In United States v. Syphers, a case decided last week, the First Circuit opined on a tremendously interesting question of Fourth Amendment law: When the police execute a warrant to seize a computer, are there any temporal limits on when the government needs to analyze the computer that has been seized? Unfortunately, the court's opinion is remarkably confusing.

  The timing of computer searches is an interesting question because computer warrants usually are executed in a two-step process. First, the police go to the place to be searched and take the computer away; and second, a trained government computer forensic analyst examines the computer for the evidence the computer contains. Existing Fourth Amendment rules on the timing of searches focus entirely on the first step. That's understandable: this is the only step in most traditional searches. After the evidence has been retrieved, the search is done.

  Under the existing law that regulates only the first step, the basic rule is that the initial search has to occur in 10 days after the warrant is sighed under statutory rules such as the Federal Rule of Criminal Procedure 41. The constitutional concern driving this rule is that if the police wait for too long, the probable cause that led to the warrant may become stale. The question is, what rules govern the second step, the electronic search through the defendant's computer? At this point, the police have the seized computer in their custody. Most offices and agencies have a considerable backlog of computer forensic work, though, so they don't get to a newly seized computer for months. Is this too long? For that matter, is any period too long?

  The handful of district courts that have addressed the issue have agreed that the 10-day requirement of Rule 41 does not apply to the second step. Agents have to seize the computer in the 10 days, but they don't need to analyze it within that window. The harder question is what if anything the Fourth Amendment has to say. A few district courts have suggested that there are no rules on when the government must search a seized computer, but a few others have suggested that the Fourth Amendment requires investigators to search seized computers in a "reasonable" time.

  This issue came up at the appellate level for the first time in the Syphers case, in an opinion by Judge Patti Saris, a district judge sitting by designation. Syphers involved a state investigation in which the government applied for and obtained an order permitting the government to search the computer in a one-year window. The computer was searched five months into the one year. Judge Saris first held that Rule 41 was not applicable because this was a state investigation, not a federal investigation. Saris then turned to the Fourth Amendment question:

  The Fourth Amendment itself "contains no requirements about when the search or seizure is to occur or the duration." United States v. Gerber, 994 F.2d 1556, 1559-60 (11th Cir.1993). However, "unreasonable delay in the execution of a warrant that results in the lapse of probable cause will invalidate a warrant." United States v. Marin-Buitrago, 734 F.2d 889, 894 (2d Cir.1984). The restrictions in Rule 41 "not only ensure that probable cause continues to exist, but also that it is the neutral magistrate, not the executing officers, who determines whether probable cause continues to exist." Id. The policy behind the ten-day time limitation in Rule 41 is to prevent the execution of a stale warrant. "A delay in executing a search warrant may render stale the probable cause finding." United States v. Gibson, 123 F.3d 1121, 1124 (8th Cir.1997).
  A delay in execution of the warrant under Rule 41 does not render inadmissible evidence seized, absent a showing of prejudice to the defendants resulting from the delay. See United States v. Cafero, 473 F.2d 489, 499 (3d Cir.1973). Courts have permitted some delay in the execution of search warrants involving computers because of the complexity of the search. See, e.g., United States v. Gorrell, 360 F.Supp.2d 48, 55 n. 5 (D.D.C.2004) (ten-month delay in processing of computer and camera seized, although "lengthy," "did not take the data outside the scope of the warrant such that it needs to be suppressed"); United States v. Triumph Capital Group, Inc., 211 F.R.D. 31, 66 (D.Conn.2002) ("[C]omputer searches are not, and cannot be subject to any rigid time limit because they may involve much more information than an ordinary document search, more preparation and a greater degree of care in their execution.").
  The primary question is whether, under the policies embedded in Rule 41, the one-year extension order issued by the court because of a backlog in computer crimes investigations provided an excessive amount of time to allow for the search of a computer already in police custody pursuant to a warrant. Under the circumstances, the five-month delay did not invalidate the search of appellant's computer because there is no showing that the delay caused a lapse in probable cause, that it created prejudice to the defendant, or that federal or state officers acted in bad faith to circumvent federal requirements.

  I confess I am quite puzzled by this. If Rule 41 is inapplicable, as Judge Saris found, why is the court looking to "the policies embedded in Rule 41" to decide the case? Why is this the "primary question," and what other questions are there? For that matter, just what "policies" are "embedded" in Rule 41? The "prejudice" test is used to determine when Rule 41 violations lead to suppression; why it is being used if Rule 41 isn't implicated here? And what kind of prejudice might be relevant, given that the search occurs back at the government's lab — and that if the computer is found to contain evidence, the computer can be kept in government custody until the trial? For that matter, how can delay in the search of a seized computer cause a lapse in probable cause, given that all of the evidence is stored inside the computer?

  Can anyone make more sense of this analysis than I can? I'm not sure I understand what the Court did.

  For more on these issues, see my forthcoming article Search Warrants in an Era of Digital Evidence.