Reported / Citable
Background
Burlington, Washington police were called to John Holcomb’s home after his ex-girlfriend “JJ” alleged he had raped her during a sexual encounter the previous evening. Officers obtained a warrant to search Holcomb’s computer for evidence of rape in the second degree. The warrant listed five categories of evidence: communications with JJ, surveillance footage, location data, search history, and—critically—any files “show[ing] dominion and control” over the device. The first four categories were limited to the period around the alleged incident; the dominion-and-control provision had no time limit at all.
A digital forensics detective began scrolling through all videos on the computer rather than using available software to filter by date. He quickly found footage from January 2020—the night of the alleged rape—that appeared to show a consensual encounter, corroborating Holcomb’s account in every detail except the coercive acts JJ described. His supervising detective noted to a prosecutor that the case would likely be dismissed. Despite this, the detective pressed on, scrolling through videos on an older hard drive. He found three videos from 2016 depicting Holcomb sexually abusing his young daughter.
Multiple local agencies dropped charges when Holcomb moved to suppress the child abuse videos, but federal prosecutors indicted him for producing child pornography. The federal district court initially granted suppression, then reversed itself on reconsideration after concluding the good-faith exception applied. Holcomb pleaded guilty while reserving his suppression argument. The Ninth Circuit issued an initial reversal in March 2025, withdrew it for further consideration, and re-filed the opinion on July 17, 2026.
The Court’s Holding
A two-judge majority (Judges Graber and Rakoff) reversed Holcomb’s conviction and remanded for further proceedings. The court held that when officers discovered the January 2020 surveillance video showing the alleged rape “almost certainly had not occurred,” probable cause for the rape warrant dissolved. Under binding Ninth Circuit precedent, no reasonable officer could have concluded—after watching that video—that there was still a fair probability that a crime had occurred. At that point, officers had a duty to stop the search.
The good-faith exception—which protects evidence obtained when officers reasonably rely on a valid warrant later found deficient—does not rescue the search here. Good faith evaporates when probable cause does: once the officers watched the exculpatory video, they could no longer reasonably believe the warrant justified their continued search. The evidence found on the older hard drive, which post-dated probable cause dissipation, must be suppressed.
The court also noted the dominion-and-control provision was independently overbroad for lacking any temporal limitation, though it grounded suppression primarily on the probable cause dissipation theory. The majority rejected the government’s argument that the CSAM videos were in plain view, because plain-view discovery requires the officer to be in a lawful vantage point—which they were not after probable cause dissolved. Judge Sung dissented, writing that no precedent required officers to cease searching mid-execution upon discovering exculpatory evidence, and that probable cause had not fully dissipated.
Key Takeaways
- Officers executing a computer search warrant must stop searching if, during the search, they discover evidence that negates the probable cause supporting the warrant—simply having a piece of paper does not authorize continued fishing after the factual basis disappears.
- The good-faith exception to the exclusionary rule does not save evidence found after probable cause dissolves: once officers know the warrant’s factual premise has failed, their reliance on the warrant is no longer objectively reasonable.
- Dominion-and-control provisions in digital search warrants—which authorize searches of all files showing control over a device—must be temporally limited to the period relevant to the alleged crime; unlimited provisions are overbroad under the Fourth Amendment’s particularity requirement.
- This is a published, precedential Ninth Circuit opinion binding on all California federal districts (C.D. Cal., E.D. Cal., N.D. Cal., S.D. Cal.). Defense counsel challenging digital evidence should audit whether officers discovered exculpatory material mid-search and pressed on anyway.
- The opinion was initially issued in March 2025, withdrawn after a government rehearing petition, and re-filed July 2026 with a dissent—suggesting it may be a candidate for en banc review. Watch for further developments.
Why It Matters
For California federal criminal practitioners, Holcomb establishes a concrete rule for a scenario that digital forensics examiners encounter more often as computer storage grows: what happens when the search turns up evidence that undermines the warrant’s premise before it turns up evidence supporting it? The answer, under Holcomb, is that the search must stop. Defense attorneys handling cases involving computer seizures should immediately request the forensic examiner’s notes and logs to determine the precise sequence in which files were accessed—if an exculpatory file was viewed before the incriminating one, a suppression motion under Holcomb may lie.
For law enforcement and prosecutors, the case is a directive to update digital forensics training. Examiners should be instructed to document when they encounter potentially exculpatory material and to pause and seek supervisory guidance—and potentially a new warrant—rather than continuing to scroll. The overbroad dominion-and-control warrant language that appears in many boilerplate digital search warrants is also now squarely at risk. Warrant applications in the Ninth Circuit should include a temporal limitation on any “domin and control” provision tied to the period surrounding the alleged offense.