Probable Cause, Particularity, & Demonstrating a Nexus in the Digital World

Knowledge of Technology

Continuing to understand how current technology and digital evidence evolves is critical to today’s law enforcement officers.  A law enforcement officer’s lack of understanding of the technology may result in many investigation issues. A potential pitfall may include failing to provide critical descriptions of the types of data located within the technology resulting in a narrower search. Similarly, an officer may write a bare-bones affidavit making it possible for a defendant to challenge the search warrant's scope.[1] An affidavit containing sufficient details describing the digital evidence's potential contents and their relevance to the investigation fulfills the particularity requirement.[2]

Warrants Clause Requirements

The Fourth Amendment’s “Warrants Clause” states, in part: “no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.” The Fourth Amendment requires all warrants to contain the following:

1. Probable cause,
2. Particularity in the place to be searched, and
3. Particularity in the persons or things to be seized.

Probable Cause exists when a reasonable person would believe there is a fair probability that a crime occurred, a particular person committed that crime, and a search of the targeted location would reveal evidence of the crime.[3]  An affidavit that establishes probable cause in a digital evidence case incorporates answers to what, why, where, and how: what evidence you believe exists; why you believe the specific device contains that evidence; where the device is located as well as where evidence is likely to be found on the device; and how that evidence will prove an element of an underlying crime.

Particularity in the place to be searched requires the affiant to provide facts that demonstrate a “fair probability” or a “substantial chance” that a search of the identified location will reveal relevant evidence.[4]  To satisfy the particularity requirement for digital devices, an officer must provide specific information describing the type of digital device, the unique device’s location, and expressly explaining where evidence exists on the device.  An officer looking for records related to a stolen credit card might not know enough facts to justify a search of photos or a messaging application on a device in question. To satisfy particularity requires additional information supporting the conclusion that the images may provide relevant evidence. Potential evidence might include photos of a specific purchase that the suspect created or posted online. Perhaps, the messaging application contains information detailing a trip where the suspect meets a co-conspirator or describes a place where the suspect used the stolen credit card. A carefully crafted search warrant includes enough details where digital evidence resides.

Particularity in the persons or things to be seized requires an officer to describe, in detail, the evidence expected on the device.  An officer searching for “financial records” cannot merely write “financial records” in the search warrant affidavit; instead, including information detailing the date range, type of records, and what evidence the records might reveal. Recently, several federal and state courts released opinions limiting search warrants on mobile devices temporally as well as by the category of data sought.[5]

Nexus Between Evidence and Crime

After determining an affidavit contains facts demonstrating probable cause and particularity, review whether the affidavit establishes a nexus between the evidence sought and the underlying crime elements. The nexus answers the question: how is this evidence relevant to the current investigation?  Providing logical explanations between probable cause to seize or search evidence enables a judge reviewing a warrant affidavit to understand the connection and grant a search warrant.  The nexus also provides additional support against a defense challenge to the search warrant. An affidavit describing a seamless relationship between the defendant, the device, the evidence, the investigation, and potential crimes, creates a much higher burden for a defendant to challenge in court.

An investigator commonly handling digital evidence during cases most likely possesses a deeper understanding of connections between digital evidence and an offense's elements. However, a law enforcement officer cannot assume the reviewing judge will have the same knowledge or appreciate those links' significance. Instead, the affidavit should adequately explain the relationship.

For example, an investigator involved with social media investigations might already know that Facebook generates a unique Facebook Photo Identification Number (FPIN) for individual users tagged in a photo posted on the site. Facebook’s AI then compares newly posted pictures with the hash value associated with known FPIN’s and matches those recently added photos to existing Facebook users' accounts. This type of digital evidence might be beneficial for an investigation. However, if the affidavit merely states that Facebook creates and retains this type of information without explaining how it might help identify an underlying offense element, the affidavit lacks a nexus. A reviewing judge may not grant the initial warrant application, or a judge reviewing a motion to suppress may rule failing to include the nexus makes the warrant overbroad.[6] 

The critical process of explaining the nexus applies to every search warrant affidavit. For example, a homicide affidavit must provide the reviewing court with the necessary links between the collected facts and evidence, such as the consistency of a victim’s wounds with being stabbed by a sharp object and the evidence sought to prove the suspect committed the crime, such as the unique knife used to commit the murder.             

Conclusion

Accurately drafted search warrants for digital evidence, while not simple, lay the proper foundation for the successful collection and use of crucial evidence.  Legally appropriate search warrants for digital evidence require a competent explanation of the technology involved, the inclusion of facts and evidence establishing probable cause and particularity, as required by the Fourth Amendment, and the ability to demonstrate a nexus between the search location and the underlying crime.  These necessary aspects of the warrant affidavit help support your investigation and, ultimately, prosecution and conviction of the suspect. While this article references the general requirements to satisfy the “Warrants Clause” of the Fourth Amendment, the National White Collar Crime Center (NW3C) provides more detailed information, examples of search warrant templates, additional live online training, online training modules, and technical assistance for law enforcement officers and prosecutors. For access to these services and reference materials, please visit NW3C’s webpage at www.nw3c.org. 

Authors

Alicia D. Loy, Esq., is a Cyber and Economic Crime Attorney at the NW3C, where she assists in the development of curriculum for NW3C’s Judges and Prosecutors courses, provides support for NW3C’s prosecutorial technical assistance program, and develops content for webinars and podcasts on aspects of technology-facilitated crime.  Ms. Loy graduated from West Virginia University College of Law with her Doctor of Jurisprudence in May 2020. During law school she worked as a Student Attorney in the General Litigation Clinic and as an extern for the Honorable Michael John Aloi, Magistrate Judge for the Northern District of West Virginia. 

Justin Fitzsimmons currently serves as an Associate Vice President with the NW3C, where he oversees NW3C’s prosecutorial and judicial programs. He develops and implements cyber, high-tech, and economic crime curriculum while also providing training and technical assistance to law enforcement, prosecutors, and the judiciary across the country. He is licensed to practice law in Illinois and has significant experience as a prosecuting attorney.  He has published articles on child sexual exploitation and emerging technological issues. He has served as a member of national working groups to develop responses and education to technology-facilitated crimes.