Indiscriminate collection versus targeted capture: why the way data is collected is part of the evidence

What the court decided in the Flock ruling, United States v. Kyle

In United States v. Kyle (Case No. 26-CR-00189-SEH), decided on October 1, 2026, U.S. District Judge Sara E. Hill of the Northern District of Oklahoma found that a deputy’s query of the Flock automated license plate reader (ALPR) network, run only because a car had California plates, was a search done without a warrant and not supported by probable cause. The court granted the motion to suppress on two independent grounds: the traffic stop had been extended without reasonable suspicion, and the ALPR search was warrantless. The ruling turns on method, and method is what TrueScreen documents: each acquisition comes with a report of its fingerprints and certified time, so the scope of what was collected can be shown item by item.

Kyle is a single district court ruling with two grounds for suppression: its legal reach is narrow, while its reasoning about indiscriminate collection is useful for digital evidence collection well beyond policing.

A Tulsa County deputy queried Flock because the car had out-of-state plates and for no other reason. He had access to at least 30 days of data and got back more than 50 sightings of the vehicle across several states. In the opinion and order, Judge Hill wrote:

“This is a type of indiscriminate mass surveillance. It is not targeted on a single individual, as in Carpenter. It is a tool that collects information about all vehicles that pass by any network-connected camera at all times, and it serves up the information to law enforcement on demand.” (slip op. at 34)

A page later she adds that “it becomes constitutionally problematic when law enforcement can indiscriminately and passively catalog your whereabouts over an extended period of time and then use that information for any purpose whenever convenient.” The remedy: “all evidence obtained after [the deputy] initiated the ALPR search must be suppressed as fruit of the poisonous tree.” (slip op. at 38) The suppression rests on two independent grounds, so reading Kyle as a case decided on the Flock search alone gets it wrong.

The backdrop is Carpenter v. United States, 585 U.S. 296 (2018), decided on June 22, 2018, which held that acquiring historical cell-site location records is a Fourth Amendment search and that “the Government must generally obtain a warrant supported by probable cause before acquiring such records.” Judge Hill’s own opinion notes that neither the Tenth Circuit nor the Supreme Court has decided whether ALPR use is a search, and that nearly every court so far has concluded it is not.

So are Flock cameras unconstitutional? One federal judge found that one warrantless Flock search violated the Fourth Amendment, in a ruling that is not binding precedent and can be appealed. Any Flock camera lawsuit or warrantless search challenge elsewhere will be argued on its own facts, even if TechCrunch and 404 Media both put the judge’s phrase in their headlines.

Why the collection method is part of digital evidence collection

Digital evidence collection is the process of identifying, collecting, acquiring and preserving digital data so that it can be relied on as evidence, with a record of how each step was done. ISO/IEC 27037:2012 provides international guidelines for these four phases. TrueScreen follows ISO/IEC 27037 and documents each acquisition in a report that a third party can check independently.

Digital evidence loses weight when nobody can explain how and why it was collected.

The ISO/IEC 27037 guidelines split digital evidence collection into identification (finding where relevant data lives), collection (taking custody of devices or sources), acquisition (making a copy) and preservation (keeping it unchanged). The guidelines are built around evidence that is relevant, reliable and sufficient for the question, and they offer guidance on the process, not a rule of admissibility. An unbroken chain of custody runs through every phase: who handled the data, when and with which tool.

A method you can’t explain weakens evidence even when the data is accurate. The other side doesn’t have to prove a file false. It is enough to show that nobody can say why it was collected, what else came with it, or whether the copy matches the source.

Volume has a cost too. In its 2012 study “Where the Money Goes”, the RAND Institute for Civil Justice looked at 57 large eDiscovery productions at Fortune 200 companies and found that document review accounted for about 73% of production costs. Every item you collect is one someone has to review, justify and, if challenged, defend.

Indiscriminate collection versus targeted capture

Unlike indiscriminate collection, which records everything a source produces and sorts it out later, targeted capture records only what the operator selects for a stated reason, one item at a time. The two differ in scope, volume, review effort, exposure of third-party data and how easily the file can be explained. Targeted capture is the side TrueScreen stands on: the operator chooses each item, and every captured page gets its own fingerprint.

Targeted capture produces a smaller file in which every item has a reason you can state.

Targeted data collection has its own weak spot: the other side may argue you left out context that changes the meaning of what you kept. Collecting everything doesn’t fix that. Recording why you chose each item does, along with capturing what surrounds it, such as the seller page next to the listing or the thread around a reply. A broad scope is sometimes right, for example when a whole mailbox must be preserved for expected litigation, but whoever sets the scope of a digital evidence collection should check with counsel what the applicable privacy and employment rules allow, and still answer the questions in the table.

Where the same question returns: internal investigations, brand protection and journalism

The Fourth Amendment binds the government, not companies, so United States v. Kyle does not apply to an employer, a brand owner or a newsroom. The question of method still returns whenever a private collection has to be explained to a court, a regulator or the public. When that moment comes, TrueScreen lets the team answer item by item: each certified post, page or video carries the record of how and when it was acquired.

The comparison is about method, not law: private digital evidence collection faces the same demand to show why each item is in the file.

What follows is an analogy of method, not a legal extension of the Fourth Amendment. Nothing in Kyle governs what private parties may collect. What carries over is the distinction the judge drew between a search aimed at one person and a tool that records everyone who passes by.

In internal investigations, the temptation is to export an employee’s entire social media profile. A targeted approach acquires only the posts relevant to the allegation, plus the few around them that give context, with a note on why each was taken. Its scope matches the complaint, with far less data about colleagues and family. Targeted capture is a way of documenting content you are already entitled to collect, such as publicly available posts; it does not make an unauthorized collection lawful.

A brand protection team that finds a counterfeit seller can certify the infringing listings and the seller page, each in its own acquisition with its own certified time, instead of collecting a whole marketplace. Each listing becomes an exhibit with its own date and reason, and if the seller later edits or removes it, the certification still shows what was captured at that time. Our guide to brand protection evidence covers this use in more depth.

Journalists face the same choice when they document a post before it is deleted. Capturing what supports the story, not everyone in the conversation, can help limit the exposure of sources and bystanders.

What targeted capture means in a forensic acquisition

TrueScreen certifies what a person chooses to acquire, not everything a system happens to record. In the Forensic Browser‘s Targeted acquisition mode, available on TrueScreen Standard, the operator browses and picks, one by one, the pages, files and videos to certify.

In a forensic acquisition, targeted capture means only the selected items are acquired and fingerprinted, with a report a third party can check independently.

For every page captured in Targeted acquisition, you get the original PNG image with its own fingerprint, the page source both as rendered and as delivered by the server, a web archive, and a manifest with SHA-256 and SHA-512 fingerprints. TrueScreen also acquires photos, videos, audio and the screen of the device through the TrueScreen App, included in the Standard, Business and Enterprise plans. A chat on a phone is certified with a screen recording in the app while the person scrolls through the conversation.

Each certification comes with a report listing cryptographic fingerprints, the certified time, the location where relevant and the remaining metadata, and a third party can read and check it independently. The certification closes with a qualified electronic seal and a qualified timestamp, after an acquisition made in a controlled environment, following ISO/IEC 27037, with an unbroken chain of custody.

The limits matter just as much. TrueScreen guarantees the how, not the what: a certification does not attest that content is true, complete or representative, and it does not guarantee the outcome of any proceeding. TrueScreen is not a monitoring tool either. It certifies specific content chosen by the person who certifies it, and deciding what to capture, and why, remains your team’s decision.

Picture a compliance investigator handling a complaint about a public post: she opens the profile in the Forensic Browser, certifies the posts named in the complaint and the account header, notes why each matters and closes the session.

How to plan a targeted acquisition

Targeted digital evidence collection is planned from the allegation outward, and each step leaves a record you can show later.

1. 1

   Set the scope from the allegation

   Before any digital evidence collection starts, write the claim in a sentence or two, then list what would prove or disprove it: which posts, listings, messages and dates. Anything outside that list needs its own reason. Collect no more than the allegation requires, and keep unrelated people’s data out of the file.

2. 2

   Choose the sources and the tool

   Identify where each item lives, whether a website, a marketplace, a social profile or a phone, and pick an acquisition method that fits: a forensic browser for web pages, a mobile acquisition for photos, video, audio or a phone screen.

3. 3

   Capture item by item

   When collecting digital evidence, acquire each page, file or video as a separate capture. If a listing changes next week, capture it again: two dated certifications show the change more clearly than one large archive.

4. 4

   Record the context and the reason for each capture

   Note why each item was taken, which part of the allegation it relates to and what context you captured with it. That note answers the first question an opposing expert is likely to ask.

5. 5

   Preserve the report and the chain of custody

   For evidence preservation, store each report with its original files, unchanged, and log who accessed them. Since a third party can verify the report independently, share the report itself with counsel, not screenshots of it.

Conclusion