O'TOOLE, District Judge.
The defendant, David Keith, is charged with distribution of child pornography in violation of 18 U.S.C. § 2252(a)(2) and possessing and accessing child pornography in violation of 18 U.S.C. § 2252(a)(4)(B). He has moved to suppress physical evidence and statements obtained as the result of a
The application for the warrant relied on two distinct sources of information for a showing of probable cause. First, in December 2009, the National Center for Missing and Exploited Children ("NCMEC") made available to the Massachusetts State Police a "CyberTipline" report indicating that a computer that eventually was linked to the defendant's residence was likely the source of an emailed file that contained what appeared to be child pornography meeting the federal criminal definition.
The following factual findings are based on the parties' written submissions and testimony given at an evidentiary hearing.
America Online ("AOL"), which may be described variously as an electronic service provider ("ESP") and an internet service provider ("ISP"), provides an email service for subscribers. To prevent its communications network from serving as a conduit for illicit activity, AOL systematically attempts to identify suspected child pornography that may be sent through its facilities. It uses an Image Detection and Filtering Process ("IDFP") of its own devise which compares files embedded in or attached to transmitted emails against a database containing what is essentially a catalog of files that have previously been identified as containing child pornography.
Commonly, AOL may be alerted that an image or video file being transmitted through its facilities likely contains child pornography by a complaint from a customer. When AOL receives such a complaint, an employee called a "graphic review analyst" opens and looks at the image or video file and forms an opinion whether what is depicted likely meets the federal criminal definition of child pornography. If the employee concludes that the file contains child pornography, a hash value of the file is generated automatically by operation of an algorithm designed for that purpose. A hash value is an alphanumeric sequence that is unique to a specific digital file. Any identical copy of the file will have exactly the same hash value as the original, but any alteration of the file, including
AOL maintains a "flat file" database of hash values of files that AOL has at some time concluded contain child pornography. It does not maintain the actual files themselves; once a file is determined to contain child pornography, it is deleted from AOL's system. When AOL detects a file passing through its network that has the same hash value as one in the flat file database, AOL reports that fact to NCMEC via the latter's CyberTipline. By statute, an ESP or ISP such as AOL has a duty to report to NCMEC any apparent child pornography it discovers "as soon as reasonably possible." 18 U.S.C. § 2258A(a)(1). The CyperTipline report transmits the intercepted file to NCMEC, but no AOL employee opens or views the file. AOL's decision to report a file to NCMEC is made solely on the basis of the match of the hash value of the file to a stored hash value.
A CyberTipline report is typically created by direct upload to NCMEC's server through a facility made available by NCMEC to an ESP such as AOL specifically for that purpose. After a report is received, a NCMEC analyst opens and views the file to determine whether its content meets the federal criminal definition of child pornography. If it is determined that the file contains child pornography, the NCMEC analyst queries the email sender's internet protocol ("IP") address using conventional "open source" search engines to try to identify the sender's geographic location, as well as the ISP through which the sender accesses the internet. When the general geographic location and the relevant ISP for the computer of interest have been determined, the NCMEC analyst adds the report containing the file to a database that is accessible only to law enforcement agencies in the identified geographic location via a virtual private network ("VPN") that is dedicated to that use.
In this case, AOL identified a suspect file in an email sent on November 26, 2009. The following day, AOL uploaded a CyberTipline report that contained the file to NCMEC's server. In accordance with its practice, no AOL employee opened or viewed the file before it was forwarded to NCMEC. Rather, it was forwarded solely because its hash value matched a hash value in AOL's flat file database. Nothing is known about how the file came to be originally hashed and added to the flat file database, except that it was AOL's practice to hash and add to the database either the hash value of any file that was identified by one of its graphic file analysts as containing child pornography or a hash value similarly generated by a different ESP or ISP and shared with AOL.
After the file was received at NCMEC, an analyst opened and examined the image file, determined that it met the criteria for classification as child pornography, investigated the IP address from which the offending email originated, and determined that the IP address was located within Massachusetts. NCMEC then created the CyberTipline report and made it accessible to law enforcement personnel in Massachusetts through the dedicated VPN, along with information about the email sender's
According to a statement on its website, NCMEC
About Us — Congressional Authorization, NCMEC, http://www.missingkids.com/Authorization (last visited Nov. 4, 2013). The "partnership" is reflected in an explicit statutory finding by the United States Congress:
42 U.S.C. § 5771. To support this work of the Center, Congress has mandated funding for the Center by means of annual grants administered through the Office of Juvenile Justice and Delinquency Prevention of the Department of Justice. See id. § 5773(b). One of the purposes of the annual grant is specifically to support NCMEC's CyberTipline:
Id. § 5773(b)(1). As noted above, the CyberTipline is supported by the statutory mandate that any ESP that discovers what appears to be child pornography must report that fact and its surrounding circumstances to the CyberTipline. 18 U.S.C. § 2258A(a). A knowing failure by an ESP to make such a report is punishable by a fine. Id. § 2258A(e). When it receives such a report via the CyberTipline, NCMEC must forward it to an appropriate federal law enforcement agency, and is authorized to do likewise with respect to state law enforcement agencies. Id. § 2258A(c).
According to NCMEC's annual report, for the year ending December 31, 2012, NCMEC received government contracts and grants slightly in excess of $36 million, approximately 70% of its total revenue for the year from all sources. 2012 Annual Report, NCMEC, www.missingkids.com/en_US/publications/NC171.pdf (last visited Nov. 4, 2013). It also receives annual donations from private citizens. For 2012, private contributions were approximately $7.7 million, a little over 15% of total revenue from all sources. Id.
In addition to the CyberTipline, NCMEC also administers a number of other programs relating to missing and exploited children which are not directly relevant to the issues presented in this case.
The defendant attacks the inspections of his intercepted email by both AOL and NCMEC respectively as violations of his right "to be secure in [his] ... papers[] and effects, against unreasonable searches and seizures" guaranteed by the Fourth Amendment. A "search" for purposes of the Fourth Amendment occurs when there has been a governmental intrusion into a place or thing as to which a person has a reasonable expectation of privacy. Put another way, the inquiry is whether the defendant had a subjective expectation of privacy in the place or thing that society recognizes as reasonable. Kyllo v. United States, 533 U.S. 27, 33, 121 S.Ct. 2038, 150 L.Ed.2d 94 (2001).
Email has become one of the most common forms of communication, but courts have yet to come to a consensus regarding whether and to what extent a sender has, for Fourth Amendment purposes, a reasonable expectation of privacy in email committed to the custody of an ISP. See, e.g., Rehberg v. Paulk, 611 F.3d 828, 846 (11th Cir.2010), aff'd, ___ U.S. ___, 132 S.Ct. 1497, 182 L.Ed.2d 593 (2012) ("[W]hether [the defendant] had a reasonable privacy expectation in the contents of his personal emails sent voluntarily through that third-party ISP, are complex, difficult, and `far-reaching' legal issues") (collecting cases). There are some perhaps useful analogs from other methods of transmitting communications. So, for example, while there is not a reasonable expectation of privacy in the matter on the outside of a mailed envelope, there is as to the letter sealed inside, see Ex Parte Jackson, 96 U.S. 727, 733, 24 L.Ed. 877 (1877), and while there is not a reasonable expectation of privacy in the numbers dialed from a telephone, see Smith v. Maryland, 442 U.S. 735, 745, 99 S.Ct. 2577, 61 L.Ed.2d 220 (1979), there is as to the conversation itself, see Katz v. United States, 389 U.S. 347, 352, 88 S.Ct. 507, 19 L.Ed.2d 576 (1967). Following the principles at work in these and similar cases, one might conclude that a sender of emails has a reasonable expectation of privacy in some aspects of the email, such as the contents of the message including
In any event, the government has not taken the position that the defendant lacked a legitimate privacy interest in the contents of the emailed file, and so it is assumed for present purposes that he had such an interest. That being so, any governmental invasion of that privacy interest would be a "search" for Fourth Amendment purposes.
"The Fourth Amendment's protection against unreasonable searches and seizures applies only to government action and not to a search or seizure, even an unreasonable one, effected by a private individual not acting as an agent of the government." United States v. Silva, 554 F.3d 13, 18 (1st Cir.2009) (citations and internal quotation marks omitted). The defendant argues that neither AOL nor NCMEC was acting as a private party in screening and examining the email file because each was acting under a statutory duty or compulsion and thus must be considered to have been effectively a government agent. Therefore, he contends, their searches are to be regarded as having been conducted by the government for purposes of enforcing the criminal law and thus were subject to the requirements of the Fourth Amendment.
Under First Circuit precedent, whether a private party is acting effectively as an agent of the government in conducting a search is evaluated against three principal factors: (1) "the extent of the government's role in instigating or participating in the search"; (2) "[the government's] intent and the degree of control it exercises over the search and the private party"; and (3) "the extent to which the private party aims primarily to help the government or to serve its own interests." Silva, 554 F.3d at 18.
AOL's comparison of the hash value of the file transmitted from the defendant's computer with its database of stored hash values of files thought to contain child pornography was not a search conducted by or on behalf of the government. None of the so-called "Silva factors" are present. Contrary to the defendant's suggestion, AOL is not required by law to monitor email traffic for possible child pornography, 18 U.S.C. § 2258A(f), but only to report it when it is found, id. § 2258A(a). The government exercises no control over AOL's monitoring of its network. Most importantly, the evidence considered on the present motion established, and I find, that AOL is motivated by its own wholly private interests in seeking to detect and deter the transmission of child pornography through its network facilities. An AOL representative testified at the evidentiary hearing held on the present motion that AOL had an important business reason for its IDFP filtering process:
(Tr. of Evidentiary Hr'g at 67-68 (dkt. no. 53).) This legitimate business interest is distinct from the government's interest in
On the other hand, NCMEC's examination of the file uploaded by AOL to the NCMEC CyberTipline was a search conducted for the sole purpose of assisting the prosecution of child pornography crimes. NCMEC's goal in operating the CyberTipline is a worthy and laudable one, but it is one that it pursues in "partnership," 42 U.S.C. § 5771(9)(B), with the government. Unlike AOL, which monitors its email traffic to serve its own business interest, NCMEC's operation of the CyberTipline is intended to, and does, serve the public interest in crime prevention and prosecution, rather than a private interest.
The Silva factors are satisfied. Through congressional authorization and funding of the CyberTipline, the government "instigat[es]" such searches. Silva, 554 F.3d at 18. A statutory provision requires NCMEC to report discovered child pornography to federal law enforcement, and another encourages similar reporting to state and foreign law enforcement agencies. 18 U.S.C. § 2258A(c)(1, 2). This requirement addresses the "control" factor identified by the First Circuit. Silva, 554 F.3d at 18. Finally, the CyberTipline serves no private purpose for NCMEC separate from assisting law enforcement, the third Silva factor. Id.
While not directly addressing the question presented here, the First Circuit has noted that NCMEC reviews suspected files and "conducts an online search regarding the provided suspect information... aimed at identifying the appropriate law enforcement agency with jurisdiction to investigate the suspected child pornography activity." Cameron, 699 F.3d at 633. The court further observed that "[a]lthough NCMEC is not officially a government entity, it receives a grant from the government, and one of the uses to which NCMEC puts this grant money is to operate the CyberTipline and forward reports of child pornography to law enforcement." Id. at 644 (citing 42 U.S.C. § 5773(b)(1)(P)). The "partnership" between NCMEC and law enforcement with respect to the operation of the CyberTipline is not just rhetorical but real. Members of law enforcement serve on various NCMEC boards, and U.S. Marshals and other law enforcement personnel provide on-site support and referral assistance for NCMEC's Exploited Child Division. As noted above, NCMEC makes the results of its examination of suspected files available exclusively to federal and state law enforcement officials by means of a dedicated V PN, accessible only to law enforcement personnel. It is clear that NCMEC's CyberTipline is, and is intended by Congress to be, an integral part of the governmental effort to detect and prosecute child pornography crimes. Cf. Skinner v. Ry. Labor Execs. Ass'n, 489 U.S. 602, 615, 109 S.Ct. 1402, 103 L.Ed.2d 639 (1989) (holding that drug testing was not a private search where the "Government has removed all legal barriers to the testing ... and indeed has made plain not only its strong preference for testing, but also its desire to share the fruits of such intrusions").
If AOL had sent the file directly to the FBI or the State Police instead of to NCMEC's CyberTipline, it could not seriously
The government weakly argues that a NCMEC analyst's viewing of the contents of the file was not an expansion of AOL's private search, citing United States v. Jacobsen, 466 U.S. 109, 104 S.Ct. 1652, 80 L.Ed.2d 85 (1984). In that case, FedEx employees opened a damaged box for private, non-governmental reasons, discovered what appeared to be cocaine, and contacted the Drug Enforcement Administration. The FedEx employees put the contents back in the box. When DEA agents arrived, they reopened the package and removed the cocaine. Id. at 111, 104 S.Ct. 1652. In these circumstances, the Supreme Court held there had been no separate search by the police to which the Fourth Amendment applied. Id. at 120, 104 S.Ct. 1652. An argument that Jacobsen is factually similar to this case is untenable in light of the testimony given at the
In this regard it is worth noting that matching the hash value of a file to a stored hash value is not the virtual equivalent of viewing the contents of the file. What the match says is that the two files are identical; it does not itself convey any information about the contents of the file. It does say that the suspect file is identical to a file that someone, sometime, identified as containing child pornography, but the provenance of that designation is unknown. So a match alone indicts a file as contraband but cannot alone convict it. That is surely why a CyberTipline analyst opens the file to view it, because the actual viewing of the contents provides information additional to the information provided by the hash match. This is unlike what the Court found the case to be in Jacobsen, where the subsequent DEA search provided no more information than had already been exposed by the initial FedEx search. Jacobsen is inapposite.
On July 29, 2010, employees in a Staples store in Plaistow, New Hampshire alerted local police that a laptop computer left for repair contained files with filenames suggesting that they contained child pornography. It does not appear that the Staples employees actually viewed any of the files. The work order for the Staples laptop listed the defendant's name and Haverhill address. On August 10, 2010, a Plaistow police officer questioned the defendant, who admitted both that the Staples laptop was his and that he had seen and downloaded upwards of fifty files depicting images of children as young as eight years old engaging in sexual activity. The officer then applied for and obtained a state warrant to search the laptop. According to the affidavit of Massachusetts State Trooper Michael Murphy submitted in support of his application for the warrant for the search at issue here, the forensic examination of the laptop pursuant to the New Hampshire warrant revealed online chat messages suggesting possible sexual abuse of a minor living in the defendant's house. Police independently confirmed that the minor in question did live there. The search also discovered a photographic image of the defendant in the vicinity of computer equipment other than the laptop. The Plaistow police contacted the Haverhill police who contacted Trooper Murphy, conveying the information from the investigation of the laptop.
Trooper Murphy applied for the warrant for the search at issue here relying on both the NCMEC CyberTipline reports and evidence from the Staples laptop investigation. A warrant issued, and Massachusetts State Police executed it on September 17, 2010, recovering physical evidence the government expects to be useful in the present prosecution. The defendant also was advised of his Miranda rights and questioned. Again, he made statements admitting to the possession of child pornography.
The defendant contends that because Trooper Murphy's affidavit relied on information obtained in violation of the Fourth Amendment by NCMEC in the course of its CyberTipline examination of the suspect
There was a sufficient factual basis to support probable cause if only the information from the investigation of the Staples laptop were to be considered. Paragraphs 10 through 12 of Trooper Murphy's affidavit present facts from the laptop investigation. Those facts include that Staples personnel had discovered possible files containing child pornography on a laptop, that the Staples work order named the defendant as the owner of the laptop and gave a Haverhill address that other information independent of the CyberTipline report indicated was the defendant's address, that in a subsequent interview with Plaistow police the defendant "admitted that the Toshiba laptop referenced above is his and that he has seen and downloaded images of children as young as 8 years old engaged in sexual activity," that a forensic examination of the computer at the request of the Plaistow police "recovered multiple online chat messages with various individuals discussing the possible sexual abuse of a child living in the home of David Keith," that it was independently confirmed that a child with the same name used in the chats did reside there, and that a recovered photograph showed the defendant in proximity to computer equipment other than the searched laptop. (See Def.'s Mem. in Supp. of Mot. to Suppress Evidence, Ex. 3 ("Search Warrant Affidavit") at 6-7 (dkt. no. 23-3).) Based on these facts, the magistrate could properly have determined that probable cause existed that evidence of computer based child pornography crimes could be found at the Keith residence. Moreover, although the record may not be entirely clear on this point, Trooper Murphy's affidavit indicates that he attached the affidavit that Sergeant Caggiano of the Plaistow police had submitted to a New Hampshire court to obtain a warrant to search the laptop. That affidavit supplies further specifics, including the highly suggestive names of some of the files on the laptop. (See id., Ex. 4 at 3-4 (dkt. no. 23-4).)
I also conclude that the State Police would have applied for the warrant solely on the basis of the information from the laptop investigation. The CyberTipline report and others like it had been received several months earlier. While police opened and apparently continued an investigation into those reports, they did not move to seek a search warrant based on them. The laptop investigation was the more immediate impetus for the search. In particular, the forensic examination done on the laptop revealed information that there might be a child living in the defendant's home in immediate danger of actual sexual abuse. The timeline is also significant. Trooper Murphy apparently learned of the results of the forensic exam of the laptop computer either on September 16 or 17, and he applied for the warrant on the 17th. This rather strongly suggests that the "proximate cause" (as it were) of the application was the specific information provided as a result of the laptop investigation, and not the earlier CyberTipline reports.
The information from the New Hampshire investigation was not stale, contrary to the defendant's contention. That investigation had begun less than two months before. There is no standard measurement for assessing whether information is stale for these purposes. The affidavit set forth Trooper Murphy's assertion that his training and experience with child pornography crimes (detailed in the affidavit) teach that in general "[t]hose who have
Accordingly, I conclude that if the evidence presented in the affidavit from the NCMEC search were to be excised from the affidavit, there was nonetheless a sufficient factual basis set forth, based on the laptop investigation, for the magistrate to have concluded that the issuance of the requested warrant was adequately supported by probable cause.
Evidence obtained in violation of the Fourth Amendment may not be used against a defendant in a criminal prosecution. Weeks v. United States, 232 U.S. 383, 398, 34 S.Ct. 341, 58 L.Ed. 652 (1914). The exclusionary rule, however, is not a remedy for a completed private wrong, but a practical means of deterring future unlawful behavior by agents of the government. United States v. Calandra, 414 U.S. 338, 347, 94 S.Ct. 613, 38 L.Ed.2d 561 (1974). The Supreme Court has observed that "[t]he deterrent purpose of the exclusionary rule necessarily assumes that the police have engaged in willful, or at the very least negligent, conduct" to deprive a defendant of a guaranteed right. United States v. Peltier, 422 U.S. 531, 539, 95 S.Ct. 2313, 45 L.Ed.2d 374 (1975) (internal quotation marks omitted). As a corollary, the Court has concluded that the deterrent effect of exclusion of evidence is minimal where an officer has acted on an objectively reasonable belief that his actions did not violate the Fourth Amendment. United States v. Leon, 468 U.S. 897, 104 S.Ct. 3405, 82 L.Ed.2d 677 (1984). In Leon, the Court concluded that the exclusionary rule should not be applied to prevent the use in a criminal prosecution of evidence obtained by officers whose reliance on a warrant issued by a magistrate was objectively reasonable, even though it was later determined that probable cause for the issuance of the warrant was lacking. "Penalizing the officer for the magistrate's error, rather than his own, cannot logically contribute to the deterrence of Fourth Amendment violations." Id. at 921, 104 S.Ct. 3405.
In Leon, the officers acted in objectively reasonable reliance on a warrant issued by a magistrate.
There is nothing in the record in this case that would suggest either NCMEC or the police or the magistrate who issued the warrant knew or ought to have known that by relying on the CyberTipline report they were doing something that was unconstitutional under the Fourth Amendment. No persuasive argument can be made that an organization like NCMEC needs to be deterred from acting in good faith in a way that is consistent with explicit congressional will.
Moreover, any possible deterrent value from applying the exclusionary rule must be weighed against the "substantial social costs" of suppressing the evidence. See Leon, 468 U.S. at 907, 104 S.Ct. 3405; see also Herring v. United States, 555 U.S. 135, 141-42, 129 S.Ct. 695, 172 L.Ed.2d 496 (2009). The Supreme Court has cautioned that the exclusionary rule
Davis v. United States, ___ U.S. ___, 131 S.Ct. 2419, 2427, 180 L.Ed.2d 285 (2011) (internal citations omitted). In this case, where the likely deterrent value of exclusion is so minimal, the balance tips decidedly against suppression.
To summarize my major conclusions as to contested issues:
1. In monitoring its network email traffic using its Image Detection and Filtering Process, AOL was acting for its private purposes, and the Fourth Amendment did not apply.
2. In examining the contents of the emailed image file from the defendant's computer that was uploaded to its CyberTipline
3. Accordingly, NCMEC's examination of the contents of that emailed image file violated the Fourth Amendment because it was not authorized by a duly issued warrant (or by some constitutionally adequate substitute).
4. Probable cause for the issuance of the search warrant in this case was nevertheless adequately supported by facts in the affidavit concerning the defendant's laptop, and the warrant would more likely than not have been applied for and issued even if no information from the CyberTipline had been included in the affidavit. For this reason, the Fourth Amendment violation by NCMEC did not affect the validity of the warrant.
5. Even if the Fourth Amendment violation by NCMEC were deemed to have affected the validity of the warrant, considering all the circumstances, the exclusionary rule should not be applied to suppress the fruits of the search.
For all the reasons set forth above, the defendant's Motion to Suppress Evidence (dkt. no. 22) is DENIED.
It is SO ORDERED.