Skip to content

Forensic protocol and scope · 9th Cir. (en banc) · 2010

United States v. Comprehensive Drug Testing, Inc.

621 F.3d 1162 (9th Cir. 2010)

Investigating ten baseball players, federal agents seized drug-test records for hundreds. The en banc Ninth Circuit affirmed orders returning and suppressing the overseized data, warning that segregating seizable electronic data must not become the government's route to data it lacked probable cause to collect.

The process of segregating electronic data that is seizable from that which is not must not become a vehicle for the government to gain access to data which it has no probable cause to collect.
United States v. Comprehensive Drug Testing, Inc., 621 F.3d 1162 (9th Cir. 2010) read the opinion

Issue

In the BALCO steroid investigation, the government had probable cause as to ten named players — and executed a warrant at a drug-testing laboratory whose directory contained confidential results for hundreds of others, seizing far beyond the ten. Three district judges ordered the excess returned or suppressed. The en banc question was whether those orders stood, and what constrains the government when the practical realities of computer storage require seizing more than the warrant particularizes.

Rule

Warrants for electronic storage routinely justify over-seizure on the ground that intermingled data must be examined off-site under controlled procedures — the government itself made that case here, then disregarded the warrant's conditions, letting case agents rather than designated computer personnel review everything and treat what they saw as plain view. The en banc court held the resulting seizure unreasonable and affirmed return and suppression: the segregation process cannot be the instrument by which the government acquires what it had no probable cause to take, and greater judicial vigilance is called for as electronic seizures make the risk routine.

Application

The warrant in question had been carefully conditioned: initial review by trained computer personnel rather than the investigating agents, on-site segregation where feasible, and procedures to keep out-of-scope data from the case team. The agents inverted each safeguard — the case agent himself reviewed the directory containing every player's results — and the government then defended the windfall as plain view. Chief Judge Kozinski's concurrence, joined by four judges, distilled the lesson into guidance for future warrants: waiver of plain-view reliance, segregation by specialists or an independent third party, disclosure of the actual risks to the issuing magistrate, and return or destruction of non-responsive data.

Conclusion

The suppression and return orders were affirmed (one appeal dismissed as untimely). The binding holding condemns using the mechanics of digital segregation to launder an overbroad seizure; the concurrence's protocol, while guidance rather than command, became the reference design for electronic-search warrants and taint procedures nationwide, and its logic — someone other than the interested party should separate responsive from non-responsive data — is now standard in civil forensic protocols as well.

What this means in practice

CDT's architecture is the one civil litigants borrow every time a forensic examination is negotiated: the party seeking data does not get to rummage. A neutral examiner or court-appointed special master images the source, applies agreed search criteria, screens for privilege and out-of-scope material, and produces only what the protocol allows — which is how an examination of an adversary's systems, like the one in Klipsch, stays defensible. Write the segregation roles into the protocol before collection begins; CDT is what happens when the roles collapse.

Related services: Special Master & Neutral Services · Forensic Imaging & Chain of Custody · eDiscovery Consulting & Strategy

From our work

Need this looked at properly?

Our examiners and testifying experts work these questions for a living. Tell us what you're facing.

Reviewed by Law & Forensics. See our editorial standards.

This summary is provided for general information and is not legal advice. The linked opinion is the authoritative source; citation and quotation verified against the CourtListener record (cluster 175207).