United States v. DiTomasso, 2014 WL 5462467 (S.D.N.Y.) October 28, 2014

*This is a District Court Judges’ opinion and has not yet withstood appellate scrutiny.

Facts: Defendant is charged with production and transportation of child sexual abuse images. The evidence supporting some of the charges comes from NCMEC Cybertipline reports. Those reports came to NCMEC from AOL Inc., and Omegle Inc. (Omegle is a social media platform where two strangers are paired together for chatting, either via video or text).

Issues: Whether defendant has a reasonable expectation of privacy (REP) in the content of his emails and chats. And whether agreeing to the terms of use of AOL and Omegle constituted consent to those searches.

* Not addressed in this opinion, is whether Omegle’s search was a “private search” or done at the behest of law enforcement (think Ackerman and Keith). The Judge has ordered additional pleadings on this issue, so more will be revealed.

AOL and CyberTipline Reports

AOL uses IDFP and pDNA to scan attachments sent/received by its users. IDFP is an automated program that scans images sent, saved, or forwarded from an AOL email account.  AOL has a database of more than 100,000 hash values of pictures meeting the definition of child sexual abuse images.  If the IDFP hits on a hash value within the database, the email is captured, AOL terminates the users email account (pursuant to its terms of service).  Next, AOL generates a report and an email to send to NCMEC’s CyberTipline (pursuant to statutory requirement).  The report includes the captured email, the attached file, the user’s account information, and the IP address of the user at the time of the email.

(This is the Judge’s description of AOL’s pDNA process, flawed though it is) Using the pDNA program, if a hash value is close to one known to be a child sexual abuse image, it will be quarantined. An AOL employee will personally review the image to determine if it meets the definition of child sexual abuse images. If it does, AOL generates a CyberTipline report as detailed above.

Omegle and CyberTipline Reports

Omegle monitors the chats of its users for inappropriate content via automated program. If content is flagged, the content is reviewed by an employee. If the content in the opinion of the employee is deemed to be child sexual abuse images, a NCMEC CyberTipline report is filed.

Defendant’s Expectations of Privacy

The court goes through the typical 4th amendment analysis being sure to also address Smith v. Maryland language that one does not have a legitimate expectation of privacy in information he voluntarily turns over to third parties. The judge also addresses the U.S. v. Knights language from SCOTUS that probation agreements significantly diminish expectation of privacy. (Interesting enough defendant is on probation for possession of child sexual abuse images. Conditions of his probation allow for his probation officer to inspect and access computers, storage devices, and other media at any time.)

The Government argued that defendant has no REP because he made his communications (exchanging emails and chats with other people) in the presence of others. The judge shut that argument down pretty quickly via Katz v. U.S.. However the argument that defendant had no REP because AOL and Omegle warned defendant that they would be monitoring his communications got a little more traction (a little). AOL Inc., has a much stronger terms of service agreement than Omegle in this regard (you can read each of them in the opinion). Ultimately, the court stated that “Fourth Amendment privacy, however, is a context-sensitive question of societal norms. In some domains, people expect information to stay shielded from law enforcement even as they knowingly disclose it to other parties. As the Supreme Court has recognized, workplace desks and hotel rooms are two such domains. In the digital age, electronic communication is another.”

Holding: The judge answered the first issue in the affirmative. Defendant has a REP in his electronic communications.

Consent to Search due to Terms of Service Agreement

Moving on to the second issue, regarding consent the Judge frames the issue by stating there is no question Defendant voluntarily agreed to AOL and Omegle’s policies, the question is what exactly he consented to.

“A reasonable person, having read carefully through the policy, would certainly understand that by using Omegle’s chat service, he was running the risk that another party—including Omegle—might divulge his sensitive information to law enforcement. But this does not mean that a reasonable person would also think that he was consenting to let Omegle freely monitor his chats if Omegle was working as an agent of law enforcement. When Omegle’s policy refers to the “law enforcement [purpose]” behind maintaining IP address records,

it is unclear whether this “purpose” is motivated (1) by Omegle’s independent desire to aid criminal investigations, or (2) by Omegle’s obligations under state or federal law. In other words, it is plausible to interpret the policy as implying that Omegle is required to keep IP address records. So construing the policy, a reasonable user would be unlikely to conclude that Omegle intended to act as an agent of law enforcement. And such a user would be even less likely to conclude that he had agreed to permit such conduct.”

“AOL’s policy is quite different. Not only does it explicitly warn users that criminal activity is disallowed, and that AOL monitors for such activity; the policy also explains that “AOL reserves the right to take any action it deems warranted” in response to illegal behavior, including “terminat [ing] accounts and cooperat[ing] with law enforcement.” The policy also makes clear that AOL reserves the right to reveal to law enforcement information about “crimes[s] that [have] been or [are] being committed.” In contrast to Omegle’s policy, which includes only a passing reference to law enforcement—and which gives no indication of the role Omegle intends to play in criminal investigations—AOL’s policy makes clear that AOL intends to actively assist law enforcement. For this reason, I conclude that a reasonable person familiar with AOL’s policy would understand that by agreeing to the policy, he was consenting not just to monitoring by AOL as an ISP, but also to monitoring by AOL as a government agent. Therefore, DiTomasso’s Fourth Amendment challenge fails as to the emails.”

Holding: Defendant has REP in both his chats and emails. However by agreeing to AOL’s terms of service defendant consented to a search of his emails by law enforcement and thereby waived his 4th amendment rights. The CyberTipline reports (filed by AOL) and derivative evidence gained therefrom are admissible.

Oral argument is set for Novemeber 14th to determine whether the Omegle chats were a private search, thereby not implicating the 4th amendment.

This entry was posted in Defenses, Deleted Files, Fourth Amendment, Search Warrant, Suppression, Technology. Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s