## Facts

- Howard Cotterman and his wife, Maureen Cotterman, drove to a United States port of entry seeking admission.
- A Treasury Enforcement Communications System (TECS) hit indicated Howard had been convicted of child sex crimes about 15 years earlier and alerted officers to watch for possible child pornography.
- Border inspectors referred the Cottermans to secondary inspection and searched their vehicle.
- Inspectors found two laptop computers and three digital cameras.
- A cursory review did not reveal contraband, but inspectors noticed certain files on Howard’s laptop were password protected.
- Howard offered to help access the password-protected files, but the offer was declined.
- Immigration and Customs Enforcement (ICE) agents seized both laptops and one camera and transported them about 170 miles to Tucson for a forensic examination.
- The forensic work occurred off-site and took place over multiple days; investigators ultimately found about 75 images of child pornography on Howard’s laptop.
- No illegal material was found on Maureen’s laptop; the laptop was returned to her.
- ICE nonetheless made and retained a complete copy of Maureen’s hard drive, and the copy remained in government custody about 17 months later.
- ICE field guidance stated that seized electronic media should not be kept longer than needed to determine whether it furthered ICE’s law-enforcement mission.
- Howard was indicted for federal child-pornography offenses and moved to suppress the evidence obtained from the forensic search of his laptop; the magistrate judge’s report also addressed the retained copy of Maureen’s hard drive.

## Issues

1. Whether an off-site, multi-day forensic examination of a laptop seized at the border is a non-routine border search that requires at least reasonable suspicion under the Fourth Amendment.
2. If reasonable suspicion is required, whether the government had reasonable suspicion to conduct the forensic examination of Howard Cotterman’s laptop.
3. Whether the government’s continued retention of a complete forensic copy of Maureen Cotterman’s hard drive, after finding no contraband on her laptop, was an unreasonable seizure.

## Decision

- The district court granted Howard Cotterman’s motion to suppress, adopting the magistrate judge’s recommendation in substantial part.
- The court treated the off-site, multi-day forensic examination conducted far from the port of entry as a non-routine border search that required reasonable suspicion.
- The court concluded the government did not show reasonable suspicion sufficient to justify the forensic examination when it was initiated; the TECS hit reflecting old convictions and the presence of password-protected files did not, without more, supply a current, particularized basis for the intensive search performed.
- As to Maureen Cotterman, the court found that keeping a full copy of her hard drive long after agents found nothing illegal on her laptop violated the Fourth Amendment.
- The court ordered the government to return or destroy the retained copy of Maureen’s hard-drive data.

## Legal Principles

- Routine searches at the international border generally may be conducted without a warrant and without individualized suspicion.
- Border searches that are non-routine in scope or manner may require at least reasonable suspicion.
- A comprehensive forensic examination of electronic storage, conducted off-site and over an extended time, can be treated as non-routine because of the privacy interests implicated by the volume and type of information stored on computers.
- Reasonable suspicion must rest on specific, articulable facts tied to current suspected wrongdoing; an old criminal record and generic indicators such as password protection, standing alone, may be insufficient to justify an intensive forensic review.
- Even when a device is lawfully seized, continuing to hold property (or a complete data copy) after the government determines it contains no contraband and lacks an ongoing law-enforcement need can amount to an unreasonable seizure; internal agency guidance on retention may inform the reasonableness analysis.

## Conclusion

In United States v. Howard Wesley Cotterman, the district court suppressed child-pornography evidence found through a multi-day, off-site forensic examination of a laptop seized at the border because it treated the search as non-routine and concluded the government lacked reasonable suspicion to conduct it, and the court also ruled that ICE’s long-term retention of a complete forensic copy of Maureen Cotterman’s hard drive—after finding nothing illegal—was unreasonable and required return or destruction of the copied data.


United States v. Howard Wesley Cotterman, 2009 U.S. Dist. LEXIS 14300 (2009)