Summary
holding that a defendant must establish that a cell phone "consistently conveys granular location information" for the application to collect in order to demonstrate a reasonable expectation of privacy in UGLI data associated with a cell phone
Summary of this case from United States v. BledsoeOpinion
18-CR-872 (VM)
2019-07-03
UNITED STATES of America v. Lloyd KIDD, Defendant.
Elinor Lynn Tarlow, Jacob Gutwillig, Mary Elizabeth Bracewell, Sagar Kananur Ravi, U.S. Attorney's Office, New York, NY, for United States of America. Adam Elewa, Zachary Margulis-Ohnuma, The Law Office of Zachary Margulis-Ohnuma, Florian Miedel, Miedel & Mysliwiec, LLP, Jill R. Shellow, Law Offices of Jill R. Shellow, Victoria Nicole Medley, Perlmutter and McGuinness, PC, New York, NY, for Defendant.
Elinor Lynn Tarlow, Jacob Gutwillig, Mary Elizabeth Bracewell, Sagar Kananur Ravi, U.S. Attorney's Office, New York, NY, for United States of America.
Adam Elewa, Zachary Margulis-Ohnuma, The Law Office of Zachary Margulis-Ohnuma, Florian Miedel, Miedel & Mysliwiec, LLP, Jill R. Shellow, Law Offices of Jill R. Shellow, Victoria Nicole Medley, Perlmutter and McGuinness, PC, New York, NY, for Defendant.
DECISION AND ORDER
VICTOR MARRERO, United States District Judge.
On December 11, 2018, a grand jury returned an indictment charging defendant Lloyd Kidd ("Kidd") with two counts of commercial sex act exploitation of minors in violation of 18 U.S.C. Section 1591 (" Section 1591"). (See "Original Indictment," Dkt. No. 1.)
Kidd moved to dismiss the Original Indictment, request a bill of particulars, and suppress certain evidence. (See "First Motion to Suppress," Dkt. No. 25.) The Court denied Kidd's motion to dismiss the indictment (see "First Suppression Order," Dkt. No. 38), and, after holding an evidentiary hearing, also denied Kidd's motion to suppress evidence (see "Second Suppression Order," Dkt. No. 49). The Court granted in part Kidd's request for a bill of particulars. (See First Suppression Order.)
On June 5, 2019, a grand jury returned a four-count superseding indictment, which added two additional counts charging commercial sex act exploitation in violation of Section 1591. (See "Superseding Indictment," Dkt. No. 29.) Since then, the Government has filed a Second Superseding Indictment, including a fifth count for recording images of a minor engaging in sexually explicit conduct. (See "Second Superseding Indictment," Dkt. No. 52.)
Kidd now moves to dismiss the Superseding Indictment on the same bases as presented in the First Motion to Suppress. (See "Second Motion to Suppress," Dkt. No. 30.) Kidd also moves to suppress records from a telecommunications provider, Pinger, Inc. ("Pinger"), regarding a cellphone number ending in -9064 (the "9064 Number"). Specifically, Kidd moves to suppress the IP address information associated with the 9064 Number and gathered over 581 days (from May 5, 2017 to December 7, 2018), which Pinger provided to the Government pursuant to a subpoena. Kidd argues that this Internet Protocol ("IP") address information effectively provides day-to-day location tracking through his cellphone, and thus constituted a warrantless search, in violation of the Fourth Amendment under the Supreme Court's decision in Carpenter v. United States, ––– U.S. ––––, 138 S. Ct. 2206, 201 L.Ed.2d 507 (2018). In Carpenter, the Court held that cellphone users had a reasonable expectation of privacy in the cell-site location information ("CSLI") retained by the cellular service provider. See Carpenter, 138 S. Ct. at 2217.
"Every device on the Internet is identified by a unique number" called an IP address, which is used "to route information between devices, for example, between two computers." United States v. Ulbricht, 858 F.3d 71, 83-84 (2d Cir. 2017) (internal quotation marks omitted).
The Government opposes both requests. (See "Opposition," Dkt. No. 39.) First, the Government reasserts its argument in opposition to the First Motion to Suppress regarding the dismissal of the indictment. Second, the Government opposes Kidd's request to suppress the IP address information obtained from Pinger, largely supporting its argument by citing several post- Carpenter cases that have declined to extend Carpenter's reasoning to IP address information.
I. DISCUSSION
A. DISMISSAL OF SUPERSEDING INDICTMENT
The Court denied Kidd's motion to dismiss the Original Indictment because it "permissibly tracks the language of the statute under which the Government is charging Kidd." (First Suppression Order at 4.) Considering that the Superseding Indictment follows the same structure and format as the Original Indictment, the Court reaffirms and here applies its previous reasoning and analysis and finds that the Superseding Indictment provides sufficient detail of the crimes with which Kidd is charged to inform him of the Government's accusations against him and enable him to mount an appropriate defense.
As for Kidd's request for a bill of particulars regarding the two new counts in the Superseding Indictment, the Court finds that the Government has provided sufficient details as to the relevant acts in its pretrial filings. For example, the Government's motion in limine described at length the expected testimony of the victims pertaining to the new counts in the Superseding Indictment. (See Dkt. No. 35 at 6-8.)
Therefore, the Court denies Kidd's Second Motion to Suppress seeking to dismiss the Superseding Indictment and requesting a bill of particulars.
B. SUPPRESSION OF PINGER RECORDS
In moving to suppress the records the Government obtained from Pinger, Kidd mainly contends "there is no meaningful distinction between CSLI and IP address data, which can similarly be used to track a user's location." (Second Motion to Suppress at 4.) Specifically, Kidd analogizes CSLI to the location information derived from "[r]eadily available internet resources" which can "translate" an IP address to a user's physical location. (Id. at 2.)
The Government responds by citing several decisions which declined to extend the Carpenter holding to IP address information. After summarizing the case law, the Government focuses on two facts: the IP address information "show[s] information associated with the defendant's affirmative access and use of the internet" and, conversely, does not "show the actual physical location of the user." (Opposition at 4.)
It appears that the treatment of IP address information post- Carpenter presents an issue of first impression in both this Court and district. As such, the issue requires an extensive look at the Supreme Court's reasoning and analysis in Carpenter and its implications for the Fourth Amendment.
1. Carpenter v. United States
In Carpenter, the defendant was the leader in a series of retail store robberies. During the investigation of the robberies, police apprehended four suspects, and launched an investigatory chain leading the Government to serve subpoenas on the defendant's wireless service carriers. In response to the subpoenas, the wireless service carriers produced the defendant's CSLI, or more specifically, the location information of the defendant's cellphone for incoming and outgoing calls. This request totaled nearly 13,000 points of location data over only 129 days. After the district court denied the defendant's motion to suppress the CSLI, the Government introduced maps at trial placing him near the robberies. See 138 S. Ct. at 2211-12.
The CSLI enabled the Government to make such a map because of its frequency and granularity. As the Supreme Court explained, "[e]ach time the phone connects to a cell site, it generates a time-stamped record known as cell-site location information." Id. at 2211. And modern cellphones connect to cell sites more and more frequently each year, thus generating numerous CSLI records on a daily basis, as evidenced by the more than one hundred datapoints collected per day in Carpenter. The granularity of the location data depends on the density of the cell sites in an area. While not as precise as, Global Position System ("GPS") monitoring, for example, in urban environments CSLI can pinpoint users to within several blocks. Telecommunications carriers retain this detailed CSLI for their own business reasons for various lengths of time. See id. at 2211-12, 2218.
GPS uses "three or more network satellites" to triangulate a user's position. United States v. Caraballo, 831 F.3d 95, 99 (2d Cir. 2016).
The Supreme Court found that the request for CSLI required it to reconcile two intersecting sets of cases. "The first set of cases addresses a person's expectation of privacy in his physical location and movements." Id. at 2215. Under this set, a person has no reasonable expectation of privacy in his or her movements in a car from place to place. See id. (citing United States v. Knotts, 460 U.S. 276, 103 S.Ct. 1081, 75 L.Ed.2d 55 (1983) ). However, this set of cases circumscribes that holding when faced with more pervasive, augmented, and sophisticated surveillance methods enabled by technology. Thus, in United States v. Jones, 565 U.S. 400, 132 S.Ct. 945, 181 L.Ed.2d 911 (2012), the Supreme Court found an unlawful trespass when the FBI, without a warrant, installed a GPS tracking device on the defendant's car for twenty-eight days. Critically, the GPS monitoring revealed "every movement" of the defendant in that vehicle. Jones, 565 U.S. at 430, 132 S.Ct. 945.
The second set of cases involves the third-party doctrine as an exception to the application of the Fourth Amendment's protections. The broad principle of the doctrine provides that "a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties." Carpenter, 138 S. Ct. at 2216 (internal quotation marks omitted). The specific examples explaining that principle arise from a pair of Supreme Court decisions in the 1970s.
In the first case, the Supreme Court found that the defendant had no reasonable expectation of privacy in bank records the Government subpoenaed while investigating tax fraud, because the defendant took "risk, in revealing his affairs to another, that the information [would] be conveyed by that person to the Government." See United States v. Miller, 425 U.S. 435, 443, 96 S.Ct. 1619, 48 L.Ed.2d 71 (1976).
In the second case, and perhaps more apt comparison for IP address information, the Supreme Court found that recording the outgoing phone numbers dialed on a landline phone was not a search, because the subscriber "know[s] ... that the numbers are used by the telephone company ‘for a variety of legitimate business purposes,’ including routing calls." Carpenter, 138 S. Ct. at 2216 (quoting Smith v. Maryland, 442 U.S. 735, 743, 99 S.Ct. 2577, 61 L.Ed.2d 220 (1979) ).
Applying these principles, the Carpenter Court found that CSLI sufficiently implicated the concerns described in the first line of cases regarding privacy of one's movements to justify a narrow exception to the second line regarding the third-party doctrine. The Court began with the principle, derived from Jones, that individuals have a "reasonable expectation of privacy in the whole of their physical movements." Id. at 2217. The Supreme Court then recognized that the ubiquity of the modern cellphone, coupled with sophisticated surveillance methods enabled by technology, substantially threatens that expectation.
Specifically, CSLI threatens the expectation of privacy in one's movements because the technology is cheap, retrospective, and precise. Nearly everyone has a cellphone that "faithfully follows" them nearly everywhere. Id. at 2218. The cellphone's ubiquity and the CSLI it generates provide the Government a "sweeping mode[ ] of surveillance" and the power of "near perfect surveillance, as if it had attached an ankle monitor to the phone's user." Id. This surveillance can be achieved with much less effort than would be required to physically follow someone. In fact, for these reasons, the Court stressed that CSLI "present[s] even greater privacy concerns than the GPS monitoring of a vehicle [the Supreme Court] considered in Jones." Id.
In light of these concerns implicating one's reasonable expectation of privacy "in the whole of [one's] physical movements," the Court found that the third-party doctrine should not extend to "these novel circumstances." Id. at 2217. Thus, CSLI was "a qualitatively different category" of information from the telephone numbers and bank records implicated by Smith and Miller. Id.
Ultimately, according to the Carpenter Court, the "detailed, encyclopedic, and effortlessly compiled" log created by CSLI "provides an all-encompassing record of the holder's whereabouts." Id. at 2217. For these reasons, the collection of CSLI violates the expectation of privacy "in the whole of [one's] physical movements," id. at 2217, even if that data implicates just seven days, id. at 2217 n.3.
In support of its holding, the Court addressed two concerns which were highlighted by the dissent and which are particularly relevant to IP address information at issue here. First, the Court recognized that CSLI does not provide the same granular location data that the GPS monitoring in Jones did. Even so, the Court emphasized that CSLI provides sufficient detail to permit the Government to "deduce a detailed log of [the defendant's] movements." Id. Perhaps more importantly, the Court had to "take account of more sophisticated systems that are already in use or in development." Id. at 2218 (quoting Kyllo v. United States 533 U.S. 27, 36, 121 S.Ct. 2038, 150 L.Ed.2d 94 (2001) ). Indeed, "[t]he accuracy of CSLI is rapidly approaching GPS-level precision." Id. at 2219.
Second, the Court circumscribed Carpenter to preserve its prior third-party doctrine holdings: "[o]ur decision today is a narrow one." Id. at 2220. Carpenter explicitly does not "disturb the application of Smith and Miller" and the Court declined to "address other business records that might incidentally reveal location information." Id.
2. IP Address Cases
Prior to Carpenter, numerous courts, including the Court of Appeals for the Second Circuit, had determined that the Government could collect IP address information without a warrant. These cases typically relied on the third-party doctrine and analogized IP address information to information historically considered voluntarily disclosed to third parties, such as "envelope markings" or telephone numbers "captured by a pen register." See, e.g., United States v. Ulbricht, 858 F.3d 71, 97 (2d Cir. 2017).
see, e.g., United States v. Ulbricht, 858 F.3d 71, 97 (2d Cir. 2017) ; United States v. Caira, 833 F.3d 803, 806-08 (7th Cir. 2016) ; United States v. Wheelock, 772 F.3d 825, 828-29 (8th Cir. 2014) ; United States v. Christie, 624 F.3d 558, 574 (3d Cir. 2010) ; United States v. Bynum, 604 F.3d 161, 164 (4th Cir. 2010) ; United States v. Perrine, 518 F.3d 1196, 1205 (10th Cir. 2008) ; United States v. Forrester, 512 F.3d 500, 510-11 (9th Cir. 2008).
As regards the third-party doctrine as it applies to the collection of IP address information, not much has changed since Carpenter. Every court to consider the application of Carpenter in this context has declined to extend its reasoning to IP address information. Moreover, most courts have adopted a categorical approach holding that users have no reasonable expectation of privacy in such IP address information.
For example, the Court of Appeals for the Fifth Circuit, relying on the explicitly undisturbed historical holdings outlined in Carpenter, found that IP addresses remain "business records that might incidentally reveal location information" and thus obtainable without a warrant under the third-party exception. See United States v. Contreras, 905 F.3d 853, 857 (5th Cir. 2018) (quoting Carpenter, 138 S. Ct. at 2217 ). In that case, the defendant sought to suppress IP address information associated with his username on Kik, a smartphone messaging application. In a concise treatment of the issue, the Contreras court reasoned that the location concerns at issue in Carpenter were not at issue there because the IP address information revealed only the defendant's residence, not his "day-to-day" movement. Id.
More recently, the Court of Appeals for the First Circuit analyzed the impact of Carpenter at length and found that the defendant had no reasonable expectation of privacy in IP address information. See United States v. Hood, 920 F.3d 87 (1st Cir. 2019). In Hood, as in Contreras, the defendant sought to suppress IP address information associated with his username on Kik. Id. at 88-89.
In declining to extend Carpenter to IP address information, the Hood court identified three differences between IP address information and CSLI. First, the court emphasized that the request for IP address information "concerned [the defendant's] internet activity only on Kik and only over a four-day span." Id. at 92. Second, the court contrasted the active steps required by users to generate IP address information with the passive tracking of a cellphone for every call, text message, email, or update the cellphone receives. That is, "an internet user generates [ ] IP address data ... only by making the affirmative decision to access a website or application." Id. Third, the court distinguished the types of information conveyed by the two technologies. Specifically, "IP address data that the government acquired from Kik does not itself convey any location information.... By contrast, CSLI itself reveals -- without any independent investigation -- the (at least approximate) location of the [cellphone] user who generates that data simply by possessing the phone." Id.
In sum, the Hood court found that the location data conveyed by IP address information did not warrant the same departure from the third-party doctrine that CSLI compelled.
Shortly after Hood, the First Circuit again upheld the warrantless collection of IP address information in United States v. Morel, 922 F.3d 1 (1st Cir. 2019). In that case, after identifying three images of child pornography on a popular image-hosting website, law enforcement officers obtained the IP addresses from which the images were uploaded onto the image-hosting website. See id. 922 F.3d at 4. The court largely followed its reasoning in Hood in denying defendant's suppression motion and upholding the Government's warrantless collection of IP address information.
No other federal court of appeals has considered whether Carpenter requires reexamining a person's expectation of privacy in IP address information. However, several district courts have considered this issue. Two cases in particular are worth addressing in greater detail.
Most recently, the court in United States v. Jenkins considered a motion to suppress IP address information collected from August 2015 to February 2016 for a Kik username. No. 18 CR 181, 2019 WL 1568154, at *1 (N.D. Ga. Apr. 11, 2019). The court found that the defendant did not show that the location information implicated "tracking a person's movements" with "near perfect surveillance" per Carpenter. Id. at *4 (internal quotation marks omitted). Instead, the court found that "IP address information merely shows the location at which a device accesses the internet during a specific session. It does not follow that person around. Indeed, it does not even identify the user, just the location of. internet access." Id.
Then, a few months before Hood, a district court within the First Circuit found that, as in the case of "the records of dialed numbers kept by a telephone company," the defendant had no reasonable expectation of privacy in IP address information. United States v. Monroe, 350 F. Supp. 3d 43, 49 (D.R.I. 2018). There, law enforcement officers obtained the IP address information for any device that uploaded or downloaded content from twenty-nine target URLs containing child pornography. See id. at 44-45. The defendant moved to suppress certain collected IP address information based on Carpenter.
The court denied the motion, on the grounds that the IP address information did not provide an "exhaustive chronicle" of his physical or digital activities. Id. at 48. The court reasoned that an IP address provides only "the location at which one of any number of computer devices may be deployed, much like a telephone number can be used for any number of telephones." Id. The court implied that an IP address was less intimately associated with a person than CSLI: a "subscriber to whom a certain IP address was assigned may not be the same person who used the Internet connection for illicit purposes." Id. at 49-50 (internal quotation marks omitted).
Finally, several other district courts have relied on reasoning similar to Hood, Jenkins, and Monroe, albeit often in lesser detail. See United States v. Tolbert, No. 14 CR 3761, 2019 WL 2006464, *3 (D.N.M. May 7, 2019) (finding no reasonable expectation of privacy in records from internet service and email providers, in part, because "the information does not provide comprehensive, detailed information about [the defendant's] movements over an extended period of time"); United States v. Germain, No. 18 CR 26, 2019 WL 1970779, at *4 (D. Vt. May 3, 2019) (finding no reasonable expectation of privacy in internet service company records obtained via subpoena after the Government collected IP address information for defendant's email account through a search warrant served on Google); United States v. McCutchin, No. 17 CR 1517, 2019 WL 1075544, at *3 (D. Ariz. Mar. 7, 2019) (analogizing IP address information to the return address on envelopes to find that the defendant did not have a privacy interest "in the IP address used to connect his home with the internet"); United States v. Felton, 367 F. Supp. 3d 569, 575 (W.D. La. 2019) (applying third-party doctrine to find that there is no reasonable expectation of privacy in IP address information associated with defendant's access of the United States Postal Service website to track a package of methamphetamine); United States v. Rosenow, No. 17 CR 3430, 2018 WL 6064949, at *10-11 (S.D. Cal. Nov. 20, 2018) (finding no reasonable expectation of privacy in "recent" IP address information associated with Yahoo.com and Facebook.com accounts).
Considering the preceding detailed account of the post- Carpenter treatment of a person's reasonable expectation of privacy in IP address information as the applicable doctrine, the Court now turns to the Pinger records at issue in this case.
3. Application
The legal question Kidd's Second Suppression Motion presents is whether Kidd had a reasonable expectation of privacy in the IP address information produced by Pinger. Kidd "bears the burden of showing that he had a reasonable expectation of privacy" in that information. See, e.g., United States v. Sparks, 287 F. App'x 918, 919 (2d Cir. 2008) (citing California v. Greenwood, 486 U.S. 35, 39, 108 S.Ct. 1625, 100 L.Ed.2d 30 (1988) ).
Like the Supreme Court in Carpenter, this Court is faced with two competing "lines" of cases that it must endeavor to reconcile. One line of cases, decided both before and after Carpenter, finds that defendants have no reasonable expectation of privacy in IP address information. The other "line" consists of Carpenter itself, which found unique technical considerations that warranted a departure from the third-party doctrine when it comes to tracking a person's movements through CSLI. These doctrinal approaches collide when the IP address information collected involves a cellphone. Put differently: what expectation of privacy does a person have in his or her cellphone's IP address information?
As described at length above, the Court in Carpenter highlighted the following considerations about CSLI when holding that cellphone users have a reasonable expectation of privacy in CSLI, despite the third-party doctrine: (1) CSLI is widely retained and easily obtained by the Government; (2) CSLI can be obtained retroactively for discrete intervals over a long period of time; (3) CSLI provides relatively precise location data, and is becoming more and more precise; (4) cellphones constantly generate CSLI without any action on the user's part; and (5) cellphones are ubiquitous in modern life. Taken together, these considerations result in the Government's ability to generate a "detailed and comprehensive record of a person's movements." 138 S. Ct. at 2217.
None of the post- Carpenter cases described above conclusively addresses each of these considerations in a factually analogous setting.
Many of the cases appear to be premised on finding that the IP address information revealed only the defendant's home location, and thus could not track the whole of defendant's movements. See Contreras, 905 F.3d at 857 (holding that the subpoenaed "records revealed only that the IP address was associated" with a residence and thus "had no bearing on any person's day-to-day movement"); Jenkins, 2019 WL 1568154, at *1 (IP address information "does not follow that person around"); McCutchin, 2019 WL 1075544, at *3 (no privacy interest "in the IP address used to connect his home with the internet"); Monroe, 350 F. Supp. 3d at 44, 49 (IP address information that disclosed the IP address assigned to defendant's residence did not provide an "exhaustive chronicle of his physical or digital activities" (internal quotation marks omitted)). However, IP address information associated with a smartphone messaging application like Pinger is not necessarily limited to one's home, like a personal computer might be.
Other cases highlight the relatively limited nature of the IP address information requested by the Government. See, e.g., Morel, 922 F.3d at 4 (IP address information associated with the uploading of three images); Felton, 367 F. Supp. 3d at 575 (IP address information associated with specific visits to a website); Rosenow, 2018 WL 6064949, at *10-11 ("recent" IP address information collected); Monroe, 350 F. Supp. 3d at 49 (IP address information collected only for certain URLs). Although in those cases the Government's requests were more limited, here, the Government requested 581 days of Kidd's records from Pinger.
Even Hood, which also involves IP address information from a smartphone messaging application, is factually dissimilar to the present case due to the limited timeframe of data collected. See Hood, 920 F.3d at 92 (four days of information collected). Further, Hood sidestepped the question of whether IP address information is capable of revealing the whole of a person's movement, ignoring many of the other Carpenter considerations that might justify an exception to the third-party doctrine.
In contrast to these post- Carpenter cases, Kidd identifies numerous considerations he contends present similarities between the concerns about CSLI and his IP address information. Both data types are cheap and easy to obtain by law enforcement officer via a simple subpoena. And as is evident from the logs the Government produced to Kidd, IP address information may be obtained retroactively.
Further, it appears that IP address information may convey location information with similar degrees of specificity and required investigatory follow-up as CSLI does. However, the record here is underdeveloped on precisely what steps are involved in converting each data type into digestible location information and any material differences between those methods.
For example, as Kidd points out, triangulating "time and angle of signals hitting" cell towers using CSLI is not always a trivial task. ("Reply," Dkt. No. 44, at 4 (quoting Carpenter, 138 S. Ct. at 2219 ).) Moreover, triangulating a phone's location relative to a cell tower is useful only insofar as the Government knows where the cell tower is located on a map, which also requires further investigatory follow-up.
Any physical location derived from IP address information also requires some limited investigatory follow-up. To be sure, an IP address does not refer to a physical location itself. This fact constitutes a distinction emphasized by the Hood court's ruling that IP address information "does not itself convey any location information." 920 F.3d at 92. But that fact may be a distinction without a difference. Practically, telecommunications providers assign IP addresses to discrete physical locations, enabling the identification of that physical location using the IP address. And as Kidd points out, it is oftentimes trivially easy to deduce that physical location using other websites. (See Reply at 4.)
Of course, the Carpenter Court cautioned that its ruling on CSLI did not "address other business records that might incidentally reveal location information." 138 S. Ct. at 2220. However, this Court does not draw from that statement a requirement that the information subpoenaed must directly convey physical location information, especially given the work required to translate CSLI into digestible data. Rather, the holding in Carpenter is chiefly concerned with the Government's ability to track one's daily movements. The addition of an extra step in the process to deduce location should not categorically shield Government action if it is otherwise in violation of the Fourth Amendment. Therefore, the Court finds that the circumstances at issues here present a substantial unresolved question as to whether the location information conveyed by IP address information is sufficiently similar in kind to that conveyed by CSLI to warrant the application of Carpenter.
Indeed, if that distinction were so clear, it is unlikely that Justice Kennedy's dissent in Carpenter would specifically note that the Court's majority opinion does not address the "considerations that should determine whether greater or lesser thresholds should apply to information like IP addresses." 138 St. Ct. at 2234 (Kennedy, J., dissenting).
Kidd, however, fails to sufficiently show a matter on which he has the burden, namely that the Government's ability to precisely track his daily movements necessarily follows from the fact that IP address information conveys some location information. Specifically, Kidd does not establish that his cellphone (1) passively generates IP address information for Pinger to collect in a way similar to CSLI; or (2) consistently conveys granular location information. Without these showings, Kidd has not carried his burden to reasonable expectation of privacy in the IP address information associated with the 9064 Number.
In responding to the Government's argument, premised on Hood, that only affirmative acts generate IP address information, Kidd attempts to create a factual dispute by stating it is "unclear what portion of the Pinger records were generated ‘by dint of [the 9064 Number's] operation, without any affirmative acts on the part of the user.’ " (Reply at 2 (quoting Carpenter, 138 S. Ct. at 2220 ).) However, Kidd has the burden to demonstrate his privacy interest. Thus, Kidd has not even asserted, let alone provided any evidence to establish, that, once installed on a cellphone, Pinger service is even capable of recording IP address information without an affirmative act by Kidd.
In fact, Kidd barely describes what Pinger is, other than refer to it as a "telecommunications provider." (Second Motion to Suppress at 1.) During the June 28, 2019 hearing before the Court, he Government explained that Pinger provides internet applications that allow users to have a cellphone number through the internet. Thus, in contrast to a wireless provider such as Verizon or Spectrum which can provide internet and telecommunication services directly to the end user, to use Pinger a user must already have an internet connection through a provider. As such, Pinger may be more limited in what information it can track passively compared to that of a cellular service provider.
Even if Finger collected IP address information without any affirmative act by the user, Kidd has not demonstrated that the IP address information collected from Pinger is analogous to the all-encompassing collection of CSLI described in Carpenter. Specifically, Kidd has not addressed the legal impact of his choice to use Pinger, or placed that choice within the context of how customers use cellphones. For example, Kidd has not argued that the ubiquity of the Pinger service approaches that of cellphones, such that it warrants broadening the limited exception for the third-party doctrine created by Carpenter.
Kidd attempts to avoid his burden to demonstrate that his IP address information was passively collected by the government by arguing that Carpenter "had little to do with whether the location information was the direct result of user activity." (Reply at 2.) However, the Carpenter Court clearly emphasized within the first few lines of the opinion that "modern devices ... tap into the wireless network several times a minute whenever their signal is on, even if the owner is not using one of the phone's features." 138 S. Ct. at 2211 (emphasis added). Kidd's reading of Carpenter is thus unsupported and unpersuasive.
Passive collection of IP address information presents problems only if it provides geographically accurate information that follows a defendant's day-to-day movements. Although here the Government sought IP address information for a substantial amount of time and for an inherently mobile device, Kidd has failed to demonstrate that fact translated into surveillance of Kidd's daily movements. Kidd has also not shown that the IP address information enabled the Government to track him outside the home, nor that, like CSLI, the location information conveyed by IP addresses is getting more precise. Instead, Kidd provides evidence that the IP address information the Government collected "overlaps with a known residence of" Kidd. (Reply at 3.) Kidd posits that the Government employed that information to locate him in his home. That usage is precisely the limited kind of incidental use for IP address information consistently blessed as analogous to return envelopes or dialed telephone numbers, and as such, the concerns its deployment presents differ meaningfully from those raised by the technology at issue in Carpenter.
* * *
Extending Carpenter to new areas requires a precise understanding of the technology at issue, as demonstrated by the discussion of technology in Carpenter itself. Ultimately, Kidd has not addressed certain key questions that bear on the considerations the Supreme Court addressed in Carpenter. For example, does Pinger collect IP address information when the customer is not affirmatively using the service, such as when he or she receives a call but does not answer? Did Kidd use Pinger on his cellphone while connected to a cellular network and out of the house? If so, how geographically accurate was the resulting IP address information while on the cellular network? Depending on the answers to some of these questions, the location information derived from IP address information might convey such minute details of a cellphone user's daily movement that might be more analogous to that conveyed by CSLI.
Conceivably, a user whose cellphone automatically connects to the wireless internet of his or her apartment, subway, local coffee shop, or park, and in each instance, passively sends the IP address assigned to him or her at each of those locations to the messaging application of choice. Perhaps the messaging application may even collect the user's IP address from his or her wireless carrier between these stops.
But that hypothetical: (1) is not the one Kidd presents; (2) might be rendered moot by certain technical limitations of IP address information; and (3) does not resolve how the Court should assess the affirmative act of downloading and using a messaging application in the first place.
Still, even if the example described above is not the one Kidd presents, it may caution against the categorical approach found in most of the post- Carpenter cases holding that there is no reasonable expectation of privacy in IP address information. The Government's especially aggressive conduct in this case -- subpoenaing 581 days and nearly 1,800 pages of IP address information associated with a mobile device -- also cautions against adoption of a categorical approach. The Court recognizes that a case-specific holding does not fulfill the "need for a clear rule" desired in the Fourth Amendment context. Thornton v. United States, 541 U.S. 615, 623, 124 S.Ct. 2127, 158 L.Ed.2d 905 (2004). But here, under the unique circumstances this case presents and the substantial questions the record leaves unresolved, such a rule may not be justified.
Accordingly, the Court finds that Kidd has not met his burden of showing that he has a reasonable expectation of privacy in the IP address information collected by Pinger and subpoenaed by the Government, because there is an insufficient record to support a conclusion that such information reflected the whole of Kidd's locations and movements.
II. ORDER
For the reasons described above, it is hereby
ORDERED that the motion to suppress (Dkt. No. 30) of defendant Lloyd Kidd ("Kidd") is DENIED .
SO ORDERED .