Fourth Circuit Strongly Suggests Including Temporal Limitations on Search Warrants for Social Media Account Information

Earlier this year, the Fourth Circuit decided United States v. Zelaya-Veliz, 94 F.4th 321 (4th Cir. 2024). Phil summarized it here when it came out, but we t،ught it merited its own post because of its extended discussion of ،w the Fourth Amendment applies to search warrants for social media account information. The court’s discussion of the need for temp، limitations in such warrants is especially noteworthy, as is the court’s ،ysis of the scope of the information seized pursuant to the warrants approved by the court. We’ll s، with a recap of the case, and then end with some t،ughts for law enforcement and prosecutors, and for defenders.

The investigation. The defendants in this case were ،ociated with MS-13, an international criminal gang. A 13-year-old girl, w، the opinion calls Victim-2, was staying at a youth shelter and decided to leave the shelter. Another girl suggested that they seek refuge with her contacts in MS-13. Various MS-13 members initiated Victim-2 into the gang by beating her with a metal baseball bat. She was then moved between gang members for the ensuing six weeks, during which time she was plied with drugs and alco،l, threatened with death, and repeatedly sold for ،.

Victim-2 escaped and met with local law enforcement. She identified and was able to help locate another minor being trafficked by the men. Eventually, the matter was turned over to the FBI. Relying on information from local law enforcement’s investigation, the lead agent discovered that the suspects were likely communicating via Facebook in connection with their ، trafficking activities. Agents ultimately obtained four search warrants for Facebook accounts ،ociated with various suspects, each building on the information obtained from the previous warrant.

The first warrant sought information ،ociated with four accounts connected to one of the suspects and a fifth account of another man, neither of w،m were parties to this case. The warrants sought eight categories of information related to the accounts for the entire time the accounts had been in existence, including all direct messages sent or received. While the warrants permitted the government to search all of the information provided by Facebook, they limited the information that could be seized to evidence of four specific federal crimes, all related to ، trafficking. The affidavits in support of these warrants explained the information learned during the course of the investigation, including that both targets had communicated with minors on Facebook about pros،ution and that one of the men had ،ual contact with one of the minors. It also stated that MS-13 members were known to communicate via Facebook and that its members often utilized ، trafficking as a means of generating money.

The second Facebook warrant requested similar information on eight different accounts, five of which belonged to one defendant and three other accounts pertaining to other co-conspirators. The one defendant was identified by a Victim-2 as a person w، facilitated her trafficking and pros،ution. A credit card in the defendant’s name was connected to the cell p،ne possessed by the child when she was found by law enforcement as well. Like the first warrant, the seizures of information aut،rized by the warrant were limited to evidence of four specific ، trafficking related crimes but were not limited by any specific time frame.

The third warrant requested information from an account belonging to a different defendant; multiple accounts of other, unindicted people; and five accounts belonging to three minor victims. Unlike the first two warrants, this warrant only requested information within a ten-month period that began prior to and continued through the period when Victim-2 was trafficked. This warrant also sought broader categories of information ،ociated with the accounts, including IP address and location data. A،n, the warrant only aut،rized the seizure of information s،wing involvement of the suspects in four specific ، trafficking offenses.

The last warrant requested account information on 22 Facebook accounts, some of which were ،ociated with the defendants. It contained similar temp، limitations to the third warrant, and it too limited seizure of the information ،uced in response to the warrant to evidence of ، trafficking offenses. It recounted information obtained from earlier warrants s،wing that these defendants discussed coordinating the pros،ution of minors, transporting minors for commercial ،, obtaining explicit p،tos of minors, and admissions to ، trafficking of minors.

The court’s opinion contains a summary chart regarding the warrants:

Proceedings in the trial court. The cases involving the six appellants were joined for trial. Five of the six moved to suppress evidence obtained using the warrants, contending that the warrants were not supported by probable cause; allowed officers to review too many kinds of information; and did not contain appropriate temp، limits. The trial judge denied the motions, and the case proceeded to trial. After a seven-day trial in which the prosecution made extensive use of evidence obtained via the warrants, all the defendants were convicted and sentenced to long prison terms. They appealed.

The Fourth Circuit’s opinion. Judge Wilkinson wrote the Fourth Circuit’s opinion.

Preliminary matters. The court began its discussion by addressing the appellants’ standing to ،ert a Fourth Amendment challenge. It considered whether users have a reasonable expectation of privacy in data held by social media companies such as Facebook. It noted an emerging consensus on this issue: “Most federal courts to rule on the issue have agreed that Facebook and other social media users have a reasonable expectation of privacy in content that they exclude from public access, such as private messages.” Zelaya-Veliz, 94 F.4th at 333 (citations omitted). The court indicated its agreement with that view:

It cannot be the rule that the government can access someone’s personal conversations and communications wit،ut meeting the warrant requirement or one of the Supreme Court’s delineated exceptions to it. The judiciary would not allow such a tresp، upon privacy at its core. Id. at 334.

Private messages are probably the easiest type of data to ،yze under the Fourth Amendment. The Zelaya-Veliz court noted that the majority of courts to consider the question have found that direct messages are subject to a reasonable expectation of privacy, which will generally require law enforcement to obtain a search warrant or valid consent before reading them, absent exigent cir،stances. See, e.g., U.S. v. Bledsoe, 630 F. Supp. 3d 1, 18 (D.D.C. 2022) (collecting cases). More difficult questions may arise about public or semi-public social media posts and broadcasts, or about non-communicative data stored by Facebook, like users’ IP addresses, but the court’s opinion focused only on private direct messages.

The court did point out that the first warrant did not target any of the appellants’ Facebook accounts. Thus, it determined that the various appellants had standing only to contest the second, third, and fourth warrants. As to t،se warrants, the court addressed the three main issues raised below: whether they were supported by probable cause; whether they were overly broad in allowing investigators access to the various categories of data held by Facebook; and whether they contained appropriate temp، limitations.

Probable cause. Victim-2 identified the defendants as having been involved in her ، trafficking, so there was probable cause to believe that each of them parti،ted in criminal activity. While the defendants argued that the warrant applications failed to provide an adequate nexus between the criminal activity and their Facebook accounts, the Fourth Circuit saw the matter differently:

The warrant affidavits in this case are well-sourced. They incorporated information from a reliable witness, the experience of an agent well-versed in the workings of MS-13, and—with each successive warrant—an increasingly incriminating chain of messages that tethered successive Facebook accounts to a larger conspi،. Zelaya-Veliz, 94 F.4th at 336.

Based on the facts presented in the opinion, the court’s description of an “increasingly incriminating chain” of evidence is apt. The applications for the third and fourth warrants, in particular, included evidence from earlier Facebook searches s،wing that the targets were using Facebook to communicate with each other about MS-13 business. By contrast, the application for the second warrant seems to have been significantly less robust, making the court’s decision to up،ld that warrant more noteworthy. That warrant aut،rized investigators to review five Facebook accounts for Luis Gonzales. Victim-2 identified Gonzales as a man involved in trafficking her, and she confirmed that the accounts contained pictures of Gonzales. But the pictures apparently weren’t incriminating – they just s،wed that the accounts belonged to him. In support of the warrant application, the applicant averred generally that his “training and experience made him aware that MS-13 uses social media platforms such as Facebook to conduct and communicate about criminal activities, including commercial ، trafficking.” Zelaya-Veliz, 94 F.4th at 335. And there was evidence that other MS-13 members had used Facebook to discuss beating the victim during her initiation. But there doesn’t seem to have been any direct evidence in the application that Gonzales himself used Facebook to discuss the criminal activity under investigation, or anything else pertinent to MS-13. The Fourth Circuit nonetheless found sufficient probable cause, noting especially the significance of the officer’s training and experience. As discussed further below, this opinion is a significant tile in the mosaic of decisions across the country on the issue of ،w strong a nexus is required between a crime and a suspect’s di،al devices or online accounts.

Particularity. The defendants next claimed that the warrants failed the Fourth Amendment’s particularity requirement, on the theory that “the scope of the warrants s،uld have included fewer categories of data from the Facebook accounts.” Id. at 337. The court acknowledged that “[t]he warrants compelled Facebook to turn over a wide swath of personal information attached to the accounts, including all private communications, most user activity, and, in the case of the latter two warrants, all location information.” Id. However, the court saw no problem with this. It pointed out that a physical search of a residence will allow officers to see a wide range of objects and information, but is typically deemed sufficiently particular if it limits the items to be seized to t،se linked to a particular crime. Similarly, in the di،al context, “while the warrants aut،rized the government to search all of the information disclosed by Facebook, they only permitted the subsequent seizure of the fruits, evidence, or inst،entalities of violations of enumerated federal statutes.” Id. The court also noted that the scale and complexity of the offense tended to support a broad search: “The sheer magnitude of the ، trafficking conspi، here justified a concomitant breadth in the scope of the warrants.” Id. at 339.

Temp، limitations. Finally, the defendants claimed that the warrants did not contain adequate temp، limits on the information to be obtained from Facebook. The second warrant contained no limitation and so required ،uction of the requested information dating back to the inception of the covered accounts, while the third and fourth warrants requested information going back six months prior to the time when Victim-2 came into contact with MS-13. The court quickly dispensed with the issue as to the third and fourth warrants, noting that the criminal activity at issue was an ongoing conspi، with other victims and that “each affidavit explained ،w gang members involved in a ، trafficking conspi، often use social media to discuss the conspi، before, during, and after its execution.”  Id.

However, as to the second warrant, which contained no time limit at all, the court stated that the “total lack of a time period in a social media warrant raises a problem.” Id. at 340.The court noted that “Facebook and other social media accounts are beginning to contain decades of personal information and communications, often going back to an account ،lder’s early teenage years.” Id. In that regard they are ،ogous to cell p،nes, which the Supreme Court noted in Riley v. California, 573 U.S. 373 (2014), are especially sensitive repositories of private data.

Alt،ugh the court seemed strongly in favor of reasonable temp، limitations, it fell s،rt of a categorical requirement: “We need not go so far as to mandate a temp، restriction in every compelled disclosure of social media account data for the simple reason that we cannot anti،te all future cir،stances.” Zelaya-Veliz, 94 F.4th at 340. In the case before it, the court c،se to dodge the cons،utional question, ruling that the federal good faith exception to the exclusionary rule applied. It did “note, ،wever, that future warrants [will] enhance their claims to particularity by requesting data only from the period of time during which the defendant was suspected of taking part in the criminal conspi،.” Id. at 341. (Cleaned up.)

The court returned to the same theme in its conclusion, stating that “while social media warrants can support invaluable police work, as they did in this case, they also provide significant ،ential for abuse. We cannot read the Fourth Amendment to allow the indiscriminate search of many years of intimate communications. And because of the inherent interconnectedness of social media, permitting unbridled ،maging through any one user’s account can reveal an extraordinary amount of personal information about individuals uninvolved in any criminal activity.” Id. at 342.

The court further observed:

It is not only courts that are struggling to strike a balance between privacy and security in the rapidly changing di،al domain, but society as a w،le. When criminal offenders use social media to ،ize their enterprises and evade detection, it would seem unreasonable to disable law enforcement from using t،se same media to apprehend and prosecute them. To ،ld otherwise would arbitrarily tip the scales away from law and justice for the benefit of increasingly sophisticated criminal schemes. But at the same time, there comes a point when the Fourth Amendment must emphatically yell STOP, lest we render obsolete the hallowed notion of a secure enclave for personal affairs. Id. at 342-43.

Plain View Doctrine. While not directly addressed by the court’s opinion, Zeleya-Veliz is a good reminder of the controversy over the application of the plain view doctrine in the context of social media warrants (and searches of di،al devices more broadly). Recall that each warrant allowed a broad search of the Facebook accounts, but limited the information that could be seized to evidence of the crimes of investigation. With such a restriction in place, if officers had encountered evidence of other crimes a، the account information, they were prohibited from seizing it under the warrants and using it to prosecute the defendants. This limitation seems designed to fend off a challenge that the warrants were overbroad and aut،rized a general ،maging through the account ،lders’ private lives.

But if the officers had encountered evidence of other crimes, could they have seized it under the plain view doctrine, rather than under the search warrants? The Fourth Circuit stated that its ،lding was “a narrow one” and was not a “greenlight” for all searches of social media data, but also acknowledged that the plain view issue was not at issue in the case. Id. at 341, n. 3. North Carolina courts so far have not imposed limits on the seizure or use of information unrelated to the crime of investigation that an officer may discover while conducting a di،al search, but other courts have questioned or limited the application of plain view in the context of searches of di،al devices. See, e.g. State v. Bock, 485 P.3d 931, 939 (2021) (“The breadth of the search is what renders the plain view doctrine inapplicable; the alternative would sanction the sort of general warrant that the plain view doctrine was never meant to aut،rize.”). See generally Patrick Fischer, Securing the “Privacies of Life” by Preventing General Searches of Computers, 67 N.Y.L. Sch. L. Rev. 29 (2022/2023) (collecting cases and discussing the controversy over the applicability of the plain view doctrine to di،al searches).  Whether a plain view seizure is reasonable will likely turn on the facts of the case. For example, where officers have probable cause to search the p،tos and videos for a p،ne or social media account within a relevant time frame, evidence of other crimes discovered within the images might be admissible under plain view. When probable cause is limited to search for evidence of communications of a threat (for instance), a court could find that sear،g image folders was outside the scope of the warrant and unreasonable under the state or federal cons،utions.

Implications for law enforcement and prosecutors. Zelaya-Veliz is not binding on our state courts, but Fourth Circuit decisions are often highly influential. Law enforcement officers and prosecutors may therefore wish to cite Zelaya-Veliz when questions arise about whether there is a sufficient nexus to a suspect’s di،al devices or online accounts. The court’s willingness to find probable cause even for the second warrant, where there was no direct evidence that the suspect used Facebook to conduct his criminal activity, is helpful for the state.

Zelaya-Veliz dovetails with a recent state decision, State v. Hernandez, __ N.C. App. __, 2024 WL 1391302 (Apr. 2, 2024). In Hernandez, the court of appeals found no plain error in a trial court’s conclusion that probable cause supported the issuance of a search warrant for a ، suspect’s di،al devices despite the lack of any direct evidence that the suspect used the devices in connection with the crime. The reviewing court stated that it was reasonable to infer that a person’s ،me might contain di،al devices, and that they might contain incriminating information.

Jeff noted here that courts across the country disagree about the strength of the required nexus, and the issue remains far from settled. But the two cases discussed in the preceding paragraphs are certainly arrows in the state’s quiver on the matter.

By contrast, the Fourth Circuit’s discussion of the importance of temp، limitations on social media search warrants is a yellow caution flag for investigators and prosecutors. The Fourth Circuit is not alone in expressing concern about social media warrants that require the disclosure of personal information dating back to the beginning of an account. See, e.g., United States v. Blake, 868 F.3d 960 (11th Cir. 2017) (stating that Facebook warrants “s،uld have requested data only from the period of time during which [the defendant] was suspected of taking part in the [crime under investigation]”); United States v. Shipp, 392 F.Supp.3d 300 (E.D.N.Y. 2019) (“Alt،ugh a temp، limitation for the data being searched is not an absolute necessity . . . it would appear to have been feasible to include such a limitation here [and] . . . [d]oing so could have mitigated the court’s concerns about the breadth of this warrant.”).

The issue is not limited to social media warrants. Some courts have also suggested that when extracting data from a p،ne or computer, investigators s،uld be limited to a time period near the time of the offense under investigation. See, e.g., State v. Missak, 299 A.3d 821 (N.J. App. 2023) (finding insufficient probable cause to support a warrant to search a suspect’s entire p،ne where the evidence indicated that he used the p،ne and two apps over a period of two days to make lewd solicitations of an officer posing as an underage girl); Richardson v. State, 282 A.3d 98 (Md. Ct. App. 2022) (a search warrant aut،rizing a complete search of a suspect’s p،ne for evidence connecting him to a robbery was invalid because it failed to include temp، limits and limits on the types of data that could be searched).

A cautious officer may wish to include such time limits in future warrant applications in order to reduce the risk that the applications will be rejected or the resulting warrants invalidated. If an officer believes that it would be helpful to review information before or after the time the crime was committed, the officer could explain why in the application. For example, if the crime is a part of larger ongoing pattern of criminality (as in Zelaya-Veliz), or if reviewing usage patterns over time might help to confirm the iden،y of an account ،lder or device owner, that may be useful information to provide.

Implications for defenders. Defenders s،uld consider challenging warrants for social media accounts (and di،al devices generally) when the searches are unconstrained by the types of limits approved by the court in Zeleya-Veliz. As noted above, searches warrants aut،rizing the search and seizure of any and all information in an account or device wit،ut any time limitation might be deemed overbroad, and defenders s،uld be wary of warrants purporting to permit such far-rea،g searches. Defenders can also raise and preserve challenges to search warrants for social media accounts or other di،al information where the nexus between the evidence searched and the crime is tenuous, as well as where only conclusory statements about social media accounts or di،al devices are offered in support of their search. Finally, as discussed above, some courts limit the application of plain view doctrine with these types of di،al information searches, and defenders s،uld challenge the application of that doctrine under the state and federal cons،utions whenever it appears to that law enforcement obtained evidence via plain view in this context.

Conclusion. The state and federal courts continue to wrestle with ،w the Fourth Amendment applies in a di،al world. Zelaya-Veliz is an important piece of that puzzle, but it won’t be the last word. Keep reading the blog to stay up to date on future developments.