Summary
finding no reasonable expectation of privacy in "recent" IP address information associated with Yahoo.com and Facebook.com accounts
Summary of this case from United States v. KiddOpinion
CASE NO. 17CR3430 WQH
11-20-2018
UNITED STATES OF AMERICA, Plaintiff, v. CARSTEN IGOR ROSENOW, Defendant.
ORDER :
The matters before the Court are the motion to suppress evidence (ECF No. 29) and the motion to dismiss indictment (ECF No. 34) filed by Defendant Carsten Igor Rosenow. Background facts
On or about September 19, 2014, Yahoo, Inc. ("Yahoo") was alerted by Xoom.com ("Xoom"), an on-line money transfer service, that a number of Yahoo accounts were involved in buying and selling child pornography. Zoom indicated to Yahoo that individuals from Zoom had seen child pornography activities on the Yahoo platform. Zoom reported to Yahoo ten email addresses that Zoom personnel believed had been engaged in the sale of child exploitation materials over Yahoo instant messenger.
Yahoo E-Crime Investigations Team (ECIT) initiated an investigation of the ten Yahoo accounts identified by Zoom in order to determine whether the accounts were engaged in activity that violated the Yahoo acceptable use policy or needed to be reported to the National Center for Missing and Exploited Children ("NCMEC'). The Yahoo investigation was lead by Sean Zadig, a senior manager for the Yahoo ECIT with supervisory responsibilities over investigations. Zadig is a former law enforcement agent.
The Yahoo ECIT conducts investigations involving the abuse of the terms of service of the Yahoo operating platforms. The Yahoo ECIT investigates activities prohibited by the Yahoo acceptable use policy and criminal activity on the Yahoo platform. Yahoo has policies against activities which the company does not want on Yahoo products, such as harassment, cyber intrusion, and child pornography. Yahoo privacy policies notify users that Yahoo will not share personal information unless "[w]e believe it is necessary to share information in order to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of Yahoo's terms of use, or as otherwise required by law." (ECF No. 49-4 at 3). Yahoo ECIT started with the ten accounts provided by Zoom. Yahoo ECIT looked at user information, contact lists for a particular user, subject lines of emails, snipets of chat conversations, and open source information, including Facebook and public records. Yahoo ECIT did not consult any outside agency or law enforcement agency in the investigation.
On October 3, 2014, Yahoo ECIT filed a supplement to an existing CyberTip with the NCMEC containing findings from the initial investigation of the seller and buyer accounts identified by Zoom to be engaged in the sale of child exploitation material. Yahoo ECIT made the initial report in order to provide information to NCMEC as quickly as possible because of the discovery of active child abuse. The report indicated that Yahoo ECIT found approximately 115 Yahoo accounts, operated from the Philippines, which were believed to be selling images, video, and live-streamed child exploitation materials via Yahoo mail and Yahoo messenger. Yahoo reported that the images were reviewed by Yahoo personnel and queued for reporting to NCMEC. Yahoo reported that a number of sellers had child sexual abuse images as their Messenger profile picture and the seller accounts appeared to be broadcasting video on commercial "camgirl" websites. Yahoo reported that Yahoo reviewed the header metadata and not the mail content on the buyer accounts. Yahoo reported that based upon the header analysis, some of the buyer accounts appeared to be traveling to the Philippines. Aside from the information provided by Zoom and open source information, Yahoo ECIT did not use any information provided by any outside agency in the October 2014 report.
Following the submission of the October CyberTip to NCMEC, Yahoo ECIT contacted the Federal Bureau of Investigation (FBI), and the Department of Homeland Security (DHS) to notify these agencies that there was a supplement for their review at NCMEC. Zadig testified that Yahoo wanted to be sure that law enforcement was aware of their investigation. Zadig testified that the investigation had determined that children were being actively exploited and that some users were traveling to abuse children. Zadig testified that there are hundreds or even thousands of Cybertips reported per month and that Yahoo wanted to be sure that law enforcement knew that there were children in danger and would prioritize the Yahoo report.
On October 6, 2014, representatives of Yahoo met with representatives of NCMEC, the FBI, and Homeland Security Investigations (HSI) in Alexandria, Virginia to discuss the initiation of the Yahoo investigation, provide an overview of the Yahoo investigation, and advise law enforcement of the Yahoo process for legal service.
In November 2014, the Yahoo ECIT began a second investigation into potential buyers and sellers of child exploitation materials beyond the accounts identified in the initial investigation. Zadig testified that the initial referral in October 2014 contained a small number of individuals directly linked to the ten accounts identified by Zoom. Zadig testified that Yahoo was concerned that there was more activity on the platform and potentially more children in danger. Zadig testified that Yahoo ECIT undertook a second investigation without any direction from the NCMEC or law enforcement in order to go out a few more levels from the initial set of buyers and sellers. The second investigation started with the buyers from the first investigation linked to additional sellers through the same investigatory methods.
Yahoo ECIT used open source information associated with the Yahoo accounts under investigation, including searching public sex offender registries and Facebook. In the second investigation, the Yahoo ECIT identified casandrarophilipps@yahoo.com as a seller account associated either by email address or SMS number to other seller accounts containing child abuse imagery, and europe_120@yahoo.com as a potential traveler to the Philippines for the purpose of child abuse based upon chat snippets.
On December 5, 2014, Yahoo ECIT sent a supplemental report to NCMEC, which outlined the results of the second investigation. Yahoo ECIT reported that it had observed 267 accounts, operated by at least 45 individuals, which appear to be selling child exploitation material. Yahoo indicated that the buyer list included 347 accounts which appeared to be purchasing images, video, or live streams from the seller accounts. Yahoo ECIT reported that 81 of the 347 buyer accounts appeared to be travelers who may be visiting the Philippines to abuse children. The buyer section of the report included information relating to email account europe_120@yahoo.com and included the name "Carsten Rosenow." Id. at 8. Yahoo provided a large batch of information to NCMEC, including subscriber and IP login information for the buyer accounts. Yahoo provided subscriber information for the email addresses europe_120@yahoo.com and crosenow@rocketmail.com. Yahoo identified these accounts as potential buyers traveling to the Philippines from contacts with a Philippines based seller and chat snippets.
No outside agency provided any information included in the Yahoo December 2014 report, and Yahoo did not consult any agency during the investigation. Yahoo ECIT notified the FBI and HSI that there was additional information for their review for the same reasons that Yahoo notified law enforcement agencies of the October 2014 report.
On December 16, 2014, Yahoo ECIT personnel attended a second meeting with NCMEC, the FBI, and HSI in Alexandria, Virginia.
After receiving the information from Yahoo, FBI Major Crimes Coordination Unit (MCCU), and HSI Cyber Crimes Center Child Exploitation Investigations Unit in Washington, D.C. began conducting a joint investigation into child exploitation involving hundreds of users of Yahoo services purchasing child exploitation materials. Agent Yenesky of the FBI testified that the overall investigation, referred to as "Operation Swift Traveler" or "Philippines Webcam," included a number of different individuals. Agent Yenesky testified that the overall investigation originated with the Yahoo reports through NCMEC. Agent Yenesky testified that law enforcement had no role in directing or participating in the Yahoo investigation. Agent Yenesky testified that he spoke to Zadig at Yahoo from time to time and that Zadig would contact him directly in order to make sure that Agent Yenesky was aware of information Yahoo was providing to NCMEC. Agent Yenesky testified that his investigation was separate from the Yahoo investigation, and that the meetings with Yahoo were necessary to review the large amounts of information as efficiently as possible. Agent Yenesky testified that the overall investigators would contact the particular appropriate field offices to investigate as the subjects of the investigation were identified.
Law enforcement served preservation requests on Yahoo accounts in October 2014, December 2014, and June 2015. Law enforcement collected wire transfer information from Western Union, Xoom, and Paypal pursuant to criminal summons issued by HSI for money transaction records associated with the seller accounts identified by Yahoo. This information included three transactions in which the email address crosenow@rocketmail.com transferred ten dollars to one of seller accounts identified by Yahoo. The shipping address listed was for Rosenow at a residential address in San Diego, California.
On February 19, 2015, FBI MCCU advised agents in the San Diego Division and the Chicago Division of the joint investigation and identified Carsten Rosenow as a potential suspect residing in the San Diego area. FBI MCCU summarized the information received regarding europe_120@yahoo.com and provided copies of the October and December 2014 NCMEC reports from Yahoo, copies of the HSI summons to PayPal, records checks, and Cybertip information related to the europe_120@yahoo.com account.
During 2015, government investigators placed travel alerts in the U.S. Customs and Border Patrol TECS system regarding Rosenow. Defendant was detained at the border several times and secondary searches yielded no evidence of wrongdoing.
In October 2015, the FBI executed federal search warrants on additional Yahoo account holders for the casandraroyphilipps@yahoo.com account. Yahoo returned records pursuant to the search warrants. On November 3, 2015, the FBI MCCU provided agents in San Diego FBI with the Yahoo records obtained through the search warrant for casandraroyphilipps@yahoo.com.
Emails in the record show that Zadig remained the point of contact for Yahoo with law enforcement throughout the investigation. Yahoo ECIT and Zadig continued to investigate and enforce user safety on the Yahoo platform. Zadig received calls and emails from local law enforcement agents who received leads generated from the broader investigation. Zadig answered questions about the information provided by Yahoo in the Cybertips and provided information on how to serve Yahoo with legal process. Yahoo ECIT assured that law enforcement complied with the Electronic Communications Act in order to protect the privacy of its users. Zadig did not receive any requests from law enforcement to retrieve information from particular Yahoo accounts without proper legal service and did not provide any information to law enforcement from particular Yahoo accounts without proper legal service.
After the December 2014 NCMEC report made by Yahoo, the Yahoo ECIT was advised by law enforcement that a U.S. based buyer included in the December 2014 report had been arrested in Texas. News regarding that arrest led Yahoo ECIT to further scrutinize the buyer's activity on Yahoo which revealed additional, previously unknown sellers in the Philippines who had been in contact with that buyer. A third investigation was opened by ECIT regarding new sellers and any buyers connected to those sellers. As a part of the third investigation, the europe_120@yahoo.com account was found to be in contact with some of the new sellers. While reviewing that activity, a series of chats from October and November 2015 were located in which the owner of the europe_120@yahoo.com account described upcoming travel plans to the Philippines and the abuse of children.
On December 2, 2015, ECIT filed NCMEC Cyber Tip Report #7431977 to report Yahoo Messenger chats related to europe_120@yahoo.com. (ECF No. 49-8). NCMEC processed the CyberTip on December 23, 2015 and forwarded the information to the FBI that same day. Portions of the content of messages sent between the europe_120@yahoo.com account and other Yahoo user screen names were later included in sealed search warrant affidavits for Defendant Rosenow's person, baggage and residence.
On January 21, 2016, at the completion of the third investigation, Yahoo ECIT sent another supplemental report to NCMEC.
In January 2017, Agent Cashman of the FBI San Diego, working investigations involving sexual exploitation of children, was assigned to work on the investigation involving Carsten Rosenow. During the investigation, Agent Cashman reviewed the NCMEC Cybertip from Yahoo for December 2014 and January 2016.
Based on information received from NCMEC via Yahoo, Agent Cashman began investigating whether Rosenow was involved in the abuse of children in the Philippines. While viewing public information on a Carlos Senta Facebook account, Agent Cashman concluded that Rosenow had two accounts on Facebook, including the Carlos Senta account in which Rosenow spoke primarily to Filipino girls.
On January 4, 2017, Agent Cashman sent a preservation request to Facebook, Inc. for Account #100000403405520, which was associated with the moniker "Carlos Senta" and had previously been associated with the moniker "Carl Europe". The preservation request was submitted via Facebook's Law Enforcement Online Request System (LEORS), and indicated that the request related to a child exploitation matter. When submitting legal process through LEORS, law enforcement must provide the type of legal process, the nature of the case, the signature date, the due date, and the relevant accounts.
Facebook acknowledged receipt of the preservation request via automatically generated email on the same day and preserved the account for 90 days. The acknowledgment from Facebook did not indicate that Facebook would search the account.
On January 9, 2017, Agent Cashman emailed a request to NCMEC asking for any information available regarding the Defendant. The email stated in part "FBI San Diego attempted to get a search warrant for ROSENOW's Yahoo account but the U.S. Attorney's office declined our request and stated we needed additional updated information." (ECF No. 29-11at 2).
On March 17, 2017, Agent Cashman served an administrative subpoena on Facebook for the Carols Senta account which stated "THIS IS A CHILD EXPLOITATION MATTER" and requested that Facebook not disclose the existence of the subpoena. The administrative subpoena sought basic subscriber information and IP log-in information. No content information was requested from the account and no request was made to Facebook to search the account. (ECF No. 29-12 at 5).
On April 10, 2017, Facebook Law Enforcement Response Team (LERT) made data responsive to the administrative subpoena available for download. No content information was received.
In April 17, 2017, Facebook LERT conducted a limited review of the Carlos Senta account and flagged the account for further review by the Community Operations team as possibly containing material constituting sexual exploitation of minors in violation of Facebook's Community Standards. Facebook Community Standards state "[w]e do not allow content that sexually exploits or endangers children. When we become aware of apparent child exploitation, we report it to [NCMEC], in compliance with applicable law." (ECF No. 49-4 at 2). In reviewing legal process submitted via LEORS, Facebook LERT conducts a limited review of the account for violating material when the nature of the case selected by law enforcement indicates that conduct could be occurring on the platform in violation of Facebook Community Standards.
On April 27, 2017, the Community Operations team conducted a more thorough review and disabled the account for violation of Facebook's Community Standards.
On April 28 and May 1, 2017, the Community Operations team reported potential child sexual exploitation related to the Carlos Senta account to NCMEC. The first report (Cybertip report #207111118) identified three images that appeared to depict sexual exploitation of a minor, and the second report included additional facts and reported the discovery of evidence of possible child exploitation.
NCMEC passed the information from the Facebook Cybertip to the FBI. Agent Cashman subsequently reviewed the FBI report with chats. The report contained additional information which lead FBI San Diego to believe that both of the reported Facebook accounts and the Yahoo accounts europe_120@yahoo.com and crosenow@rocketmail.com were used by Defendant Rosenow.
On May 4, 2017, Facebook LERT received another preservation request from the FBI for carlos.senta account through LEORS, which triggered the automatic preservation of the account for 90 days.
On June 5, 2017, LERT received a subpoena from the FBI for the carsten.rosenow account, which indicated that the nature of the case was "Child Safety (Potential Harm)."
On June 12, 2017, LERT made data responsive to the subpoena available for download. On the same day, LERT conducted a limited review of the carsten.rosenow account for violating conduct and indicated that no violating content was located.
In June 2017 the F.B.I. requested search warrants from a magistrate judge for Rosenow's luggage and his home, including searches of his digital devices. The requests were supported by an affidavit of FBI Agent Dingle. In the affidavit, Agent Dingle stated that the facts set forth were based on his personal knowledge, knowledge obtained from other individuals during his participation in the investigation, including other law enforcement officers, review of documents and computer records related to this investigation, communication with others who have personal knowledge of the events and circumstances described herein, and information gained through training and experience. Agent Dingle explained that the investigation led him to believe that Rosenow had traveled to the Philippines on multiple occasions over the course of several years for the purpose of engaging in criminal sexual activity, illicit sexual conduct with minors, and the production and distribution and possession of images of minors engaged in sexually explicit conduct. Agent Dingle informed the Magistrate Judge that the investigation began when Yahoo identified Yahoo accounts, operating from the Philippines, selling pictures, videos and live-streamed images of sexual abuse on Yahoo Mail and Yahoo Messenger. Agent Dingle informed the Magistrate Judge that Yahoo identified one specific seller account, and that Yahoo found accounts purchasing the images from this seller account, including the user of the email account europe_120@yahoo.com . After detailing chat messages sent between the seller and the user of the email account europe_120@yahoo.com, Agent Dingle detailed information linking the user to Rosenow. The Magistrate Judge authorized the warrants.
On June 21, 2017, Rosenow arrived at the San Diego airport on a flight from San Francisco. Federal search warrants were executed on Defendant's person, baggage and residence and items of digital evidence were seized, including digital image and video files. Rosenow was arrested and placed into federal custody.
On July 14, 2017, FBI San Diego obtained a federal search warrant for the Carlos Senta Facebook account.
On July 19, 2017, a one-count information was filed charging Defendant Rosenow with one count of travel with intent to engage in illicit sexual conduct, in violation of 18 U.S.C. § 2423(b).
On October 19, 2017, a three count indictment was filed against Defendant charging one count of attempted sexual exploitation of a child in violation of 18 U.S.C. § 2251(c); one count of travel with intent to engage in illicit sexual conduct, in violation of 18 U.S.C. § 2423(b); and one count of possession of images of minors engaged in sexually explicit conduct, in violation of 18 U.S.C. § 2252(a)(4)(B) and (b)(2).
On March 19, 2018, Defendant moved the Court to suppress evidence. Defendant contends that all of the evidence against him "is the result of warrantless searches of his private communications — searches that were 'government action' on these facts." (ECF No. 29-1 at 9). Defendant moves the Court to suppress "all evidence described herein." Id. at 45.
On April 27, 2018, Plaintiff United States filed an opposition to the suppression of any evidence on the grounds that searches conducted by Yahoo and Facebook were private action not subject to Fourth Amendment constraints. Plaintiff United States asserts that Yahoo, Facebook, and law enforcement acted in conformance with all applicable laws. Plaintiff United States contends that there are no grounds to suppress any evidence.
On July 27, 2018 and August 8, 2018, the Court held an evidentiary hearing with testimony from Yahoo and Facebook personnel as well as law enforcement agents involved in the investigation. Motion to suppress evidence
Yahoo investigation
Defendant asserts that the Government violated his Fourth Amendment rights by repeatedly accepting private communications from Yahoo in violation of law. Defendant asserts that the Cybertips to NCMEC from Yahoo went far beyond child pornography and were not authorized by 18 U.S.C. §2258A. Defendant contends that information relating to travel for purposes of illicit sexual conduct is outside the scope of the statute authorizing Yahoo to disclose information to NCMEC. Defendant asserts that the interaction of NCMEC with the electronic service providers instigated the searches by Yahoo personnel, and Yahoo personnel acted as government agents investigating the materials on the Yahoo platform.
Plaintiff United States contends that any search by Yahoo personnel on the Yahoo platform was private action not subject to Fourth Amendment constraints. Plaintiff United States asserts that Yahoo was alerted to a complaint about Defendant's account by a non-law enforcement source before law enforcement became involved. Plaintiff United States asserts that Yahoo was not acting on behalf of the Government when ECIT personnel investigated the activities of their users on Yahoo servers. Plaintiff United States asserts that Yahoo was acting on behalf of its business interest. Plaintiff United States asserts that there is no evidence that the Government knew of or acquiesced in the Yahoo investigations while they were occurring. Plaintiff United States contends that the communications received by NCMEC from Yahoo complied with existing statutes and legal precedent.
In Carpenter v. United States, the United States Supreme Court stated,
The Fourth Amendment protects "[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures." The "basic purpose of this Amendment," our cases have recognized, "is to safeguard the privacy and security of individuals against arbitrary invasions by governmental officials." Camara v. Municipal Court of City and County of San Francisco, 387 U.S. 523, 528, 87 S.Ct. 1727, 18 L.Ed.2d 930 (1967). . . .138 S.Ct. 2206, 2213 (2018). The United States Supreme Court "has consistently construed [Fourth Amendment] protection as proscribing only government action; it is wholly inapplicable 'to search or seizure, even an unreasonable one, effected by a private individual not acting as an agent of the Government or with participation or knowledge of any governmental official.'" United States v. Jacobsen, 466 U.S. 109, 113 (1984) (quoting Walter v. United States, 447 U.S. 649, 662 (1980) (Blackmun, J., dissenting)); see United States v. Al Nasser, 555 F.3d 722, 725 (9th Cir. 2009) ("The Fourth Amendment protects people from unreasonable 'seizures,' and the Supreme Court 'has consistently construed this protection as proscribing only government action.'") (quoting Jacobsen, 466 U.S. at 113.). However, the Fourth Amendment does prohibit unreasonable intrusions by private individuals who are acting as government instruments or agents. See Coolidge v. New Hampshire, 403 U.S. 443, 487 (1971); United States v. Walther, 652 F.2d 788, 792-93 (9th Cir.1981).
The defendant has the burden of showing government action. United States v. Gumerlock, 590 F.2d 794 (9th Cir. 1979) (en banc), cert. denied, 441 U.S. 948 (1979). In United States v. Reed, 15 F.3d 928 (9th Cir. 1994), the Court of Appeals stated,
The general principles for determining whether a private individual is acting as a governmental instrument or agent for Fourth Amendment purposes have been synthesized into a two part test. United States v. Miller, 688 F.2d 652, 657 (9th Cir.1982). According to this test, we must inquire:
Id. at 931. (quoting Miller, 688 F.2d at 657).(1) whether the government knew of and acquiesced in the intrusive conduct; and (2) whether the party performing the search intended to assist law enforcement efforts or further his own ends.
In this case, the evidence at the evidentiary hearing established conclusively that Yahoo, an electronic service provider, was alerted to information about certain accounts involved in buying and selling child pornography by another internet service provider, Xoom. Yahoo ECIT initiated an investigation in October of 2014 based solely upon the information provided by Zoom. Yahoo ECIT discovered buyer and seller accounts on the Yahoo platform with child sexual images. Yahoo ECIT concluded that their investigators had discovered active child abuse and expeditiously reported to NCMEC as required by law. Law enforcement was not involved in any way until after this investigation was completed and the October 2014 report was sent to NCMEC.
After meeting with law enforcement to review the October 2014 report, Yahoo ECIT began a second investigation. Yahoo ECIT remained concerned that there was more activity on their platform that violated the Yahoo terms of service, and investigated additional suspected buyers and sellers of child exploitation materials. There is no evidence in the record that law enforcement was involved in any way with the decision by Yahoo ECIT to undertake a second investigation or that law enforcement was involved in or participated in the second investigation by Yahoo ECIT. After identifying additional buyers and sellers, Yahoo filed a second Cybertip with NCMEC in December 2014 and again met with law enforcement.
After the second report, law enforcement undertook an investigation. There is no evidence that law enforcement sought or received any assistance from Yahoo personnel in conducting this investigation outside of legal process. During the investigation, Zadig remained in communication with FBI Agent Zelensky receiving information from the FBI when available to the public. After learning of an arrest in Texas of a Yahoo user included in the December 2014 Cybertip, Yahoo ECIT began a third investigation into users of its platform. There is no evidence in the record that law enforcement was involved with the decision by Yahoo ECIT to undertake a third investigation or that law enforcement was involved in or participated in third investigation by Yahoo ECIT. The evidence in the record shows that Yahoo ECIT acted on behalf of Yahoo. Yahoo took no direction from law enforcement and law enforcement had no involvement in any Yahoo investigation.
Yahoo ECIT conducted its investigations involving the activity on Yahoo platforms in order to determine whether users were violating the Terms of Service and Community Guidelines. Yahoo has a business interest in enforcing its terms of service and ensuring that its products are free of illegal conduct, in particular, child sexual abuse material. The evidence in the record shows that Yahoo ECIT was acting to enforce the Yahoo terms of service and to ensure that Yahoo products were free of illegal content. Yahoo ECIT was acting in compliance with internal policies, business interests, and all existing laws. The Court concludes that Yahoo ECIT acted in a private capacity not subject to Fourth Amendment constraints. See Jacobsen, 466 U.S. at 115 (concluding that the Fourth Amendment does not protect against "invasions . . . occasioned by private action.").
The Stored Communications Act, 18 U.S.C. § 2701 et al., generally prohibits remote computing services from disclosing records, information, and contents of accounts, except under certain circumstances. 18 U.S.C. §2702(a). 18 U.S.C. §2702(b) provides in part:
(b) Exceptions for disclosure of communications.-- A provider described in subsection (a) may divulge the contents of a communication--§ 2702(b). In this case, Yahoo ECIT discovered material on the Yahoo platform indicating that sellers and buyers, including Defendant, were suspected of using the Yahoo messenger to seek commercial sex with minors and to exchange sexual images of minors. Yahoo personnel reasonably concluded that facts and circumstances existed to support suspected child abuse involving the sellers of images, videos, and live-streams located in the Philippines in violation of section 2252.
(5) as may be necessarily incident to the rendition of the service or to protect the rights or property of the provider of that service;
(6) to the National Center for Missing and Exploited Children, in connection with a report submitted thereto under section 2258A;. . .
(8) to a governmental entity, if the provider, in good faith, believes that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay of communications relating to the emergency[.]
The investigation of Yahoo ECIT pursuant to legitimate business purposes lead Yahoo to a duty to report under 18 U.S.C. § 2258A, which provides in part:
a) Duty to report.--
(1) In general.--Whoever, while engaged in providing an electronic communication service or a remote computing service to the public through a facility or means of interstate or foreign commerce, obtains actual knowledge of any facts or circumstances described in paragraph (2) shall, as soon as reasonably possible-
(A) provide to the CyberTipline of the National Center for Missing and Exploited Children, or any successor to the CyberTipline operated by such center, the mailing address, telephone number, facsimile number, electronic mail address of, and individual point of contact for, such electronic communication service provider or remote computing service provider; and
(B) make a report of such facts or circumstances to the CyberTipline, or any successor to the CyberTipline operated by such center.
(2) Facts or circumstances.--The facts or circumstances described in this paragraph are any facts or circumstances from which there is an apparent violation of--
(A) section 2251, 2251A, 2252, 2252A, 2252B, or 2260 that involves child pornography; or . . .
(b) Contents of report.--To the extent the information is within the custody or control of an electronic communication service provider or a remote computing service provider, the facts and circumstances included in each report under subsection (a)(1) may include the following information:
(1) Information about the involved individual.--Information relating to the identity of any individual who appears to have violated a Federal law described in subsection (a)(2), which may, to the extent reasonably
practicable, include the electronic mail address, Internet Protocol address, uniform resource locator, or any other identifying information, including self-reported identifying information.§ 2258A. Compliance with this duty to report did not convert Yahoo ECIT into a government actor subject to Fourth Amendment warrant requirements. Yahoo personnel investigated the use of its business platform as a private actor in furtherance of its business interest in excluding users of its service perpetrating child abuse and child exploitation. Compliance with the reporting requirements of § 2258A, standing alone, did not transform Yahoo, an internet service provider, into a government agent. See United States v. Stevenson, 727 F.3d 826, 830 (8th Cir. 2013) ("A reporting requirement, standing alone, does not transform an Internet service provider into a government agent whenever it chooses to scan files sent on its network for child pornography."); United States v. Cameron, 699 F.3d 621, 638 (1st Cir. 2012) ("[T]he statute did not impose any obligation to search for child pornography, merely an obligation to report child pornography of which Yahoo! became aware."); United States v. Richardson, 607 F.3d 357, 367 (4th Cir. 2010) ("We conclude that the statutory provision pursuant to which AOL reported Richardson's activities did not effectively convert AOL into an agent of the Government for Fourth Amendment purposes.").
Unlike the regulatory scheme in Skinner v. Railway Labor Executives' Association, 489 U.S. 602 (1989), the actions taken by Yahoo were the result of private initiatives. In Skinner, the Supreme Court considered whether the regulatory scheme imposed by the Federal Railroad Administration for mandatory and permissive drug testing by private railroads implicated the Fourth Amendment. Because the regulations mandated the means, methods and procedures for testing, the Court concluded that "[a] railroad that complied with the provision of Subpart C of the regulations does so by compulsion of sovereign authority, and the lawfulness of its acts is controlled by the Fourth Amendment." Id. at 614. In this case, the government played no role in instigating or participating in Yahoo's investigation. Section 2258A imposed no duty on Yahoo to monitor its platform for child exploitation materials. The duty imposed to report when facts and circumstances of apparent violations of child pornography laws are found does not transform Yahoo's investigation into government action.
Preservation Requests
Defendant asserts that the Government committed unconstitutional searches and seizures of his private communications by issuing preservation requests to third-parties pursuant to 18 U.S.C. § 2703(f). Defendant contends that the Government unlawfully seized and held his private communications through preservation and subpoena requests. Defendant asserts that this seizure of his private communications was subject to the warrant requirement of the Fourth Amendment based upon the recent decision of the United States Supreme Court in United States v. Carpenter.
Plaintiff United States contends that preservation requests issued by the Government pursuant to Section 2703(f) are not seizures under the Fourth Amendment. Plaintiff United States asserts that the preservation of Defendants' accounts under § 2703(f) is not a meaningful interference with Defendant's possessory interests in his account. Plaintiff United States asserts that Defendant was free to continue to use his account and only prevented by the preservation request from manipulating the copy made by the service provider. Plaintiff United States asserts that the Fourth Amendment does not require probable cause for this minimal intrusion authorized by Congress in Section 2703(f).
The record in this case shows that law enforcement sought the preservation of Defendant's Yahoo and Facebook accounts in compliance with 18 USC § 2703(f)which provides
Requirement to preserve evidence.--(1) In general.--A provider of wire or electronic communication services or a remote computing service, upon the request of a governmental entity, shall take all necessary steps to preserve records and other evidence in its possession pending the issuance of a court order or other process.§ 2703(f).
(2) Period of retention.--Records referred to in paragraph (1) shall be retained for a period of 90 days, which shall be extended for an additional 90-day period upon a renewed request by the governmental entity.
See also 18 U.S.C. § 2258A(h) Preservation.
In Carpenter, prosecutors applied for court orders under the Stored Communications Act, 18 U.S.C. § 2703(d), to obtain cell phone records for Carpenter and several other suspects in a robbery investigation. 138 S.Ct. at 2206. Carpenter was charged with six counts of robbery and moved to suppress the cell-site records provided by the wireless carriers. Carpenter argued that the government's seizure of the records violated the Fourth Amendment because the records had been obtained without a warrant supported by probable cause. The Court of Appeals held that Carpenter lacked a reasonable expectation of privacy in the location information collected by the FBI "because he had shared that information with his wireless carriers." Id. at 2214. The Court of Appeals concluded that the resulting business records were not entitled to Fourth Amendment protection.
The Supreme Court concluded that the location information obtained from the "[g]overnment's acquisition of the cell-site records was a search within the meaning of the Fourth Amendment." Id. at 2220. The Supreme Court stated, "while the third-party doctrine applies to telephone numbers and bank records, it is not clear whether its logic extends to the qualitatively different category of cell-site records." Id. at 2216-17. The Supreme Court found that the collection of Carpenter's cell phone location information was an "entirely different species of business records — something that implicates basic Fourth Amendment concerns about arbitrary government power much more directly than corporate tax or payroll ledgers." Id. at 2222. The Supreme Court concluded that the protections of the Fourth Amendment "should extend to a detailed log of a person's movements over several years." Id. The Supreme Court went on to state, "[t]his is certainly not to say that all orders compelling the production of documents will require a showing of probable cause. The Government will be able to use subpoenas to acquire records in the overwhelming majority of investigations. We hold only that a warrant is required in the rare case where the suspect has a legitimate privacy interest in records held by a third party." Id. "A 'seizure' of property occurs when there is some meaningful interference with an individual's possessory interest in the property." Jacobsen, 466 U.S. at 113. A preservation request pursuant to Section 2703(f) notifies the online provider to "take all necessary steps to preserve records" of an account for 90 days. 18 U.S.C. § 2703(f). The preservation requests in this case did not interfere with the Defendant's use of his accounts and did not entitle the Government to obtain any information without further legal process. Law enforcement may, generally, seize items without warrant when the items are found under circumstances where the risk of destruction of the evidence before a warrant may be obtained outweighs the interest in possession. See United States v. Place, 462 U.S. 696, 701-02 (1983). The statutory authorization to preserve a wire or electronic communications account held by a third-party online provider recognizes that the information is easily and readily destroyed and allows its preservation for a short period in order to allow law enforcement to seek further legal process. The Court concludes that the preservation requests in this case did not amount to an intrusion subject to Fourth Amendment requirements.
However, "subpoenas trigger Fourth Amendment concerns and may be challenged under Fourth Amendment grounds." See Grand Jury Subpoena v. Kitzhaber, 828 F.3d 1083, 1088 n.1 (9th Cir. 2016); see also Carpenter, ("[T]his Court has never held that the Government may subpoena third parties for records in which the suspect as a reasonable expectation of privacy."). The Stored Communication Act, §2703(c), provides in part that
"A government entity may require a provider of electronic communication service or remote computing service to disclose a record or other information pertaining to a subscriber to or customer of such service (not including the contents of communications) only when the governmental entity - (B) obtains a court order for such disclosure under subsection (d) of this section;
. . .
(d) Requirements for court order.--A court order for disclosure under subsection (b) or (c) may be issued by any court that is a court of competent jurisdiction and shall issue only if the governmental entity offers specific and articulable facts showing that there are reasonable grounds to believe that the contents of a wire or electronic communication, or the records or other information sought, are relevant and material to an ongoing criminal investigation. In the case of a State governmental
authority, such a court order shall not issue if prohibited by the law of such State. A court issuing an order pursuant to this section, on a motion made promptly by the service provider, may quash or modify such order, if the information or records requested are unusually voluminous in nature or compliance with such order otherwise would cause an undue burden on such provider.18 U.S.C. § 2703(c)(d).
The United States Supreme Court has "consistently held that a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties." Smith v. Maryland, 442 U.S. 735 (1979) (pen register for phone numbers from the phone company do not acquire the contents of communications and are not subject to Fourth Amendment warrant requirements); see also United States v. Miller, 425 U.S. 435 (1976) ( subpoena for bank records not search because bank records were not respondent's private papers); United States v. Forrester, 512 F.3d 500, 510 (9th Cir. 2008) (warrantless government surveillance of email to/from addresses and IP addresses do not constitute search because defendant voluntarily turned over the information in order to direct the third party server).
In this case, the Government received subscriber information and IP log-in information from Yahoo and Facebook pursuant to §2703 administrative subpoenas. This information disclosed by third-parties Yahoo and Facebook did not reveal any contents of the account pursuant to the administrative subpoenas. The Court concludes that Defendant had no reasonable expectation of privacy in the subscriber information and the IP log-in information Defendant voluntarily provided to the online service providers in order to establish and maintain his account. The Court concludes that Defendant did not have a legitimate expectation of privacy in the information provided pursuant to the administrative subpoenas. Unlike the location information in Carpenter, the information requested by the subpoenas is not subject to reasonable expectation of privacy and not a search within the meaning of the Fourth Amendment. Facebook investigation
Subpoena requested the "name associated with [the carlos.senta account], length of service, credit card information, email address, and recent login/logout IP addresses, if available." (ECF No. 29-12 at 5).
Defendant contends that the Facebook personnel acted as government agents when they investigated his account and reported to NCMEC. Defendant asserts that Facebook acted because of the preservation requests and subpoenas by the law enforcement. Defendant asserts that every time Facebook investigates an account after receiving a "child exploitation" preservation request or subpoena, Facebook is acting on behalf of law enforcement. Defendant asserts that the search by Facebook, instigated by law enforcement, led directly to the compelled disclosure of evidence under Section 2258A. Defendant contends that "a Carpenter search and seizure" resulted "on these facts." (ECF No. 76 at 31).
Plaintiff United States contends that law enforcement did not request that Facebook conduct any search or initiate any internal investigations into the Defendant's accounts. Plaintiff United States asserts that Facebook conducted its review of Defendant's account in compliance with its own internal policies and reported the information found in compliance with applicable law. Plaintiff United States asserts that law enforcement acted within normal investigative procedures at all times.
The evidence established that the Government submitted a preservation request and subpoena for the carlos senta Facebook account indicating a potential child exploitation matter. Facebook internal policy provided that subpoenas which indicated a child exploitation matter trigger a limited content review by Facebook LERT in order to investigate suspected violations of the acceptable use policy. There is no evidence that the FBI acted outside normal investigative procedures in order to prompt an investigation by Facebook. Facebook acted pursuant to its internal policies and procedures regarding the review of the accounts of their users. FBI San Diego did not request that Facebook conduct any search or initiate any internal investigation into Defendant's accounts. The Facebook investigation was initiated pursuant to internal Facebook policies in order to advance Facebook business interests. The Court concludes that Facebook search was private action not subject to Fourth Amendment constraints.
Franks
Defendant contends that the affidavit in support of the search warrants for his luggage and his home contained material misrepresentations and omissions requiring suppression or a Franks hearing. Defendant asserts that the affidavit in support of the search warrant lacked probable cause and that Agent Dingle had no personal knowledge of the facts contained in the affidavit. Plaintiff United States asserts that the search warrant did not contain material omissions or misrepresentations which would require suppression and that all search warrants in this case were supported by probable cause.
In Franks v. Delaware, 438 U.S. 154 (1978), the Supreme Court examined the circumstances under which a defendant may "attack the veracity of a warrant affidavit after the warrant has been issued and executed." Id. at 164. "A defendant is entitled to a Franks hearing only if he makes a two-fold showing: intentional or reckless inclusion or omission, and materiality." United States v. Bennett, 219 F.3d 1117, 1124 (9th Cir. 2000). To make this showing, a defendant "must make specific allegations that indicate the portions of the warrant claimed to be false" and "[t]he allegations must be accompanied by a detailed offer of proof, preferably in the form of affidavits." United States v. Kiser, 716 F.2d 1268, 1271 (9th Cir. 1983). Defendant failed to identify any misrepresentations or material omissions at the evidentiary hearing necessary to a finding or probable cause.
Probable cause exists when "there is a fair probability that contra band or evidence of a crime will be found in a particular place." Illinois v. Gates, 462 U.S. 213, 238 (1983). The Court finds that the affidavit in support of search warrant sworn by Agent Dingle set forth facts sufficient to support probable cause as to the alleged child pornography violations.
Conclusion
The record in this case shows that Yahoo and Facebook conducted investigations in accordance with their internal policies and procedures. The record shows that Yahoo and Facebook reported information to NCMEC pursuant to applicable law based upon facts and circumstances supporting an apparent violation of child pornography laws. The record further shows that law enforcement conducted an investigation independent of Yahoo and Facebook. Law enforcement utilized information provided by Yahoo and Facebook in compliance with all applicable laws and issued preservation requests and subpoenas to obtain limited information from third parties as provided by applicable statutory authorization. Defendant's motion to suppress evidence is denied. Motion to dismiss indictment
On October 19, 2017, the grand jury returned an indictment charging Defendant in Count One with attempted sexual exploitation of a minor in violation of 18 U.S.C. § 2251(c); in Count Two with travel for the purposes of engaging in illicit sexual conduct of 18 U.S.C. § 2423(b); and in Count Three with possession of images of minors engaged in sexually explicit conduct in violation of 18 U.S.C. § 2252 (A)(4)(B) and (b)(2).
Defendant moves to dismiss the charges in Count One and Count Three on the grounds that the statute violates the First Amendment, the charge lacks any allegation of culpable scienter, and the statute is unconstitutionally vague and overbroad. Defendant contends that the federal child pornography laws defining a minor as an individual under the age of 18 are substantially overbroad and violate the first Amendment. Defendant asserts that the age of consent for sexual relationships in federal law and in many states is 16 years old. Defendant asserts that prohibiting all sexually explicit depictions of 16 and 17 year olds is not consistent with the First Amendment principle that Congress may not suppress lawful speech as a means to suppress unlawful speech. Defendant further asserts that the charge in Count Two of travel for the purposes of engaging in illicit sexual conduct must be dismissed on the grounds that the phrase "commercial sex act" is unconstitutionally vague and that the statute lacks mens rea.
Plaintiff United States asserts that the offenses charged in Count One and Three are constitutionally sound. Plaintiff United States further asserts that the term "commercial sex act" as used in 18 U.S.C. § 2324(b) is not unconstitutionally overbroad.
In United States v. X-Citement Video, Inc., 513 U.S. 64 (1994), the United States Supreme Court upheld the constitutionality of § 2252 "conclud[ing] that the term 'knowingly' in § 2252 extends both to the sexually explicit nature of the material and to the age of the performers." 513 U.S. at 78. The Supreme Court further stated:
As an alternative grounds for upholding the reversal of their convictions, respondents reiterate their constitutional challenge to 18 U.S.C. § 2256. These claims were not encompassed in the question on which this Court granted certiorari, but a prevailing party, without cross-petitioning, is "entitled under our precedents to urge any grounds which would lend support to the judgment below." Dayton Bd. of Ed. v. Brinkman, 433 U.S. 406, 419, 97 S.Ct. 2766, 2775, 53 L.Ed.2d 851 (1977). Respondents argue that § 2256 is unconstitutionally vague and overbroad because it makes the age of majority 18, rather than 16 as did the New York statute upheld in New York v. Ferber, supra, and because Congress replaced the term "lewd" with the term "lascivious" in defining illegal exhibition of the genitals of children. We regard these claims as insubstantial, and reject them for the reasons stated by the Court of Appeals in its opinion in this case.513 U.S. at 78-79. The Court of Appeals had stated, "we would not lightly hold that the Constitution disables our society from protecting those members it traditionally considered to be entitled to special protections - minors." United States v. X-Citement Video, Inc., 982 F.2d 1285, 1288 (9th Cir. 1992), rev'd on other grounds, 513 U.S. 64 (1994). The Court of Appeals recognized a "series of Supreme Court cases that permit 'adult' treatment of 16- and 17-year-olds" noting that these "Supreme Court cases . . . merely permit, rather than require, adult treatment of 16- and 17-year-olds." 982 F.2d at 1288. The Court of Appeals concluded that the Supreme Court cases "indicate nothing about the substantiality (or lack thereof) of the overbreadth of section 2256" and concluded that the defendant's arguments are "far from sufficient to overcome the presumption against invalidating a statute on its face for overbreadth." Id.
In this case, Count One and Count Three allege the production and possession of depictions of sexually explicit conduct involving minors. Minor is defined as "any person under the age of eighteen years." 18 U.S.C. § 2256(1). This court applies the holding of the Supreme Court in X-Citement Video that §2256 is not "unconstitutionally vague and overbroad because it makes the age of majority 18, rather than 16." 513 U.S. at 78. The Court further concludes that Count One and Count Three are not unconstitutional on the grounds that the statutes lack an element of scienter or violate the foreign commerce clause. See United States v. Jayavarman, 871 F.3d 1050, 1059-60 (9th Cir. 2017).
Count Three charges Defendant with travel for the purpose of engaging in any illicit sexual conduct in violation of 18 U.S.C. § 2423(b). The term "illicit sexual conduct", as used in Section 2423(b), is defined in 18 U.S.C. § 2423(f) to include "any commercial sex act (as defined in section 1591) with a person under 18 years of age[.]" 18 U.S.C. § 1591(a)(3) provides, "The term 'commercial sex act' means any sex act, on account of which anything of any value is given to or received by any person." 18 U.S.C. § 1591(a)(3). Section 1591(e)(3) provides that an item of value given or received must have been "on account of" a sexual act with a minor. The Court concludes that this statute is not unconstitutionally vague.
The Court concludes that the offenses charged in the indictment are constitutional and Defendant's motion to dismiss the indictment is denied.
IT IS HEREBY ORDERED that Defendant's motion to suppress evidence (ECF No. 29) is denied and Defendant's motion to dismiss indictment (ECF No. 34) is denied. DATED: November 20, 2018
/s/_________
WILLIAM Q. HAYES
United States District Judge