12/17/2024
DA 24-0139
Case Number: DA 24-0139
IN THE SUPREME COURT OF THE STATE OF MONTANA
2024 MT 308
STATE OF MONTANA,
Plaintiff and Appellant,
v.
YANBIN BAO,
Defendant and Appellee.
APPEAL FROM: District Court of the Fourth Judicial District,
In and For the County of Missoula, Cause No. DC-23-326
Honorable Leslie Halligan, Presiding Judge
COUNSEL OF RECORD:
For Appellant:
Austin Knudsen, Montana Attorney General, Roy Brown, Assistant
Attorney General, Helena, Montana
Matt Jennings, Interim Missoula County Attorney Andrea Renee
Haney, Katrina Thorness, Deputy County Attorneys, Missoula,
Montana
For Appellee:
Jordan Kilby, Stephens Brooke, P.C., Missoula, Montana
Submitted on Briefs: November 6, 2024
Decided: December 17, 2024
Filed:
ir,-6‘A•-if
__________________________________________
Clerk
Justice Laurie McKinnon delivered the Opinion of the Court.
¶1 The State of Montana appeals from a February 16, 2024, Order of the Fourth Judicial
District Court, Missoula County, pursuant to § 46-20-103(2)(e), MCA. The District Court
ordered the suppression of evidence obtained from four electronic devices because the
process of decrypting and extracting the data contained within those devices required more
time than allowed by the ten-day time limit for serving warrants established by § 46-5-225,
MCA. We reverse and remand for continuation of proceedings.
¶2 The State presents the following issue for review:
Whether the District Court erred when it found that § 46-5-225, MCA, requires
the State complete a search of evidence within ten days of the warrant’s
issuance.
FACTUAL AND PROCEDURAL BACKGROUND
¶3 The State charged Yanbin Bao (Bao), a foreign national and resident of South
Carolina, with seven counts of felony sex trafficking under § 45-5-702(1), MCA, and one
count of felony labor trafficking under § 45-5-703(1), MCA. Bao allegedly ran a
prostitution operation out of a Missoula, Montana, massage parlor called Soul Massage
with her husband, Richard Bushey (Bushey). Bao and Bushey purportedly employed at
least three women as prostitutes at Soul Massage, including Jane Doe (JD).
¶4 JD entered the United States in March 2023 and answered an internet advertisement
for dog-friendly housing for “only $20 a day.” JD met Bao through the advertisement and
she subsequently moved to Missoula on April 26, 2023. The advertised housing was Soul
Massage, where JD claims Bao held her in captivity and forced her to engage in sexual acts
with customers under the threat of violence.
2
¶5 On May 29, 2023, JD called law enforcement from Soul Massage and accused Bao
and Bushey of running a prostitution and sex trafficking operation. Deputies arrested Bao
and Bushey. Responding officers performed a search incident to arrest and seized their
cellphones. From Bao, deputies seized a silver Apple iPhone in a clear case (Phone 1) and
a white Apple iPhone in a purple case (Phone 2). From Bushey, deputies seized an Apple
iPhone with a black case (Phone 6). Soul Massage was then searched pursuant to a search
warrant and Deputies also seized several other electronic devices: an Apple iPad Pro in a
grey case (Tablet 1), a red Apple iPhone with a clear case (Phone 3), a blue Motorola phone
(Phone 4), and a black Samsung phone (Phone 5).
¶6 On June 6, 2023, law enforcement arrested another suspect, Hui Wang (Wang), in
connection with the allegedly illegal operations at Soul Massage. Law enforcement found
four phones on Wang’s person: a black Samsung phone (Phone 7), a Blu V50 cell phone
(Phone 8), a Blu Vivo phone (Phone 9), and an Apple iPhone in a “pink/purple case with
red staining upon it” (Phone 10). Acting upon a search warrant for Wang’s hotel room,
law enforcement seized a black Vortex cell phone (Phone 11) and an Apple iPad (Tablet 2).
¶7 On July 10, 2023, law enforcement obtained another warrant to search all the
devices seized from Bao, Bushey, and Wang. The warrant was presented to Forensic
Analyst Melanie Thomas (Thomas) on July 11, 2023. Thomas then began the process of
decrypting the seized devices to access and copy the data stored on the devices. On July 12,
2023, Thomas accessed Phone 6 using a provided PIN code and began extracting data.
Phone 2 was protected by a PIN code and required Thomas to brute force the phone’s
3
encryption with the GrayKey decryption program. On July 13, 2023, Thomas extracted
the full filesystem from Phone 4. On July 14, 2023, Thomas extracted the full filesystem
from Phone 5. On July 19, 2023, Thomas extracted the full filesystem from Phone 6 and
generated a report from the extracted data. On July 20, 2023, Thomas generated her report
from the data extracted from Phone 4 and Phone 5, and she began the process of brute
forcing the encryption on Tablet 1.
¶8 Thomas required more time to bypass the other devices’ encryption and security
mechanisms. As detailed in the application for the July 10, 2023, warrant, the GrayKey
software brute forces an electronic device’s encryption to allow “a valid law enforcement
agency located in a supported country” to access stored data in a potentially time intensive
process. To brute force and decrypt an Android device, a forensic analyst must physically
manipulate the screen, power, and buttons on the device to place the device into download
mode. Once placed into download mode, GrayKey can recover and download a file if the
device is compatible and supported by the GrayKey software. Phone 4, Phone 5, Phone 7,
Phone 8, and Phone 11 are Android devices.
¶9 When decrypting an Apple device, the duration of the GrayKey process depends on
when the phone was powered off or previously unlocked by the user. An “After First
Unlock” (AFU) process allows GrayKey to make 300,000 attempts at decrypting a phone
every ten minutes—a “fast brute force”—because the device had been unlocked at some
point prior to the seizure by law enforcement and remained powered on, rendering 95% of
the device’s data available instantly. Conversely, a “Before First Unlock” (BFU) process
4
is required when the phone was off when seized or “had a power event after” seizure. When
a phone is reset, “most of its data, including contacts, messages, and other personal data”
is still encrypted. In a “slow brute force” BFU situation, GrayKey can make one attempt
to decrypt the phone every ten minutes. An AFU—or a particularly lucky BFU—might
render the device accessible to law enforcement within a day. Or a BFU brute force could
require up to 23 years to more than 200 years to decrypt a device depending on the method
and sophistication of encryption. Phone 1, Phone 2, Phone 3, Phone 6, Phone 10, Tablet 1,
and Tablet 2 are Apple devices, and each presents a unique puzzle of decryption.
¶10 On December 1, 2023, the brute force had revealed the PIN protecting Phone 2,
allowing Thomas to begin extracting data from the device on December 5, 2024. Thomas
encountered obstacles processing this data when the software failed to translate the
contained data from Mandarin to English, but she was able to troubleshoot the issue with
the extraction software company customer service. She eventually completed the
translations and generated a report from the data extracted from Phone 2 on December 28,
2023. On January 4, 2024, Thomas began extracting data from Phone 1. Thomas’s report
indicates that the data “obtained from the extraction was significantly large,” delaying the
generation of a report from that data until the next day. On January 5, 2024, she extracted
and compiled all the data from Phone 3. The record is unclear as to when, if at all, Thomas
was able to access data contained on Tablet 1.
¶11 On January 22, 2024, Bao moved to suppress the data obtained from the electronic
devices on several grounds. Relevant here, Bao argued the warrant was void when the full
5
forensic analysis of the seized devices was not complete within ten days following issuance
of the warrant. The District Court granted Bao’s motion in part, ordering the suppression
of evidence obtained from Phone 1, Phone 2, Phone 3, and Tablet 1 because the forensic
analysis took longer than ten days in violation of the time limit for serving a warrant
imposed by § 46-5-225, MCA. The District Court “interpret[ed] [§ 46-5-225, MCA] to
mean that law enforcement had ten days from July 10, 2023, to execute the search” and
complete its analysis of the seized electronic devices detailed by the warrant. The State
now appeals from the order granting Bao’s motion to suppress.
STANDARD OF REVIEW
¶12 We review the grant or denial of a motion to suppress for clear error as to the
findings of fact and de novo as to whether the district court correctly interpreted and applied
the governing law. State v. Levine, 2024 MT 169, ¶ 7,
417 Mont. 410,
553 P.3d 416
(citations omitted). The interpretation of a statute is a question of law reviewed de novo.
Levine, ¶ 7 (citation omitted).
DISCUSSION
¶13 Section 46-5-225, MCA, the statute we are required to interpret, provides:
When warrant may be served. The warrant may be served at any time of
the day or night. The warrant must be served within 10 days from the time
of issuance. Any warrant not served within 10 days is void and must be
returned to the court or judge issuing the warrant and identified as “not
served.”
The statute directs that the warrant must be “served” within ten days of its issuance. Under
a related statute, “service of a search warrant is made by exhibiting the original warrant or
6
a duplicate original warrant at the place or to the person to be searched.” Section 46-5-227,
MCA (emphasis added). “Serve,” under its plain meaning, refers to making “legal delivery
of (a notice or process)” or “to present (a person) with a notice or process as required by
law.” Serve, Black’s Law Dictionary (12th ed. 2024); see also Personal Service, Black’s
Law Dictionary (12th ed. 2024) (“Actual delivery of the notice or process to the person to
whom it is directed.”). Even more colloquially, “service” means “the act of bringing a
legal writ, process, or summons to notice actually or constructively as prescribed by law”
and “the carrying into effect or execution of a writ or process (as an attachment by seizing
the goods or person attached or an execution by levying it upon the goods or person of the
defendant).” Service, Webster’s Third International Dictionary (3rd ed. 2002) (emphasis
added); see also Personal Service, Webster’s Third International Dictionary (3rd ed. 2002)
(“Service of a legal process by delivering it or a copy thereof to the defendant or by statute
to an agent of the defendant authorized to receive service in the case at issue.”).
¶14 Other jurisdictions have analogous time limits on service of warrants. The Illinois
Code of Criminal Procedure, from which our provision was sourced, § 46-5-225, MCA,
Annotations, Comm’rs Note (2016), contains largely identical language: warrants “shall be
executed within 96 hours from the time of issuance.” 725 Ill. Comp. Stat. § 5/108-6 (2024).
The 96-hour time limit was intended to prevent probable cause from becoming stale, but
did not constrain “the execution of search warrants authorizing the search of evidence
lawfully seized and lawfully in the possession of the investigating authorities prior to the
issuance of the search warrant to be executed.” People v. Shinohara, 872 N.E.2d 498, 517
7
(Ill. Ct. App. 2007). Likewise, Wisconsin recently addressed the same issue as in the
instant case and determined a statute requiring the execution of a search warrant within
five days did not require law enforcement complete their digital forensic analysis of
lawfully seized electronic devices within five days. State v. Drachenberg, 2023 WI
App 61, ¶ 38,
998 N.W.2d 566. Other relevant, persuasive authority is consistent with
Drachenberg and Shinohara. See State v. Sanchez,
2020-NMSC-017, ¶¶ 13-14,
476 P.3d
889 (Search warrant for data on electronic device “served” for purposes of state statute
when device was seized or when the data stored on the device was copied on site.); State v.
Nadeau,
2010 ME 71, ¶ 48,
1 A.3d 445 (Warrant to search property lawfully in state
custody was effectively executed at the time issued and “there was no danger that a search
of the computer conducted after the expiration of the ten-day period would result in a
seizure based on stale probable cause.”); State v. Johnson,
831 N.W.2d 917, 925 (Minn.
Ct. App. 2013) (“Forensic analysis was not a second search within the meaning of the
Fourth Amendment where the hard drive had been validly seized pursuant to a search
warrant issued on probable cause” and search occurred after expiration of ten-day deadline
to execute warrant.).
¶15 Here, the warrant was served within the § 46-5-225, MCA, ten-day time limit. The
warrant issued on July 10, 2023, clearly states that “evidence, contraband, or persons
connected with the aforementioned crimes may be found . . . within the devices” seized
from Bao, Bushey, and Wang as well as devices found in Soul Massage or Wang’s hotel
room “located at the Missoula County Sheriff’s Office secure evidence storage.” The
8
record indicates that Thomas received the request to extract data from the electronic
devices and was provided with the signed, valid warrant on July 11, 2023—well within the
ten-day limit for service set by § 46-5-225, MCA. “As long as a warrant is executed within
ten days from its issuance, as set by our legislature in § 46-5-225, MCA, the warrant itself
is not stale.” State v. Neely, 261 Mont. 369, 373,
862 P.2d 1109, 1111 (1993). Thus, the
warrant issued on July 10, 2023, was served upon delivery to the forensic analyst already
in possession of the lawfully seized devices on July 11, 2023. The process of accessing
electronic devices already lawfully seized by the State does not violate the ten-day time
limit imposed by § 46-5-225, MCA, on serving a warrant. Accordingly, the District
Court’s Order to suppress the evidence gathered from Phone 1, Phone 2, Phone 3, and
Tablet 1 is reversed.
¶16 We need not consider Bao’s alternative claims raised in her answer to the State’s
opening brief in this interlocutory appeal. Section 46-20-103(1)(e), MCA, allows the State
to take an appeal from an order granting a motion to suppress. The scope of this
interlocutory appeal is dictated by statute. The District Court’s order granting Bao’s
motion to suppress was based solely on its interpretation of § 46-5-225, MCA. Therefore,
Bao’s alternative claims are not properly before the Court and Bao must await entry of a
final judgment should she choose to appeal a decision of the District Court. Section
46-20-104(1), MCA (“An appeal may be taken by the defendant only from a final judgment
of conviction and orders after judgment which affect the substantial rights of the
defendant.”).
9
CONCLUSION
¶17 The July 10, 2023, warrant was properly served within the time limits established
by § 46-5-225, MCA. The District Court erred in granting Bao’s motion to suppress.
¶18 Reversed and remanded for continuation of proceedings.
/S/ LAURIE McKINNON
We Concur:
/S/ JAMES JEREMIAH SHEA
/S/ BETH BAKER
/S/ INGRID GUSTAFSON
/S/ JIM RICE
10
