Searching over 5,500,000 cases.

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

State v. Mansor

Supreme Court of Oregon

June 28, 2018

STATE OF OREGON, Petitioner on Review,
KALIQ MICHAEL MANSOR, Respondent on Review.

          Argued and submitted June 15, 2017

          On review from the Court of Appeals. (CC C111376CR) (CA A153124) [*]

          Peenesh Shah, Assistant Attorney General, Salem, argued the cause and fled the briefs for the petitioner on review. Also on the briefs were Ellen F. Rosenblum, Attorney General, and Benjamin Gutman, Solicitor General.

          Joshua B. Crowther, Chief Deputy Defender, Offce of Public Defense Services, Salem, argued the cause and fled the brief for the respondent on review. Also on the briefs was Ernest G. Lannet, Chief Defender.

          Before Balmer, Chief Justice, and Kistler, Walters, Nakamoto, Flynn, Duncan, and Nelson, Justices. [**]

         The decision of the Court of Appeals is affirmed. The judgment of the circuit court is reversed, and the case is remanded to the circuit court for further proceedings.

          [363 Or. 186] Case Summary: Defendant moved to suppress evidence discovered during a forensic examination of his computer conducted pursuant to a warrant, on the grounds that the warrant did not satisfy the particularity requirement of Article I, section 9, of the Oregon Constitution. The trial court denied the motion to suppress and a jury convicted defendant of murder and other crimes. The Court of Appeals reversed, holding that the warrant did not satisfy the particularity requirement because it was overbroad. Held: (1) Article I, section 9, of the Oregon Constitution requires a warrant authorizing the search of a computer to describe the information sought with as much specificity as reasonably possible under the circumstances, including, if available and relevant, a temporal description of when the information was created, accessed, or otherwise used; and (2) Article I, section 9, of the Oregon Constitution requires the suppression of evidence found during a warranted search of a computer if the search for that evidence was not authorized by the warrant and does not come within an exception to the warrant requirement.

         The decision of the Court of Appeals is affirmed. The judgment of the circuit court is reversed, and the case is remanded to the circuit court for further proceedings.

          [363 Or. 187] BALMER, C. J.

         In this case, we consider defendant's challenge under Article I, section 9, of the Oregon Constitution, to a warrant that authorized the search, seizure, and examination of his computer. Police investigated the injury of defendant's infant son while in defendant's care on June 12, 2011. The infant later died at the hospital. Defendant told the police that his son had struggled to breathe and that he had used his computer to look online for first aid advice before calling 9-1-1. For that and other reasons, police seized and then searched defendant's computer as part of their investigation. The forensic examination of the computer found internet search history shortly before the 9-1-1 call that was generally consistent with defendant's statements, but the examination also revealed that defendant had visited websites and entered search terms related to the abuse of infants several times in the months and weeks prior to the infant's death. The trial court denied defendant's motion to suppress the latter evidence, and defendant was convicted of murder and other crimes. The Court of Appeals reversed the convictions, concluding that the warrant authorizing the search of the computer violated the particularity requirement of Article I, section 9, because it permitted the examination of everything on defendant's computer. State v. Mansor, 279 Or.App. 778, 801, 381 P.3d 930 (2016). We allowed the state's petition for review of that decision and now affirm, although our analysis differs in some respects from that of the Court of Appeals.

         For the reasons discussed below, we conclude that the application of Article I, section 9, to warranted searches of personal electronic devices requires a test that protects an individual's right to be free from unreasonable searches and seizures while also recognizing the government's lawful authority to obtain evidence in criminal investigations, including through searches of digital data. A warrant to search a computer or other digital device for information related to a crime must be based on probable cause to believe that such information will be found on the device. To satisfy the particularity requirement of Article I, section 9, the warrant must identify, as specifically as reasonably possible in the circumstances, the information to be searched for, [363 Or. 188] including, if available and relevant, the time period during which the information was created, accessed, or otherwise used. We acknowledge that, for practical reasons, searches of computers are often comprehensive and therefore are likely to uncover information that goes beyond the probable cause basis for the warrant. In light of that fact, to protect the right to privacy and to avoid permitting the digital equivalent of general warrants, we also hold that Article I, section 9, prevents the state from using evidence found in a computer search unless a valid warrant authorized the search for that particular evidence, or it is admissible under an exception to the warrant requirement.

         In this case, police had probable cause to believe that defendant's computer would contain information regarding defendant's internet searches shortly before his 9-1-1 call. We refer to that information as "the June 12 internet search history." Defendant moved to suppress all of the information found through the forensic examination of the computer, which, as noted, included the evidence of child abuse and other crimes dating from weeks and months before the 9-1-1 call, as well as the June 12 internet search history. The trial court found that the police lacked probable cause to search the computer for any information beyond the June 12 internet search history. Nevertheless, the trial court denied defendant's motion to suppress, and virtually all of the relevant forensic evidence was admitted at trial. That was error. In our view, the warrant was sufficiently particular to permit a search of the computer; however, the trial court erred in admitting the proffered evidence that was obtained as a result of the forensic examination, because, as we read the warrant, it authorized the police to search only for the June 12 internet search history. Accordingly, we conclude that defendant's motion to suppress should have been granted in part and denied in part. Because that error was not harmless, we affirm the Court of Appeals' decision reversing defendant's convictions and remand the case to the trial court.


         On June 12, 2011, defendant called 9-1-1 at 2:22 p.m. and reported that his 11-week-old son, B, had stopped [363 Or. 189] breathing. After an ambulance took the infant to the hospital, Detective Rookhuyzen of the Washington County Sheriff's Office child abuse unit interviewed defendant at his home. On the basis of information learned in that interview and a pediatrician's examination of B at the hospital, Rookhuyzen applied for and obtained the warrant which defendant now challenges.

         Rookhuyzen prepared a seven-page affidavit in support of his warrant application. The Court of Appeals summarized the affidavit's contents, which recounted Rookhuyzen's interactions with defendant and observations of the home:

"At the beginning of the interview, Rookhuyzen noted that defendant was 'non-emotive'-which, in Rookhuyzen's training and experience, was 'highly unusual' in such circumstances because' [p] arents are usually crying, sobbing, and exhibiting signs of sadness or anxiety' Defendant told Rookhuyzen that he had been home alone with B and his twin brother, while his wife was working. According to defendant, as he had been feeding B a mixture of formula and liquid vitamins, the mixture had started to come out of the baby's nose and the baby had started coughing, so defendant had turned him over, shaken him, and 'smacked' him on the back. The baby's eyes became 'fixed' and 'droopy,' and his breathing became 'very much labored.' Defendant told Rookhuyzen that he then shook B more, and the baby began going 'a minute or two between breaths.'
"Defendant did not call 9-1-1 at that point. Instead, he told Rookhuyzen, he 'went online' on a computer in the baby's room to conduct research about what he should do. When, after 15 minutes, the baby's condition did not improve, defendant called 9-1-1.
"Defendant did not call his wife during that period- and, indeed, had not attempted to contact her by the time Rookhuyzen began to interview him. In Rookhuyzen's experience, that was 'extremely unusual': '[W]ith these kind of incidents, spouses want to call each other instantly, even before speaking with law enforcement.'
"Rookhuyzen's affidavit further recounted that, at the hospital, B was examined by a pediatrician, Dr. Lindsay, who determined that the baby had no brain activity and [363 Or. 190] would die soon. Lindsay further determined, inter alia, that the baby had experienced head trauma resulting in a skull fracture, bilateral retinal hemorrhages, and an 'old rib fracture.' In Lindsay's opinion, defendant's account was not consistent with the baby's condition, and he ultimately rendered a diagnosis of 'shaken baby syndrome' as a result of intentionally inflicted abuse.
"* * * Further, as specifically pertinent to the lawfulness of the seizure and search of defendant's computers, the affidavit included the following averment:
'"I know based upon my training and experience that computers can be connected to the internet to find information using computer software that browse internet sites for information. Internet search engine sites such as Google and Yahoo! are often used to search the internet for information related to a user's requests. I know that the computer will retain a history of internet sites visited and the search terms used on the internet. I know that to retain the integrity of a computer's memory and how the system was used, the computer needs to be searched in a laboratory and carefully examined by a trained computer forensic examiner in order to ensure that the data is not corrupted, damaged, or otherwise changed from the time when the machine was seized. [Defendant] told me that he searched the internet between the time he noticed [B] was having difficulty breathing and the time he called emergency dispatch. He told me that he was using a computer to search the internet for advice on what he should do. When I was in the residence, I saw two laptop computers and two desktop computers. [Defendant] did not specify which computer he was using just before he called 9-1-1.'
"The affidavit also included a detailed description of defendant's residence. Finally, in a section titled 'Conclusion,' the affidavit stated Rookhuyzen's belief that there was probable cause to seize and search 11 types of evidence, including '[t]wo laptop computers in the residence' and '[t]wo desktop computer towers located in the office/baby room.'"

Mansor, 279 Or.App. at 780-81 (brackets in Mansor; footnotes omitted).

         A circuit court judge signed the search warrant that evening. The search warrant instructed executing [363 Or. 191] officers to "seize and search and forensically examine the following objects: See attachment A." (Emphasis omitted.) Attachment A was captioned "items to be searched for, to be seized, and to be analyzed." It repeated verbatim the list of eleven items included in Rookhuyzen's affidavit, including "[t]wo laptop computers" and "[t]wo desktop computer towers." The warrant itself contained no instructions or limitations regarding how the computers were to be analyzed.

         The warrant was executed that night. Two laptop computers, two desktop computers, and other items from B's room were seized. The computers were taken to the Northwest Regional Computer Forensics Laboratory, operated by the FBI, which performed the forensic analysis. The lab's report summarized the request:

"[Rookhuyzen] requested that the [seized computer drives] be examined for internet history and internet search terms input by the user on [June 12] especially from 2pm onward. Per a discussion with Det. Rookhuyzen, the suspect searched the internet 15 minutes prior to calling 9-1-1 in regards to his 11-week old child suffering injuries. Suspect claimed that the internet searches were regarding how to aid an injured infant. Pertinent examination results should be regarding child abuse and a possible history thereof."

         When Rookhuyzen made the initial request to the lab, he provided a list of 19 search terms. A week later, another detective, Hays, added eight more search terms.[1]

         The scope of the analysis of the computers expanded further. The report noted that about a month after the initial request, a detective directed that the search of the computer be expanded to include email, although no relevant emails were ultimately located. The forensic examiners also included in the report search terms that were not provided by the detectives, but that, in their opinion, "yielded possibly pertinent results."[2] The forensic examiner stated that [363 Or. 192] he had no knowledge of the case itself, other than what he had learned from the detective's request regarding the examination of the computers.

         The report also summarized the lab's methods and findings. For each computer and laptop, the storage media were removed and imaged.[3] An initial analysis revealed that some of the hard drives had last been used in 2009, and those were not examined further. For the remaining drives, the forensic examiner assembled a "complete Internet history," including "deleted Internet history records." "Internet history" is a broad term. The software used by the lab-"Net Analysis"-compiled many types of data, for example, cookies, cached data, "leaks," and other types of data that are generated as part of normal internet browsing activity, to create the internet history dataset.[4] Each piece of internet history data might contain or be associated with information useful to investigators, such as the identity of the computer user logged in at the time, the time and date that a particular web page was visited, or search terms entered into search engines, but each piece of data was not associated with all of those types of information. For example, not all records were associated with a date and time or revealed how the user navigated to a particular web page.

         The internet history dataset was compiled into a large spreadsheet containing over 360, 000 records dating back to 2005-six years before B was born. Net Analysis allowed the forensic examiner to search for text in any of the [363 Or. 193] websites visited and to organize the internet history records by date and time. In addition to a printed summary of its findings, the lab provided detectives with a DVD containing that dataset and several lengthy reports on specific searches requested by detectives. For example, one report listed all web URLs visited on the date of the 9-1-1 call, beginning with a visit to Netflix nine seconds after midnight and continuing until that afternoon. That report is 630 pages long. Another report that listed results for the search term "abuse" was 101 pages long, and contained URLs dating from a 16 month period as well as many other URLs not associated with a date and time. The lab also provided reports for the search terms that "originated during the examination" as yielding "possibly pertinent results," listed above. Similarly, the DVD contained files that were not internet history, but that the forensic examiner believed might be relevant, such as a Microsoft Word document containing a narrative description of the child's birth, photos of B, and a downloaded computer game that allowed the user to simulate child abuse.

         Before trial, defendant moved to suppress the evidence discovered on the computers, arguing that the warrant was "worded so broadly as to constitute a general warrant." Defendant suggested that "search protocols" should have been included in the warrant to restrict the potentially unlimited search of the computer hard drives. A search protocol, for example, could limit the search to specific files or types of data on the computer-such as emails, internet searches, or photographs-or to search terms used in an internet browser. See United States v. Comprehensive Drug Testing, Inc., 621 F.3d 1162, 1179 (9th Cir 2010) (on rehearing en banc) (Kozinski, C.J., concurring) (discussing search protocols in warrants to search computers).

         The trial court denied the motion in a written opinion. The trial court first noted that defendant had conceded that the search warrant properly permitted law enforcement officials to search the computers for the June 12 internet search history. The court then rejected defendant's argument that the lack of search protocols in the warrant rendered the warrant unconstitutional, noting that the majority view is that such protocols are not constitutionally required. The court found that the affidavit did not provide [363 Or. 194] probable cause to search the computer for evidence of any crimes other than those related to B's injuries on June 12. Nevertheless, and apparently relying on the "traditional rules for the plain view exception," the court concluded that "all evidence obtained through the execution of the warrant [was] admissible."[5]

         At trial, Detective Hays relied on the forensic lab's reports to testify about defendant's internet history. He stated that shortly before the 9-1-1 call, defendant searched the term "baby pulse no breathing"-a search consistent with defendant's explanation of events. The focus of Hays's testimony on defendant's internet history, however, was computer activity that occurred before that day. Interpreting reports generated by the forensic examiner, Hays concluded that on five separate occasions-the day of the 9-1-1 call and four earlier occasions, the earliest 54 days before the call-the computer had been used to conduct searches about or related to child abuse. The prosecutor implied that the search terms typed into the computer, often in quick succession, provided a snapshot of defendant's thought process and conduct. For example, three days before the 9-1-1 call, there were many relevant searches, including, at 6:24 a.m., a search for "afraid of abusing my baby," then shortly after that, "how do I deal with a screaming baby," then three minutes later, "baby, swelling, back of head."[6]

         The evidence gathered from defendant's computer was undoubtedly helpful to the state's case. In the state's closing argument, the prosecutor called internet search history "a looking glass" into a person's character and "a record [363 Or. 195] of what's going on in [defendant's] head." The prosecutor recited strings of sequential search terms to the jury, such as those quoted above, and used those to speculate about defendant's thought process. Defendant's ex-wife and B's mother also relied on the internet history to understand what had happened. She said that in the first two weeks after B's death, she supported defendant because she couldn't believe that he would hurt B. But "[w]hen the evidence came to light about [defendant's] computer searches, I stopped supporting him."

         The state charged defendant with six counts relating to three discrete incidents of abuse against B and B's twin in the weeks before B's death, and four counts relating to the incident that caused B's death. After an eleven day trial, the jury convicted defendant of all charged counts: murder, assault in the first degree, three counts of assault in the third degree, and three counts of criminal mistreatment in the first degree.

         On appeal, defendant challenged the warrant as facially invalid because it failed to satisfy the particularity requirement of Article I, section 9, of the Oregon Constitution. Defendant also asserted that, to determine whether the warrant was valid, the court should look at the warrant alone and not consider information contained in the affidavit that supported the warrant application.

         The Court of Appeals first addressed whether its review of the warrant was limited to the face of the warrant or whether it also could look at the affidavit. Mansor, 279 Or.App. at 788. It noted that the state had introduced evidence at trial that supported its contention that the affidavit was attached to the warrant at the time defendant's house was searched, and that defendant had not produced any evidence to the contrary. Id. at 790. A defendant bears the burden to rebut the presumption that a warranted search is valid. State v. Walker, 350 Or. 540, 553, 258 P.3d 1228 (2011). Because defendant had not presented any evidence supporting his argument, the court held that it would consider the contents of the affidavit in the challenge to the warrant. Mansor, 279 Or.App. at 791.

          [363 Or. 196] But on the broader issue of the warrant's validity, the court held that, even considering the information in the affidavit as well as the warrant, the warrant was unconstitutionally overbroad in authorizing the forensic examination of defendant's computers. It recognized that the case presented a question of first impression and reviewed decisions from other courts, some of which invalidated computer search warrants for failing to meet particularity requirements. It quoted with approval Wheeler v. State, 135 A.3d 282 (Del 2016), which adopted a requirement that warrants "describe what investigating officers believe will be found on electronic devices with as much specificity as possible under the circumstances." Mansor, 279 Or.App. at 796 (quoting Wheeler, 135 A.3d at 304). The court, in light of the "unique functionality and capacity of electronic devices," concluded that

"for purposes of the constitutional particularity requirement, personal electronic devices are more akin to the 'place' to be searched than to the 'thing' to be seized and examined. Concomitantly, that requires that the search of that 'place' be limited to the 'thing(s)'-the digital data- for which there is probable cause to search."

Id. at 801.[7]

         The court then applied that rule. It read the warrant and affidavit as establishing probable cause

"with respect to internet searches during the 15-minute period preceding the 9-1-1 call-and, arguably, with respect to all electronic communications and photos during the entire time that B was in defendant's care on June 12, 2011. However, nothing in Rookhuyzen's affidavit established probable cause that a temporally unlimited examination of the contents of defendant's computers, including of files and functions ...

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.