## Facts

- Ali Saboonchi, a dual U.S.–Iranian citizen, was investigated for possible exports to Iran in violation of U.S. sanctions and export-control laws.
- On March 31, 2012, Saboonchi and his wife attempted to reenter the United States from Canada at the Rainbow Bridge near Buffalo, New York.
- During primary inspection, a government “lookout” alert tied to the export investigation triggered secondary inspection.
- Officers questioned Saboonchi and his wife, permitted them to leave, but seized two smartphones and a USB flash drive from Saboonchi without his consent.
- A Homeland Security Investigations agent created forensic images of the devices and transmitted the images for later, detailed forensic examination using specialized software away from the border.
- The forensic examinations produced evidence supporting charges under the International Emergency Economic Powers Act and the Iranian Transactions and Sanctions Regulations.
- Saboonchi moved to suppress the device evidence, arguing the warrantless forensic searches were nonroutine, highly intrusive, and unlawful without probable cause or, at minimum, reasonable suspicion.

## Issues

1. Whether warrantless forensic examinations of smartphones and a USB drive seized at the border fall within the Fourth Amendment’s border search exception.
2. Whether forensic examinations of digital devices at the border may be conducted without individualized suspicion, or instead require reasonable suspicion.
3. Whether the government had reasonable suspicion, on these facts, to justify the forensic searches and defeat suppression.

## Decision

- The court denied the motion to suppress.
- The court held that a forensic examination of digital devices, given its intrusiveness and data exposure, is a nonroutine border search that requires reasonable suspicion.
- The court found reasonable suspicion existed because Saboonchi was the subject of an active export-control investigation, his border crossing triggered an investigative alert, and the seized devices were reasonably suspected to contain evidence of the suspected offenses.
- The court rejected the argument that later imaging and analysis at a separate location transformed the examination into a non-border search, treating it as a continuation of a lawful border seizure and search process.

## Legal Principles

- Routine searches of persons and property at the international border (or its functional equivalent) may be conducted without a warrant or individualized suspicion.
- Nonroutine border searches that are highly intrusive or substantially implicate privacy interests require at least reasonable suspicion.
- Forensic examinations of digital devices are nonroutine because they can expose extensive personal data (including deleted and metadata) beyond what traditional property searches reveal.
- When reasonable suspicion supports the seizure and forensic examination of electronic devices at the border, neither probable cause nor a warrant is required under the border search doctrine.
- Post-seizure forensic imaging and off-site analysis may remain within the border search doctrine when tied to the border event and supported by the requisite suspicion.

## Conclusion

The court treated forensic analysis of digital devices seized at the border as a nonroutine border search requiring reasonable suspicion, concluded that standard was met based on the active export-control investigation and border alert, and denied suppression of the evidence obtained from the smartphones and flash drive.


United States v. Saboonchi, 990 F. Supp. 2d 536 (D. Md. 2014)