United States v. Ganias

• Decision Date: 27 May 2016
• Docket Number: August Term 2015,No. 12-240-cr,12-240-cr
• Citation: 824 F.3d 199
• Parties: United States of America, Appellee, v. Stavros M. Ganias, Defendant–Appellant.
• Court: U.S. Court of Appeals — Second Circuit

824 F.3d 199

United States of America, Appellee

v.Stavros M. Ganias, Defendant–Appellant.

No. 12-240-cr

August Term 2015

United States Court of Appeals, Second Circuit.

Argued: September 30, 2015

Decided: May 27, 2016

Sandra S. Glover (Sarala V. Nagala, Anastasia Enos King, Jonathan N. Francis, Assistant United States Attorneys; Wendy R. Waldron, Senior Counsel, U.S. Dep't of Justice, on the brief), for Deirdre M. Daly, United States Attorney for the District of Connecticut, for Appellee United States of America.

Stanley A. Twardy, Jr., Day Pitney LLP, Stamford, CT (Daniel E. Wenner, John W. Cerreta, Day Pitney LLP, Hartford, CT, on the brief), for Defendant–Appellant Stavros Ganias.

(Counsel for amici curiae are listed in Appendix A.)

Before: Katzmann, Chief Circuit Judge, Jacobs, Cabranes, Pooler, Raggi, Wesley, Hall, Livingston, Lynch, Chin, Lohier, Carney, and Droney, Circuit Judges.

Livingston and Lynch, JJ., filed the majority opinion in which Katzmann, C.J., Jacobs, Cabranes, Raggi, Wesley, Hall, Carney, and Droney, JJ., joined in full, and Pooler and Lohier, JJ., joined in full as to Parts I and III and in part as to Part II.

Lohier, J., filed a concurring opinion in which Pooler, J., joined.

Chin, J., filed a dissenting opinion.

Debra Ann Livingston

and Gerard E. Lynch, Circuit Judges:

Defendant-Appellant Stavros Ganias appeals from a judgment of the United States District Court for the District of Connecticut (Thompson, J. ) convicting him, after a jury trial, of two counts of tax evasion in violation of 26 U.S.C. § 7201

. He challenges his conviction on the ground that the Government violated his Fourth Amendment rights when, after lawfully copying three of his hard drives for off-site review pursuant to a 2003 search warrant, it retained these full forensic copies (or “mirrors”), which included data both responsive and non-responsive to the 2003 warrant, while its investigation continued, and ultimately searched the non-responsive data pursuant to a second warrant in 2006. Ganias contends that the Government had successfully sorted the data on the mirrors responsive to the 2003 warrant from the non-responsive data by January 2005, and that the retention of the mirrors thereafter (and, by extension, the 2006 search, which would not have been possible but for that retention) violated the Fourth Amendment. He argues that evidence obtained in executing the 2006 search warrant should therefore have been suppressed.

We conclude that the Government relied in good faith on the 2006 warrant, and that this reliance was objectively reasonable. Accordingly, we need not decide whether retention of the forensic mirrors violated the Fourth Amendment, and we AFFIRM the judgment of the district court.

I

A. Background¹

In August 2003, agents of the U.S. Army Criminal Investigation Division (“Army CID”) received an anonymous tip that Industrial Property Management (“IPM”), a company providing security for and otherwise maintaining a government-owned property in Stratford, Connecticut, pursuant to an Army contract, had engaged in misconduct in connection with that work. In particular, the informant alleged that IPM, owned by James McCarthy, had billed the Army for work that IPM employees had done for one of McCarthy's other businesses, American Boiler, Inc. (“AB”), and for construction work performed for IPM's operations manager at his home residence. The informant told the agents, including Special Agent Michael Conner, that IPM and AB's financial books were maintained by Stavros Ganias, a former Internal Revenue Service (“IRS”) agent, who conducted business as Taxes International. On the basis of the informant's information, as well as extensive additional corroboration, Agent Conner prepared an affidavit seeking three warrants to search the offices of IPM, AB, and Taxes International for evidence of criminal activity.² Nothing in the record suggests that Ganias himself was suspected of any crimes at that time.

In a warrant dated November 17, 2003, U.S. Magistrate Judge William I. Garfinkel authorized the search of Taxes International. The warrant authorized agents to seize, inter alia , “[a]ll books, records, documents, materials, computer hardware and software and computer associated data relating to the business, financial and accounting operations of [IPM] and [AB].” J.A. 433. It further authorized seizure of “[a]ny of the items described [in the warrant] ... which are stored in the form of magnetic or electronic coding on computer media or on media capable of being read by a computer with the aid of computer-related equipment, including ... fixed hard disks, or removable hard disk cartridges, software or memory in any form.” Id. The warrant also specifically authorized a number of digital search protocols, though it did not state that only these protocols were permitted.³ The warrant authorized seizure of all hardware relevant to the alleged crimes.⁴

On November 19, 2003, Army CID agents executed the search warrants. Because the warrants authorized the seizure of computer hardware and software, in addition to paper documents, Agent Conner sought the help, in executing the warrants, of agents from the Army CID's Computer Crimes Investigation Unit (“CCIU”), a unit with specialized expertise in digital forensics and imaging. At Ganias's office, the CCIU agents—and in particular Special Agent David Shaver—located three computers. Rather than take the physical hard drives, which would have significantly impaired Ganias's ability to conduct his business, Agent Shaver created mirror images: exact copies of all of the data stored thereon, down to the bit.⁵ Ganias was present at his office during the creation of the mirrors, spoke with the agents, and was aware that mirrored copies of his three hard drives had been created and taken off-site.⁶ There is no dispute that the forensic mirrors taken from Ganias's office contained all of the computerized data maintained by Ganias's business, including not only material related to IPM or AB, but also Ganias's own personal financial records, and the records of “many other” accounting clients of Ganias: businesses of various sorts having no connection to the Government's criminal investigation.⁷ J.A. 464, ¶ 14.

The next day, Agent Shaver consolidated the eleven mirrored hard drives from all three searches (including the three from Ganias's office) onto a single external hard drive which he provided to Agent Conner. Agent Conner, in turn, provided this hard drive to the evidence custodian of the Army CID, who stored it at Fort Devens, Massachusetts. There the consolidated drive remained, unaltered and untouched, throughout the events relevant to this case. Around the same time, Agent Shaver created two additional copies of the mirrored drives on two sets of nineteen DVDs. After providing these DVD sets to Agent Conner, Agent Shaver then purged the external hard drives onto which he had originally written the mirrors. At this point, a week after the search, three complete copies of the mirrors of Ganias's hard drives existed: an untouched copy stowed away in an evidence locker and two copies available for forensic analysis.⁸

Though internal protocols required that specialized digital forensic analysts search the mirrored hard drives, the paper files were not subject to such limitations. Thus, shortly after the November 19 seizure, the Army CID agents began to analyze the non-digital files seized pursuant to the warrant. These files suggested that IPM had made payments to a third company whose owner, according to the Connecticut Department of Labor, was a full-time employee of an insurance company who received no wages from any source other than that insurance company. This and other red flags spurred Agent Conner to contact the Criminal Investigation Division of the IRS, which subsequently joined the investigation.

In early February 2004, as he and his fellow agents continued to follow leads from the paper files, Agent Conner sent one of the two DVD sets containing the forensic mirrors to the Army Criminal Investigation Laboratory (“ACIL”) in Forest Park, Georgia, accompanied by a copy of one of the three search warrants. In early June, the ACIL assigned Gregory Norman, a digital evidence examiner, to perform a forensic analysis. Around the same time, Special Agent Michelle Chowaniec, who replaced Agent Conner as the primary case agent for the Army CID in late March, provided the second set of DVDs to the IRS agent assigned to the case, Special Agent Paul Holowczyk. Agent Holowczyk in turn, passed it on, by way of intermediaries, to Special Agent Vita Paukstelis, a computer investigative specialist.

By the end of June 2004, computer experts for the Army CID and the IRS—Norman and Agent Paukstelis, respectively—had received copies of the digital evidence (which, as the district court found, were “encoded so that only agents with forensic software not directly available to the case agents could view [them],” Ganias , 2011 WL 2532396, at *7

), and forensic examination began.

Norman commenced his analysis in late June by loading the eleven mirrored drives into EnCase—the same software with which Agent Shaver initially created the mirrors—so that he could search the data thereon. After looking at the search warrants, he created a number of keywords, with which he searched for potentially relevant data. Initially, the search returned far too many results for practicable review (more than 17,000 hits); thus, Norman requested new keywords from Agent Chowaniec. On the basis of these new keywords, he was able to narrow his search and ultimately identify several files he thought might be of interest to the investigation, all of which he put on a single CD.⁹ Some of these files he was able personally to examine, to determine whether they were responsive to the warrant; a few (including the QuickBooks file labeled “Steve_ga.qbw,” which was ultimately searched pursuant to the 2006 warrant, J.A. 467) Norman...