The White Collar Appeal: Tenth Circuit Finds Fourth Amendment Violation in Warrant for Cloud Account Data but Affirms Under the Good-Faith Exception

• In United States v. Tew, the Tenth Circuit held that a warrant for a defendant’s Apple iCloud account was insufficiently particularized but declined to exclude evidence obtained pursuant to the unconstitutional warrant under the good-faith exception. 

• The warrant limited the scope of seizure only by reference to a variety of broad federal criminal statutes and an ambiguous start date, and it did not provide any other constitutionally sufficient guardrails to cabin the government’s review. Agents thus had virtually unfettered discretion over years of a defendant’s digital communications, including with her coconspirator husband. 

• Defendants facing similarly sweeping warrants for their Google, Apple, and other cloud accounts should cite Tew in challenging such warrants, especially because the decision provides clear authority proscribing this practice, which should limit the government’s ability to rely on the good-faith exception to the exclusionary rule.

Background

Michael Tew was a financial advisor hired to help guide National Air Cargo—a logistics provider and Department of Defense contractor—through Chapter 11 bankruptcy proceedings.  He ultimately rose to serve as the company’s CFO.  His wife, Kimberley Tew, traded cryptocurrency and gambled and eventually ran up significant debts.  So Michael and Kimberley enlisted the help of National Air Cargo’s comptroller, who submitted falsified invoices for nonexistent vendors, enabling the Tews to misappropriate more than $5 million from National Air Cargo.  

The government ultimately caught wind of this scheme, and National Air Cargo’s comptroller implicated the Tews when agents interviewed him.  The agents obtained a search warrant directed to Apple for data from Kimberley’s iCloud account under the Stored Communications Act, 18 U.S.C. § 2701, et seq.  

As has become customary in search warrants for electronic data, the warrant authorized a two-step process.  First, the warrant required Apple to provide “[a]ll records or other information” that would identify the account’s user and the devices used to access the account.   It also stated that Apple was to provide the “contents of all emails” and “all instant messages associated with the account” between May 1, 2018, and September 17, 2020.  And it required disclosure of all photos stored on the account and all locations where the account was accessed, without providing any time limitation. 

In the second step, the warrant authorized the government to seize a subset of that information.  Under the heading “[i]nformation to be seized by the government,” the warrant stated that it applied to “[a]ll information described above in Section I that [sic] fruits, evidence and/or instrumentalities of violations of 18 U.S.C. §§ 371, 1343, 1349, 1519, 1956 and 1957 (the ‘Target Offenses’) since May 1, 2018, including” seven subcategories of information. Five of the subcategories referenced the “Target Offenses.”  The others did not.  Only one subparagraph referenced National Air Cargo or a scheme to defraud it.  

Apple complied with the warrant and turned over the contents of Kimberley’s emails, text messages, photos, historical physical locations, and records identifying all apps and devices linked to her account—data spanning virtually every device she had ever used to log into Apple’s servers.  Before trial, Kimberley moved to suppress evidence obtained from her cloud accounts, arguing that the warrant was insufficiently particularized.  The district court denied the motion, holding that the warrant was not overbroad and, even if it were, the good-faith exception to the exclusionary rule applied.  The jury convicted both Tews on nearly all counts.  On appeal, Kimberley challenged the denial of her suppression motion (as well as the denial of severance motion, which we do not address here).  

Holdings

The Tenth Circuit held that the Apple warrant violated the Fourth Amendment’s particularity requirement, but it affirmed the district court’s denial of the suppression motion under the good-faith exception. 

The Fourth Amendment requires that warrants “particularly describ[e] the place to be searched, and the persons or things to be seized.”  U.S. Const. amend. IV.   The particularity requirement, the Tew court explained, was designed to prevent precisely the kind of “exploratory rummaging” that a warrant like this one enabled.  The court further noted that, “just as the search of a computer’s hard drive is categorically different from the search of a physical file cabinet, the search of a cloud-based account is itself categorically different from the search of a physical device like a computer or a cell phone.” (citation omitted).

Reviewing the text of the warrant’s seizure provision, the court found that the introductory paragraph—authorizing seizure of all data constituting fruits or instrumentalities of the Target Offenses—was limited only by those offenses and an ambiguous start date. The seven subcategories that followed were non-exhaustive and did not cabin the introductory paragraph.  In particular, only one of seven subcategories referenced the misappropriation scheme or the scheme’s alleged victim, National Air Cargo.

The court further explained that referencing the Target Offenses provided no meaningful limitation either.  Statutes like the general federal conspiracy prohibition, wire fraud, and money laundering are among the broadest in the federal criminal code, and the Tenth Circuit emphasized its precedent that an “unadorned reference to a broad federal statute does not sufficiently limit the scope of a search warrant.”

But despite the unconstitutional overbreadth, the court declined to suppress the evidence under the good-faith exception.  Where, as here, a neutral magistrate has issued a warrant, there is a presumption that the officers who execute the warrant have acted in good faith such that excluding evidence is not justified. That presumption may be rebutted, however, if the warrant is “so legally insufficient that executing agents’ reliance upon them is so wholly unwarranted that good faith is absent.”  Here, the court held that, although it was a “close call,” there was insufficient evidence to rebut the presumption of good faith.  

In reaching that determination, the court identified seven factors: (1) no prior Tenth Circuit opinion had provided specific guidance on how to frame and limit the search of a cloud-based account under the Stored Communications Act; (2) the warrant “made some effort” to comply with the particularity requirement by listing at least some criminal statutes; (3) it “did not include a catchall clause allowing for seizure of ‘any other information’ that might bear on any potential violation of criminal statutes”; (4) the agent who executed the search was familiar with the investigation; (5) although the affidavit supporting the warrant application was not attached to the warrant, the magistrate who issued the warrant had reviewed the affidavit; (6) a prosecutor had reviewed the warrant application; and (7) the government used a taint team to avoid improper review of privileged communications.

Key Takeaways

Tew was a “close call.”  Future cases shouldn’t be.  Of the seven factors the court cited in finding good faith, the first one—lack of on-point precedent—seems to have done the most work in the analysis.  The other six factors are present in the vast majority of cases involving warrants targeting cloud account data.  In Tew, the Tenth Circuit now has “given law enforcement agents specific guidance on how to draft and execute this type of search warrant.”  Future government reliance on the good-faith exception in defending similar warrants thus should be met with skepticism.  Where the government obtains a warrant for cloud account data that lacks the guardrails the court identified—for example, specific participants, named coconspirators, defined fraudulent schemes—defendants should cite Tew.

The Tenth Circuit joins a growing number of circuits affirming that warrants for cloud account data are more invasive than phone or computer searches.  The Tenth Circuit’s alignment with the Fourth and Eleventh Circuits in expressing alarm about overbroad digital-account warrants reflects a growing judicial consensus that such searches are even more precarious than phone and hard drive searches.  Defense counsel should highlight this distinction, relying on Tew to argue that the particularity requirement is especially important in searches of cloud-based account data.

Two features of Tew may limit its applicability in future cases.  The coconspirators in Tew were married, which magnified the privacy intrusion that resulted from the warrant’s lack of particularity.  Although the court noted that this permitted “an incredible intrusion into the intimate and personal lives of the warrant’s subject and her spouse,” this fact does not appear to have played an outsize role in the decision. Second, the affidavit in support of the warrant application provided more detail about the scope of the investigation that might have mitigated the warrant’s lack of particularity.  But  the affidavit was not incorporated into the warrant or physically attached to the warrant itself.  That might well have made Tew not a close call at all.

You can sign up to receive White Collar Appeal email updates by clicking here.