United States v. Ixcolgonzalez: "See Attachment A," a Commander's Signature, and the Distance Between Richards and Riccardi

CAAF hands the Government a clean win in United States v. Ixcolgonzalez, No. 25-0243/MC (C.A.A.F. Aug. 24, 2026), an interlocutory appeal under UCMJ art. 62, 10 U.S.C. § 862, that reached the court on four certified issues. Judge Johnson writes for a unanimous court. CAAF that sets aside NMCCA's decision.

Two holdings do the work. First, a command authorization for search and seizure (CASS) that confines the search to a named Marine's digital devices, on his person or in his barracks room, for evidence of CSAM under Article 134 is sufficiently particular under the Fourth Amendment. Slip op. at 11, 13. Second, even if it were not, the CASS incorporated the eleven-page affidavit that accompanied it, and the affidavit supplied whatever particularity the CASS lacked. Slip op. at 13-15. Having answered the first and third certified issues that way, CAAF left the second (good faith) and fourth (deterrence) issues on the shelf. Slip op. at 3. Those two issues, along with a footnote about sixty-three Telegram messages, are why suppression litigation in this case may not be over.

The paperwork

The investigation began as usual. In January 2022, Snap, Inc. sent a cyber tip to the National Center for Missing and Exploited Children about a user who had uploaded suspected CSAM. The tip was forwarded to the North Carolina State Bureau of Investigation, then to the Naval Criminal Investigative Service (NCIS). A warrant returned four videos from Snap. Slip op. at 3. An NCIS special agent then sought the accused's commanding officer's approval for a CASS covering the barracks room and the accused's digital devices.

The request form contained the line that gives this case its texture. When the form asked for the facts establishing grounds to search, the agent wrote: "See Attachment A." Slip op. at 4. Attachment A ran eleven pages. It set out the cyber tip and the Snap warrant, explained why the agent expected to find CSAM on the accused's mobile devices, and listed six categories of items sought: any and all digital storage devices in the room and on the accused's person pertaining to the Article 134 offenses; the Snapchat application; a named Gmail address; child pornography images and videos; proof of ownership of the devices; and "[a]ny and all applications in which videos and photographs are stored or records thereof." Slip op. at 4-5.
The CASS itself said less. It recited that an affidavit had been made before the commander; identified the premises as the accused's digital devices and his barracks room; described the property sought as evidence of possession, receipt, viewing, and distribution of child pornography under Article 134; and stated that grounds for the search existed "as stated in the supporting affidavit(s)." Slip op. at 5. The agent briefed the commander orally, handed over both documents, and swore to probable cause. The commander signed the CASS and the first and last pages of the affidavit. Slip op. at 5. The search followed in August 2022. The Department of Defense Cyber Crime Center found 254 videos and 272 images of suspected CSAM on the iPhone, plus sixty-three Telegram messages in which the accused requested, sent, or received such material. Slip op. at 5-6. Snapchat is in the affidavit. Telegram is not. Hold that thought.

What the military judge did with it

The MJ agreed with the Government on the devices. The CASS "marginally satisfies" particularity as to the things to be seized, and it would have been unreasonable to demand more when the Government did not know what devices the accused owned. Slip op. at 11-12. The trouble, in the MJ's view, lay inside the devices. The CASS said nothing about which data, data sets, or applications agents could search, and nothing about whether they were after pictures, videos, communications, or all three. Slip op. at 6-7. Relying on United States v. Riccardi, 405 F.3d 852, 862 (10th Cir. 2005), the MJ held that a digital search authorization must use "as much specificity as the government's knowledge and circumstances allow," and that this one fell "well-short." Slip op. at 7, 12.

The MJ then found what became the Government's best fact on appeal. The affidavit, the MJ found, "unambiguously provided a particularized list" of the places within the devices to be searched and the things to be seized, and the forensic examiner worked from a request nearly identical to it. Slip op. at 7. Having found that, the MJ held the affidavit did not count, because the CASS's reference to it was "boilerplate language" about probable cause that "did nothing to actually incorporate the specificity within the supporting affidavit." Slip op. at 7. The MJ also found, by a preponderance, that the affidavit did not accompany the CASS when it was served on the accused. Slip op. at 7 n.5. NMCCA affirmed on particularity and incorporation, though it rejected any suggestion that service on the accused matters, quoting United States v. Grubbs, 547 U.S. 90, 98-99 (2006), for the point that the Constitution does not require the warrant to be shown to anyone during the search. Slip op. at 8 n.5.

Particularity: Richards governs, and Riccardi does not add to it

CAAF reviewed for abuse of discretion, with overbreadth reviewed de novo, and, as it customarily does on interlocutory review, pierced NMCCA’s decision. Slip op. at 9-10. The anchor is United States v. Richards, 76 M.J. 365 (C.A.A.F. 2017). There, an AFOSI authorization reached "all electronic media" without a date range, even though agents knew the relevant communications fell within a seventeen-month window. CAAF held that a temporal limit is "one possible method" of tailoring but "by no means a requirement," because the authorization did not give "carte blanche to search in areas clearly outside the scope of the crime being investigated." Slip op. at 12-13 (quoting Richards, 76 M.J. at 370). The same logic disposes of this case. The CASS confined agents to the accused's devices, on his person or in his room, for evidence of identified child pornography offenses. That is not Groh v. Ramirez, 540 U.S. 551, 558 (2004), where the warrant described the items to be seized "at all." Slip op. at 13.

CAAF then said something about the MJ's method that trial judges will want to note. Reliance on Riccardi to require as much specificity as the Government could have provided is "inconsistent with this Court's precedent," and although the MJ said he did not "discount" Richards, his reliance on Riccardi "suggests otherwise." Slip op. at 12-13. A ruling built on that view of the law is an abuse of discretion. Slip op. at 13.

The defense side deserves a fair hearing here, because the MJ did not invent his standard. Richards itself quoted Riccardi for the rule that computer warrants "must affirmatively limit the search to evidence of specific federal crimes or specific types of material," and Richards also adopted the Sixth Circuit's line that "[t]he proper metric of sufficient specificity is whether it was reasonable to provide a more specific description of the items at that juncture of the investigation." Richards, 76 M.J. at 369-70 (quoting United States v. Richards, 659 F.3d 527, 541 (6th Cir. 2011)). The MJ took that metric at face value, asked whether NCIS could reasonably have said more about what it wanted inside the phone, and answered yes, since the agent's own affidavit said more. What Ixcolgonzalez tells us is that the "proper metric" sentence is not the test. The operative question is the carte blanche one: does the authorization confine agents to evidence of identified offenses? If it does, it survives even when a sharper version sat on the agent's desk. Defense counsel who have been citing Richards for the "reasonable to be more specific" line should expect the Government to answer with pages 12 and 13 of this opinion.

The Government's better argument, which the opinion carries forward from Richards, is that digital evidence hides. File names lie, dates lie, and an examiner may have to open a great many files to find the ones that matter. Richards, 76 M.J. at 370. (Or they might be smart enough to put all the CSAM in the Windows Thumbnail folder that is hidden from a user.) A rule that requires the CASS to name the applications and file types in advance lets the target pick the hiding place. On that view, the fight over what an examiner may open belongs at the execution stage, where scope and plain view are litigated on an actual record, and not on the face of the authorization. That is a coherent position, and it is now the law of the military courts on facial challenges.

Incorporation: "See Attachment A" is enough

The alternative holding matters more for drafting. Groh says the Fourth Amendment requires particularity "in the warrant, not in the supporting documents," but Groh also acknowledged that most circuits will read the two together "if the warrant uses appropriate words of incorporation, and if the supporting document accompanies the warrant." 540 U.S. at 557-58. CAAF picked Baranski v. Fifteen Unknown Agents, 452 F.3d 433 (6th Cir. 2006), as its model. In Baranski, the warrant said "See Attached Affidavit," the magistrate signed both documents, and the affidavit described the guns to be seized; the Sixth Circuit held that was incorporation and that the warrant described the items when the magistrate issued it. Slip op. at 14 (citing Baranski, 452 F.3d at 436, 439-40).

The parallel here was close. The CASS referred to the affidavit twice, the affidavit announced that it was made "in support of a request for a Command Authorization for Search and Seizure," the agent briefed the commander and handed over both documents, and the commander signed both. Slip op. at 14-15. The accused argued that the CASS mentioned the affidavit only in the probable cause sentence and not in the "places to be searched" block where particularity lives. CAAF was not persuaded: the reference was not limited by its terms, so it incorporated the entire affidavit, and a second reference in another block was unnecessary. Slip op. at 15 n.7. Then CAAF took the MJ's own finding that the affidavit "unambiguously" particularized the places and things within the devices and used it to finish the job. Slip op. at 15.

Two observations from the other side of the aisle. First, Groh's formula has two prongs, words of incorporation and accompaniment, and CAAF decided only the first. The MJ found the affidavit was not with the CASS when the search was served; NMCCA said that does not matter under Grubbs; and the accused did not challenge that ruling at CAAF, so CAAF declined to reach it. Slip op. at 8 n.5. Some federal courts read "accompanies" to require that the affidavit be physically present at the search, not just at issuance. United States v. McGrew, 122 F.3d 847, 849-50 (9th Cir. 1997); United States v. SDI Future Health, Inc., 568 F.3d 684, 699 (9th Cir. 2009). Whether military law follows that reading remains open, and the next accused should preserve it. Second, footnote 2 reminds readers that a commander stands in for a magistrate. Slip op. at 3 n.2 (citing Rule 315(d)(1), Military Rules of Evidence (Mil. R. Evid.), Manual for Courts-Martial, United States (2019 ed.)). After Ixcolgonzalez, the agent's own description of what the agent wants becomes the constitutional boundary of the search, on the strength of a cross-reference and a signature on the first and last pages of an eleven-page attachment. The Government will fairly answer that this is how every federal warrant works: agents draft, magistrates sign. The defense will fairly answer that the CASS form gave the commander a place to describe the property sought and the commander used it to describe an offense.

What is left when the case goes back

The interesting part of the opinion is what CAAF declined to decide. Footnote 6 preserves the MJ's observation that, even with the affidavit incorporated, the forensic examiner "may have exceeded the scope" of the authorization by seizing Telegram messages, where the affidavit named Snapchat and photos and videos. Slip op. at 8 n.6. The MJ could not resolve that because the examiner did not testify, so the MJ could not assess the search sequence or whether the messages came into plain view. CAAF construed the MJ's comments as something short of conclusions of law and expressed no opinion on the question. Slip op. at 8-9 n.6.

This does not seem to be small leftover. The charge sheet carries one possession specification, seven distribution specifications, one receipt specification, and a solicitation specification under UCMJ art. 82, 10 U.S.C. § 882. Slip op. at 6. The images and videos support possession. The distribution, receipt, and solicitation counts look like they ride on the sixty-three Telegram messages. So the scope motion on remand is aimed at most of the case.

Both sides have material. The affidavit's sixth category asked for "[a]ny and all applications in which videos and photographs are stored," and CAAF's own footnote 4 quotes the DC3 report describing Telegram as an application that saves exchanged pictures and videos to the user's cloud account. Slip op. at 6 n.4. The Government will say Telegram is exactly what category six describes. The defense will say the agent knew how to name a messaging application, named Snapchat, and did not name Telegram; that category six reads as a gallery-and-storage clause, not a communications clause; and that a communications seizure needs its own authorization. Plain view is the Government's fallback, and it requires the examiner on the stand. Who must put the examiner there is worth a paragraph in the motion: once the defense moves to suppress, Mil. R. Evid. 311(d)(5)(A) puts the burden on the prosecution to show by a preponderance that the evidence was not obtained by an unlawful search. [Lexis check the subparagraph and the 2019 versus 2024 edition.] The examiner's absence hurt the defense at the first hearing because the MJ could not find a scope violation on the record before him. On the second try, the absence may cut the other way.

If the MJ finds a scope violation, the two certified issues CAAF did not reach come back to life at the trial level: whether the exclusionary rule's deterrent value outweighs its costs under Mil. R. Evid. 311(a)(3), and whether good faith applies under Mil. R. Evid. 311(c)(3). Those questions look different when the claimed error belongs to an examiner exceeding a valid authorization rather than a commander signing a deficient one.

One last note on the calendar. The cyber tip arrived in January 2022. The search followed in August 2022. NMCCA ruled in April 2025. CAAF ruled in August 2026, and the case now returns to the Judge Advocate General of the Navy for further proceedings. Slip op. at 16. Four and a half years after the tip, no one has been tried, and the next stop is likely another suppression hearing. Presumably Appellant has been on active receiving pay during this time? If trial proceeds, does he get his original defense counsel back? See, e.g., United States v. Hutchins, 69 M.J. 282 (C.A.A.F. 2010); United States v. Hohman, 70 M.J. 98 (C.A.A.F. 2011).