State of Montana v. Yanbin Bao

Missoula, Montana criminal defense lawyer represented the Defendant charged with sex trafficking.

The State charged Yanbin Bao (Bao), a foreign national and resident of South Carolina, with seven counts of felony sex trafficking under § 45-5-702(1), MCA, and one count of felony labor trafficking under § 45-5-703(1), MCA. Bao allegedly ran a prostitution operation out of a Missoula, Montana, massage parlor called Soul Massage with her husband, Richard Bushey (Bushey). Bao and Bushey purportedly employed at least three women as prostitutes at Soul Massage, including Jane Doe (JD).



JD entered the United States in March 2023 and answered an internet advertisement for dog-friendly housing for "only $20 a day." JD met Bao through the advertisement and she subsequently moved to Missoula on April 26, 2023. The advertised housing was Soul Massage, where JD claims Bao held her in captivity and forced her to engage in sexual acts with customers under the threat of violence.



On May 29, 2023, JD called law enforcement from Soul Massage and accused Bao and Bushey of running a prostitution and sex trafficking operation. Deputies arrested Bao and Bushey. Responding officers performed a search incident to arrest and seized their cellphones. From Bao, deputies seized a silver Apple iPhone in a clear case (Phone 1) and a white Apple iPhone in a purple case (Phone 2). From Bushey, deputies seized an Apple iPhone with a black case (Phone 6). Soul Massage was then searched pursuant to a search warrant and Deputies also seized several other electronic devices: an Apple iPad Pro in a grey case (Tablet 1), a red Apple iPhone with a clear case (Phone 3), a blue Motorola phone (Phone 4), and a black Samsung phone (Phone 5).



On June 6, 2023, law enforcement arrested another suspect, Hui Wang (Wang), in connection with the allegedly illegal operations at Soul Massage. Law enforcement found four phones on Wang's person: a black Samsung phone (Phone 7), a Blu V50 cell phone (Phone 8), a Blu Vivo phone (Phone 9), and an Apple iPhone in a "pink/purple case with red staining upon it" (Phone 10). Acting upon a search warrant for Wang's hotel room, law enforcement seized a black Vortex cell phone (Phone 11) and an Apple iPad (Tablet 2).



On July 10, 2023, law enforcement obtained another warrant to search all the devices seized from Bao, Bushey, and Wang. The warrant was presented to Forensic Analyst Melanie Thomas (Thomas) on July 11, 2023. Thomas then began the process of decrypting the seized devices to access and copy the data stored on the devices. On July 12, 2023, Thomas accessed Phone 6 using a provided PIN code and began extracting data. Phone 2 was protected by a PIN code and required Thomas to brute force the phone's encryption with the GrayKey decryption program. On July 13, 2023, Thomas extracted the full filesystem from Phone 4. On July 14, 2023, Thomas extracted the full filesystem from Phone 5. On July 19, 2023, Thomas extracted the full filesystem from Phone 6 and generated a report from the extracted data. On July 20, 2023, Thomas generated her report from the data extracted from Phone 4 and Phone 5, and she began the process of brute forcing the encryption on Tablet 1.



Thomas required more time to bypass the other devices' encryption and security mechanisms. As detailed in the application for the July 10, 2023, warrant, the GrayKey software brute forces an electronic device's encryption to allow "a valid law enforcement agency located in a supported country" to access stored data in a potentially time intensive process. To brute force and decrypt an Android device, a forensic analyst must physically manipulate the screen, power, and buttons on the device to place the device into download mode. Once placed into download mode, GrayKey can recover and download a file if the device is compatible and supported by the GrayKey software. Phone 4, Phone 5, Phone 7, Phone 8, and Phone 11 are Android devices.



When decrypting an Apple device, the duration of the GrayKey process depends on when the phone was powered off or previously unlocked by the user. An "After First Unlock" (AFU) process allows GrayKey to make 300,000 attempts at decrypting a phone every ten minutes-a "fast brute force"-because the device had been unlocked at some point prior to the seizure by law enforcement and remained powered on, rendering 95% of the device's data available instantly. Conversely, a "Before First Unlock" (BFU) process is required when the phone was off when seized or "had a power event after" seizure. When a phone is reset, "most of its data, including contacts, messages, and other personal data" is still encrypted. In a "slow brute force" BFU situation, GrayKey can make one attempt to decrypt the phone every ten minutes. An AFU-or a particularly lucky BFU-might render the device accessible to law enforcement within a day. Or a BFU brute force could require up to 23 years to more than 200 years to decrypt a device depending on the method and sophistication of encryption. Phone 1, Phone 2, Phone 3, Phone 6, Phone 10, Tablet 1, and Tablet 2 are Apple devices, and each presents a unique puzzle of decryption.



* * *



CRIMINAL PROCEDURE. SEARCH WARRANT EXECUTION TIME LIMITS. The court addressed whether the statutory ten-day time limit for serving a search warrant under § 46-5-225, MCA, requires the completion of a forensic analysis of electronic devices within that period.



CRIMINAL PROCEDURE. SEARCH AND SEIZURE. The judgment considered whether the process of decrypting and extracting data from electronic devices already lawfully seized violates the statutory time limit for executing a search warrant.



CRIMINAL PROCEDURE. STATUTORY INTERPRETATION. The decision involved interpreting the statutory language of § 46-5-225, MCA, in terms of what constitutes the "service" of a warrant and whether the execution time frame includes forensic analysis.



Key Phrases Felony sex trafficking. Electronic devices suppression. Search warrant execution. District Court order. Ten-day time limit.

¶10 On December 1, 2023, the brute force had revealed the PIN protecting Phone 2, allowing Thomas to begin extracting data from the device on December 5, 2024. Thomas encountered obstacles processing this data when the software failed to translate the contained data from Mandarin to English, but she was able to troubleshoot the issue with the extraction software company customer service. She eventually completed the translations and generated a report from the data extracted from Phone 2 on December 28, 2023. On January 4, 2024, Thomas began extracting data from Phone 1. Thomas's report indicates that the data "obtained from the extraction was significantly large," delaying the generation of a report from that data until the next day. On January 5, 2024, she extracted and compiled all the data from Phone 3. The record is unclear as to when, if at all, Thomas was able to access data contained on Tablet 1.



¶11 On January 22, 2024, Bao moved to suppress the data obtained from the electronic devices on several grounds. Relevant here, Bao argued the warrant was void when the full forensic analysis of the seized devices was not complete within ten days following issuance of the warrant. The District Court granted Bao's motion in part, ordering the suppression of evidence obtained from Phone 1, Phone 2, Phone 3, and Tablet 1 because the forensic analysis took longer than ten days in violation of the time limit for serving a warrant imposed by § 46-5-225, MCA. The District Court "interpret[ed] [§ 46-5-225, MCA] to mean that law enforcement had ten days from July 10, 2023, to execute the search" and complete its analysis of the seized electronic devices detailed by the warrant. The State now appeals from the order granting Bao's motion to suppress.

Reversed and remanded.