U.S. v. Sandiford
U.S. v. Sandiford
2021 WL 2689773 (M.D. Fla. 2021)
May 4, 2021

Lammens, Philip R.,  United States Magistrate Judge

Cloud Computing
Snapchat
Instant Messaging
Search and Seizure
Legal Hold
Scope of Warrant
Photograph
Mobile Device
Criminal
Text Messages
Social Media
Video
Facebook
Forensic Examination
Ephemeral Data
Download PDF
To Cite List
Summary
Dustin Sandiford was charged with knowingly possessing child pornography. He moved to suppress evidence discovered as a result of the seizure and search of a black iPhone, arguing that the evidence was obtained in violation of his Fourth Amendment rights. The Court found that the search warrant for the cell phone was valid and authorized the search of the Mega application, which may be used to display, distribute, or access child pornography. The Court denied Sandiford's motion to suppress.
UNITED STATES OF AMERICA, Plaintiff,
v.
DUSTIN SHANE SANDIFORD, Defendant
5:21-cr-1-JA-PRL
United States District Court, M.D. Florida
Filed May 04, 2021

Counsel

William S. Hamilton, US Attorney's Office, Ocala, FL, for Plaintiff.
Michael William Nielsen, Nielsen Law Firm, Winter Springs, FL, for Defendant.
Lammens, Philip R., United States Magistrate Judge

Report and Recommendation1

*1 Defendant Dustin Sandiford is charged by indictment with knowingly possessing child pornography depicting a prepubescent minor or minor less than the age of 12 in violation of 18 U.S.C. § 2252A(a)(5)(B). (Doc. 26). A jury trial is set for the June 2021 trial term. (Doc. 45).
 
Sandiford has moved to suppress evidence discovered as a result of the seizure and search of a black iPhone, arguing that the evidence was obtained in violation of his Fourth Amendment rights. (Docs. 37, 40).[2] On April 28, 2021, the Court held an in-person hearing on Sandiford's motion. The government presented the testimony of FBI Special Agent, David Moreno. Defendant offered his own testimony as well as the testimony of FBI Special Agent, Steve Burros. The Court took judicial notice of the Search Warrant Application and Master Affidavit, both of which were attached to the government's response. (Doc. 39-1).
 
I. Background
The search warrant at issue here was for “a cellular telephone assigned the unique call number of (352) 364-1308, in the possession of Dustin Sandiford.”[3] Doc. 39-1 at 2, 28. The attachment to the affidavit further stated that the phone “is believed to be manufactured by LG and operate on the Android operating system, but its specific make, model, and serial number are currently unknown.” Id. The warrant authorized the forensic examination of the cellular telephone for the purpose of identifying electronically stored information including:
Any and all computer software, including programs to run operating systems, applications, such as word processing, graphics, and communications programs, including, but not limited to, P2P software, that may be or are used to: visually depict child pornography or child erotica, display or access information pertaining to a sexual interest in child pornography; display or access information pertaining to a sexual activity with children; or distribute, possess, or receive child pornography, child erotica, or information pertaining to an interest in child pornography or child erotica.
(Doc. 39-1 at 28, 29).
 
The basis for the search and seizure of the cell phone derived from statements by confidential informants that Sandiford contacted them using the same call number assigned to the target cell phone and that Sandiford himself had provided that number. Doc. 39-1, Master Affidavit in Support of Applications for Search Warrants at ¶¶ 27, 29. In addition to texting at that number, Sandiford communicated with the confidential informants through cellular phone applications such as Snapchat and Facebook Messenger. Id. at ¶28. One confidential informant stated that Sandiford frequently showed him/her photos of naked girls on his cell phone, including a photo of a 14-year old female relative and a video of a 13-year old girl performing oral sex on him. Id. at ¶17.
 
*2 On December 2, 2020, federal agents, including Special Agents Burros and Moreno, executed the search warrant. Agents located Sandiford at his place of employment, a combination gas station and convenience store in Citrus County, Florida. At approximately 10:00 a.m., the agents entered the business through the normal front customer entrance. Special Agents Burros and Moreno both testified that once inside, agents encountered Sandiford behind the register. They asked him if he had his cellular phone, Sandiford indicated that he did, and he then pulled it out of the front pocket of his hooded sweatshirt and gave it to the agents. Sandiford testified that he did not willingly turn over the phone, but rather, that agents found the iPhone when they conducted a pat down.
 
Either way, pursuant to the search warrant, agents seized the cell phone. It was a black iPhone with the call number identified in the warrant. Sandiford refused to provide the security passcode, however, the phone was already unlocked at the time of seizure so the agents were able to conduct a limited search of its contents. The phone was taken to forensic technicians in the parking lot. One of the installed applications on the iPhone was a cloud storage app called “Mega.” In opening the “Mega” application, agents noted that Sandiford's Mega account contained approximately 137 gigabytes of total data. Agents found images and video of child pornography, several of which were parts of “known series,” or collections of child pornography that have been discovered in previous investigations.
 
Agents detained Sandiford at his place of employment for approximately two and half hours while they searched the iPhone, put a preservation letter in place to protect the contents of Sandiford's Mega account, and conferred with the AUSA regarding the contents of the Mega account and whether Sandiford should be arrested. During this time, Sandiford sat on a bench outside of the business. The agents ultimately declined to arrest Sandiford that day. Shortly after his detention ended, there was a remote login to Sandiford's Mega account from an IP address linked to an adjacent business, during which over 17,000 files (or 95% of all content) were deleted.
 
II. Discussion
Sandiford has moved to suppress the “black iPhone, and all of the contents contained in the phone or videotaped from the phone or derived from the phone in any manner, by law enforcement.” (Docs. 37, 40). The Fourth Amendment requires that search warrants particularly describe the things to be seized. United States v. Khanani, 502 F.3d 1281, 1289 (11th Cir.2007). Items which are seized but are not particularly described in the search warrant are to be excluded from evidence. United States v. Hendrixson, 234 F.3d 494, 497 (11th Cir.2000); United States v. Travers, 233 F.3d 1327, 1329 (11th Cir.2000). Nonetheless, the Fourth Amendment must be applied with a practical margin of flexibility, considering the nature of the items to be seized and the complexity of the case under investigation. United States v. Wuagneux, 683 F.2d 1343, 1349 (11th Cir.1982). “The description is considered sufficiently particular when it enables the searcher to reasonably ascertain and identify the things authorized to be seized.” United States v. Betancourt, 734 F.2d 750, 754–55 (11th Cir.1984).
 
Here, Sandiford argues that the search warrant for the cell phone fails to meet the particularity requirement. As discussed above, the property to be searched was described in the warrant as: “a cellular telephone assigned the unique call number of (352) 364-1308, in the possession of Dustin Sandiford.” While one of the sources provided information to suggest the phone may have been an LG phone, the affidavit made clear that the precise type of phone was unknown: “It is believed to be manufactured by LG and operate on the Android operating system, but its specific make, model, and serial number are currently unknown.” This was sufficiently particular for the agents to reasonably ascertain and identify the property that was authorized to be searched.
 
*3 The cell phone seized by the agents met the description—it was in Sandiford's possession and it had the unique call number identified in the warrant. As Special Agent Moreno testified (and to which there was no dispute), a particular call number can only be assigned to one cell phone at a time. The fact that it was an iPhone and not an LG phone, or that the warrant did not list the serial number or MEI number for the phone, does not render the warrant unlawfully vague. The Eleventh Circuit has made it clear that “the standard is one of practical accuracy rather than technical nicety.” United States v. Betancourt, 734 F.2d 750, 754–55 (11th Cir.1984). Accordingly, the iPhone was seized and searched pursuant to a valid search warrant.
 
At the hearing, Sandiford argued that the warrant did not authorize the search of the Mega application because that application requires an internet connection, so it is not actually “on the phone.”[4] However, the warrant broadly covered the search of applications that inter alia may be used to display, distribute, or access child pornography. Agent Moreno testified that the Mega application is popular for its encryption where Mega itself cannot view or see any of the data. The account can only be accessed by the account holder who has a decryption password. The phone was unlocked at the time it was seized and the agents were readily able to access the Mega application where they saw images and videos of child pornography. Accordingly, the search of the Mega application was authorized by the search warrant.
 
Sandiford also takes issue with the circumstances surrounding the execution of the search warrant. Sandiford contends that he did not voluntarily hand over the phone, but rather, that agents found it when they conducted a pat down. Even if Sandiford's version of events is true (notably, though, his testimony was not credible), it would not render the search warrant invalid. Pursuant to the valid search warrant for the cell phone, the agents had a right to secure it. Once the agents had the cell phone, they were authorized by the search warrant to immediately take custody of the cellular phone and inspect or seize the contents in accordance with terms of the lawful warrant. Any subsequent detention, even if unlawful (it was not), cannot taint the validity of the judicially authorized seizure.[5]
 
III. Conclusion
Accordingly, Defendant's motion to suppress (Docs. 37, 40) should be DENIED.
 
DONE and ENTERED in Ocala, Florida on May 4, 2021.

Footnotes
Within 14 days after being served with a copy of the recommended disposition, a party may file written objections to the Report and Recommendation's factual findings and legal conclusions. See Fed. R. Civ. P. 72(b)(3); Fed. R. Crim. P. 59(b)(2); 28 U.S.C. § 636(b)(1)(B); Local Rule 6.02. A party's failure to file written objections waives that party's right to challenge on appeal any unobjected-to factual finding or legal conclusion the district judge adopts from the Report and Recommendation. See 11th Cir. R. 3-1.
On April 6, 2021, Sandiford filed his initial motion to suppress evidence (Doc. 37), to which the government filed a response. (Doc. 39). Sandiford then filed an amended motion to suppress evidence (Doc. 40), which the Court treated as a reply since it addressed issues raised by the government in its response.
Two search warrants were applied for and issued related to Sandiford—one for the cell phone (5:20-mj-1183-PRL) and one for his residence (5:20-mj-1174-PRL). On defense motion, the Court unsealed the search warrants and affidavits from both cases. Doc. 36. The evidence at issue in this motion (the black iPhone) was seized pursuant to the warrant for the cell phone. Accordingly, the Court need not address the warrant for the residence, nor consider Plaintiff's wholly irrelevant arguments regarding it.
Sandiford does not argue that a separate warrant was required for data stored in a cloud app. Nor has he cited any case suggesting that the government is required to get a separate warrant for data stored in the cloud.
Relatedly, his initial contention (found in his initial motion to suppress) that he was only detained because of the search warrant being simultaneously executed at his home and that his phone shouldn't have been taken from him pursuant to a detention related to the search warrant being executed at his home, is without any merit. As discussed and established, his phone was seized and he was detained pursuant to the execution of a valid search warrant for the phone in his possession.