Searching over 5,500,000 cases.

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

United States v. Wanjiku

United States Court of Appeals, Seventh Circuit

March 19, 2019

United States of America, Plaintiff-Appellee,
Donald Wanjiku, Defendant-Appellant.

          Argued November 7, 2018

          Appeal from the United States District Court for the Northern District of Illinois, Eastern Division. No. l:16-cr-00296-1 - Elaine E. Bucklo, Judge.

          Before Rovner, Sykes, and Barrett, Circuit Judges.


         Donald Wanjiku pled guilty to one count of transportation of child pornography in violation of 18 U.S.C. § 2252A, but he retained his right to appeal the district court's denial of his motion to suppress the primary evidence against him. That evidence included photographs and videos recovered from his cell phone, laptop and external hard drive during a warrantless border search at O'Hare International Airport. We affirm.


         On June 9, 2015, Wanjiku arrived at O'Hare after a trip to the Philippines. Unbeknownst to Wanjiku, Customs and Border Patrol ("CBP") and Homeland Security Investigations ("HSI") were together conducting a criminal investigation dubbed "Operation Culprit" at the airport that day. Operation Culprit targeted certain individuals returning from three countries known to investigators for "sex tourism" and sex trafficking, including the sex trafficking of children. The investigators developed a list of initial criteria to identify individuals of interest to Operation Culprit: (1) U.S. citizen (2) men (3) between the ages of eighteen and fifty or sixty (4) returning from the Philippines, Thailand, or Cambodia (5)traveling alone (6) with a prior criminal history. Along with an unspecified number of other passengers from the eight to ten flights that investigators were monitoring that day, Wanjiku met all of the initial screening factors. That is, he is a U.S. citizen male, then aged forty-one, returning from the Philippines, traveling without any apparent companion, with a prior arrest.

         Investigators sought to whittle down the resulting list by further investigating these travelers before they arrived at O'Hare. Using government databases[1] and publicly available social media, they determined that Wanjiku's prior arrest was for contributing to the delinquency of a minor, [2] that this was his third trip to the Philippines in two years, that this trip was sixty days in length, and that he had no apparent affiliation with the Philippines other than these trips. For example, they were unable to find business or family ties to the Philippines for Wanjiku. The investigators determined that Wanjiku had booked a prior flight using an email address that incorporated the name "Mr. Dongerous," which heightened their suspicions based on their belief that this was a play on the word "dong," which is vulgar slang for penis.[3] Using that email address, they searched Facebook and found a public Facebook page associated with that address. The person in the profile picture (whom they believed to be Wanjiku) was wearing a mask of the type that one wears to a masquerade ball. Photos of "friends" on that page appeared to be "very young" relative to Wanjiku's age.[4] The investigators for Operation Culprit found all of this suspicious enough to warrant sending Wanjiku to a more thorough secondary inspection on his arrival at the airport.[5]

         After Wanjiku passed through the primary inspection point and was referred to the secondary inspection area in Baggage Hall A, CBP Officer Toler met Wanjiku for a more thorough secondary inspection. Toler testified that, at the secondary inspection area, he typically would take the traveler's bags and then obtain a binding declaration from that person. He would then ask what the traveler was doing outside of the United States, obtain a story about the trip, and then go through the traveler's bags to see if the contents of the bags corroborated the traveler's answers. Toler candidly testified at the suppression hearing that investigators had already decided to inspect the contents of Wanjiku's cell phone and other electronic devices before he reached the secondary inspection point (indeed, before he reached the primary inspection point) on the basis of the information that they had gathered prior to his arrival. Nevertheless, before those devices were actually inspected, Wanjiku gave the investigators additional cause for concern. For openers, at the primary inspection point, the officer interacting with Wanjiku indicated in notes to the secondary inspector that Wanjiku was "evasive for questioning."

         At the secondary inspection area in Baggage Hall A, Wanjiku came to Toler's attention even before Toler could begin his usual inspection process. Toler saw Wanjiku leave the line of persons awaiting inspection, something Toler had never seen a passenger do before. As Toler later learned from an Immigration and Customs Enforcement ("ICE") agent, Wanjiku left Baggage Hall A and walked approximately two hundred feet away and across an exit corridor to a bathroom in Baggage Hall B, even though there was an identically marked bathroom much closer in Baggage Hall A. Wanjiku left his luggage in the line when he took this walk and an ICE agent escorted him back to the line.

         At the beginning of the inspection, Toler asked Wanjiku why he had left the line. Wanjiku replied that he had heat stroke and needed to use the bathroom. Toler noted that Wanjiku was sweating profusely in the air conditioned hall, was shifting his weight, and seemed visibly nervous. Toler then asked Wanjiku about the trip itself, and Wanjiku said he had been visiting friends in the Philippines for two months. In response to Toler's questions, Wanjiku also revealed that he had left the U.S. with $6000 and was returning with just a few hundred dollars. He had stayed at the home of the friends he was visiting. Because Wanjiku had reported on a Customs Declaration form that he was not bringing in items exceeding $800 in value and because he had said he was staying with friends, Toler asked him how he had spent more than $5000 during the trip. Wanjiku gave vague and evasive answers, saying only that his friends had shown him around the country. He also told Toler that he sometimes sent or gave money to the family he stayed with in order to help their child attend school. He went to the Philippines, he said, in part to make sure his money was being put to good use. Toler asked where Wanjiku traveled in the Philippines and he would not elaborate, saying only that his friends showed him around the country. Toler went through the list of questions that a traveler normally must answer on the standard Customs Declaration form, including whether he was bringing in more than $10, 000 in currency, food, cell cultures, snails, or gifts, among other things.

         After obtaining a binding declaration from Wanjiku, Toler prepared to inspect Wanjiku's two large bags and single carry-on bag. He asked if the bags belonged to Wanjiku and whether Wanjiku himself had packed them. Wanjiku responded affirmatively to both questions. In response to Toler's questions, he denied that there were any sharp objects in the bags that could possibly poke, cut or hurt Toler as he went through the bags. Toler and another agent then opened the bags. They set aside Wanjiku's cell phone, laptop and portable hard drive for later inspection. In one bag, Toler found a pocket full of receipts, including multiple receipts for hotel stays. Most were for one-night stays, and two were for one-night stays at the same hotel approximately one week apart. Because Wanjiku had previously told Toler that he stayed with friends, Toler asked what the hotel receipts were for. Wanjiku said that his friend showed him around the country and these receipts were from those trips. That answer heightened Toler's suspicions both because Wanjiku had previously given the address of the friend as the place he stayed and because Toler deemed it unusual to stay at the same hotel twice in the span of a week if a person is traveling around the country. He asked Wanjiku about the dual receipts for the same hotel specifically and Wanjiku would not elaborate, instead asking Toler whether it was illegal to go around the country or have a friend show him around the country.

         Toler next found a pocket containing syringes and condoms, which upset him because Wanjiku had denied that the bags contained sharp objects, putting Toler at risk of injury. When asked about the syringes, Wanjiku explained that he had medication in his other bag. The injectable medication recovered from the other bag was to treat low testosterone. The second bag also contained oxycodone and OxyContin pills, a narcotic pain medication. The medications raised additional red flags for Toler because he believed that testosterone was a "sexually specific" substance related to "male genitalia." R. 59, Tr. at 34. Moreover, both medications were in the name Donald Kwiatkowski, not Donald Wanjiku. Wanjiku explained that he had changed his name, and offered a social security card issued in his prior name to support his claim.

         After completing this check of Wanjiku's bags, Toler turned his attention to the cell phone. The phone was password-protected, and Toler began by asking Wanjiku to unlock the phone. Wanjiku initially resisted but relented when Toler told him that everything was searchable at the border and that the phone would be seized, unlocked by a "lab," and examined whether or not Wanjiku unlocked it. Toler took the unlocked phone and manually scrolled through the pictures. Within a minute, he found several pictures of Wanjiku lying in bed with another man who was in his underwear. Although Toler twice referred to the other person in the photos as a "man," he also testified at the suppression hearing that he was uncertain of the age of the person pictured.[6] Toler then turned the phone over to HSI because the HSI forensics team was better trained than he to identify child pornography.

         Agent Kevin Gerlock of HSI was the computer forensic coordinator on the scene at O'Hare that day. HSI agents used forensic software to "preview" Wanjiku's cell phone and hard drive while Wanjiku waited at the secondary inspection area. Gerlock explained that "EnCase" software was used first to preview Wanjiku's external hard drive. EnCase allows a search of the contents of a hard drive without modifying or destroying any of the information contained on the device. A preview, Gerlock testified, involved looking only at allocated space on the device, essentially items catalogued by the device's operating system in files. In contrast, a full forensic examination of a device would copy every bit of memory in the device and would reveal items that had been deleted or placed in hidden areas of memory. A preview generally takes one to three hours to complete. A full forensic examination could take months. The agents used software to inspect the devices in order to avoid damaging the devices or altering the data on the devices.[7]

         Agent Mark Bowers performed the forensic preview on the hard drive, which was neither password-protected nor encrypted. Bowers used the EnCase software to view photographs and videos stored on the device. The preview took less than an hour and revealed six videos of suspected child pornography. The file names for the videos included references to the ages of the children portrayed and terms known to the agents to be associated with child pornography. For example, one file was labeled "pthc-15yogirlteachingl2yoboys." Gerlock explained that "pthc" is known by the agents to be an abbreviation for "preteen hardcore." Gerlock, having seen the videos, confirmed that the titles were in fact descriptive of the content.[8]

         The second preview search performed by forensics officers at the airport that day was of Wanjiku's Samsung cell phone.[9]In this instance, Officers Keith Smith and Marci Landri used "Cellebrite" and "XRY" software to review photos and videos stored on the phone. As with the hard drive, the search did not include deleted or hidden files. The agents did not attempt to inspect email, text messages or similar data, instead confining the searches to photographs and videos. The fourteen photographs of child pornography that were found that day were stored on a small memory card inserted into the phone rather than in the memory of the phone itself. This removable "micro SD" memory card was neither password-protected nor encrypted.

         The agents lacked the necessary equipment to preview the laptop at the airport. Because child pornography had already been discovered on two of Wanjiku's electronic devices, the laptop was taken to an HSI lab where it was previewed approximately one week later. The laptop preview took under three hours, and agents again restricted the search to photographs and videos, not searching for deleted or hidden files. Child pornography was also recovered from the laptop. For each electronic device, the photographs and videos that were suspected to be child pornography were copied to a compact disk and entered into evidence at the suppression hearing.[10]

         On the basis of the photographs and videos discovered on Wanjiku's electronic devices during these warrantless searches at the border, he was charged with one count of transportation of child pornography, in violation of 18 U.S.C. § 2252A(a)(1). Wanjiku moved to suppress the evidence collected during the searches of his electronic devices at the border, arguing that it was improper for the agents to insist that Wanjiku unlock the phone, and that searches of electronic devices are non-routine border searches that require reasonable suspicion or, arguably, a warrant.[11] The government countered that the preview examinations of the devices were routine searches that may be conducted at the border without any suspicion whatsoever. In the alternative, the government asserted that the agents possessed reasonable suspicion based both on information known to them before Wanjiku arrived at O'Hare and information developed during routine inspection and questioning, and that no court had required more than reasonable suspicion for even a non-routine border search. The district court found that the information known to the agents at the time they searched Wanjiku's devices was sufficient to trigger a reasonable suspicion that he was involved in the kind of criminal activity targeted by Operation Culprit. The court therefore denied the motion to suppress the fruits of the border search, and Wanjiku pled guilty conditionally retaining his right to challenge the district court's suppression ruling on appeal.


         On appeal, Wanjiku contends that, in the wake of the Supreme Court's decisions in Riley v. California, 134 S.Ct. 2473 (2014), and Carpenter v. United States, 138 S.Ct. 2206 (2018), border searches of electronic devices may be conducted only with a warrant supported by probable cause. In the alternative, if the applicable standard is reasonable suspicion, he contends that the facts known to the officers when they decided to search his electronic devices were not sufficient to give rise to reasonable suspicion. The government takes the position that no individualized suspicion is needed for a routine border search of electronic devices. In the alternative, the government argues that if probable cause is now required under Riley and Carpenter, suppression would not be warranted under the good faith doctrine. Finally, the government maintains that if reasonable suspicion is the appropriate standard for border searches of electronic devices, that standard was met here. In reviewing a district court's denial of a motion to suppress, we review findings of fact for clear error and questions of law de novo. United States v. Velazquez, 906 F.3d 554, 557 (7th Cir. 2018); United States v. Borostowski, 775 F.3d 851, 863 (7th Cir. 2014).

         The primary positions staked out by the parties could not be more starkly contrasted. The defendant argues that nothing less than a warrant authorizes a search of electronic devices at the border. The government asserts that it may conduct these searches without any particularized suspicion at all. In the end, though, we need not adopt either of these positions, and indeed may avoid entirely the thorny issue of the appropriate level of suspicion required. Instead, we affirm the district court's denial of the motion to suppress because these agents acted in good faith when they searched the devices with reasonable suspicion to believe that a crime was being committed, at a time when no court had ever required more than reasonable suspicion for any search at the border.


         Two months before the First United States Congress proposed the Bill of Rights, it enacted the first customs statute, granting customs officials "'full power and authority' to enter and search 'any ship or vessel, in which they shall have reason to suspect any goods, wares or merchandise subject to duty shall be concealed . . ..'" United States v. Ramsey,431 U.S. 606, 616 (1977) (quoting section 24 of Act of July 31, 1789, c. 5, 1 Stat. 29). Approximately one hundred years later, the Supreme Court noted that the statute allowing searches of ships and vessels and the seizure of goods "concealed to avoid the duties payable on them" had been passed by the same Congress that proposed the Fourth Amendment. That timing made clear "that the members of that body did not regard searches and seizures of this kind as 'unreasonable,' and they are not embraced within the prohibition of the amendment." Boyd v. United States, 116 U.S. 616, 623 (1886). See also Ramsey, 431 U.S. at 616 ("searches made at ...

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.