yang sent the undercover agent an email asking to obtain Honeywell QA-3000-30's from him, and he offered: "Because my uncle has a sudden schedule to USA, he may could meet you and pay you." Report of Investigation, No. 107, May 20, 2011, Gov't Ex. 3 ("May 2011 ROI") at 3. On April 4, 2011, Yang sent the undercover agent another email stating, "My uncle just has his sudden trip to US, he may meet you and only see the goods and maybe pay you." May 2011 ROI at 3. In an April 5, 2011 telephone conversation between Yang and the undercover agent, Yang again volunteered that he had a contact who would be traveling to the United States who could inspect the QA-3000 accelerometers that Yang hoped to buy. May 2011 ROI at 3; 4/7 Tr. at 15-16. Yang proposed to have his "uncle" travel to the United States, inspect the accelerometers, and provide payment for them. 4/7 Tr. at 15-16. He also stated he did not want his "uncle" to physically carry the items out of the country because he was afraid that U.S. customs officials would discover them. 4/7 Tr. at 16; see also Report of Investigation, No. 114, Jun. 22, 2011, Gov't Ex. 2 ("Jun. 2011 ROI") at 3 (detailing information about the April 5, 2011 telephone call). At that point, the unidentified "uncle" became a further subject of the investigation. 4/7 Tr. at 16. On April 27, 2011, Special Agent Hamako obtained and executed a warrant to search and seize Yang's emails, and on May 12, 2011, he received the emails. May 2011 ROI at 3; see also 4/7 Tr. at 17. The emails included several communications with "Uncle Kim" atJS®karham.co.kr: • an email dated June 24, 2010 from Yang to Kim that stated, "There is an inquiry from a domestic client for Honeywell products. It is not for military application and I confirm the end user is not Iranian," to which Kim responded on the same day, "Thanks! Raymond, I will also check the Honeywell parts whether [w]e can buy them." • emails between Yang and Kim from July 2010 relating to the purchase of various items not subject to export controls • an email from almost a year later, dated March 28, 2011, in which Yang asked Kim if he could identify a source for other parts that are not subject to controls: "Dear Uncle Kim Hi. I have the inquiry for Honeywell QAT 185/160 model, about 150pcs for each model per year. 3pcs is a completed unit. First trial order, the client will buy 9pcs for each model as a start. Do you have any good sources to supply them." On the same date, Kim responded, "Now, Mr Ji are checking it with ow USA office. And also, Tomorrow, I will go to USA with Mr. Ji and stopped in USA office. We will check it again and feed back you soon." *3 • an email from Yang to Kim dated April I, 2011, stating: "I see that you will go to U.S.A, it is very good. For your reference, I get a message that there is supplier could supply us some stocks of QA3000. But I don't have successful business with him before, but we could buy his goods if his stocks are ok. Dear Uncle Kim, can you please have a check if you agree. We could pay you, so you can buy it in USA.... QAT 185 and 160 are not sensitive products, and if you can supply, we could buy from you, and there is no worry to pay the deposit, because I trust my uncle." May 2011 ROI at 4-6. On April 5, 2011, Yang had the recorded telephone call with the undercover agent described above in which he proposed that his "uncle" could inspect the parts Yang hoped to buy. As of May 2011, though, the agents were aware that Yang's inquiry to Kim had borne no fruit and the undercover operation was over. 4/7 Tr. at 72 (stating the agents knew "fairly soon after, within maybe a couple of weeks" that the operation was not going ahead). WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 5 EFTA01207797 United States v. Kim, — F.Supp.3d (2015) B. The Identification of "Uncle Kim" and his Companies On June 21, 2011, Special Agent Hamako was able to identify "Uncle Kim" as defendant Jae Shik Kim by searching a government database for theJS ®karham.co.kr email address. 4/7 Tr. at 21-22; Jun. 2011 ROI at 3-4. The email address appeared in U.S. State Department records on a non-immigrant visa application submitted by Kim. 4/7 Tr. at 21-22; Jun. 2011 ROI at 3. The application provided Special Agent Hamako with other information about Kim, including his date of birth, passport number, and nationality. Jun. 2011 ROI at 3-4; 4/7 Tr. at 22. From the visa application, Special Agent Hamako also determined that Kim was president of corporate defendant Karham. 4/7 Tr. at 22. Through further research, he learned that Karham was located in South Korea and Stevenson Ranch, California, and that Karham shared its Stevenson Ranch, California address with a company called Apex Components. 4/7 Tr. at 22-23; see also Jun. 2011 ROI at 3-5 (providing information about the identification of Kim). Special Agent Hamako researched Karham and Apex Components and found that Karham was involved in the export and sale of equipment used in the oil industry and petrochemical industries, including types of meters. 4/7 Tr. at 24. On a web-based government database, Special Agent Hamako found approximately thirty-nine shipper's export declarations ("SEDs") from Karham for the export of meters from the United States to Australia and South Korea. 417 Tr. at 24. He found eight shipper's export declarations from Apex Components, which also showed exports of various industrial equipment from the United States to South Korea. 4/7 Tr. at 25. Finally, Special Agent Hamako found travel records showing that defendant Kim arrived in Los Angeles International Airport ("LAX") on April 2, 2011, and departed LAX for Narita, Japan on April 14, 2011. Jun. 2011 ROI at 4; see also 4/7 Tr. at 26. C. Yang's Arrest and Debrief Early the following year, in January 2012, Yang was arrested and, in May 2012, he was extradited from Bulgaria to the United States. 4/7 Tr. at 9. He agreed to be debriefed by U.S. authorities in an effort to ameliorate his sentence. 4/7 Tr. at 9; see also Search Warrant, Ex. B to Defs.' Mot. [Dkt. # 35-2] ("Search Warrant"); Aff. in Supp. of Appl. for Search Warrant, Ex. B to Defs.' Mot. [Dkt. # 35-2] ("SW Aff."), at 7 n. 1. On October IS, 2012, Special Agent Hamako interviewed Yang. 4/7 Tr. at 9; see also Report of Investigation No. 146, Nov. 15, 2012, Gov't Ex. 1 ("Nov. 2012 ROI") at 3-5 (reporting results of the Yang debrief). Yang told investigators that at some point in 2008 or 2009, he purchased six QA-2000 accelerometers from Kim, which were shipped to him in China without an export license. 4/7 Tr. at 10. Yang said that once he received the accelerometers, two of his Iranian customers traveled from Iran to China to receive them directly. Id. Yang told Special Agent Hamako that Kim purchased the accelerometers through his connections in the United States, and they were shipped from the United States to China. 4/7 Tr. at 11; Nov. 2012 ROI at 3. While this is not reflected in the report of the interview, Special Agent Hamako testified that Yang also told him that Kim knew the accelerometers were destined for customers in Iran. 4/7 Tr. at II. *4 As a result of the Yang interview, Special Agent Hamako decided to conduct what he characterized as a border search of Kim's electronic devices "as he was leaving the U.S. on his next travel." 4/7 Tr. at 110. I wanted to know when [Kim] was returning to further my investigation in the sense that I wanted to be ready to conduct more proactive steps if he was in the U.S., specifically, to include a border search, surveillance, or other activities to determine if he was engaged in any potential criminal activity while in the United States. 4/7 Tr. at 33. At that time, it was the agent's understanding that no suspicion was required to conduct a border search of any items Kim might be carrying, including electronic devices. 4/7 Tr. at 32. Because of the ongoing investigation, Kim's name was in DHS's case management system, which meant Special Agent Hamako would receive an automatic email if Kim was booked on a flight to or from the United States. 4/7 Tr. at 32-33. Some time later, the agent received an email notifying him that Kim was going to return to the United States in November 2012, and that he would be departing LAX for South Korea on December 5, 2012. 4/7 Tr. at 33. D. The December 5, 2012 Search of Kim Special Agent Hamako testified that while he understood that he had the authority to conduct a border search of WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 6 EFTA01207798 United States v. Kim, — F.Supp.3d (2015) Kim without any level of suspicion that Kim was engaged in criminal activity, 4/7 Tr. at 34, he had grounds for that suspicion in any event. At that time my suspicion was based on the debriefing of Yang in which Yang stated he had previously successfully procured ITAR controlled accelerometers from Mr. Kim, as well as the fact that Mr. Kim's company appeared to be engaging in exports from the U.S. to South Korea and other foreign locations, as well as the fact that, more recently, Mr. Yang had asked Mr. Kim to view products in the U.S., inspect them and pay for them. 4/7 Tr. at 35. Special Agent Hamako stated that although he knew Yang was incarcerated, he "wasn't sure if Mr. Kim was in contact with other individuals who might be seeking to illegally procure U.S. goods," and that his goal was to ascertain whether Kim had other customers. 4/7 Tr. at 35-36. Under questioning by the prosecutor at the hearing, the agent agreed that he also thought it was reasonable to believe that records of the 2008 transactions, including emails, could still be saved on the computer. 4/7 Tr. at 38-39. Special Agent Hamako said he intended to conduct a border search of Kim as he departed the country rather than as he entered the country, because if I believed at that time that he was traveling to the U.S. and might be conducting criminal activity while he was in the U.S., such as procuring products or attempting to set up subsequent deals, I would want to capture that information after he had done so, rather than before he had conducted any such activity. So, conducting a border search on the inbound side could cause him to decide not to conduct whatever activities or operations he might have been planning. Whereas, conducting the border search as he was leaving, in our view, would be more likely to obtain evidence of any criminal activity he had conducted during his trip. *5 4/7 Tr. at 34-35. He added that based on Yang's statements and Karham's general business activities, he was "concerned that [Kim] could be involved in further activity in the [Spates regarding illegal exports." 4/7 Tr. at 39. But he testified that he did not know at the time—and he does not know now—what Kim did while he was in the United States between November 25 and December 5, 2012, and that he did not conduct any surveillance or take any steps to find out before carrying out his plan to obtain the laptop. 4/7 Tr. at 81. On December 5, 2012, working with a LAX duty agent and Customs and Border Protection officers, Special Agent Hamako conducted the planned search of Kim as he departed the country. 4/7 Tr. at 40. First, he searched Kim's checked luggage, which was located behind the check-in counter with Korean Airlines. Id. He found no accelerometers or contraband. 4/7 Tr. at 82-83. He did find a small plastic bag containing plastic o-rings, some unidentified industrial metal objects, and some product brochures. 4/7 Tr. at 40-41, 90. The agent was not able to identify the applications of these particular o-rings because he was not an aircraft parts expert, but said that he knew "in other cases the Iranian Air Force had been seeking o-rings for their aircraft," and so he thought that these small plastic ones "could be" on the munitions list, and he kept them to determine their application. 4/7 Tr. at 41-42. He later spoke with the manufacturer, and determined "it was very unlikely that they were export controlled items," and shipped them back to Kim. 4/7 Tr. at 43. Special Agent Hamako also testified that the metal objects in the luggage did not appear to have any moving parts or sensors or electronics and may have been a tripod, and the product brochures "didn't seem to be pertinent at the time." 4/7 Tr. at 87-88, 90. So he did not retain either the metal objects or the brochures and did not photograph or document what they were. 4/7 Tr. at 88-89. Next, Special Agent Hamako stopped Kim on the jetway between the gate and the airplane as Kim was boarding his flight. 4/7 Tr. at 40, 43. He identified himself and asked Kim if he had any electronics, to which Kim responded that he had a laptop. 4/7 Tr. at 44. Special Agent Hamako told Kim that he would be detaining the laptop pursuant to a border search and that he would return it once the search was complete. Id. He also told Kim that he would be detaining the o-rings until their export control status was determined. Id. Special Agent Hamako testified that he did not have an interpreter during the encounter with Kim because he did not anticipate that he was likely to say anything incriminating. 4/7 Tr. at 94. My goal at that time wasn't to WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 7 EFTA01207799 United States v. Kim, — F.Supp.3d (2015) conduct an in-depth interview or subject interview of Mr. Kim, reading him his rights or anything like that, since my main goal was to obtain his electronics and then let him go on his way. 4/7 Tr. at 95. This is precisely what took place, and Kim boarded his flight. 4/7 Tr. at 45. Special Agent Hamako did not turn the laptop on or review its contents in any way during his search of Kim at LAX. 4/7 Tr. at 45. He explained that "it would be inappropriate to search his laptop without—without an individual who's qualified to preserve the contents of the laptop. Because if I were to turn on the laptop and just begin searching it there, that would be altering the information on the laptop and could render any evidence I found on it tainted or otherwise questionable, since I would be modifying the contents of the laptop by conducting searches on it. And also, because based on the time available, it could have taken who knows how long." 4/7 Tr. at 45; see also 4/7 Tr. at I 15 (stating that "conducting a live search on his computer would have necessarily changed and altered the contents of the laptop, so I would not have conducted such a search"). Special Agent Hamako testified, "[M]y main goal was to obtain any electronics that he had on his person at that time." 4/7 Tr. at 94. E. The Search of Kim's Computer *6 On December 6, 2012, Special Agent Hamako submitted Kim's laptop to Special Agent David Marshall of the Homeland Security Investigation San Diego Computer Forensics Group. Report of Investigation, No. 147, Dec. 11, 2012, Gov't Ex. 5 ("Dec. 2012 Ron at 1, 3; Mots. Hr'g Tr., April 8, 2015 ("4/8 Tr.") at 7-8;' see also 4/7 Tr. at 99-100. Special Agent Hamako "requested a border search of the laptop" from Special Agent Marshall. 4/8 Tr. at 8. To carry out Special Agent Hamako's request, Special Agent Marshall removed the hard drive from Kim's laptop and created a forensic image, or a duplicate copy, of it. 4/8 Tr. at 8. To do this, Special Agent Marshall connected a piece of hardware "about the size of a shoebox" to the laptop hard drive: the hardware creates "an exact copy, reading every single bit, as we call it, every single piece of data on the hard drive and making a copy of that for me to analyze later on." 4/8 Tr. at 8-9. The imaged copy included all files from both the allocated and unallocated space on the computer, which WestlawNexi © 2015 Thomson Reuters. No claim to original U.S Special Agent Marshall explained as follows: Allocated space, in general, means space in your hard drive where ... files are living, files that you see on your desktop, maybe a photo of a family vacation or Word documents. Unallocated space refers to space that's not currently being used by—let's say it's Windows, by Windows for any files. And when you delete a file, it goes into unallocated space.... [U]nallocated space is space that's not currently being used by the computer. 4/8 Tr. at 9. Special Agent Marshall placed the hard drive back into Kim's laptop and returned the laptop to Special Agent Hamako on December 7, 2012. 4/8 Tr. at 8.: Also on December 7, 2012, Special Agent Marshall employed a software program called EnCase to export files from Kim's computer. 4/8 Tr. at 10; see also Dec. 2012 ROI at 4 (stating that he used commercially available email analysis software to export files). He used EnCase to export six Microsoft Outlook email containers,' 8,184 Microsoft Excel spreadsheets, 11,315 Adobe PDF files, 2,062 Microsoft Word files, and 879 Microsoft PowerPoint files from the image. Dec. 2012 ROI at 4; see also 4/8 Tr. at II. Special Agent Marshall used another program, Intella, to process the files. 4/8 Tr. at 10; see also Dec. 2012 ROI at 4. He testified that Intella is a powerful piece of software with a variety of capabilities, including the ability to search the text of emails that are not otherwise searchable. 4/8 Tr. at 31. It also indexes and categorizes emails: [A]n e-mail container can contain thousands of e-mails. So Intella will go through and open up the e-mail, and what we call index and categorize the e-mail. So it looks at all the e-mail information, the to and the from, the dates, things like that, the attachments, and it processes those and categorizes all that information so that the user can then go in and see all the e-mails from a certain person, you know, or to a certain person or on a date. Government Works. 8 EFTA01207800 United States v. Kim, — F.Supp.3d (2015) *7 4/8 Tr. at 31-32. And according to Special Agent Hamako, it would have been "impractical" to use the search function in Outlook instead; given the investigators' search methodologies, "Intella is more efficient." 4/7 Tr. at 105. These files were copied to a "case agent review" laptop for Special Agent Hamako to review. 4/8 Tr. at II. When Special Agent Marshall saw the number of files on the laptop, he asked Special Agent Hamako to give him a keyword list to use to "filter down the amount of information for him to review." 4/8 Tr. at II. On December 10, 2012, Special Agent Hamako gave Special Agent Marshall a list of twenty-two keywords: QA-2000, QA-3000, G-2000, 7270A, accelerometers, gyroscope, angular, sensor, Honeywell, Endevco, Northrop, Grumman, ITAR, sensitive, export, shipment, military, aircraft, missile, satellite, ballistic, and nuclear. 4/8 Tr. at 12-13. Using these keywords to screen the files on Kim's laptop, Special Agent Marshall found approximately 5,900 files that had a keyword match. 4/8 Tr. at 13. He burned the files to a DVD and gave the DVD to Special Agent Hamako, along with the case agent review laptop. Dec. 2012 ROI at 4; 4/8 Tr. at 13. The next day, on December 11, 2012, Special Agent Marshall exported all of the picture files, which can include images of documents and not simply photographs, that were located in the allocated space of the computer —approximately 24,900 .jpg files. 4/8 Tr. at 13-14; Dec. 2012 ROI at 4. He copied all of those onto another DVD and gave the DVD to Special Agent Hamako. 4/8 Tr. at 13-14; Dec. 2012 ROI at 4. Special Agent Hamako then spent "[s]everal days" reviewing the files obtained from Kim's computer, conducting keyword searches of the emails and documents. 4/7 Tr. at 47; Search Warrant 1 17 (stating that Special Agent Hamako received the emails on December 10, 2012 and reviewed them until December 19, 2012). He found emails consistent with the 2008 transaction Yang described during the interview, and those form the basis for the criminal charges in this case. 4/7 Tr. at 47-48. F. The Search Warrant On January 13, 2013, Special Agent Hamako filed an application for a search warrant in the U.S. District Court for the Southern District of California. Search Warrant. He provided an affidavit with the application, in which he stated his belief that there was "probable cause to believe that evidence relating to violations" of the ACEA, IEEPA, the Iranian Transactions Regulations, and other statutes would be contained in the files on Kim's laptop. SW Aff. 10. The affidavit states that the laptop was detained during a border search, that the government had imaged the laptop, and that Special Agent Hamako reviewed emails obtained from the laptop for ten days. SW Aff. 11 16-17. The affidavit then describes the contents of emails between Kim and Yang from December 2007 through April 2008, showing that Kim helped Yang purchase six accelerometers without the required export control license, and that the items were to be forwarded to Iran. SW Aft ¶¶ 18-40. The application stated further that, "[w]ith the approval of the Court in signing this warrant, agents executing this search warrant will employ the following procedures" to search Kim's computer: forensic imaging, which the affidavit acknowledged had already occurred, and identification and extraction of relevant data. SW Aff. 43-50. Special Agent Hamako explained: *8 Analysis of the data following the creation of the forensic image can be a highly technical process requiring specific expertise, equipment and software. There are literally thousands of different hardware items and software programs, and different versions of the same program, that can be commercially purchased, installed and custom-configured on a user's computer system. sss Analyzing the contents of a computer or other electronic storage device, even without significant technical challenges, can be very challenging. Searching by keywords, for example, often yields many thousands of hits.... Merely finding a relevant hit does not end the review process. The computer may have stored information about the data at issue: who created it, when and how it was created or downloaded or copied, when was it last accessed, when was it last modified, when was it last printed and when it was deleted.... Moreover, certain file formats do not lend themselves to keyword searches.... Many common electronic mail, database and spreadsheet applications do not store data as searchable text. SW Aft. ¶¶ 45-46. According to the agent's affidavit, the "mind-boggling" amount of data stored on computers makes analyzing the data "increasingly time-consuming." SW Aff. ¶ 48. Therefore, Special Agent Hamako predicted that "[t]he identification and extraction process ... may take weeks or months." SW Aff. 1j 49. He also averred that the WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. 9 EFTA01207801 United States v. Kim, — F.Supp.3d (2015) government "has not attempted to obtain this data by other means, except I) through border search authority ... and 2) some email communications between Kim and Yang ... previously obtained pursuant to court authorized search warrants of Yang's email accounts." SW Aff. ¶ 52. On January 16, 2013, the U.S. District Court for the Southern District of California signed the warrant. Search Warrant. But Special Agent Hamako and Special Agent Marshall each testified that after the search warrant was obtained, no further searches or analyses were undertaken. 4/7 Tr. at 51 ("THE COURT: Was there some new, different program that was applied after you got the warrant that did something more to the computer, or is it just a matter that you actually seized the e-mails? [Special Agent Hamako]: That's correct, Your Honor. We didn't use any different programs after obtaining the search warrant."); 4/8 Tr. at 23 ("THE COURT: Did you do anything to—either the complete image that you had created or the case agent's laptop, did you do any further searching or application of any programs after the search warrant was obtained? [Special Agent Marshall]: No."). ANALYSIS The government argues first and foremost that a laptop is nothing more than a sort of container, and that the agents had full authority to scour its contents without the need for a warrant or a showing of any particular level of suspicion simply because the search was initiated at the border. Gov't Opp. at 6, citing, inter alia, United States v. Ramsey, 431 U.S. 606, 97 S.Ct. 1972, 52 L.Ed.2d 617 (1977), and 19 U.S.C. § 1581.4 But the government also suggests that a search which took place at LAX, involving a passenger traveling to and from California, should be assessed utilizing the Ninth Circuit precedent set forth in United States v. Cotterman, 709 F.3d 952 (9th Cir.20I3). 4/8 Tr. at 86; Gov't Opp. at 10, n.9, II n.11. *9 In Cotterman, the Ninth Circuit announced that reasonable suspicion was required before investigators could undertake the forensic examination of a computer hard drive as part of a search that began as a cursory review at the border. 709 F.3d at 957. In this case, the government argues both that no suspicion was necessary since this was an ordinary, reasonable border search that can be distinguished from the forensic examination that took place in Cotterman, and also that the necessary suspicion was present. Gov't Opp. at 10-14. Neither the Supreme Court nor the D.C. Circuit has weighed in on this issue, so there is no binding precedent to be applied by this Court.' In 2014, a District Court in Maryland also concluded that reasonable suspicion was needed to justify a forensic search of a defendant's electronic data storage devices. United States v. Sahoonchi, 990 F.Supp.2d 536, 539 (D.Md.2014). And later that year, another court in this District was asked to apply the Cotterman rule to a search of a laptop seized from a passenger flying into LAX, but in that case, the court determined that it was not necessary to reach the constitutional question of whether reasonable suspicion was required because it found that such suspicion was present in any event. United States v. Hassanshahi, No. 13—0274(RC), — F.Supp.3d —, 2014 WL 6735479, at *12 (D.D.C.2014). In an effort to follow that sensible approach, this Court took up the reasonable suspicion question first. I. Was there reasonable suspicion to support the search of Kim's laptop? In 1~1The Supreme Court has defined reasonable suspicion as "a particularized and objective basis for suspecting the particular person stopped of criminal activity." United States v. Cortez, 449 U.S. 411, 417-18, 101 S.Ct. 690, 66 L.Ed.2d 621 (1981). The standard is met when a law enforcement officer can point to "specific and articulable facts," which, when considered together with the rational inferences that can be drawn from those facts, indicate that criminal activity "may be afoot." Terry v. Ohio, 392 U.S. I, 21, 30, 88 S.Ct. 1868, 20 L.Ed.2d 889 (1968). As the government has pointed out in this case, a court's determination of whether the officer had reasonable suspicion must be based upon the totality of the circumstances. See United States v. Arvizu, 534 U.S. 266, 273, 122 S.Ct. 744, 151 L.Ed.2d 740 (2002); see also Cortez, 449 U.S. at 418, 101 S.Ct. 690 (recognizing that law enforcement agents will draw upon their training and experience to piece together subtle clues that may seem innocent to others); United States v. Tiong, 224 F.3d 1136, 1140 (9th Cir.2000). 13IBut what is it that the officer must reasonably suspect? Neither party focused in on that issue, but a review of the cases decided in the wake of Terry makes it clear that the reasonable suspicion standard relates to ongoing or imminent crime. See Cortez, 449 U.S. at 417, 101 S.Ct. 690 ("An investigatory stop must be justified by some objective manifestation that the person stopped is, or is about to be, engaged in criminal activity."); United States v. Edmonds, 240 F.3d 55, 59 (D.C.Cir.2001) r[T]he issue is whether a reasonably prudent man in the circumstances would be warranted in his belief that the suspect is WestlawNexr © 2015 Thomson Reuters. No claim to original U.S. Government Works. 10 EFTA01207802 United States v. Kim, — F.Supp.3d (2015) breaking, or is about to break, the law.") (citation and internal quotation marks omitted). Therefore, if this Court were to determine, after considering the totality of the circumstances, that a reasonably prudent officer would have been justified in his belief that Kim was engaged in ongoing criminal activity at the time he was stopped at LAX, then the search would have been lawful under the Cottennan standard. And then, the Court could adopt the approach taken by the District Court in Hassanshahi and find the constitutional question of whether the search of the computer required reasonable suspicion to be moot. *10 1411n this case, though, the Court is troubled by the lack of particularized grounds to believe that this defendant was engaged in criminal activity at the time he was exiting the United States. First of all, there is no question that the decision to conduct the search was not made on that basis: Special Agent Hamako candidly testified that he made the decision to obtain the laptop and search it for evidence of the alleged conspiracy with Yang based upon his understanding that such a search required no level of suspicion at all. 4/7 Tr. at 34. He testified that once he had information from Yang that defendant Kim had been his source in 2008, he decided to conduct what he termed a "border search" the next time Kim came to the United States for the purpose of obtaining the laptop. 4/7 Tr. at 33-34, 94. And he made that decision before he knew when Kim would be travelling to the United States, whether he would be travelling, or why, and in the absence of any information whatsoever about what Kim would or did do while he was in the country. 4/7 Tr. at 81, 33.6 Even after the agent had been notified that Kim was on his way, he took no steps to monitor Kim's activities in any way while he was in the United States. 4/7 Tr. at 81. Notwithstanding these undisputed facts, the government takes the position that the agent had reasonable suspicion to search the laptop under the Teny standard adopted in Cottennan based upon the totality of the circumstances. It argued in its opposition to the motion to suppress, "Yang's admission that he previously conspired with Kim ... created reasonable suspicion that Kim had been, and perhaps still was, involved in illegal activity." Opp. at 12. And, "SA Hamako had reason to suspect that Kim would be crossing the border with a laptop that still contained evidence of his earlier criminal conspiracy with Yang, as well as any recent illegal activities." Gov't Opp. at 14. But the government's use of such language as "perhaps" and "any" was not at all reassuring, as it served to highlight how thin the showing is in this case. And the agent's testimony confirmed that gathering evidence of a completed crime was the central motivation here. See 4/7 Tr. at 95 ("[M]y main goal was to obtain his electronics and then let him go on his way."). WestlawNext © 2015 Thomson Reuters. No claim to original U.S. Government Works. The government points out that the subjective intent of the agent is irrelevant. Gov't Opp. at 12 (stating that "only a 'minimal level of objective justification' " is required), quoting Hassanshahi, — F.Supp.3d at —, —, 2014 WL 6735479, at *16. And at the hearing on the motion, it posited that there was reasonable suspicion to support the search based upon the following circumstances: the preexisting ongoing investigation into Kim's involvement in Yang's 2008 transaction with Iran; the fact that Kim's name came up in connection with the more recent attempt to engage Yang in an undercover transaction; the fact that Kim did travel to the United States at the time Yang said he would be traveling; the business relationship between Kim and Yang; and the discovery of the o-rings. 4/8 Tr. at 77-78; Gov't Opp. at 12-14. IsiBut even if one credits Special Agent Hamako's testimony that Yang told him Kim knew that the items shipped in 2008 were bound for Iran, see 4/7 Tr. at 10-11—despite the agent's failure to mention that key detail in either his contemporaneous report or the affidavit he submitted in support of the search warrant, see Nov. 2012 ROI; SW Aff. —and even if one credits Yang's account of the previous transaction, evidence of prior criminal conduct alone is not sufficient to give rise to reasonable suspicion. Hassanshahi, — F.Supp.3d at , —, 2014 WL 6735479, at *14, citing United States v. Johnson, 482 Fed.Appx. 137, 148 (6th Cir.20 12); United States v. Walden, 146 F.3d 487, 490 (7th Cir.1998). This is particularly true under the circumstances of this case, where the only evidence of more recent activity was Yang's inquiry to Kim on behalf of the undercover officer, which did not result in any action on Kim's part. As of December 5, 2012, all that Special Agent Hamako knew about ongoing activity was that Yang had contacted Kim and the approach had quickly come to a dead end, that Yang was under arrest and no longer conspiring with anyone, and that the search of Kim's luggage revealed no accelerometers or obviously controlled items. *11 The government points to Kim's previous travel and the fact that exports to Yang and others were a regular part of his business, but this is the sort of evidence the Supreme Court has cautioned against according much weight in the reasonable suspicion analysis because it "describe[s] a very large category of presumably innocent travelers." Reid v. Georgia, 448 U.S. 438, 441, 100 S.Ct. 2752, 65 L.Ed.2d 890 (1980). Further, it is difficult to find that the o-rings had anything other than marginal importance. The testimony was that they were small and plastic, and it was not obvious to an agent who was well trained in the contents of the 11 EFTA01207803 United States v. Kim, — F.Supp.3d (2015) munitions list that they were listed at all. 417 Tr. at 41, 83-86. Indeed, they were of so little value to his investigation that the agent did not retain them, photograph them, or even describe them in any report. 4/7 Tr. at 86-87. According to Special Agent Hamako, that was because his "main goal was to obtain [Kim's] electronics and then let him go on his way." 4/7 Tr. at 95. And the agent testified that that the decision to search the laptop well preceded the discovery of the o-rings in any event. 4/7 Tr. at 110-12. The agent's answers to questions posing obvious propositions that do not depend on sophisticated investigatory experience, see 4/7 Tr. at 48 ("Q.... Ulf you knew that Mr. Yang and Mr. Kim had conspired to export the accelerometers Mr. Yang tol