Fourth Circuit Strongly Suggests Including Temporal Limitations on Search Warrants for Social Media Account Information

Earlier this year, the Fourth Circuit decided United States v. Zelaya-Veliz, 94 F.4th 321 (4^th Cir. 2024). Phil summarized it here when it came out, but we thought it merited its own post because of its extended discussion of how the Fourth Amendment applies to search warrants for social media account information. The court’s discussion of the need for temporal limitations in such warrants is especially noteworthy, as is the court’s analysis of the scope of the information seized pursuant to the warrants approved by the court. We’ll start with a recap of the case, and then end with some thoughts for law enforcement and prosecutors, and for defenders.

The investigation. The defendants in this case were associated with MS-13, an international criminal gang. A 13-year-old girl, who the opinion calls Victim-2, was staying at a youth shelter and decided to leave the shelter. Another girl suggested that they seek refuge with her contacts in MS-13. Various MS-13 members initiated Victim-2 into the gang by beating her with a metal baseball bat. She was then moved between gang members for the ensuing six weeks, during which time she was plied with drugs and alcohol, threatened with death, and repeatedly sold for sex.

Victim-2 escaped and met with local law enforcement. She identified and was able to help locate another minor being trafficked by the men. Eventually, the matter was turned over to the FBI. Relying on information from local law enforcement’s investigation, the lead agent discovered that the suspects were likely communicating via Facebook in connection with their sex trafficking activities. Agents ultimately obtained four search warrants for Facebook accounts associated with various suspects, each building on the information obtained from the previous warrant.

The first warrant sought information associated with four accounts connected to one of the suspects and a fifth account of another man, neither of whom were parties to this case. The warrants sought eight categories of information related to the accounts for the entire time the accounts had been in existence, including all direct messages sent or received. While the warrants permitted the government to search all of the information provided by Facebook, they limited the information that could be seized to evidence of four specific federal crimes, all related to sex trafficking. The affidavits in support of these warrants explained the information learned during the course of the investigation, including that both targets had communicated with minors on Facebook about prostitution and that one of the men had sexual contact with one of the minors. It also stated that MS-13 members were known to communicate via Facebook and that its members often utilized sex trafficking as a means of generating money.

The second Facebook warrant requested similar information on eight different accounts, five of which belonged to one defendant and three other accounts pertaining to other co-conspirators. The one defendant was identified by a Victim-2 as a person who facilitated her trafficking and prostitution. A credit card in the defendant’s name was connected to the cell phone possessed by the child when she was found by law enforcement as well. Like the first warrant, the seizures of information authorized by the warrant were limited to evidence of four specific sex trafficking related crimes but were not limited by any specific time frame.

The third warrant requested information from an account belonging to a different defendant; multiple accounts of other, unindicted people; and five accounts belonging to three minor victims. Unlike the first two warrants, this warrant only requested information within a ten-month period that began prior to and continued through the period when Victim-2 was trafficked. This warrant also sought broader categories of information associated with the accounts, including IP address and location data. Again, the warrant only authorized the seizure of information showing involvement of the suspects in four specific sex trafficking offenses.

The last warrant requested account information on 22 Facebook accounts, some of which were associated with the defendants. It contained similar temporal limitations to the third warrant, and it too limited seizure of the information produced in response to the warrant to evidence of sex trafficking offenses. It recounted information obtained from earlier warrants showing that these defendants discussed coordinating the prostitution of minors, transporting minors for commercial sex, obtaining explicit photos of minors, and admissions to sex trafficking of minors.

The court’s opinion contains a summary chart regarding the warrants:

Proceedings in the trial court. The cases involving the six appellants were joined for trial. Five of the six moved to suppress evidence obtained using the warrants, contending that the warrants were not supported by probable cause; allowed officers to review too many kinds of information; and did not contain appropriate temporal limits. The trial judge denied the motions, and the case proceeded to trial. After a seven-day trial in which the prosecution made extensive use of evidence obtained via the warrants, all the defendants were convicted and sentenced to long prison terms. They appealed.

The Fourth Circuit’s opinion. Judge Wilkinson wrote the Fourth Circuit’s opinion.

Preliminary matters. The court began its discussion by addressing the appellants’ standing to assert a Fourth Amendment challenge. It considered whether users have a reasonable expectation of privacy in data held by social media companies such as Facebook. It noted an emerging consensus on this issue: “Most federal courts to rule on the issue have agreed that Facebook and other social media users have a reasonable expectation of privacy in content that they exclude from public access, such as private messages.” Zelaya-Veliz, 94 F.4th at 333 (citations omitted). The court indicated its agreement with that view:

It cannot be the rule that the government can access someone’s personal conversations and communications without meeting the warrant requirement or one of the Supreme Court’s delineated exceptions to it. The judiciary would not allow such a trespass upon privacy at its core. Id. at 334.

Private messages are probably the easiest type of data to analyze under the Fourth Amendment. The Zelaya-Veliz court noted that the majority of courts to consider the question have found that direct messages are subject to a reasonable expectation of privacy, which will generally require law enforcement to obtain a search warrant or valid consent before reading them, absent exigent circumstances. See, e.g., U.S. v. Bledsoe, 630 F. Supp. 3d 1, 18 (D.D.C. 2022) (collecting cases). More difficult questions may arise about public or semi-public social media posts and broadcasts, or about non-communicative data stored by Facebook, like users’ IP addresses, but the court’s opinion focused only on private direct messages.

The court did point out that the first warrant did not target any of the appellants’ Facebook accounts. Thus, it determined that the various appellants had standing only to contest the second, third, and fourth warrants. As to those warrants, the court addressed the three main issues raised below: whether they were supported by probable cause; whether they were overly broad in allowing investigators access to the various categories of data held by Facebook; and whether they contained appropriate temporal limitations.

Probable cause. Victim-2 identified the defendants as having been involved in her sex trafficking, so there was probable cause to believe that each of them participated in criminal activity. While the defendants argued that the warrant applications failed to provide an adequate nexus between the criminal activity and their Facebook accounts, the Fourth Circuit saw the matter differently:

The warrant affidavits in this case are well-sourced. They incorporated information from a reliable witness, the experience of an agent well-versed in the workings of MS-13, and—with each successive warrant—an increasingly incriminating chain of messages that tethered successive Facebook accounts to a larger conspiracy. Zelaya-Veliz, 94 F.4th at 336.

Based on the facts presented in the opinion, the court’s description of an “increasingly incriminating chain” of evidence is apt. The applications for the third and fourth warrants, in particular, included evidence from earlier Facebook searches showing that the targets were using Facebook to communicate with each other about MS-13 business. By contrast, the application for the second warrant seems to have been significantly less robust, making the court’s decision to uphold that warrant more noteworthy. That warrant authorized investigators to review five Facebook accounts for Luis Gonzales. Victim-2 identified Gonzales as a man involved in trafficking her, and she confirmed that the accounts contained pictures of Gonzales. But the pictures apparently weren’t incriminating – they just showed that the accounts belonged to him. In support of the warrant application, the applicant averred generally that his “training and experience made him aware that MS-13 uses social media platforms such as Facebook to conduct and communicate about criminal activities, including commercial sex trafficking.” Zelaya-Veliz, 94 F.4th at 335. And there was evidence that other MS-13 members had used Facebook to discuss beating the victim during her initiation. But there doesn’t seem to have been any direct evidence in the application that Gonzales himself used Facebook to discuss the criminal activity under investigation, or anything else pertinent to MS-13. The Fourth Circuit nonetheless found sufficient probable cause, noting especially the significance of the officer’s training and experience. As discussed further below, this opinion is a significant tile in the mosaic of decisions across the country on the issue of how strong a nexus is required between a crime and a suspect’s digital devices or online accounts.

Particularity. The defendants next claimed that the warrants failed the Fourth Amendment’s particularity requirement, on the theory that “the scope of the warrants should have included fewer categories of data from the Facebook accounts.” Id. at 337. The court acknowledged that “[t]he warrants compelled Facebook to turn over a wide swath of personal information attached to the accounts, including all private communications, most user activity, and, in the case of the latter two warrants, all location information.” Id. However, the court saw no problem with this. It pointed out that a physical search of a residence will allow officers to see a wide range of objects and information, but is typically deemed sufficiently particular if it limits the items to be seized to those linked to a particular crime. Similarly, in the digital context, “while the warrants authorized the government to search all of the information disclosed by Facebook, they only permitted the subsequent seizure of the fruits, evidence, or instrumentalities of violations of enumerated federal statutes.” Id. The court also noted that the scale and complexity of the offense tended to support a broad search: “The sheer magnitude of the sex trafficking conspiracy here justified a concomitant breadth in the scope of the warrants.” Id. at 339.

Temporal limitations. Finally, the defendants claimed that the warrants did not contain adequate temporal limits on the information to be obtained from Facebook. The second warrant contained no limitation and so required production of the requested information dating back to the inception of the covered accounts, while the third and fourth warrants requested information going back six months prior to the time when Victim-2 came into contact with MS-13. The court quickly dispensed with the issue as to the third and fourth warrants, noting that the criminal activity at issue was an ongoing conspiracy with other victims and that “each affidavit explained how gang members involved in a sex trafficking conspiracy often use social media to discuss the conspiracy before, during, and after its execution.”  Id.

However, as to the second warrant, which contained no time limit at all, the court stated that the “total lack of a time period in a social media warrant raises a problem.” Id. at 340.The court noted that “Facebook and other social media accounts are beginning to contain decades of personal information and communications, often going back to an account holder’s early teenage years.” Id. In that regard they are analogous to cell phones, which the Supreme Court noted in Riley v. California, 573 U.S. 373 (2014), are especially sensitive repositories of private data.

Although the court seemed strongly in favor of reasonable temporal limitations, it fell short of a categorical requirement: “We need not go so far as to mandate a temporal restriction in every compelled disclosure of social media account data for the simple reason that we cannot anticipate all future circumstances.” Zelaya-Veliz, 94 F.4th at 340. In the case before it, the court chose to dodge the constitutional question, ruling that the federal good faith exception to the exclusionary rule applied. It did “note, however, that future warrants [will] enhance their claims to particularity by requesting data only from the period of time during which the defendant was suspected of taking part in the criminal conspiracy.” Id. at 341. (Cleaned up.)

The court returned to the same theme in its conclusion, stating that “while social media warrants can support invaluable police work, as they did in this case, they also provide significant potential for abuse. We cannot read the Fourth Amendment to allow the indiscriminate search of many years of intimate communications. And because of the inherent interconnectedness of social media, permitting unbridled rummaging through any one user’s account can reveal an extraordinary amount of personal information about individuals uninvolved in any criminal activity.” Id. at 342.

The court further observed:

It is not only courts that are struggling to strike a balance between privacy and security in the rapidly changing digital domain, but society as a whole. When criminal offenders use social media to organize their enterprises and evade detection, it would seem unreasonable to disable law enforcement from using those same media to apprehend and prosecute them. To hold otherwise would arbitrarily tip the scales away from law and justice for the benefit of increasingly sophisticated criminal schemes. But at the same time, there comes a point when the Fourth Amendment must emphatically yell STOP, lest we render obsolete the hallowed notion of a secure enclave for personal affairs. Id. at 342-43.

Plain View Doctrine. While not directly addressed by the court’s opinion, Zeleya-Veliz is a good reminder of the controversy over the application of the plain view doctrine in the context of social media warrants (and searches of digital devices more broadly). Recall that each warrant allowed a broad search of the Facebook accounts, but limited the information that could be seized to evidence of the crimes of investigation. With such a restriction in place, if officers had encountered evidence of other crimes among the account information, they were prohibited from seizing it under the warrants and using it to prosecute the defendants. This limitation seems designed to fend off a challenge that the warrants were overbroad and authorized a general rummaging through the account holders’ private lives.

But if the officers had encountered evidence of other crimes, could they have seized it under the plain view doctrine, rather than under the search warrants? The Fourth Circuit stated that its holding was “a narrow one” and was not a “greenlight” for all searches of social media data, but also acknowledged that the plain view issue was not at issue in the case. Id. at 341, n. 3. North Carolina courts so far have not imposed limits on the seizure or use of information unrelated to the crime of investigation that an officer may discover while conducting a digital search, but other courts have questioned or limited the application of plain view in the context of searches of digital devices. See, e.g. State v. Bock, 485 P.3d 931, 939 (2021) (“The breadth of the search is what renders the plain view doctrine inapplicable; the alternative would sanction the sort of general warrant that the plain view doctrine was never meant to authorize.”). See generally Patrick Fischer, Securing the “Privacies of Life” by Preventing General Searches of Computers, 67 N.Y.L. Sch. L. Rev. 29 (2022/2023) (collecting cases and discussing the controversy over the applicability of the plain view doctrine to digital searches).  Whether a plain view seizure is reasonable will likely turn on the facts of the case. For example, where officers have probable cause to search the photos and videos for a phone or social media account within a relevant time frame, evidence of other crimes discovered within the images might be admissible under plain view. When probable cause is limited to search for evidence of communications of a threat (for instance), a court could find that searching image folders was outside the scope of the warrant and unreasonable under the state or federal constitutions.

Implications for law enforcement and prosecutors. Zelaya-Veliz is not binding on our state courts, but Fourth Circuit decisions are often highly influential. Law enforcement officers and prosecutors may therefore wish to cite Zelaya-Veliz when questions arise about whether there is a sufficient nexus to a suspect’s digital devices or online accounts. The court’s willingness to find probable cause even for the second warrant, where there was no direct evidence that the suspect used Facebook to conduct his criminal activity, is helpful for the state.

Zelaya-Veliz dovetails with a recent state decision, State v. Hernandez, __ N.C. App. __, 2024 WL 1391302 (Apr. 2, 2024). In Hernandez, the court of appeals found no plain error in a trial court’s conclusion that probable cause supported the issuance of a search warrant for a rape suspect’s digital devices despite the lack of any direct evidence that the suspect used the devices in connection with the crime. The reviewing court stated that it was reasonable to infer that a person’s home might contain digital devices, and that they might contain incriminating information.

Jeff noted here that courts across the country disagree about the strength of the required nexus, and the issue remains far from settled. But the two cases discussed in the preceding paragraphs are certainly arrows in the state’s quiver on the matter.

By contrast, the Fourth Circuit’s discussion of the importance of temporal limitations on social media search warrants is a yellow caution flag for investigators and prosecutors. The Fourth Circuit is not alone in expressing concern about social media warrants that require the disclosure of personal information dating back to the beginning of an account. See, e.g., United States v. Blake, 868 F.3d 960 (11^th Cir. 2017) (stating that Facebook warrants “should have requested data only from the period of time during which [the defendant] was suspected of taking part in the [crime under investigation]”); United States v. Shipp, 392 F.Supp.3d 300 (E.D.N.Y. 2019) (“Although a temporal limitation for the data being searched is not an absolute necessity . . . it would appear to have been feasible to include such a limitation here [and] . . . [d]oing so could have mitigated the court’s concerns about the breadth of this warrant.”).

The issue is not limited to social media warrants. Some courts have also suggested that when extracting data from a phone or computer, investigators should be limited to a time period near the time of the offense under investigation. See, e.g., State v. Missak, 299 A.3d 821 (N.J. App. 2023) (finding insufficient probable cause to support a warrant to search a suspect’s entire phone where the evidence indicated that he used the phone and two apps over a period of two days to make lewd solicitations of an officer posing as an underage girl); Richardson v. State, 282 A.3d 98 (Md. Ct. App. 2022) (a search warrant authorizing a complete search of a suspect’s phone for evidence connecting him to a robbery was invalid because it failed to include temporal limits and limits on the types of data that could be searched).

A cautious officer may wish to include such time limits in future warrant applications in order to reduce the risk that the applications will be rejected or the resulting warrants invalidated. If an officer believes that it would be helpful to review information before or after the time the crime was committed, the officer could explain why in the application. For example, if the crime is a part of larger ongoing pattern of criminality (as in Zelaya-Veliz), or if reviewing usage patterns over time might help to confirm the identity of an account holder or device owner, that may be useful information to provide.

Implications for defenders. Defenders should consider challenging warrants for social media accounts (and digital devices generally) when the searches are unconstrained by the types of limits approved by the court in Zeleya-Veliz. As noted above, searches warrants authorizing the search and seizure of any and all information in an account or device without any time limitation might be deemed overbroad, and defenders should be wary of warrants purporting to permit such far-reaching searches. Defenders can also raise and preserve challenges to search warrants for social media accounts or other digital information where the nexus between the evidence searched and the crime is tenuous, as well as where only conclusory statements about social media accounts or digital devices are offered in support of their search. Finally, as discussed above, some courts limit the application of plain view doctrine with these types of digital information searches, and defenders should challenge the application of that doctrine under the state and federal constitutions whenever it appears to that law enforcement obtained evidence via plain view in this context.

Conclusion. The state and federal courts continue to wrestle with how the Fourth Amendment applies in a digital world. Zelaya-Veliz is an important piece of that puzzle, but it won’t be the last word. Keep reading the blog to stay up to date on future developments.