United States v. Hoffman, 2014 WL 6997856 (N.M.Ct.Crim.App.) 11 December, 2014

Facts: AL, a thirteen year old boy reported that while he was walking home alone a Male in an SUV approached him making gestures consistent with fellatio.  After doing this several times, the male asked if AL wanted a ride.  AL declined. A little more than a month later, AL saw the same SUV in the same area and he telephoned his mother.  She picked up AL and they engaged in a high speed chase with the SUV, and copied down the license plate.  Investigators showed up to Appellant’s work to speak with him.  Appellant gave consent to search his barracks and seize any evidentiary items.  After a number of items were collected and placed on Appellant’s desk, appellant revoked his consent.  The agent stopped searching, but sized the items already on the desk.  Several days later, the Special Agent (SA) who took over the case learned of two other identical incidents involving two other similarly aged boys within months of each other. The SA requested via affidavit, authorization to search Appellant’s computer for child pornography. * Note* One avenue to secure authorization to search/seize in a military barracks room is through the Commander (who is said to own those rooms), the other of course is via a magistrate. 

Florida v. Knight, 2014 WL 7243139 (Fla.App. 1 Dist.) December 22, 2014

Facts:  Detective B of the Neptune Beach Police Department was using forensic software to look for images of child sexual abuse being transferred via peer-to-peer networks.  The program would log the IP Address of any computer trading known images of child sexual abuse.  One such IP address was found to be assigned to Comcast.  A subpoena to Comcast revealed the IP address was associated to an address located in Atlantic Beach.  Detective B called the Atlantic Beach Police Department and informed them of the criminal activity.  Detective B asked APD if they wanted to keep the case or have Detective B forward to ICAC of Northeast Florida.  APD kept the case but asked for assistance from Detective B.  At that time there was a mutual aid agreement between the two law enforcement agencies.

Issue: Appellant appeals his conviction of two counts of possession of child sexual abuse images by arguing the trial court erred in denying three motions.  We will only discuss one here, as the other two were affirmed without discussion. The motion sought to suppress all evidence seized as a result of the extra-jurisdictional investigation and search of appellant’s home computer located in Atlantic Beach by Detective B of the Neptune Beach Police Department.

United States v. Gladding, 2014 WL 7399113 (C.A.9 (Cal.)) December 31, 2014

Facts: Appellant was indicted on two counts of possession of child sexual abuse images.  The indictment included that Appellant’s electronic storage devices, including three computers and other hard drives, were subject to forfeiture under 18 U.S.C. 2253 because they contained child sexual abuse images.  Appellant plead guilty to one of the two counts and did not dispute the forfeiture but asked for the Government to return certain noncontraband files.  The Government agreed, but negotiations soon broke down. Appellant filed a motion with the district court for return of the noncontraband files under Fed.R.Crim. Pro 41(g).  Without ruling, the court directed the parties to work it out.  The court did enter a forfeiture order with respect to the contraband items.  Failing to reach a mutually agreeable outcome, appellant filed another motion with the district court for return of the noncontraband items.  Three separate hearings were held on this motion.  The Government contended that it would be unduly costly and difficult to separate contraband from noncontraband files.  At the close of the third hearing, the court denied the motion.

Issue:  Whether the district court erred in denying the motion to return property.

Law: “A person aggrieved … by the deprivation of property may move for the property’s return.” Fed.R.Crim.P. 41(g). The burden of proof on a Rule 41(g) motion depends on when the defendant files the motion.

United States v. Borostowski, 2014 WL 7399074 (C.A.7 (Ill.)), December 31,2014

Facts: An FBI Agent assumed (with consent) the identity of an informant, and used that identity to chat with appellant.  Appellant offered to provide child sexual abuse images in exchange for a web cam session with a child.  Images were sent from Appellant to the FBI, and a search warrant followed.  The facts pertaining to the issue at hand are extensive (it’s obvious the court was not happy with the execution of the search warrant).  The facts presented are limited to the issue we discuss in this blog.   13 law enforcement agents executed the warrant.  They knocked and announced, Appellant opened the door and let them in.  Appellant was grabbed by the arm, brought outside, and handcuffed.  He was made to wait 25 minutes while the house was secured (he was in sweatpants, a t-shirt, no socks or shoes in 40 degree weather).  Once secured he was brought to one of the bedrooms and uncuffed.  Two agents stayed in the room, one blocking the door.  The agents told Appellant what they were there for, and that he was not under arrest.

Appellant was Mirandized, and replied that he wanted to cooperate, “But I think I should have an attorney present.” Agent S told Appellant that he was “a bit unclear of exactly what you mean and what you want,” and suggested that they discuss this further.  Appellant then told the agent that he was “torn and conflicted,” that he wanted to cooperate but that he was also concerned that what he said would be used against him. Agent S asked if Appellant had an attorney in mind and he replied that he did not. Agent S asked who had represented Appellant when he was previously prosecuted for child pornography offenses.

Appellant then named Assistant Federal Public Defender RA, and explained that he had pled guilty in that case and had served time in prison. The agents did not stop the questioning at that time and did not contact Attorney RA because, as Agent N candidly acknowledged, they wanted to continue the interview without a lawyer present. Instead, Agent S told Appellant: “One of the things you can do, I said, is you can start answering questions now. If you choose not to answer a certain question, you can say I don’t want to answer that question. You can stop answering questions at any time during the interview, and, you know, if you choose during the interview to have an attorney, you can do that also.” Agent S also told Appellant that he understood his concerns, that he had “some things [he] had to show him to clear up,” and that he would like Appellant’s cooperation. At that, Appellant agreed to be interviewed and signed the consent portion of the Miranda form. From the introductions to the signing of the consent form, approximately fourteen minutes had elapsed.

United States v. DiTomasso, 2014 WL 5462467 (S.D.N.Y.) October 28, 2014

*This is a District Court Judges’ opinion and has not yet withstood appellate scrutiny.

Facts: Defendant is charged with production and transportation of child sexual abuse images. The evidence supporting some of the charges comes from NCMEC Cybertipline reports. Those reports came to NCMEC from AOL Inc., and Omegle Inc. (Omegle is a social media platform where two strangers are paired together for chatting, either via video or text).

Issues: Whether defendant has a reasonable expectation of privacy (REP) in the content of his emails and chats. And whether agreeing to the terms of use of AOL and Omegle constituted consent to those searches.

* Not addressed in this opinion, is whether Omegle’s search was a “private search” or done at the behest of law enforcement (think Ackerman and Keith). The Judge has ordered additional pleadings on this issue, so more will be revealed.

AOL and CyberTipline Reports

AOL uses IDFP and pDNA to scan attachments sent/received by its users. IDFP is an automated program that scans images sent, saved, or forwarded from an AOL email account.  AOL has a database of more than 100,000 hash values of pictures meeting the definition of child sexual abuse images.  If the IDFP hits on a hash value within the database, the email is captured, AOL terminates the users email account (pursuant to its terms of service).  Next, AOL generates a report and an email to send to NCMEC’s CyberTipline (pursuant to statutory requirement).  The report includes the captured email, the attached file, the user’s account information, and the IP address of the user at the time of the email.

(This is the Judge’s description of AOL’s pDNA process, flawed though it is) Using the pDNA program, if a hash value is close to one known to be a child sexual abuse image, it will be quarantined. An AOL employee will personally review the image to determine if it meets the definition of child sexual abuse images. If it does, AOL generates a CyberTipline report as detailed above.

Omegle and CyberTipline Reports

Omegle monitors the chats of its users for inappropriate content via automated program. If content is flagged, the content is reviewed by an employee. If the content in the opinion of the employee is deemed to be child sexual abuse images, a NCMEC CyberTipline report is filed.

Massachusets v. Rollins, 2014 WL 5470477 (Mass.)) October 30, 2014

Facts: Appellant brought his computer in to a repair shop, where the technician observed more than 1200 images of apparent child pornography, saved them to a thumbdrive, and contacted police.   An officer arrived, confiscated the computer, and called appellant to notify him of the confiscation and request he come down for an interview. Appellant went first to the repair shop where he learned what the technician found, and told the technician those images were probably put there by a friend. During his interview with the police, appellant pulled out the Good Samaritan Defense and told police he was conducting his own special, undercover investigation into the world of child pornography. He told police that once he was finished with his investigation he intended on turning everything over to law enforcement. Appellant acknowledged that he was the owner of the computer and consented to its search.

On forensic examination, more than 6,000 images were recovered from the unallocated space (deleted files). A disc with the images was made for law enforcement. The officer reviewed approximately 1200 of the images on the disc, and printed 12 for prosecution purposes.

A 6-count criminal complaint was filed alleging that appellant possessed images of child pornography on December 30, 2009. Counts 1-5 were premised on a single image for each count, while count 6 was premised on two images.

Appellant was convicted on all 6 counts, after his motion for directed verdict was denied (arguing lack of proof of possession). He was sentenced on counts 1-3 to three concurrent 2 ½ years; for counts 4-6 he was sentenced to an additional three concurrent 2 ½ year sentences; for a total of 5 years.

Issues: What is the proper unit of prosecution for the possession of child pornography pursuant to G.L. c. 272, § 29C. when the defendant is charged with possessing multiple images at the same point in time, from a single internet cache.

Whether the images that made up counts 1-3 were protected speech.

Missouri v. Marquis, 2014 WL 5462316 (Mo.App. W.D.)) October 28, 2014

Facts: The child sexual exploitation charges arise incidentally from a child abuse investigation. One day when L.M. (the daughter of Appellant) was caught playing with her father’s playstation, he hit her in the face with the playstation, spanked her, took away all of her possessions, and made her stand in the corner. According to L.M. her father made her stand in the corner every day during Christmas break of 2009 from the moment she woke up until the moment she went to sleep, except for chores, eating, and restroom breaks (though she was timed for those). Appellant drilled a hole in the doorframe and inserted a camera to monitor his daughter’s movements (she was 14).

When L.M. returned to school she was called to the administrator’s office for skipping school. She told the administrator she was afraid to go home. A call to the child abuse hotline was placed, and an investigator showed up at school. L.M. told the investigator about her abuse, including being hit with belts by Appellant. She was temporarily placed in a teen shelter (with the consent of her parents) until a safety assessment could be conducted.   The investigator went to the house, reviewed some of the footage and began an investigation. 6 days later, Appellant pulled L.M. out of the teen shelter. She was still required to stand in the corner, though she was now allowed to sit down during homework time. L.M. told the investigator she was afraid Appellant was going to kill her. Based on that information as well as the fact that some of the evidence of physical abuse was digitally recorded, a search warrant was sought.

The warrant was executed and a total of 10 computers, 21 hard drives, and 3 external hard drives were siezed.  Forensic analysis revealed a number of videos of L.M. but also some images the examiner believed to be child pornography. A second search warrant was sought and granted for the child pornography. 35 still images of apparent child pornography were found as well as 2 videos of L.M. undressing and in a state of nudity.

Charges/Findings/Sentence: Appellant was charged with three counts of possession of child pornography, one count of child abuse, and one count of endangering the welfare of a child. He was convicted on all counts and sentenced to 20 years for the child pornography, 7 years for the child abuse, and 1 year for endangering the welfare (to be served consecutively).

Issues: First, Appellant argued the trial court abused its discretion in denying the motion for JNOV on the child pornography and child abuse for insufficient evidence. Second, he argued that the court erred in denying his motion for JNOV and mistrial because the state repeatedly introduced prejudicial material (the images of child pornography). Lastly, Appellant argued that one of the charges of child pornography should be vacated because it was beyond the statute of limitations.

United States v. Hite, 2014 WL 5343626 (C.A.D.C.)

Facts: Appellant, a resident of Virginia entered an online chat room and began conversation with an undercover police officer. The undercover’s persona was that he had access to a 12 year old girl and a 3 year old boy, and had previously engaged in sexual activity with each. Appellant was very interested in gaining access to both the 12 year old and 3 year old and told the undercover that he had previously engaged in sexual activity with an 11 year old boy. I will spare you the details about the communications, but the highlights are that he wanted access to each, discussed the use of alcohol to relax the 12 year old, and Benadryl to distort the memory of the 3 year old; as well as the use of “jelly or honey to keep him enticed… to stimulate oral exploration.” When asked by the undercover if Appellant was into the reality of the encounter and not just the fantasy, Appellant was adamant that he was interested. He went into detail about what he had done to the 11 year old on a prior occasion. The undercover told Appellant that he was babysitting the 3 year old fairly soon. They agreed to meet in D.C. a day prior to the babysitting day in order to validate that neither were police officers. Appellant got cold feet and told the undercover that he was suffering from paranoia. To relieve his paranoia, the undercover offered to do a webcam session of “performing fellatio” on the 3 year old. Appellant responded, “Okay, fabulous.” Appellant was arrested in Richmond, the webcam session never took place.  He was convicted, and sentenced to 22 years.

Issues: 1) Does 18 U.S.C. 2422(b) require direct communications with a minor, or do communications with an adult intermediary suffice? 2) Did the lower court err in its jury instructions? 3) Did the lower court err in denying the defense expert witnesses’ testimony?

In the Matter of a warrant for all content and other information associated with the email account xxxxx@gmail.com maintain at premises controlled by Google, Inc. July 2014 (S.D.N.Y.)

* This is a magistrate’s written opinion, and has not yet withstood appellate scrutiny.  However the issues presented are important for future search warrant requests, and for general legal considerations in our cases. You can read the full opinion here Gmail SW.

This opinion is from a magistrate who authorized the seizure of all email associated with the aforementioned gmail account.   This opinion does a terrific job of laying out the state of the law, the splits within the Country, and distinguishing other contrary opinions. This is not a child sexual exploitation case, but the issue presented (seizing/searching all email associated with a particular email account) is integral to our work.

Facts: As part of an investigation into money laundering (and other white collar high tech crimes), an affidavit for a search warrant was submitted seeking to seize and then search all of the email associated with the gmail account of the target of the investigation. The affidavit laid out probable cause to believe that the target of the investigation was using that gmail account to engage in criminal activity, and that other information within that account (including email) would provide evidence of the criminal activity. The warrant calls fo “all content and other information within the Provider’s possession, custody, or control associated with” the email account, including all emails sent, received, or stored in draft form, all address book information, and a variety of other information associated with the account. The search warrant provides that law enforcement personnel “are authorized to review the records produced by the Provider in order to locate” certain specific categories of evidence described in the warrant.

Issue 1: First, is it appropriate to issue a search warrant that allows the Government to obtain all emails in an account even though there is no probable cause to believe that the email account consists exclusively of emails that are within the categories of items to be seized under the search warrant?

Law: The Stored Communications Act of 1986, 18 U.S.C. §§ 2701-2712. Section 2703 of that statute authorizes the Government to obtain the “contents” of an “electronic communication” that is in “electronic storage” or held by a “provider of remote computing service” — such as emails — pursuant to a search warrant under the Federal Rules of Criminal Procedure. See 18 U.S.C. §§ 2703(a), 2703(b)(1)(A). In addition to the Stored Communications Act, 4^th Amendment jurisprudence presents issues to consider when granting a search warrant. Namely, general warrants (with a brief discussion about colonial times).

Ohio v. Fielding, 2014 WL 3512910 (Ohio App. 10 Dist.), July 2014

Facts: This is a typical ICAC investigation using Roundup on the Gnutella Network. The officer made a direct connection with defendant, downloaded images of child sexual exploitation, and captured the IP Address. A subpoena was sent to AT&T for subscriber information. Following receipt, a search warrant was issued for defendant’s home. Items of evidentiary value were found in Defendant’s hard drive. He was charged with possession and pandering images. Defendant moved to suppress the subscriber information and all derivative evidence. Motion was denied. Defendant was convicted. He appeals that conviction.
Issue 1: Whether the Judge erred in denying the motion to suppress the subscriber information and derivative evidence. In other words, is there an expectation of privacy in one’s IP Address and Subscriber Information?
Law: Appellant specifically claims that AT&T wrongfully turned over the subscriber information based on a subpoena, when the ECPA requires a court-order.
The Electronic Communications Privacy Act (“ECPA”), which regulates the disclosure of electronic communications and subscriber information. In pertinent part, 18 U.S.C. 2703(c)(1) provides: “[a] governmental entity may require a provider of electronic communication service or remote computing service to disclose a record or other information pertaining to a subscriber to or customer of such service (not including the contents of communications) only when the governmental entity … (A) obtains a warrant using the procedures described…