I’ve had several questions lately about the requirement in G.S. 15A-248 that “[a] search warrant must be executed within 48 hours from the time of issuance.” The specific concern is how this applies to searches of digital devices, which frequently require off-site forensic analysis that may not begin, let alone end, until substantially more than 48 hours after issuance of the warrant. Although we don’t have an appellate case on point in North Carolina, courts in other jurisdictions have held that so long as the initial seizure of the device is timely, the forensic analysis may be conducted later.
The 48-hour rule. The 48-hour limit was adopted when Chapter 15A was enacted in 1973 and it has remained unchanged ever since. The official commentary indicates that “[f]ormerly, North Carolina law provided no time limit for the execution of search warrants” and that the new rule was designed to prevent searches based on information that has gone stale.
The rule has been cited in the appellate division exactly once, in State v. Davidson, 131 N.C. App. 276 (1998). There, an investigator obtained a search warrant for a suspect’s bank records on April 22 and had it delivered to the bank on April 23, but did not receive the records from the bank until May 6. The court of appeals found that this was not a substantial violation of the 48-hour rule and that suppression of the records under the statutory exclusionary rule in G.S. 15A-974 was not appropriate.
For context, many jurisdictions impose time limits by court rule or by statute, or both, on the execution of search warrants. North Carolina’s time period appears to be shorter than most. See, e.g., Fed. R. Crim. P. 41(e)(2)(A)(i) (requiring that an officer “execute the warrant within a specified time no longer than 14 days”); Va. Code 19.2-56 (“Any search warrant not executed within 15 days after issuance thereof shall be returned to, and voided by, the officer who issued such search warrant.”); S.C. Code 17-13-140 (“Any warrant issued hereunder shall be executed and return made only within ten days after it is dated.”); Ga. Code 17-5-25 (“The search warrant shall be executed within ten days from the time of issuance.”). Many of the cases summarized below also address various jurisdictions’ time limits.
Searches of digital devices. Some search warrants are directed specifically at digital devices such as cellular phones or laptop computers. Others contain more general language targeting records, photographs, or other kinds of evidence that may be contained in digital devices. In either case, investigators may sometimes conduct an on-site manual search of a device, but often will want to conduct an off-site forensic analysis of the device. A digital forensic analysis requires a skilled analyst and suitable equipment, so there is often some delay between the initial seizure of device and the forensic analysis. This multi-stage search process gives rise to the question of when the warrant has been executed for purposes of the 48-hour rule. See generally Wayne R. LaFave, Search and Seizure: A Treatise on the Fourth Amendment § 4.7(a) (6th ed. 2021) (noting that digital searches often involve a two-step process where a seizure takes place, followed by an off-site forensic analysis, and stating that “[t]his gives rise to the question of whether any constitutional or statute/rule requirements regarding the time of search warrant execution apply as well to the second stage, which the courts have answered in the negative”).
Persuasive authority on delayed forensic analysis. As noted above, our appellate courts have not addressed this issue. But a number of courts across the country have done so, and uniformly they have found that so long as the initial seizure of a digital device takes place within the jurisdiction’s time limit for executing search warrants, it is permissible for a forensic analysis to take place later. Some representative cases are summarized below:
- State v. Sanchez, 476 P.3d 889 (N.M. 2020) (holding, in light of the practical realities of conducting digital searches, that “a device must be in the custody of police within ten days after the police obtain a warrant to search that device,” and that the “seizure of a device more than ten days after the issuance of a warrant to search the device violates [a state rule of criminal procedure], but if the device is seized within the ten day time limit, any subsequent extraction and analysis does not violate the rule”)
- State v. Monger, 472 P.3d 270 (Or. Ct. App. 2020) (concluding that, for purposes of the statutory rule that search warrants must be executed within five days, execution of a warrant “does not require completion of every action authorized” by the warrant, so a later forensic analysis of the defendant’s digital devices was permissible)
- Mastrogiovanni v. State, 751 S.E.2d 536, 539 (Ga. Ct. App. 2013) (“We are aware of no authority for the proposition that items seized from the lawful execution of a search warrant must then be analyzed, tested, or examined within the ten-day period provided for [execution of the warrant]. The State analogizes the forensic analysis of [defendant’s] computer to the chemical analysis of substances that field-tested positive for illegal drugs when seized pursuant to a search warrant. The State is not required to obtain a second warrant to analyze the substance or, for example, conduct ballistic tests on seized firearms. Similarly, the State is not required to obtain a second warrant to analyze the computer here.”)
- Wolf v. State, 266 P.3d 1169 (Idaho Ct. App. 2011) (defendant’s computer was seized pursuant to a search warrant in August but was subjected to a forensic analysis in October; defendant asserted that this violated Idaho’s 14-day statutory limit on the execution of a search warrant and a similar 10-day limit imposed by the state rules of criminal procedure; the reviewing court found no constitutional violation and so no basis for suppression, and stated that “the search of [defendant’s] residence and seizure of his computer was completed within fourteen days of the issuance of the search warrant”)
- State v. Grenning, 174 P.3d 706 (Wash. Ct. App. 2008) (defendant’s computer was seized on March 5 pursuant to a search warrant; on March 15, officers examined it and found child pornography; defendant claimed that this violated a 10-day limit on the execution of a search warrant in the state rules of criminal procedure; the reviewing court found no constitutional violation and so no basis for suppression, and stated that “[b]ecause the police entered and searched [defendant’s] residence within the 10–day warrant requirement, the search was timely and the seizure of his hard drives lawful,” and that “continued testing [of] the hard drives in search of evidence after they were lawfully seized does not implicate the Fourth Amendment”)
- Commonwealth v. Kaupp, 899 N.E.2d 809 (Mass. 2009) (holding that “police do not need to complete forensic analysis of a seized computer and other electronic data storage devices within the prescribed period for executing a search warrant,” which was seven days under state law)
There are more cases in the same vein. See, e.g., Brown v. Eaton, 164 N.E.3d 153 (Ind. Ct. App. 2021); Commonwealth v. Bowens, 265 A.3d 730 (Pa. Super. Ct. 2021); People v. Ruffin, 178 A.D.3d 455 (N.Y. App. Div. 2019); State v. Johnson, 831 N.W.2d 917 (Minn. Ct. App. 2013).
In the federal courts, this issue has been addressed through an amendment to Fed. R. Crim. P. 41, which governs search warrants. Although federal search warrants normally must be executed within 14 days, Rule 41(e)(2)(B) states that, for a warrant seeking electronically stored information, “[u]nless otherwise specified, the warrant authorizes a later review of the media or information consistent with the warrant. The time for executing the warrant in Rule 41(e)(2)(A) and (f)(1)(A) refers to the seizure or on-site copying of the media or information, and not to any later off-site copying or review.” This rule was applied in United States v. Carrington, 700 Fed. Appx. 224, 231-32 (4th Cir. 2017) (unpublished) (finding no violation of the 14-day rule where a defendant’s phone was seized in April pursuant to a warrant but not analyzed until October, as such warrants “are deemed executed when the electronically stored information is seized and brought within the government’s control, rather than when the information is analyzed by the government”). See also Brown v. Eaton, supra (discussing similar amendment to the Indiana statue regarding the execution of search warrants).
Analogy to other types of laboratory analysis. Searches of digital devices are not the only two-step searches conducted by law enforcement. When police seize a white powder in a drug investigation and send it off for a chemical analysis, or when police seize DNA in a sexual assault case and send it off for genetic sequencing, the same questions may arise about forensic testing conducted after the 48-hour window. Once again, North Carolina doesn’t have an appellate case right on point, but the cases elsewhere indicate that the initial seizure of the evidence satisfies any time limit established by court rule or statute. See, e.g., Schneider v. State, 623 S.W.3d 38 (Tex. App. 2021) (in a DWI case, the initial seizure of the defendant’s blood took place within the three-day statutory period for executing search warrants but the forensic analysis of the blood took place later; the court found no violation because the purpose of the three-day limit was to prevent seizures based on stale information, not to limit the timing of forensic analyses); People v. Bowen, 137 Cal. App. 3d 1020 (Cal. Ct. App. 1982) (in a murder case, the initial seizure of a vehicle connected to the defendant took place within 10 days as required by state law, but the processing of the vehicle at a crime lab extended beyond 10 days; court finds that the warrant “was executed . . . within 10 days”). Cf. Brown v. Eaton, supra (comparing search warrants for digital devices to “a situation in which police secure a warrant to search an office building and seize thousands of pages of business records,” and stating that it would be “absurd” to limit subsequent review of the records to the 10-day statutory period as “the officers would have to continuously reapply for search warrants until they finished reviewing all the documents”); Mastrogiovanni v. State, supra (anaolgizing to ballistic testing of a seized firearm).
Long delays may raise constitutional questions. For the reasons given above, the 48-hour rule almost certainly doesn’t prevent delayed forensic examinations of digital devices. But there is still some limit to the permissible delay. An extended, unjustified delay may render the forensic examination unreasonable in violation of the Fourth Amendment. An often-cited case in this area is United States v. Syphers, 426 F.3d 461 (1st Cir. 2005), where the court indicated that an unreasonable delay in executing a search warrant may violate the Fourth Amendment, especially if probable cause dissipates or if the delay prejudices the defendant. However, the court found that a six-month delay in searching the defendant’s computer, due to backlogs at the crime laboratory, was not unreasonable.
Relevant cases finding a Fourth Amendment violation include United States v. Ganias, 755 F.3d 125 (2d Cir. 2014) (finding a Fourth Amendment violation and reversing the defendant’s conviction where the government did not examine the defendant’s computers until eight months after seizing them and ultimately retained them for more than two years; this “deprived [the defendant] of exclusive control over those files for an unreasonable amount of time”); United States v. Cote, 72 M.J. 41 (C.A.A.F. 2013) (finding a Fourth Amendment violation where a computer search warrant provided that the initial search was to take place within ten days and that any forensic analysis was to be completed within 90 days, but officers conducted a forensic examination of a seized hard drive more than a year after the warrant issued); and United States v. Metter, 860 F.Supp.2d 205 (E.D.N.Y 2012) (finding that a “more than fifteen-month delay” in analyzing numerous seized hard drives was unreasonable and required suppression, where the court found that the delay was a result of investigators’ bad faith).
Additional cases finding no violation include People v. McCavitt, __ N.E.3d __, 2021 WL 4898748 (Ill. 2021) (holding that an 8-month delay was reasonable given the complexity of the legal proceedings and the volume of data at issue); United States v. Jarman, 847 F.3d 259 (5th Cir. 2017) (finding that it was reasonable for investigators to take 23 months to finish analyzing devices seized from the defendant given that “taint team review” was required to address privilege issues before the forensic analysis could be completed); and United States v. Burgess, 576 F.3d 1078 (10th Cir. 2009) (ruling that a lower court did not commit plain error in admitting evidence that resulted from a forensic analysis conducted after a 44-day delay, where the defendant “has not identified any prejudice from the delay” and “any delay was due to [an investigator’s] efforts to make sure the job was done right”).