JACQUELINE SCOTT CORLEY, Magistrate Judge.
On April 26, 2017, this Court authorized a search warrant of a residence believed to be inhabited by Real Party in Interest Ryan Michael Spencer. (Dkt. No. 1.) The warrant authorized the FBI to search the premises and any computers, storage media, routers, modems, and network equipment contained therein, as well as Mr. Spencer himself, for evidence of child pornography. (Dkt. No. 1 at 29-33.
Having considered the parties' briefs and the relevant legal authority, and having had the benefit of oral argument on March 1, 2018, the Court GRANTS the application and orders Mr. Spencer to assist in the execution of the search warrant. In doing so, the Court finds that the testimonial value of decryption as to each at-issue device is a "foregone conclusion" such that Mr. Spencer's Fifth Amendment privilege against self-incrimination is not reached.
In April 2017, this Court issued a warrant authorizing the search of Bryan Petersen's residence in Tiburon, California upon a finding of probable cause that he possessed child pornography. The FBI executed that warrant on April 26, 2017. (Dkt. No. 12 at 24, ¶ 3.) In an interview, Petersen admitted to possessing and producing child pornography, and to exchanging child pornography with individuals on the internet. (Id. at ¶¶ 3-6.) He identified Spencer as one such individual. (Id. at ¶ 3.) Petersen claimed Spencer had surreptitiously photographed naked children in the course of employment as a babysitter. (Id. at ¶ 4.) He further admitted to ordering an external hard drive on Amazon.com for delivery to Spencer, who upon receipt filled the drive with "between 10,000 and 100,000" photo/video files of child pornography. (Id. at ¶ 3.) Petersen then travelled to Aptos, California to retrieve the drive directly from Spencer. (Id.)
Additionally, Petersen gave the FBI passwords to access his electronic devices.
Later that same day, the Court authorized a warrant to search Spencer's residence in Aptos, California. The FBI executed it, with Spencer present, on the morning of April 27, 2017. (Dkt. No. 12 at 25, ¶ 9.) The FBI seized twelve devices in total. (Dkt. No. 10 at ¶ 2.) Among those devices so seized, three are at-issue in this Order. (Dkt. No. 4 at 6-7.)
The iPhone was in Spencer's hand when the FBI entered his home to execute the search warrant. (Id. at 26, ¶ 9.) He admitted ownership and has since produced the password to bypass the iPhone's lock screen. (Id.) Reviewing the iPhone, the FBI found Kik messages containing the same child pornography discovered on Petersen's phone. (Id. at 19, ¶ 9.) The iPhone also contains a "Spy Camera" application, allowing the user to take surreptitious photographs. (Id. at 28, ¶ 21.) Further, the FBI discovered a password-protected application entitled "Secret Folder & Video Vault Pro" ("Secret Folder"). (Id. at 19, ¶¶ 10-11.) This application requires 20MB to install but currently occupies 20G of phone memory. (Id.) The FBI has linked several files to the application, including "info.e2uapp.photosafe." (Id.)
This laptop was seized from Spencer's desk and he admitted ownership. (Dkt. No. 12 at 26, ¶ 9.) As with the iPhone, he produced the password to bypass the laptop's lock screen. (Id.) However, part of the laptop remains locked under VeraCrypt-brand encryption. (Id. at 18-19, ¶ 7.) The government has determined that VeraCrypt does not incorporate a developer backdoor. (Id. at 20, ¶ 13.) VeraCrypt's public posture is that it "will never implement [a developer backdoor] even if asked to do so by a government agency."
At oral argument on March 1, 2018, the government disclosed that, as with the iPhone, it has found child pornography on the unencrypted portion of the Alienware laptop.
This external hard drive was also seized from Spencer's desk. (Id. at 26, ¶ 9.) The FBI has tried and failed to bypass the VeraCrypt software installed on the drive. (Id. at 16-17, ¶ 6.) Forensic examination revealed that the drive contains over 900GB of data. (Id.)
In May 2017, Petersen and Spencer were charged under 18 U.S.C. § 2252(a)(2) with conspiracy to distribute and receive child pornography, distribution of child pornography, receipt of child pornography, and possession of child pornography in violation of 18 U.S.C. §§ 2252(a)(4)(B).
Petersen attests that he met Spencer online in 2011, and that around two years later they began exchanging child pornography, mainly through Kik and Gmail. (Dkt. No. 5 at ¶¶ 1-3.) Eventually, they began taking naked photos of children with whom they worked as babysitters. (Id.) Moreover, Spencer confided to Petersen that he had molested children under his care, including one victim who was routinely under the influence of autism medication and unable to wake when touched. (Id. at ¶ 6.) Spencer sent photos depicting these attacks as they unfolded. (Id. at ¶ 7.) He also recommended to Petersen an aftermarket iPhone camera application allowing the user to photograph subjects surreptitiously. (Id. at ¶ 5.)
In particular, Spencer described to Petersen his practice concerning the production, storage, and encryption of child pornography. (Id.) First, Spencer "[stood] with the phone close to his body such that no one could see the screen" and then used the iPhone's volume buttons to take a photo. (Id. at ¶ 4.) His surreptitious-use application rendered the screen black and ameliorated the risk of discovery as Spencer took pictures of naked children. (Id. at ¶ 5.) Second, Spencer saved the photos in a password-protected iPhone application. (Id. at ¶ 8.) Third, Spencer transferred the child pornography from the password-protected iPhone application to an encrypted external hard drive. (Id.) In addition, Spencer described the use of an "encrypted partition" on his laptop used to store child pornography, mentioning an occasion when he brought this laptop to school and nearly "projected child pornography in a classroom." (Id. at ¶ 9.)
In January 2016, Spencer told Petersen he planned to buy a new external hard drive with enough space to contain his "very large" collection of child pornography. (Id. at ¶ 10.) Spencer further intimated that his collection was stored on "numerous devices . . . including an encrypted part of his laptop, at least one external hard drive, and his phone." (Id.)
In February 2016, Spencer offered to fill an external hard drive with child pornography and to encrypt that drive for Petersen's use, with the condition that Petersen provide the drive. (Id. at ¶ 11.) In the following month, Spencer obtained for himself a new external hard drive where he began to store child pornography. (Id. at ¶ 12.) He also renewed his prior offer to fill an encrypted external hard drive with child pornography for Petersen. (Id.)
Shortly thereafter, Petersen told Spencer that he was shipping him a "Transcend Military Drop Tested 1 TB external hard drive" directly from Amazon.com. (Id. at ¶ 13.) Spencer replied that he owned "exactly the same make and model of external hard drive, which was the hard drive to which he was transferring his collection of child pornography." (Id.)
Petersen then travelled to Aptos in late 2016 to retrieve the drive from Spencer. (Id. at ¶ 14.) Spencer then gave Petersen the Transcend external drive containing child pornography, demonstrating that it was encrypted with VeraCrypt and providing the password. (Id.) Spencer next demonstrated how to access encrypted child pornography using the password he had selected for Petersen, which incorporated the name of a child whom Petersen babysat. (Id.)
During that Aptos meeting, Petersen saw Spencer connect his iPhone to a "black laptop" and remark that he was transferring "files" from his iPhone. (Id. at ¶ 15.) While Petersen watched, Spencer plugged his Transcend external drive into the laptop, inputting from memory his VeraCrypt password in order to access child pornography. (Id. at ¶ 16.) In so doing, Spencer navigated through the black laptop to his Transcend external hard drive and accessed child pornography. (Id.) Petersen also saw Spencer download child pornography from a website called "Boytraders" onto the Transcend external drive. (Id. at ¶ 17.)
Several days later, Spencer asked Petersen whether he had memorized the VeraCrypt password and Petersen replied that he had. (Id. at ¶ 18.) Spencer noted that his VeraCrypt password was easy to recall because it incorporated "the name of a boy for whom he claimed to have feelings," much like the password he prepared for Petersen. (Id.) Sometime thereafter, Spencer told Petersen the hard drive he had received in Aptos contained "one-quarter to one-third" of his total child pornography collection. (Id. at ¶ 19.)
The FBI used digital tools to recover additional Kik messages dating from January 2016 to November 2016. (Dkt. No. 12 at 26-28.) In these messages, Spencer offers detailed descriptions of his practices regarding child pornography collection and storage.
In January 2016, Spencer mentioned his "300 [gigabyte]" child pornography collection, remarking that he needed a new external hard drive to store it. (Dkt. No. 12 at 26, ¶ 12.) The following month, Spencer sent child pornography to Petersen, characterizing those images as a "fraction" of his total collection. In addition, Spencer said that his child pornography was stored on: "An external drive. Encrypted up the ass. That you can smash with a hammer at a moment's notice." (Id. at ¶ 13.) Spencer noted that he could "very easily" set up an encrypted external drive for Petersen. (Id.) In another message, Spencer opined that in addition to his hard drive, his computer "might be incriminating too." (Id.) He also messaged Petersen that he had recently had sex with a 15-year-old boy and had "so many pics I have to download on my computer lol." (Id. at ¶ 14.)
In March 2016, Spencer indicated to Petersen that he had acquired a new 1TB external hard drive that he was "encrypting . . . and making [] his bitch." (Id. at 27, ¶ 15.) He then offered to create for Petersen a "computer vault" for storing child pornography. (Id.) Spencer messaged: "I can make you one if you send me a hard drive. You can destroy it with a hammer and all files really gone. Takes under a minute. Accessed externally to computers." (Id.) In another message Petersen asked whether Spencer felt guilty about their actions. (Id.) Spencer responded that he did not feel "bad or anything" but did allow that he was "worried legally speaking." (Id.)
The next day, Petersen sent a picture of the hard drive he planned to buy—a "Transcend Military Drop Texted 1TB external hard drive." (Id. at ¶ 16.) Spencer replied: "I hav [sic] that exact one. . . . [t]hat's the one I got." (Id.) He reiterated his previous offer to create for Petersen a "computer vault"—an encrypted external hard drive storing child pornography. (Id. at ¶ 15.)
In October 2016, Kik messages show Petersen and Spencer arranging a time to meet in person for Petersen to retrieve the promised hard drive. (Id. at ¶ 18.) Spencer suggested Petersen arrive early so they would have enough time to "check out the collection." (Id.) Moreover, Spencer indicated that he would soon upload child pornography "from [his] drive to Dropbox," and that "[t]he stuff on my computer is hot as fuck." (Id.)
In November 2016, Spencer messaged that he had a babysitting job for the weekend. He also observed to Petersen that he could "control and take pictures from [his] iPhone" using his watch. (Id. at ¶ 19.) He was thus able to photograph children from another room if he "propped up" his iPhone for vantage. (Id.) Spencer recommended this application to Petersen. (Id.)
Additional messages recovered by the FBI depict Spencer educating Petersen on how to use encryption on the external hard drive. (Id. at 28, ¶ 20.) Spencer explained that to access the encrypted drive from a computer, Petersen needed to "install Veracrypt on the pc." (Id.) But to send files from the external drive, Spencer instructed that Petersen must "download 7z on his computer and throw it into a zipped file with a password. . . . [t]hen you can upload it direct to the web and send the zip file. If it's encrypted then people can't fuck with it." (Id.) Spencer explained that Petersen could send files directly from the encrypted drive: "[w]hen you mount it with Veracrypt it decrypts the files, when you dismount it they re-encrypt." (Id.)
The government has requested and received two good-cause warrant extensions in light of the challenge presented by Mr. Spencer's encryption. Magistrate Judge Laporte granted the first extension on August 11, 2017 and the second on December 11, 2017. (Dkt. Nos. 2, 9, 11.) The government investigation and bypass efforts are memorialized in the declarations of FBI Special Agents Hadley and Marceau.
On October 25, 2017, the government filed the underlying application under the All Writs Act, 28 U.S.C. § 1651, to compel Mr. Spencer to produce in a fully unlocked state the iPhone, Alienware laptop, and Transcend 1TB external hard drive. (Dkt. No. 4.) After several stipulated extensions, Mr. Spencer filed an opposition brief and the government a reply. (Dkt. No. 12 & 14.) The Court heard oral argument on March 1, 2018. (Dkt. No. 18.)
The question here is whether compelling Mr. Spencer under the All Writs Act to decrypt these devices constitutes a violation of his Fifth Amendment privilege, or whether, as the government maintains, any testimonial value inhering to the act of decryption is a foregone conclusion.
The Fifth Amendment provides that "[n]o person . . . shall be compelled in any criminal case to be a witness against himself." But "the Fifth Amendment does not independently proscribe the compelled production of every sort of incriminating evidence." Fisher, 425 U.S. at 408. "[T]he privilege protects a person only against being incriminated by his own compelled testimonial communications." Id. at 409. It encompasses incriminating answers as well as those "furnish[ing] a link in the chain of evidence needed to prosecute the claimant for a federal crime." Hoffman v. United States, 341 U.S. 479, 486 (1951). The privilege may also encompass the very act of production if that act "implicitly communicate[s] statements of fact." See Fisher, 425 U.S. at 410; United States v. Hubbell, 530 U.S. 27, 36 (2000). The government concedes here that compelling decryption of the potentially incriminating contents of the at-issue devices would—absent a further showing on its part—implicate the Fifth Amendment. And the government has not sought a grant of immunity for Mr. Spencer.
The Court turns next to the critical question: whether the testimony inhering to Mr. Spencer's act of production is a foregone conclusion such that ordering him to decrypt the at-issue devices will not implicate the Fifth Amendment. The foregone conclusion doctrine is an application of the Fifth Amendment "by which the Government can show that no testimony is at issue." In re Grand Jury Subpoena Duces Tecum Dated Mar. 25, 2011, 670 F.3d 1335, 1343 n.19 (11th Cir. 2012). The Supreme Court articulated the foregone conclusion doctrine in Fisher v. United States, where it upheld the subpoena of potentially incriminating tax documents because the government did not rely on the respondent's tacit testimony—that is, the "truth-telling" arising from the very act of production—to prove the existence of the documents or that the respondent possessed them. Fisher, 425 U.S. at 410-11. The Court thus held that "[t]he existence and location of the papers [were] a foregone conclusion and the taxpayer add[ed] little or nothing to the sum total of the Government's information." Id. ("doubtful that implicitly admitting the existence and possession of the papers [rose] to the level of testimony within the protection of the Fifth Amendment"). Because the implicit testimony was a foregone conclusion, the matter reduced to a question "not of testimony but of surrender." Id.
The question of the foregone conclusion doctrine's application in the context of compelled decryption presents a question of first impression to the Ninth Circuit. After considering the parties' submissions, surveying the relevant legal authority, and having had the benefit of oral argument, the Court finds that the foregone conclusion doctrine applies to each at-issue device.
The Court finds that the testimony inhering to the act of decryption is that Mr. Spencer knows the encryption password. The act of decryption requires nothing more.
First, it is a foregone conclusion that Mr. Spencer knows the password to fully decrypt the at-issue iPhone 7, inclusive of the encrypted "Secret Folder" application, such that he can produce the phone in a fully-unlocked state. (Dkt. No. 12 at 19.) Spencer admitted ownership of the phone and has provided—through counsel—the passcode to bypass its lock screen. (Id. at 26, ¶ 9.) This scenario arose in Apple MacPro Computer where the defendant "provided the password to access [an at-issue iPhone 6 Plus] but did not grant access to an application . . . which contained additional encrypted information." See Apple MacPro Computer, 851 F.3d at 243 (reviewing application of foregone conclusion doctrine under plain error standard in lieu of reasonable particularity as defendant failed to preserve objection). Because the defendant "had opened [the iPhone] for the police by entering a password," it was not plain error to find that he could similarly access the secondary encrypted application within the same phone. Id. at 248 (affirming application of foregone conclusion doctrine). Whereas in Apple MacPro, the primary grant of access was sufficient to impute sufficient knowledge of a secondary password, here the government has the same primary grant of access but has even greater independent knowledge as to the secondary application. Id. at 247-48. In particular, Petersen credibly attests that Spencer described his routine use of a password-protected iPhone application to store child pornography.
Second, it is a foregone conclusion that Mr. Spencer knows the VeraCrypt password such that he can produce the Alienware laptop in a fully-unlocked state. He admitted ownership and— as with the iPhone—he furnished a passcode allowing the government to access part of the laptop, but not the portions encrypted with VeraCrypt which are implicated here. (Dkt. No. 12. at 26, ¶ 9). Moreover, Petersen attests that Spencer spoke of storing child pornography in an encrypted laptop partition—even mentioning an incident at school where he had very nearly "projected child pornography in a classroom" from that laptop. (Dkt. No. 5 at 2-3, ¶ 9.) In United States v. Fricosu, the government carried its burden of showing "that [respondent] was [the laptop's] sole or primary user, who, in any event, [could] access the encrypted contents" where the respondent admitted in a recorded telephone call, and later confirmed, that sought-after files were located on her password-protected laptop. United States v. Fricosu, 841 F.Supp.2d 1235-37 (D. Colo. 2012) (applying foregone conclusion doctrine under preponderance standard in lieu of reasonable particularity). Of three laptops seized prior to the respondent's admission, only one laptop fit the description and the court applied the foregone conclusion doctrine, thus compelling decryption. Id. at 1237. Here the government has even more independent knowledge. First, Petersen saw Spencer enter a password from memory to access VeraCrypt on a "black laptop." (Dkt. No. 5 at 3, ¶ 15.) Second, the Alienware laptop is partially encrypted with VeraCrypt and is the only functioning laptop seized. (Dkt. No. 12 at 16, ¶ 5; 18-19, ¶ 7.) Further, Petersen attests that Spencer not only instructed him in the use of VeraCrypt but later said of his password-selection protocol: "[Spencer] had made his encryption password easier to remember by incorporating the name of a boy for whom he claimed to have feelings, in a format similar to the encryption password he had created for me."
Third, it is a foregone conclusion that Mr. Spencer knows the VeraCrypt password such that he can produce the Transcend 1TB external hard drive in a fully-unlocked state. This device was seized from the same desk as the Alienware laptop. (Dkt. No. 12 at 26, ¶ 9.) Later, during their Aptos meeting, Petersen saw Spencer enter the VeraCrypt password from memory to access this device. (Dkt. No. 5 at ¶¶ 15-17.) Here, messages recovered by the government show that Spencer said he: (1) owned a Transcend 1TB external hard drive "exact[ly]" like Petersen's; (2) that he used encryption on his external hard drive; and (3) that he used VeraCrypt. (Dkt. No. 12 at 28, ¶¶ 15-16, 20.) Only one seized device meets these criteria: the Transcend external hard drive seized by the FBI from Spencer's desk, which was the only such device seized from Spencer. See Fricosu, 841 F. Supp. 2d at 1235-37 (as respondent admitted the files were on encrypted laptop and only one of three seized both matched that admission and had nominal indica of ownership, it was a foregone conclusion that "[respondent] was [the] sole or primary user, who, in any event, [could] access the encrypted [files]"). Accordingly, the government has shown with reasonable particularity that it is a foregone conclusion that Mr. Spencer knows the password such that he can fully-decrypt the Transcend external hard drive, inclusive of VeraCrypt. Id.; Doe I, 383 F.3d at 909.
Because the act of decryption impliedly testifies only as to the knowledge of passwords, and Mr. Spencer's knowledge of the passwords as to each at-issue device is a foregone conclusion, the Court could grant the government's motion on this basis. But as this issue presents a question of first impression in the Ninth Circuit, the Court also considers whether the foregone conclusion doctrine applies under the analysis applied to the traditional document-subpoena inquiry.
"When the existence and location of the documents . . . are a foregone conclusion and the witness adds little or nothing to the sum total of the Government's information by conceding that he in fact has the [documents], then no Fifth Amendment right is touched because the question is not of testimony but of surrender." Doe I, 383 F.3d at 910 (citing Fisher, 425 U.S. at 411). Under this analysis, the government must establish its independent knowledge of three elements: the files' existence, the files' authenticity, and respondent's possession or control of the files.
The Court finds that Mr. Spencer's ownership or possession of the iPhone—and the Secret Folder application therein—are a foregone conclusion. The iPhone was seized from his hand when the FBI commenced to search his residence and he promptly admitted ownership. (Dkt. No. 12, at 26, ¶ 9.) He does not now dispute ownership and has provided through counsel the passcode to bypass the iPhone's lock screen. (Id.) Since Mr. Spencer owns and can access the iPhone, he owns and can access the encrypted "Secret Folder" therein. Apple MacPro Computer, 851 F.3d at 248. Moreover, Petersen credibly communicated that Spencer described his practice of using a password-protected iPhone application to store child pornography. (Dkt. No. 5. at 2, ¶ 8.) Only one such application was discovered here. Fricosu, 841 F. Supp. 2d at 1237. Thus, the government has shown with at least reasonable particularity that Mr. Spencer owns the iPhone and the "Secret Folder" application.
The Court also finds that the existence of child pornography on the iPhone's "Secret Folder" application is a foregone conclusion. First, as an initial matter, the government already discovered child pornography in Spencer's Kik messages on the iPhone more generally. (Dkt. No. 12 at 19, ¶ 9.) Second, as set forth above, Petersen credibly attests that Spencer described his practice of storing child pornography in a password-protected application on his iPhone. (Dkt. No. 5 at 2, ¶ 8.) There was only one iPhone seized, and it contains one such application. (Dkt. No. 12 at 19); see Fricosu, 841 F. Supp. 2d at 1237 (existence of files a foregone conclusion where respondent admitted to third party that sought-after files existed on password-protected laptop and only one laptop out of the three seized was password-protected). Third, forensic review showed that the Secret Folder application "exists" on the iPhone; that it requires 20MB to install; and that it now contains more than 20GB of encrypted data. (Dkt. No. 12 at 19 ¶ 9.) The foregone conclusion doctrine—regardless of whether applied to decryption or document production—does not require knowledge of specific file names. See In re Grand Jury Subpoena Duces Tecum Dated Mar. 25, 2011, 670 F.3d at 1349 n.28 (11th Cir. 2012). But such knowledge "[is] an easy way for the Government to carry its burden of showing that the existence of the files it seeks is a foregone conclusion." Id.; In re Boucher, No. 2:06-MJ-91, 2009 WL 424718, at *2 (D. Vt. Feb. 19, 2009) (existence a foregone conclusion where, upon initial grant of access to at-issue laptop, border agent saw child pornography and a file entitled "2yo getting raped during diaper change"). Here, the FBI has linked files to the Secret Folder iPhone application, including "info.e2uapp.photosafe." (Id. at 19, ¶ 11.)
Mr. Spencer insists the government is attempting to force access to an iPhone folder it knows nothing about. There is no question that a mere showing of encryption cannot prove the element of existence "to any degree of particularity." See Grand Jury Subpoena, 670 F.3d at 1347 ("we are not persuaded by the suggestion that simply because the devices were encrypted necessarily means that [the defendant] was trying to hide something"). But here the government has independently shown more. Petersen expressly noted Spencer's mention of a "password-protected iPhone application" used to store child pornography for later transfer to an encrypted hard drive. (Dkt. No. 5 at ¶ 2); Fricosu, 841 F. Supp. 2d at 1237. And although Petersen did not claim to have seen Spencer open or display any files on the iPhone when they met in Aptos, he did see Spencer plug in the iPhone and transfer "files" while they were viewing child pornography. (Dkt. No. 5 at 3, ¶ 15.) Thus, the Court finds that the government has shown with at least reasonable particularity that child pornography exists within the iPhone's "Secret Folder" application. Doe I, 383 F.3d at 910 (application of the doctrine does not demand "actual knowledge of the existence and location of each and every responsive document").
The Court finds that Spencer's ownership of the Alienware laptop is a foregone conclusion. This laptop was seized from Spencer's desk and he admitted ownership, which he does not now dispute. (Dkt. No. 12. at 26, ¶ 9.) Further, as with his iPhone, Spencer furnished a passcode allowing the government to access other parts of the laptop, but not those portions encrypted with VeraCrypt. (Id.) Thus, the Court finds that the government has shown with at least reasonable particularity that Mr. Spencer owns the Alienware laptop.
The Court also finds that the existence of child pornography on the encrypted portions of the Alienware laptop is a foregone conclusion. Petersen attests that Spencer told him of his practice of using an encrypted laptop partition to store child pornography and part of the Alienware laptop is encrypted. (Dkt. No. 5 at 2, ¶ 9) (Dkt. No. 12 at 18, ¶ 7.) Further, Kik messages recovered by the FBI show Spencer claiming that files "on [his] computer [are] hot as fuck" and that his "computer might be incriminating too." (Id. at 26-27, ¶ 13, 18.)
Mr. Spencer insists the government cannot meet its burden of showing that child pornography exists on the Alienware laptop because two laptops were seized by the FBI—the black-and-silver Alienware implicated here as well as a black Lenovo recovered in a non-functioning state as it had no hard drive—and Petersen did not clearly identify the "black laptop" he saw in Aptos as the at-issue Alienware laptop. The Court is not persuaded. First, only one working laptop was seized. It is partly-encrypted with VeraCrypt, which was Spencer's preferred encryption software (or in any event, is the encryption software installed on two of the three at-issue devices). (Dkt. No. 12 at 28, ¶ 20.) Second, Petersen directly implicates "[Spencer's] laptop." (Dkt. No. 5 at 2, ¶ 9.) Specifically, Petersen watched Spencer access child pornography on a "black laptop." (Id.) Third, Spencer's own messages likewise implicate his laptop: (1) claiming the child pornography on it was "hot as fuck" and (2) that the laptop "might be incriminating." (Dkt. No. 12 at 26-28, ¶¶ 13, 15, 18); see Fricosu, 841 F. Supp. 2d at 1237. In addition, the government disclosed at oral argument that it has since discovered child pornography on the accessible part of the laptop. Thus, the Court finds that the government has shown with at least reasonable particularity that child pornography exists within the VeraCrypt-encrypted drive partitions of the Alienware laptop.
The Court likewise finds that Mr. Spencer's ownership of the Transcend 1TB external hard drive is a foregone conclusion. First, the hard drive was seized from the same desk as the Alienware laptop which Spencer admitted to owning. (Dkt. No. 12 at 26, ¶ 9.) Further, Spencer lived in that room for the preceding five years and no evidence suggests he shared the space. (Dkt. No. 4 at 19:20-22.) Second, Petersen attests that when he sent Spencer a Kik message containing a picture of a Transcend external hard drive he had recently purchased for himself, Spencer replied that he owned "exactly that same make and model of external hard drive." (Dkt. No. 5 at 3, ¶ 13.) Later, at their Aptos meeting, Petersen saw Spencer using the Transcend hard drive. (Id. at ¶¶ 15-17.) Finally, the Court notes that Spencer does not now dispute ownership. Apple MacPro Computer, 851 F.3d at 248. Accordingly, the Court finds that the government has established with at least reasonable particularity that Mr. Spencer's ownership of the Transcend hard drive is a foregone conclusion.
Lastly, the Court finds that the existence of child pornography on the Transcend hard drive is a foregone conclusion. First, recovered Kik messages from January 2016 show Spencer claiming that he had "like 300 gigabytes" of child pornography and that he needed a new external hard drive to store them. (Dkt. No. 12 at 26 ¶ 12.) At present, the drive contains over 900GB of data. (Id. at 17, ¶ 6.) In February 2016, Spencer messaged Petersen that he was storing child pornography on an external drive that was "encrypted up the ass" and could be "smash[ed] with a hammer at a moment's notice." (Id. at 26, ¶ 13.) The next month, Spencer messaged that he had recently purchased a new external hard drive that he was "[e]ncrypting . . . and making [his] bitch." (Id. at 27, ¶ 15.) Second, Petersen attests that Spencer showed him child pornography on the Transcend drive when they met in Aptos in late 2016. (Dkt. No. 5 at 3-4, ¶ 16-17.) Mr. Spencer raises no dispute as to the sufficiency of the government's showing at to the Transcend drive. Accordingly, the government has carried its burden of establishing the existence of child pornography on the Transcend drive to the required standard of reasonable particularity. Bright, 596 F.3d at 692.
The government presumptively carries its burden of authenticity as to the iPhone, Alienware laptop, and Transcend external hard drive. This element requires "that not only must the Government show that it can independently establish that the summonsed documents are what they purport to be, it must demonstrate that it is not compelling the [respondent] to use his discretion in selecting and assembling the responsive documents, and thereby tacitly providing identifying information that is necessary to the government's authentication of the subpoenaed documents."
In considering the element of authenticity, the Court finds persuasive that Agent Marceau, an FBI Digital Evidence Extraction Technician, attested to his use of "authorized practices and procedures" as to each at-issue device. (See Dkt. No. 12 at 15-21.) Moreover, the FBI has already discovered child pornography on the accessible part of iPhone and, at oral argument, disclosed that it had discovered child pornography on the accessible part of Alienware laptop. Accordingly, this Court finds that the government can independently determine whether the at-issue devices, upon full decryption, contain additional child pornography without relying on the "truth-telling" of Mr. Spencer in order to do so. Fisher, 425 U.S. at 411. The authenticity of the files is thus a foregone conclusion. Bright, 596 F.3d at 692.
Mr. Spencer insists compelled decryption amounts to an abrogation of privacy rights. As Mr. Spencer articulates no relevant authority to support that proposition—and indeed, does not challenge the sufficiency of the search warrant underlying these proceedings—the Court is not persuaded. The Supreme Court has made clear that the search of cell phone data requires a search warrant. See Riley v. California, 134 S.Ct. 2473, 2485 (2014). Here, the government has sought and obtained such a warrant. (Dkt. No. 1 at 40-43.) Nor does Mr. Spencer insist the encrypted files are themselves privileged.
Mr. Spencer also insists that the Court errs in according weight to the testimony of an unreliable codefendant. This argument, too, is unconstructed and lacks supportive authority. The foregone conclusion doctrine simply requires that the government point to an independent source of prior knowledge. Bright, 596 F.3d at 692. This independent knowledge requirement does not qualify the source of that knowledge, except that it cannot derive from the respondent's own implied testimony. For example, courts have applied the foregone conclusion doctrine to compel decryption where the government's independent knowledge derived from the observations of a defendant's own sister and even from a government agent. Apple MacPro Computer, 851 F.3d at 248 (defendant's sister who saw him view child pornography on at-issue device(s) provided important source of independent knowledge); Boucher, 2009 WL 424718 at *2 (ICE agent who saw child pornography on at-issue device provided critical source of independent knowledge). Spencer offers no authority, persuasive or otherwise, showing that a source of independent knowledge was rejected (or could be rejected) because it was not independent enough. In any event, Petersen's testimony is either consistent with what he told the government upon the execution of the search warrant at his home, or corroborated by other evidence, such as Mr. Spencer's Kik messages or the form of the devices seized from Spencer. Petersen's testimony is thus reliable.
Here, the government has made its showing using two independent sources of knowledge: Petersen and Spencer. Petersen's immediate confession implicated Spencer and gave rise to the search warrant underlying this Order. (See Dkt. No. 1, Statement of Probable Cause at 14-18.) Later, Petersen pled guilty and entered a cooperation agreement with the government, proffering a declaration in furtherance of the prosecution. (See Dkt. No. 5, Declaration of Bryan Petersen.) And when Spencer provided the passcode to bypass the iPhone's lock screen, the government uncovered inculpatory messages authored by Spencer, listed in relevant part in Section E above. (See Dkt. No. 12 at 26-28.) The government satisfies the independent knowledge requirement under any reading of the foregone conclusion doctrine.
In sum, the Court finds that the government has satisfied to the standard of reasonable particularity that Mr. Spencer knows the encryption passwords to each at-issue device and that this is sufficient to grant the government's application here. In addition, to the extent necessary, the Court finds the government has satisfied to the standard of reasonable particularity that it has prior independent knowledge as to: (1) Mr. Spencer's ownership or control of each device; and (2) the existence of child pornography within the encrypted devices and/or applications at-issue; and (3) that the files sought are authentic. In either event, the testimony inhering to the act of decryption is a foregone conclusion "add[ing] little or nothing to the sum total of the Government's information." Fisher, 425 U.S. at 411.
For the reasons stated above, the government's application is GRANTED as to: (1) the iPhone 7, Model A1660, serial number F72SDRNGHG7; (2) the Transcend 1TB external hard drive, serial number C842472715; and (3) the Alienware laptop, Model P4sF, serial number 451PM32. Pursuant to the All Writs Act, the Court orders Mr. Spencer to provide the government with the encryption passwords for the above devices or to decrypt the devices himself such that the government has access to the devices' files.
Any party may file objections to this Order with Judge Breyer within 14 days after being served with a copy. See 28 U.S.C. § 636(b)(1); Fed. R. Civ. P. 72(b); Civ. L.R. 72-3. Failure to file an objection may waive the right to review of the issue in the district court.
This Order disposes of Docket No. 4.
