State v. Kevin M. Jereczek

2021 WI APP 30

COURT OF APPEALS OF WISCONSIN
PUBLISHED OPINION

Case No.: 2019AP826-CR

Complete Title of Case:

STATE OF WISCONSIN,

PLAINTIFF-RESPONDENT,

V.

KEVIN M. JERECZEK,

DEFENDANT-APPELLANT.

Opinion Filed: April 6, 2021
Submitted on Briefs: March 17, 2020
Oral Argument:

JUDGES: Stark, P.J., Hruz and Seidl, JJ.
Concurred:
Dissented:

Appellant
ATTORNEYS: On behalf of the defendant-appellant, the cause was submitted on the
briefs of Erica L. Bauer, Appleton.

Respondent
ATTORNEYS: On behalf of the plaintiff-respondent, the cause was submitted on the
brief of Joshua L. Kaul, attorney general, and Sarah L. Burgundy,
assistant attorney general.
2021 WI App 30

COURT OF APPEALS
DECISION NOTICE
DATED AND FILED This opinion is subject to further editing. If
published, the official version will appear in
the bound volume of the Official Reports.
April 6, 2021
A party may file with the Supreme Court a
Sheila T. Reiff petition to review an adverse decision by the
Clerk of Court of Appeals Court of Appeals. See WIS. STAT. § 808.10 and
RULE 809.62.

Appeal No. 2019AP826-CR Cir. Ct. No. 2016CF906

STATE OF WISCONSIN IN COURT OF APPEALS

STATE OF WISCONSIN,

PLAINTIFF-RESPONDENT,

V.

KEVIN M. JERECZEK,

DEFENDANT-APPELLANT.

APPEAL from a judgment of the circuit court for Brown County:
JOHN ZAKOWSKI, Judge. Reversed and cause remanded with directions.

Before Stark, P.J., Hruz and Seidl, JJ.

¶1 HRUZ, J. Kevin Jereczek appeals a judgment convicting him of a
single count of possession of child pornography as a party to the crime. Jereczek
argues the circuit court erroneously denied his suppression motion, in which he
alleged that law enforcement had exceeded the scope of consent he had given to
No. 2019AP826-CR

search their family computer. Specifically, Jereczek and the State stipulated that he
had told officers they could search only his son’s user account on the computer.

¶2 We conclude law enforcement exceeded the scope of that consent
when they began their forensic examination of the computer’s hard drive by
examining the drive’s recycle bin container, which aggregated the deleted files of
all of the computer’s users, including Jereczek. When a person limits his or her
consent to search to a particular user account on an electronic device, a reasonable
person would interpret that consent as being limited to only those files accessible
from that account’s user interface. In other words, and contrary to the State’s
argument, Jereczek’s consent did not authorize a search of all files in any shared
areas in the computer where data associated with the son’s user profile might be
found. It authorized a search of only those areas and files visible when one operates
within a particular user’s account—here, the son’s.

¶3 The law enforcement analyst in this case testified that a particular
user, while operating within his or her own account, cannot view the deleted files of
another user. The analyst also testified that he knew he was likely to encounter the
files of other users in the computer’s recycle bin while using his forensic software
to search the computer. The search of the entire recycle bin was therefore unlawful,
and the evidence derived from that search should have been suppressed. We reverse
and remand for the circuit court to grant Jereczek’s suppression motion and for
further proceedings consistent with this opinion.

BACKGROUND

¶4 A criminal complaint and an Information charged Jereczek with
eleven counts of possession of child pornography as a party to the crime. The
complaint alleged that Jereczek’s son was a suspect in a sexual assault investigation,

2
No. 2019AP826-CR

and police believed that the family computer the son used may have had
pornography on it related to the assault. Police met with Jereczek, who gave a
desktop computer to police for forensic analysis with the instruction that police were
to limit their analysis to the son’s user account.

¶5 As described in more detail below, police discovered images
appearing to be child pornography when they began their forensic review of the
computer’s hard drive—specifically, of its recycle bin. Based on these findings,
police obtained a warrant to search the entire hard drive. Jereczek filed a motion to
suppress the images discovered during the initial forensic analysis and during the
subsequent warrant search, asserting that the scope of the initial search exceeded the
consent Jereczek had given insomuch as it included the review of files outside of
the son’s user account.

¶6 At the hearing on Jereczek’s motion, he and the State reached a
stipulation regarding the scope of consent he had given to search the computer.1
Specifically, the parties agreed that Jereczek had given limited consent that allowed
police to search only his son’s user account. The evidentiary portion of the hearing
was held to ascertain whether the initial, pre-warrant forensic analysis of the hard
drive occurred within the scope of that consent. The only witness to testify was
Tyler Behling, the computer forensic crime analyst who had analyzed the hard drive
for the Brown County Sheriff’s Department.

¶7 Behling testified he had received the computer from an officer with
instructions to locate images of child pornography on the son’s user account.
Behling removed the hard drive, which had the Windows 7 operating system

1
Police had audio recorded the conversation in which Jereczek provided consent to search
the computer.

3
No. 2019AP826-CR

installed, and connected it to a “write blocker” to prevent modifying the data on the
hard drive disc. He also used software called EnCase to examine the contents of the
file system on the drive. Behling testified that the software shows law enforcement
the file system and data structure of the hard drive, and it “allows us an overview of
the entire contents of the disc.”

¶8 Behling explained that he began his search in the computer’s recycle
bin container, at which time he discovered that it contained child pornography that
had been deleted from two user accounts.2 Based upon this discovery, Behling
applied for a search warrant for the entire contents of the hard drive. According to
Behling, the recycle bin is “a container to temporar[ily] hold files that a user would
delete.” The recycle bin is a shared container on the hard drive into which any user
on a multi-user operating system is able to place discarded files.

¶9 Behling provided further details about how a recycle bin functions. If
a user logged into a particular account deletes a file (thereby placing the file in the
recycle bin), that user would be able to view the deleted file from his or her account,
but other users logged into different accounts would not be able to see it. Because
Behling’s forensic software read data directly from the hard drive disc and did not
use the operating system’s user interface, Behling could view the aggregate files
placed in the recycle bin by all of the computer’s users. In other words, under the
approach Behling used, the files appearing in the recycle bin were not separated by
user account. Behling was aware when he accessed the recycle bin that he would
likely find files deleted by other user accounts.

2
One user profile belonged to Jereczek, and one belonged to his son.

4
No. 2019AP826-CR

¶10 When Behling initially discovered that there were files containing
child pornography in the recycle bin, he did not know the user account or accounts
from which they had come. He used other software to examine registry data—
which is external to any user account—to identify “artifacts about the user account,”
including the groups to which the user belongs, the user’s security identifier, and
the user’s last log-in date. Using a globally unique identifier associated with each
of the deleted files, Behling was able to connect the deleted images to particular
user accounts, at which point he applied for the warrant. Behling stated that prior
to obtaining the warrant, he did not believe he had accessed any particular user
account.

¶11 Behling also provided additional testimony about the scope of consent
provided in relation to his forensic examination. Behling was aware that Windows
by default includes multiple user accounts, that there were in fact multiple user
accounts on the operating system, and that he was supposed to limit his analysis to
the son’s user account. Behling testified there are “difficulties” with targeting a
specific user profile when conducting a forensic search of a multi-user device, and
for this reason he would typically “just start with a warrant” for such devices.
Nonetheless, Behling stated that he did not explain to the referring detective any of
his concerns regarding his technical ability to adhere to the scope of consent.

¶12 Moreover, Behling conceded that he could have limited his search of
the hard drive in a way that was consistent with the scope of consent. Although he
initially testified it was impractical to restrict a search to a particular user’s profile,
he subsequently clarified that it was “not impossible” to do so, “but your exam
would not be complete.” Instead, using the EnCase software, Behling could select
to view all the user data under a single user profile. This type of analysis would be
confined to the user’s “home profile path,” which is the file structure for each profile

5
No. 2019AP826-CR

and includes “downloads, your documents, music, pictures, that type of material.”
But Behling testified that such an analysis would exclude the recycle bin, something
he “would never exclude” when looking for evidence of child pornography.

¶13 The circuit court denied the suppression motion. It began its decision
by emphasizing some of Behling’s testimony—in particular, that Behling usually
started his analysis with the recycle bin because, in his experience, people would
often delete illegal files after viewing them. The court also emphasized Behling’s
testimony that he would never exclude the recycle bin from a search for child
pornography and that he would eventually look at the files located there. After
highlighting Behling’s testimony regarding the difficulties with limiting a forensic
search to a particular user account, the court determined Behling did not exceed the
scope of consent.3

¶14 Specifically, the circuit court concluded that even if Behling had
started with the user data on the son’s account, Behling “would have followed the
information into the recycle bin where he would have seen the multiple child porn
images from the multiple user accounts.”4 The court applied the “inevitable
discovery” doctrine as articulated in Nix v. Williams, 467 U.S. 431 (1984), and State
v. Weber, 163 Wis. 2d 116, 471 N.W.2d 187 (1991), to conclude that Behling
“would have eventually discovered the evidence of the crime in the recycle bin and
then asked for a search warrant.”

3
The circuit court wrote that law enforcement “did not exceed the scope of the warrant.”
We presume this was an inadvertent misstatement, as law enforcement’s compliance with the scope
of Jereczek’s consent—not the scope of the warrant—was the only issue presented for resolution.
4
The circuit court did not explain what information derived from the son’s user account
would have led law enforcement to the recycle bin.

6
No. 2019AP826-CR

¶15 Following the suppression ruling, Jereczek entered a no-contest plea
to a single count of possession of child pornography as a party to the crime. The
remaining counts were dismissed outright. The parties agreed to jointly recommend
a sentence consisting of three years’ initial confinement and five years’ extended
supervision. The court accepted that recommendation. Jereczek now appeals,
challenging the denial of his suppression motion under WIS. STAT. § 971.31(10)
(2019-20).5

DISCUSSION

¶16 The Fourth Amendment to the United States Constitution and article I,
section 11 of the Wisconsin Constitution prohibit unreasonable searches and
seizures.6 The protections extend to places and things in which a person has a
reasonable expectation of privacy. State v. Tentoni, 2015 WI App 77, ¶7, 365
Wis. 2d 211, 871 N.W.2d 285. Jereczek argues—and the State does not dispute—
that he had a reasonable expectation of privacy in the computer he and his son used.

¶17 Warrantless searches are presumed to be unreasonable under the
Fourth Amendment. State v. Matejka, 2001 WI 5, ¶17, 241 Wis. 2d 52, 621 N.W.2d
891; see also Birchfield v. North Dakota, 136 S. Ct. 2160, 2173 (2016). “Consent
is an exception to the warrant requirement.” State v. Abbott, 2020 WI App 25, ¶14,
392 Wis. 2d 232, 944 N.W.2d 8. The consent exception is premised on the notion
that it is reasonable for police to conduct a search if they have been permitted to do

5
All references to the Wisconsin Statutes are to the 2019-20 version unless otherwise
noted.
6
The protections under these provisions of the federal and state constitutions are usually
interpreted coextensively. State v. Artic, 2010 WI 83, ¶28, 327 Wis. 2d 392, 786 N.W.2d 430.

7
No. 2019AP826-CR

so by the person whose expectation of privacy is implicated. Florida v. Jimeno,
500 U.S. 248, 250-51 (1991) (citing Schneckloth v. Bustamonte, 412 U.S. 218, 219
(1973)). Here, the parties stipulated that Jereczek provided consent to search the
computer, but he limited that consent to his son’s user account.7

¶18 “The scope of consent to search may be limited by the terms of its
authorization.” Matejka, 241 Wis. 2d 52, ¶37 (citing Walter v. United States, 447
U.S. 649, 656 (1980)). When a person explicitly limits the scope of the
consent-based search, courts will give effect to those limitations. See id.; see also
Jimeno, 500 U.S. at 252. The scope of consent is measured by the breadth of the
actual consent given, and courts determine whether the search remained within the
boundaries of that consent by looking at the totality of the circumstances. United
States v. Correa, 908 F.3d 208, 215 (7th Cir. 2018).

¶19 More specifically, “[t]he standard for measuring the scope of a
suspect’s consent under the Fourth Amendment is that of ‘objective’
reasonableness—what would the typical reasonable person have understood by the
exchange between the officer and the suspect?” Jimeno, 500 U.S. at 251 (citations
omitted). Importantly, when a defendant challenges the scope of consent, the State
bears the burden of establishing by clear and convincing evidence that the
warrantless search was reasonable and in compliance with the Fourth Amendment.
Matejka, 241 Wis. 2d 52, ¶17.

¶20 When reviewing a suppression motion, we apply a two-step standard
of review. State v. Lonkoski, 2013 WI 30, ¶21, 346 Wis. 2d 523, 828 N.W.2d 552.
We will uphold a circuit court’s factual findings unless they are clearly erroneous.

7
The parties do not present any issue related to Jereczek’s authority to consent to a search
of his son’s user account on the computer.

8
No. 2019AP826-CR

Id. We review de novo the application of those facts to the relevant constitutional
principles. Id.

¶21 We conclude Behling plainly violated the scope of Jereczek’s consent,
which gave police authority to search only his son’s user account. Despite this clear
limitation, Behling began his search of the computer in the recycle bin, a location
where he knew he was likely to find—and did find—not just files deleted from the
son’s user account, but the deleted files of the computer’s other users as well.
Indeed, further investigative efforts were necessary to determine precisely from
which account each item of child pornography in the recycle bin had come. A search
of the shared recycle bin container was therefore not a search of “the son’s account,”
and it exceeded the scope of the consent that Jereczek had given law enforcement.

¶22 Our conclusion in this regard gives effect to what a reasonable person
would have understood the consent limitation to mean. See Jimeno, 500 U.S. at
251. Objectively speaking, when a person thinks of a particular user account on a
computer, he or she is not likely thinking about where specific items of data are
stored on the physical hard drive disc. Rather, the commonly understood meaning
of a user account is an interface through which a user can access his or her own files,
folders and personalization options.8 This is the type of information Behling
testified constitutes the user’s “home profile path” on the hard drive—i.e., the user’s
“downloads, … documents, music, pictures, that type of material.” A search of a
user account, therefore, is functionally a limited search of a particular area of a
computer—i.e., everything accessible by that user account. Moreover, even Behling

8
See Gilberto Perera, How to Create a New User Account in Windows 7, LIFEWIRE
(updated Mar. 14, 2021), https://www.lifewire.com/create-user-account-in-windows-7-3506832.

9
No. 2019AP826-CR

did not regard the aggregate recycle bin as part of a user account, as he testified he
did not believe he accessed a user account prior to obtaining a warrant.

¶23 The recycle bin, to be sure, was accessible from the son’s user
account, but only in a limited manner. Behling testified that when a particular user
deletes a file from his or her account, that user would be able to see the deleted file,
but other users logged into different accounts would not.9 On this record, there is
no basis to conclude that Jereczek reasonably believed the consent he provided
would allow law enforcement to access data from other user accounts, whether
located in the recycle bin or elsewhere on the hard drive disk. Moreover, Jereczek
authorized police to search within the recycle bin only to the extent the search was
of data from the son’s user account. Behling’s review of the recycle bin’s aggregate
contents from all users exceeded the explicit limitations Jereczek placed on the
search.

¶24 The State’s argument is, essentially, that the limitation Jereczek
imposed “authorized [Behling] to access data associated with his son’s user profile.”
(Emphasis added.) In the State’s view, this consent meant Behling “could access
and search any area of Jereczek’s hard drive where his son’s user profile data could
be found, including shared common areas of the computer.” (Emphasis added.) As
we have explained, interpreting the scope of consent in this fashion relies on an
overly technical understanding of how data is stored on a hard drive disk and how
that data is accessed by law enforcement’s forensic software. It is not what a typical
reasonable person would have understood, nor is it necessarily consistent with the

9
Notably, Behling did not attempt to access the son’s user account by more traditional
means (e.g., by logging into the Windows user interface with the son’s account credentials). Doing
so would have, according to Behling’s testimony, allowed him to view the files the son had placed
in the recycle bin without exposing other users’ data to Behling’s review.

10
No. 2019AP826-CR

specific limitation Jereczek imposed. The State’s assertion that it is entitled to
search anywhere that the son’s user data could be stored is therefore not objectively
reasonable.

¶25 Nonetheless, in terms of authority, the State relies on case law that
concerns container searches in vehicles and the plain view doctrine. “The scope of
a search is generally defined by its expressed object.” Jimeno, 500 U.S. at 251. For
example, when an officer asks for permission to search a vehicle for narcotics, it is
implied that the officer is requesting permission to access any containers within the
vehicle where narcotics might be stored. See id. From this principle, the State
reasons that Jereczek was surely authorizing a search “in any areas where that data
[i.e., any child pornography his son possessed] might be found.” Moreover, the
State contends that because Behling was authorized to search the recycle bin
container, any child pornography—from any user—he discovered during that search
was considered an item in plain view under State v. Schroeder, 2000 WI App 128,
¶¶12-16, 237 Wis. 2d 575, 613 N.W.2d 911.

¶26 As alluded to above, the State’s argument proceeds from a faulty
premise divorced from the context of electronic devices. By stipulation, the consent
Jereczek provided was limited to his son’s user account—not to, in the State’s
formulation, any “data associated with his son’s user profile.” We perceive the latter
scope of consent to be much broader, and law enforcement certainly could have
sought that degree of authorization. Having failed to do so, though, police were not
entitled to search other areas of the hard drive merely because it was convenient for
them to do so, or because they believed evidence they desired might be located

11
No. 2019AP826-CR

there.10 Furthermore, police never attempted to clarify the scope of Jereczek’s
consent with him, which is problematic in this context given that the State carried
the burden of establishing by clear and convincing evidence that the warrantless
search was reasonable and in compliance with the Fourth Amendment. See
Matejka, 241 Wis. 2d 52, ¶17.

¶27 The State’s arguments appear to be animated, to some extent, by the
technical difficulties associated with adhering to the scope of consent Jereczek
provided, given the limitations of law enforcement’s forensic software. The State
emphasizes that Behling could not search the recycle bin for data tied to the son’s
user profile without previewing all of the files from all users in that container. The
State argues that forgoing a search of the recycle bin based on this technical
limitation would have rendered the law enforcement search incomplete.

¶28 Once again, the State misapprehends the scope of consent. Nothing
in the consent Jereczek supplied suggested that law enforcement had authority to
search anywhere on the hard drive based on whether they regarded their search as
“complete”—i.e., until they had satisfied themselves that they had reviewed every
piece of data connected to the son’s account. As in Jimeno, the terms of the search’s
authorization in this case were simple—police could search the son’s user account,

10
Jereczek and the State argue about whether some of the circuit court’s findings of fact
are consistent with Behling’s testimony. We do not regard any of the court’s factual findings as
clearly erroneous, as the court essentially accepted Behling’s testimony about how he performed
the search and why he began in the computer’s recycle bin. Behling’s testimony was undisputed,
and we perceive the court to have accepted his testimony as credible. As we explain, however, the
court’s observations about how complete the search would have been without an examination of
the recycle bin, whether Behling would have eventually examined the recycle bin’s contents, and
whether law enforcement acted in good faith are largely immaterial to the issues on appeal, which
concern only the scope of the consent to search and whether the State met its burden of showing
that law enforcement adhered to those restrictions.

12
No. 2019AP826-CR

but no more. See Jimeno, 500 U.S. at 251. Unlike Jimeno, the terms of the
authorization here were insufficient to get police everywhere they wanted to go.11

¶29 Nor do technical difficulties in adhering to the scope of consent justify
a broader search. Behling was aware it would be difficult, although not impossible,
to tailor his search to the contents of only one user profile. Indeed, he testified he
would usually seek a warrant initially for single-user searches of computers with
multiple user accounts. But Behling did not inform the referring detective that he
thought it was necessary to view data from other accounts during his review, nor
did he seek to clarify the scope of consent with Jereczek himself. Law enforcement
cannot rely on technical limitations of their forensic software to expand the scope
of consent beyond those areas that are reasonably implied by the terms of the
consent.

¶30 Because the search of the recycle bin container on the shared
computer’s hard drive was unlawful, the circuit court should have granted
Jereczek’s suppression motion and excluded the initial item of child pornography
associated with Jereczek’s account and all derivative evidence. The State,
11
The parties offer various attempts at analogies to other cases and contexts regarding
consent to search or limited-scope warrant-based searches of physical locations in support of their
respective arguments regarding Behling’s search of the computer hard drive. While we have
divined some of our own such analogies, and while we tend to agree more with those advanced by
Jereczek, we believe it is more productive to provide the analysis as we have written, without resort
to analogies from other cases about searches of physical premises.

We do note, however, that none of the cases to which the State cites regarding searches of
computer data involved the type of limited consent at issue here. Instead, they involved consent to
generally search an entire computer for particular types of information. See, e.g., State v.
Schroeder, 2000 WI App 128, ¶¶12-16, 237 Wis. 2d 575, 613 N.W.2d 911 (applying the plain view
doctrine and concluding that police did not violate the Fourth Amendment when they found child
pornography on a computer while lawfully searching it, pursuant to a search warrant, for evidence
of online harassment).

13
No. 2019AP826-CR

alternatively, suggests that it could “possibly demonstrate inevitable discovery” of
some or all of the relevant items of evidence. It requests that we remand for further
factual finding on whether the inevitable discovery exception to the exclusionary
rule applies.

¶31 We are disinclined to remand with specific directions that the circuit
court hold an evidentiary hearing on the inevitable discovery issue. The State does
not appear to have argued inevitable discovery as a basis for admitting the evidence
at any point before the court. Rather, that doctrine appears to have been applied on
the court’s own initiative.12 We remand generally with directions that the circuit
court grant Jereczek’s suppression motion. On remand, the court may also conduct
further proceedings consistent with this opinion. If the State wishes to file a motion
seeking to admit some or all of the evidence at issue based on the notion that it
would have been inevitably discovered by lawful means, it may do so on remand.

By the Court.—Judgment reversed and cause remanded with
directions.

12
As the State notes, the inevitable discovery doctrine presumes that the evidence is
tainted by an illegal act. See State v. Jackson, 2016 WI 56, ¶¶47-48, 369 Wis. 2d 673, 882 N.W.2d
422. The State’s primary argument below appears to have been that the search here was consistent
with the scope of consent Jereczek provided, and that there was no way for law enforcement to
effectuate the search without examining the recycle bin container on the hard drive.

14