GONZALO P. CURIEL, District Judge.
Before the Court is Defendant Luke Noel Wilson's ("Defendant's" or "Wilson's") Motion to Suppress Evidence as a Result of an Illegal Search. (Dkt. No. 57.) The motion has been fully briefed. (Dkt. Nos. 62, 65.) The Court conducted an evidentiary hearing and took the matter under submission on May 18, 2017. (Dkt. No. 67.) Upon consideration of the moving papers, applicable law, and argument of counsel, and for the reasons set forth below, the Court
Google is mandated by law to report known child pornography violations to the CyberTipline of the National Center for Missing and Exploited Children ("NCMEC"). 18 U.S.C. 2258A(a) mandates that Internet service providers ("ISPs") that "obtain[] actual knowledge of any facts or circumstances" evincing "apparent" child pornography violations must submit, "as soon as reasonably possible," reports to the CyberTipline.
To further its private business interests, Google takes proactive measures beyond what is statutorily mandated by 18 U.S.C. § 2258A to screen for, report, and remove child pornography from its products and services. (See Dkt. No. 62-2, Declaration of Cathy A. McGoff ("McGoff Decl.").)
(Id. ¶ 3.)
Google identifies and removes child pornography by employing a process that involves both visual inspection by trained employees and technological screening by Google's proprietary "hashing" technology. Google has been using its own hashing technology to identify child pornography since 2008. (Id. ¶ 4.) The process is as follows. First, Google trains a team of employees on Google's statutory duty to report apparent child pornography. (Id. ¶ 6.) This team is further "trained by counsel on the federal statutory definition of child pornography and how to recognize it on [Google's] products and services." (Id.)
Second, offending images are catalogued and assigned "hash values," which are often described as "digital fingerprints."
(Id. ¶ 4 (emphasis added).)
Third, Google's system searches its products and services for hash values that match hash values in its repository of known child pornography images.
(Id. ¶ 7.) Finally, Google provides a CyberTipline Report to NCMEC. (Id. ¶ 8.)
As a result of this multi-tiered process, Google's proprietary hashing technology "tag[s] confirmed child sexual abuse images" that are "duplicate images of apparent child pornography" previously identified by at least one trained Google employee. (Id. ¶ 4 (emphasis added).)
On March 13, 2014, Defendant created a Google email account with the username soulrebelsd@gmail.com. (Dkt. No. 62-1 at 2, Ex. 1.) Defendant agreed to Google's November 11, 2013 Terms of Service upon creation of the account. (Dkt. No. 62 at 4.) On April 14, 2014, Google modified its Terms of Service. (Dkt. No. 62-2 at 5-7, McGoff Decl. Ex. A.)
Google instructed users: "You may use our Services only as permitted by law," and "[w]e may suspend or stop providing our Services to you if you do not comply with our terms or policies or if we are investigating suspected misconduct." (Dkt. No. 62-2 at 5, McGoff Decl. Ex. A.)
Regarding user content, Google stated,
(Id.)
Google notified users, "Our automated systems analyze your content (including emails) to provide you personally relevant product features, such as customized search results, tailored advertising, and spam and malware detection. This analysis occurs as the content is sent, received, and when it is stored." (Id.)
Finally, Google reminded users that Google
(Id.)
On June 4, 2015, Google, by way of its proprietary hashing technology, became aware that Defendant uploaded four image files depicting child pornography to an email in his Google account. (Dkt. No. 62-3 at 4, 11-13, Ex. 3.) Google complied with its legal obligation under 18 U.S.C. § 2258A and provided a CyberTipline Report to NCMEC. (Id.) Defendant's email account was terminated on June 4, 2015. (Dkt. No. 62-2, McGoff Decl. ¶ 9; Dkt. No. 62-1 at 2.)
On June 5, 2015, NCMEC received CyberTipline Report # 5074778 from Google. (Dkt. No. 62-3, Ex. 3.) The report included information about the date and time Defendant uploaded the four child pornography images, the email address soulrebelsd@gmail.com and recent login information associated with the account (including logins from a device possessing Internet protocol ("IP") address 99.113.198.241 on June 4, 2015 at 15:07:19 UTC and on May 9, 2015 at 15:48:04 UTC), and the secondary email address associated with the soulrebelsd@gmail.com account, jameskindle2012@gmail.com. (Id.) The report also included the four image files, each of which Google classified as "A1" in accordance with the industry classification standard. (Id.; see also Dkt. No. 62-2, McGoff Decl. ¶¶ 9-11.) "A1," in short, indicates that the file content contains a depiction of a prepubescent minor engaged in a sex act. (Id.)
Specifically, "A" signifies "Prepubescent Minor," whereas "B" signifies "Pubescent Minor." (Dkt. No. 62-3 at 14, Ex. 3.) "1" denotes "Sex Act," defined as: "Any image of sexually explicit conduct (actual or simulated sexual intercourse including genital-genital, oral-genital, anal-genital, or oral-anal whether between person of the same or opposite sex), bestiality, masturbation, sadistic or masochistic abuse, degradation, or any such depiction that lacks serious literary, artistic, political, or scientific value." (Id.) "2" denotes "Lascivious Exhibition," defined as: "Any image depicting nudity and one or more of: restraint, sexually suggestive poses, focus on genitals, inappropriate touching, adult arousal, spreading of limbs or genitals, and such depiction lacks serious literary, artistic, political, or scientific value." (Id.)
Google did not forward the email itself to NCMEC. The report did not include any email body text or header information associated with the reported offending content. (Dkt. No. 62-2, McGoff Decl. ¶¶ 9-11.) The report indicated that a Google employee did not manually review the images after Google's proprietary hashing technology tagged the images as apparent child pornography.
On or about June 17, 2015, NCMEC forwarded the CyberTipline Report to the San Diego ICAC Task Force Program. (Dkt. No. 62-3 at 17, Ex. 3.) NCMEC forwarded the information supplied by Google and the four image files to ICAC. (Id.) NCMEC did not forward the email itself. (Id.) NCMEC clarified, "Please be advised that NCMEC has not opened or viewed any uploaded files submitted with this report and has no information concerning the content of the uploaded files other than information provided in the report by the ESP." (Id.)
The San Diego ICAC office printed the report it received from NCMEC and the four attached image files. The printed report and images were given to SA Thompson. SA Thompson's review was limited to the contents of the CyberTipline Report and the four image files. He did not view or have access to Defendant's email at this time.
SA Thompson visually examined the four images and confirmed that they depict child pornography. Each of the images depicts a prepubescent minor engaged in a sex act, in line with Google's classification of the images as "A1" content. SA Thompson described the four images as follows.
(Dkt. No. 62-4, Ex. 4.)
On July 6, 2015, SA Thompson submitted a DHS Summons to Google requesting subscriber information for email accounts soulrebelsd@gmail.com and jameskindle2012@gmail.com. (Dkt. No. 62 at 8; Dkt. No. 62-5 at 9-10.) Google provided the following information in response:
(Id.)
SA Thompson also submitted a DHS Summons to AT&T Internet Services requesting subscriber information for IP address 99.113.198.241 on June 4, 2015 at 15:07:19 UTC and May 9, 2015 at 15:48:04 UTC. (Id.) AT&T Internet Services provided the following information in response:
(Id.)
On July 20, 2015, SA Thompson conducted database and law enforcement queries related to Defendant and obtained his name, date of birth, California driver's license number, registered vehicle (year, make, license number), and residential address. (Id.)
On July 29, 2015, SA Thompson obtained a state search warrant for Defendant's Google email account soulrebelsd@gmail.com. (Dkt. No. 62-4, Ex. 4.) The July 29, 2015 state search warrant was the first warrant SA Thompson obtained in relation to the investigation. SA Thompson consulted with a Deputy District Attorney prior to presenting the affidavit to the judge for review. (Id. at 9.) Probable cause for the warrant was premised upon CyberTipline Report # 5074778, SA Thompson's review and description of the four images (as described above, supra Part A.6), and the subscriber information provided by Google and AT&T Internet Services. (Id. at 5-6.) SA Thompson's affidavit did not contain any mention of hash values, any description of Google's screening process for child pornography, or the A1 classification Google assigned to the four images. (See generally Dkt. No. 62-4, Ex. 4.)
After reviewing search warrant results, SA Thompson located dominion and control emails linking Defendant to the account. (Dkt. No. 62 at 9.) SA Thompson also discovered email exchanges between Defendant, using soulrebelsd@gmail.com, and Jenalyn Arriola, using jenalynarriolax3@gmail.com. (Id. at 9-10.) In these email exchanges, Defendant solicited the creation of child pornographiy for pay, and Arriola sent Defendant child pornography images and video files. (Id.)
On August 17, 2015, law enforcement obtained a state search warrant for Defendant's residence. (Dkt. No. 62-5, Ex. 5.) Probable cause for the warrant was based upon CyberTipline Report # 5074778, SA Thompson's review and description of the four images (as described above, supra Part A.6), subscriber information provided by Google and AT&T Internet Services, database and law enforcement queries, and physical surveillance conducted at Defendant's residence. (Id. at 8-10.) SA Thompson consulted with a Deputy District Attorney prior to presenting the affidavit to the judge for review. (Id. at 13.)
The warrant was executed the next day on August 18, 2015. (Dkt. No. 62 at 11.) Defendant was located in the residence upon law enforcement's entry into the apartment. (Id.) Law enforcement seized multiple electronic devices from Defendant's residence. (Id.) During execution of the warrant, a San Diego Police Department ("SDPD") officer who was positioned on perimeter security notified investigators that he observed a backpack being tossed over Defendant's third floor balcony at the same time he heard the knock and notice upon Defendant's residence door. (Id.) SA Thompson searched the backpack and discovered Defendant's checkbook and a thumb drive. (Id.) During an on-scene forensic preview of the thumb drive, SA Thompson discovered thousands of child pornography images primarily depicting prepubescent girls, approximately five to ten years of age, involved in sexual activity, including the four images reported by Google to NCMEC. (Id.)
After obtaining subscriber information related to the Google account for jenalynarriolax3@gmail.com, law enforcement located Arriola. (Dkt. No. 62 at 12.) On August 20, 2015, SA Thompson advised Arriola of her Miranda rights, which she waived. (Id.) Arriola made a statement admitting to molesting two minor females and to producing child pornography depicting these molestations. (Id.) Arriola stated that she sent child pornographic images and videos to Defendant via text message and email. (Id.)
On August 31, 2015, SA Thompson obtained a search warrant for various Google accounts belonging to Arriola, including jenalynarriolax3@gmail.com. (Dkt. No. 62-6, Ex. 6.) SA Thompson stated in his affidavit that he had previously obtained a warrant for Defendant's email account. (Id. at 5.) SA Thompson consulted with a Deputy District Attorney prior to presenting the affidavit to the judge for review. (Id. at 9.) Probable cause for the warrant was based upon information obtained from the results of the warrant executed on Defendant's email account as well as Arriola's statement. (Id. at 5-6.)
On September 8, 2015, Google responded to the search warrant and produced from the jenalynarriolax3@gmail.com account multiple email exchanges between Defendant and Arriola evidencing Defendant's violations of 18 U.S.C. § 2251(d)(1)(A), as well as Defendant's possession and receipt of child pornography. (Id.)
On October 15, 2015, Defendant was arrested on a federal complaint charging him with distribution and possession of child pornography in violation of 18 U.S.C. §§ 2252(a)(2) and 2252(a)(4)(B). (Dkt. No. 1.) On November 10, 2015, a federal grand jury returned a three-count indictment charging Defendant with Advertising of Child Pornography in violation of 18 U.S.C. § 2251(d)(1)(A), Distribution of Images of Minors Engaged in Sexually Explicit Conduct in violation of 18 U.S.C. § 2252(a)(2), and Possession of Matters Containing Images of Minors Engaged in Sexually Explicit Conduct in violation of 18 U.S.C. § 2252(a)(4)(B). (Dkt. No. 17.) The indictment also includes a criminal forfeiture allegation under 18 U.S.C. § 2253(a)-(b). (Id.) On November 12, 2015, Defendant was arraigned on the indictment and pleaded not guilty to the charges. (Dkt. No. 18.)
On June 14, 2016, Defendant appeared before Magistrate Judge Jill Burkhardt and entered a plea of guilty to Count One of the Indictment, charging him with Advertising Child Pornography, pursuant to a plea agreement. (Dkt. Nos. 32, 34.) On June 30, 2016, this Court accepted the guilty plea. (Dkt. No. 36.)
On February 3, 2017, Defendant filed a Motion to Withdraw his Guilty Plea. (Dkt. Nos. 44.) On April 14, 2017, the Court granted Defendant's motion, and Defendant's plea was withdrawn. (Dkt. No. 55.)
On April 28, 2017, Defendant filed the instant Motion to Suppress Evidence as a Result of an Illegal Search. (Dkt. No. 57.) Defendant moves to suppress the four image files tagged by Google's proprietary hashing technology, all evidence subsequently seized from Defendant's email account and residence, and all evidence seized from Arriola's email account and statements. (Id. at 14.) The Government opposed the motion on May 11, 2017. (Dkt. No. 62.) Defendant replied on May 15, 2017. (Dkt. No. 65.) On May 18, 2017, the Court conducted an evidentiary hearing and took the matter under submission. (Dkt. No. 67.)
Does a government agent's visual examination of a child pornography image that was digitally matched by an ISP's proprietary hashing technology to a duplicate image in the ISP's repository of confirmed child pornography images constitute a significant expansion of the ISP's earlier private search? It does not. While SA Thompson's visual inspection of four child pornography images flagged by Google's proprietary hashing technology expanded upon Google's private search, it was not a significant expansion. No search occurred for purposes of the Fourth Amendment. Defendant's motion to suppress is
The contents of Defendant's email messages are protected by the Fourth Amendment. The Supreme Court has long held that the government cannot engage in a warrantless search of the contents of sealed mail. United States v. Forrester, 512 F.3d 500, 511 (9th Cir. 2008) (citing cases). Analogizing email to physical mail, the Ninth Circuit concluded that the privacy interests in email and physical mail are identical. Id. Accordingly, while external information, such as the to/from addresses of e-mail messages, does not fall within the protective sweep of the Fourth Amendment, the contents of email messages may deserve Fourth Amendment protection. Id. at 510-11.
However, Defendant lacked an objectively reasonable expectation of privacy in the four child pornography files he uploaded to his Google email account. While Defendant held a subjective expectation of privacy in his Google email account at all relevant times, (see Dkt. No. 57-2, Declaration of Luke Noel Wilson ("Wilson Decl.") ¶¶ 3-5), Defendant's subjective expectation of privacy in the four child pornography attachments was not objectively reasonable or justifiable under the circumstances, see Smith v. Maryland, 442 U.S. 735, 740 (1979) (requiring an individual's subjective expectation of privacy to be objectively reasonable).
Specifically, Defendant agreed to Google's November 11, 2013 Terms of Service when he created his Google email account on March 13, 2014, and agreed to Google's April 14, 2014 Terms of Service by continuing to use his account. The April 14, 2014 Terms of Service alerted users that Google may "investigat[e] suspected misconduct," "review content to determine whether it is illegal or violates [Google's] policies," and "remove or refuse to display content that [Google] reasonably believe[s] violates [Google's] policies or the law."
In any event, the Court's resolution of the instant motion to suppress does not depend upon the finding that Defendant lacked an expectation of privacy in the four child pornography files he uploaded to his Google email account.
"The Fourth Amendment's proscriptions on searches and seizures are inapplicable to private action." United States v. Tosti, 733 F.3d 816, 821 (9th Cir. 2013) (citing United States v. Jacobsen, 466 U.S. 109, 113-14 (1984)). "Once frustration of the original expectation of privacy occurs, the Fourth Amendment does not prohibit governmental use of the now-nonprivate information." Id. (quoting Jacobsen, 466 U.S. at 117). Rather, the Fourth Amendment "is implicated only if the authorities use information with respect to which the expectation of privacy has not already been frustrated." Id. (quoting Jacobsen, 466 U.S. at 117). Accordingly, any "additional invasions of . . . privacy by the government agent must be tested by the degree to which they exceed[] the scope of the private search." Id. (quoting Jacobsen, 466 U.S. at 115).
Jacobsen is instructive. In Jacobsen, employees of Federal Express, a private freight carrier, were examining a damaged package pursuant to a company policy regarding insurance claims when they observed a white powdery substance concealed within eight layers of wrappings. 466 U.S. at 111. The employees opened the package, found a ten-inch tube within the box, cut open the tube, and saw a series of four layers of zip-lock plastic bags, the innermost of which contained white powder. Id. The employees subsequently notified the Drug Enforcement Administration ("DEA"), placed the bags back into the tube, and then returned the tube back into the box. Id. The first DEA agent to arrive saw that the tube had been slit open. Id. He first removed the four plastic bags from the tube and saw the white powder. Id. He next opened the four bags, removed a trace of the white substance with a knife blade, and performed a field test on the substance. Id. at 111-12. The field test identified the powder as cocaine. Id. at 112. Subsequently, other DEA agents arrived, conducted a second field test, rewrapped the package, and obtained a warrant to search the location to which the package was addressed. Id.
The Supreme Court concluded that the wrapped parcel was an "effect" within meaning of the Fourth Amendment, given that "[l]etters and other sealed packages are in the general class of effects in which the public at large has a legitimate expectation of privacy." Id. at 114. The Supreme Court divided the invasions of privacy of the wrapped parcel into three steps. First, the Supreme Court observed that "[t]he initial invasions of [the] package were occasioned by private action. Those invasions revealed that the package contained only one significant item, a suspicious looking tape tube. Cutting the end of the tube and extracting its contents revealed a suspicious looking plastic bag of white powder." Id. at 115. These invasions "did not violate the Fourth Amendment because of their private character." Id.
Next, the Supreme Court broke down the DEA agents' invasions of privacy into two steps: "first, they removed the tube from the box, the plastic bags from the tube and a trace of powder from the innermost bag; second, they made a chemical test of the powder." Id. at 118. The first set of government actions did not violate the Fourth Amendment. "The agent's viewing of what a private party had freely made available for his inspection did not violate the Fourth Amendment," even if the white powder was not initially in plain view, because there was a "virtual certainty that nothing else of significance was in the package" and that the agent could "learn nothing that had not previously been learned during the private search." Id. at 118-19. After the private search, "the package could no longer support any expectation of privacy." Id. at 121. Nor was the agent's warrantless seizure of the package and its contents unreasonable under the Fourth Amendment. Id. at 119-20.
Id. at 121-22.
The second set of government actions also did not violate the Fourth Amendment. "The field test at issue could disclose only one fact previously unknown to the agent— whether or not a suspicious white powder was cocaine." Id. at 122. Such a test "does not compromise any legitimate interest in privacy." Id. at 123. The Supreme Court clarified that its conclusion did not depend on the result of the test. Id.
Id.
Following Jacobsen, the Ninth Circuit concluded in Tosti that no search had occurred within the meaning of the Fourth Amendment, where the government detectives' searches of child pornography on the defendant's computer derived from a private party's original search. See 733 F.3d at 821. In Tosti, the defendant took his computer to a CompUSA store for service. Id. at 818. A CompUSA employee was servicing the defendant's computer when he discovered and opened various folders and subfolders containing many child pornography images. Id. at 818-19. The employee contacted the police, and two detectives responded to the call and arrived at the store. Id. at 819. Upon discerning that thumbnails of pictures on the screen depicted child pornography, the first detective instructed the CompUSA employee to open the images in a slideshow format so that he could view the enlarged images one by one. Id. The second detective scrolled through the thumbnail images on the screen and observed that the images depicted child pornography. Id. The detectives then seized the defendant's computer, and a search warrant for the defendant's computer, residence, office, and two vehicles was subsequently obtained based on the detectives' observations. Id.
The Ninth Circuit upheld the district court's denial of the defendant's motion to suppress the fruits of the detectives' warrantless search of his computer. Id. at 821. To start, the defendant had "voluntarily tak[en] his computer to CompUSA for repairs [and] `understood that a technician at CompUSA would have temporary custody of the computer, and would inspect it as needed to complete the requested repairs.'" Id. The detectives' warrantless viewing of the photographs did not trigger the Fourth Amendment because the CompUSA employee's "prior viewing of the images had extinguished [the defendant's] reasonable expectation of privacy in them." Id. The detectives had viewed only the photographs that the private employee had already viewed. Id. at 822. The detectives' viewing of enlarged versions of the thumbnails was not a significant expansion of the private party's search, as "the police learned nothing new through their actions." Id.
Applying Jacobsen and Tosti to the facts at hand, the Court concludes that Google conducted a private search of the contents of Defendant's email, and that the government's expansion of Google's private search was not significant.
As detailed in the Court's factual findings, Google voluntarily undertakes a multi-tiered process to screen user content for child pornography. A team of Google employees receives training from counsel on the federal statutory definition of child pornography and how to recognize child pornography on Google's products and services. After at least one trained employee has viewed an image and determined that it is apparent child pornography, the offending image is assigned a unique hash value and added to Google's repository of hashes of apparent child pornography. Google's product abuse screening system then searches its products and services for hash values that match hash values already catalogued in its repository of known child pornography images. As a result of this extensive screening process, all images tagged by Google's proprietary hashing technology—including the four uploaded files Google discovered in Defendant's email— are duplicate images of confirmed child pornography images that have already been viewed and previously identified by trained Google employees.
Google's extensive screening process constituted a private search of Defendant's email account. This conclusion is in line with Judge Kozinski's observations about hashing technology in United States v. Comprehensive Drug Testing, Inc., 621 F.3d 1162 (9th Cir. 2010) (Kozinski, J., concurring). Judge Kozinski acknowledged that "the government has sophisticated hashing tools at its disposal that allow the identification of well-known illegal files (such as child pornography) without actually opening the files themselves," and offered the admonition that "[t]hese and similar search tools should not be used without specific authorization in the warrant, and such permission should only be given if there is probable cause to believe that such files can be found on the electronic medium to be seized." 621 F.3d at 1179. If the government may not use such sophisticated hashing tools and similar search technology without specific authorization in a warrant, the use of hashing technology to identify illegal files like child pornography certainly constitutes a search. Here, by extension, Google's use of its proprietary hashing technology to screen Defendant's email account constituted a private search.
SA Thompson's viewing of the four child pornography attachments arguably expanded upon Google's private search. At least one Google employee had previously viewed each of the four child pornography images Defendant uploaded to his account; however, an employee did not open the four file attachments after Google's hashing technology tagged the four images as child pornography. Nevertheless, even assuming arguendo that SA Thompson's viewing of the four images was an expansion of Google's private search, it was not a significant expansion.
The facts of this case are even stronger than those of Jacobsen. Here, Google's private search far exceeded the Federal Express employees' private search of the damaged parcel in Jacobsen. Whereas the Federal Express employees merely suspected that the white powder in the damaged parcel was contraband, Google had previously confirmed that each of the four images in Defendant's email was child pornography. SA Thompson already knew, before visually examining the images, from the "A1" classification that each of the four images depicted a prepubescent minor engaged in a sex act. (See Dkt. No. 62-3 at 14, Ex. 3.) Compared to Jacobsen, there was even more of a "virtual certainty" that SA Thompson could "learn nothing that had not previously been learned during the private search." Jacobsen, 466 U.S. at 118-19.
Moreover, not only did Google search Defendant's email, Google extracted the four child pornography images from the email. Unlike the DEA agents in Jacobsen, who removed the tube from the box, removed the innermost plastic bags from its enclosing layers, and removed a trace amount of cocaine powder from the innermost bag for testing, SA Thompson did not perform any analogous actions. Rather, because Google performed the removal functions on the front end, SA Thompson already had access to (and indeed, only had access to) the four illegal files Google extracted from Defendant's email. Accordingly, like the detectives in Tosti who viewed images a private employee had determined to be child pornography, SA Thompson's viewing of the four images allowed SA Thompson to "learn[] nothing new." Tosti, 733 F.3d at 822. SA Thompson's expansion of Google's private search "d[id] not expose noncontraband items that otherwise would remain hidden from public view."
Defendant cites United States v. Ackerman, 831 F.3d 1292 (10th Cir. 2016), reh'g denied (Oct. 4, 2016), in support of his argument that the Government unconstitutionally expanded upon Google's private search. (Dkt. No. 65 at 2-3.) However, in Ackerman, the state actor not only viewed the child pornography file that was the subject of AOL's private hash search, but opened the email itself and viewed three other non-child pornography attachments. Ackerman, 831 F.3d at 1306-07. There, these actions expanded upon AOL's private search and "risk[ed] exposing private, noncontraband information that AOL had not previously examined." Id. at 1307. Here, SA Thompson viewed only the four child pornography files that were the target of Google's private search, and nothing more. As such, "`the governmental conduct could [have] reveal[ed] nothing about noncontraband items.'" Id. at 1306 (quoting Jacobsen, 466 U.S. at 124 n.24)).
Although the Government's remaining arguments do not affect disposition of the instant motion, the Court nonetheless addresses the Government's alternative arguments for instructive purposes.
"The mere inclusion of tainted evidence in an affidavit does not, by itself, taint the warrant or the evidence seized pursuant to the warrant. A reviewing court should excise the tainted evidence and determine whether the remaining, untainted evidence would provide a neutral magistrate with probable cause to issue a warrant." United States v. Vasey, 834 F.2d 782, 788 (9th Cir. 1987) (citing United States v. Driver, 776 F.2d 807 (9th Cir. 1985)).
Here, excising the tainted evidence from the affidavit would not support issuance of the search warrant for Defendant's email account. (See Dkt. No. 62-4, Ex. 4.) Probable cause for the warrant was premised upon CyberTipline Report # 5074778, SA Thompson's review and description of the four images, and the subscriber information provided by Google and AT&T Internet Services. (Id. at 5-6.) SA Thompson's affidavit did not contain any mention of hash values, any description of Google's screening process for child pornography, or the A1 classification Google assigned to the four images. (See generally Dkt. No. 62-4, Ex. 4.) Had the affidavit included information about Google's screening process for child pornography, there may have been sufficient information in the affidavit to establish probable cause, even after excision of the tainted evidence. However, after removing SA Thompson's description of the four images from the affidavit, the only remaining salient information states that "Google became aware of four (4) image files depicting suspected child pornography which were uploaded to an email on June 4, 2015." (Id. at 5.) This bare statement, standing alone, would be insufficient to establish probable cause for issuance of a search warrant for Defendant's entire email account.
The good faith exception to the exclusionary rule originated in United States v. Leon, 468 U.S. 897 (1984). In Leon, the Supreme Court "held that the Fourth Amendment exclusionary rule should not be applied so as to bar the use in the prosecutor's case-in-chief of evidence obtained by officers acting in reasonable reliance on a search warrant issued by a detached and neutral magistrate but ultimately found to be invalid." United States v. Vasey, 834 F.2d at 789 (citing Leon, 468 U.S. at 900, 926).
In Vasey, the Ninth Circuit rejected the government's argument that the good faith exception applied, where the officer "conducted an illegal warrantless search and presented tainted evidence obtained in this search to a magistrate in an effort to obtain a search warrant." Id. There, "[t]he search warrant was issued, at least in part, on the basis of this tainted evidence. The constitutional error was made by the officer in this case, not by the magistrate as in Leon." Id. Observing the Supreme Court's admonition that "the exclusionary rule should apply (i.e. the good faith exception should not apply) if the exclusion of evidence would alter the behavior of individual law enforcement officers or the policies of their department," the Ninth Circuit concluded that the officer's "conducting an illegal warrantless search and including evidence found in this search in an affidavit in support of a warrant is an activity that the exclusionary rule was meant to deter." Id.
Here, if SA Thompson's warrantless viewing of the four images constituted an illegal search, the good faith exception would not apply to prevent operation of the exclusionary rule. Unlike in Leon, Defendant alleges that SA Thompson made the constitutional error in this case. The magistrate's issuance of the warrant and consideration of the evidence would not "sanitize the taint of the illegal warrantless search." Id. An illegal warrantless search would be precisely the sort of conduct the exclusionary rule was meant to deter. See id.; see also United States v. Camou, 773 F.3d 932, 945 (9th Cir. 2014) ("The Supreme Court has never applied the good faith exception to excuse an officer who was negligent himself, and whose negligence directly led to the violation of the defendant's constitutional rights.").
In sum, if SA Thompson's warrantless viewing of the four images constituted an illegal search, neither excising the tainted evidence from the affidavit nor the good faith exception would prevent operation of the exclusionary rule. Nevertheless, as detailed above, supra Part II.B, SA Thompson's visual examination of the four images did not significantly expand upon Google's private search, and thus did not constitute a search within meaning of the Fourth Amendment.
For the foregoing reasons, the Court
