Opinion
CRIMINAL CASE NO. 17-37-DLB-CJS
06-11-2018
UNITED STATES OF AMERICA PLAINTIFF v. JOHN E. SCHANK DEFENDANT
MEMORANDUM OPINION AND ORDER
*** *** *** ***
This matter is before the Court on Defendant John Schank's Motion for a Franks Hearing to Suppress All Physical Evidence and Testimonial Evidence. (Doc. # 29). For the reasons listed below, Defendant's Motion is denied.
Franks v. Delaware, 438 U.S. 154 (1978)
I. FACTUAL AND PROCEDURAL BACKGROUND
On November 4, 2014, Kentucky State Police Detective Kurt Buhts used a law-enforcement database to query "recently observed IP addresses in Kentucky" that were determined to be sharing "child sexual exploitation files over the Internet on Peer-to-Peer (P2P) file sharing networks." (Doc. # 37 at 8). Detective Buhts determined that the IP address 74.130.145.43 (the ".43 Address") had recently distributed files indicative of child sexual exploitation; in addition, the law-enforcement database indicated that the .43 Address had been observed offering more than 100 notable files of child sexual exploitation for sharing. Id. On November 12, 2014, at 17:35 Greenwich Mean Time ("GMT"), Detective Buhts successfully downloaded one of the files that a computer connected through the .43 Address was offering to share. Id. This contained an image from the Identified Child Victim Series known as "Bianca." Id.
On December 3, 3014, Detective Buhts used this information and sent a subpoena to the internet service provider Time Warner Cable, seeking subscriber information for the .43 Address. Id. That same day, Detective Buhts repeated his query of Kentucky IP addresses that had been noted to have shared child sexual exploitation files over P2P file-sharing networks, and determined that the IP address 17.130.145.238 (the ".238 Address") had been observed offering to share over 100 notable files of child sexual exploitation. Id. Detective Buhts successfully downloaded two of these notable files from the .238 Address—the first file on December 4, 2014, at 02:37 GMT, and the second file on December 5, 2014, at 02:15 GMT. Id. One of these files contained an image from the same Identified Child Victim Series known as "Bianca," and the other contained an image of a child under the age of fifteen in a sexually explicit pose. Id. at 9. Detective Buhts learned that the law-enforcement database had linked the .43 Address and the .238 Address together through their use of the same Globally Unique ID 6B013867D90E42BAA6B3B32D5f876F42 ("GUID 6F42"). Id. at 8. Based upon his training and knowledge, Detective Buhts knew that a GUID is unique to a P2P software program installed on a computer, and that to change the GUID, a user would have to delete or uninstall the P2P software program. Id.
Detective Buhts described his information and training in the affidavit. (Doc. # 37 at 6-8). In summary, Detective Buhts had been with the Kentucky State Police for over nine years, and in 2011 was made a post level Internet Crimes Against Children ("ICAC") detective. Id. at 6. He had received training in accordance with ICAC investigation standards, including "child exploitation investigations, ICAC Undercover Investigations Peer-to-Per (P2P) investigations, computer data recovery, onsite computer previews, and identification and seizure of digital evidence." Id.
On December 5, 2014, Time Warner Cable responded to Detective Buhts's subpoena, indicating that the .43 Address had been assigned to Insight Communications at 100 Barnwood Drive Data Apt Test 1, Edgewood, Kentucky, 41017 on the date and time indicated in the subpoena. Id. at 9. Detective Buhts then spoke to a Time Warner Cable Security Operations Senior Investigator, who informed him that the device used to connect to the Internet through the .43 Address was a cable modem that had been assigned to and placed in a Time Warner Cable testing facility at 100 Barnwood Drive, for the purpose of testing internet connections. Id. The Senior Investigator also indicated that Time Warner Cable was unable to locate the modem at 100 Barnwood Drive, and that it would attempt to find the physical location of the modem. Id.
On February 5, 2015, the Senior Investigator contacted Detective Buhts with the following email:
Hello Detective. I was notified this morning that the modem you have been searching for was back online. I arranged with our Technical Operations teams to track the location of the modem through the cable plant. Out (Our) diagnostic tools report the node location from which the modem is responding. From this point we physically disconnect certain parts of the plant while running a continuous ping to the modem. If the pings are dropped or time out then that indicates the modem is located in a part of the plant service[d] by the leg that was disconnected. This process was repeated until we eventually pulled the service line leading to an individual address. In this case, the modem is located at 2700 Sterling Trace Burlington KY 41005-8848. This address is showing as a TWC employee account registered to John E. Schank. Information I have received shows that he would have had access to the location where the modem should have been.Id. The Senior Investigator advised that Time Warner Cable employee John E. Schank had "24/7 access to the headend facility where the modem was located." Id. at 10. Detective Buhts confirmed that John E. Schank listed the 2700 Sterling Trace address as his current address though use of the Kentucky operator's license database. Id.
On February 10, 2015, Detective Buhts sent another subpoena to Time Warner Cable, requesting the subscriber information for the .238 Address on December 4, 2014, at 02:37 GMT and on December 5, 2014, at 02:15 GMT. Id. Time Warner Cable's response indicated that the .238 Address had been assigned to Insight Communications at the 100 Barnwood Drive test site on those dates and times. Id.
Detective Buhts spoke with the Senior Investigator and learned that the modem identified at 2700 Sterling Trace had been on consistently from February 5 through February 9, 2015, and was accessing the Internet via IP address 74.132.184.119 (the ".119 Address"). Id. On February 11, 2015, Detective Buhts queried the Kentucky law-enforcement database, and found that the .119 Address had been observed to offer for sharing more than twenty notable files of child sexual exploitation during the time period from February 7 to February 9, 2018. Id. As a result, Detective Buhts sent a subpoena to Time Warner Cable for the subscriber information for the .119 Address for February 9, 2015, at 13:10 GMT, a date and time that the law-enforcement database had noted the .119 Address was observed offering to share a notable child sexual exploitation file. Id. The response indicated that the .119 Address was assigned to Insight Communications at the 100 Barnwood Drive test center on the date and time in the subpoena. Id.
Detective Buhts averred, based upon his knowledge, experience, and training, that the use of the .43 and .238 Addresses, which had been linked by law enforcement through GUID 6F42, in conjunction with the .119 Address, linked to 2700 Sterling Trace by the missing modem, demonstrated a pattern of criminal activity related to child pornography. Id. The detective's experience, knowledge, and training further led him to believe that the "user treats child pornography as a valuable commodity to be retained and collected," and it was therefore "likely that evidence of the contraband remains in the user's possession [and] is likely to be recoverable even if a person attempts to conceal it." Id.
The warrant to search the residence located at 2700 Sterling Trace, Burlington, KY—based upon Detective Buhts's affidavit—was signed and issued on February 26, 2015, by Boone County Circuit Court Judge J. R. Schrand. Id. at 12. Fifty-nine computers and associated equipment, including multiple sets of hard drives, were seized during the search of Defendant's residence. (Doc. # 1-1).
On October 12, 2017, Defendant was indicted by a federal grand jury on three counts of distribution of child pornography and one count of possession of child pornography. (Doc. # 1). Following his arrest and arraignment (Docs. # 7 and 8), Defendant filed a Motion to Suppress the evidence seized at his home, seeking a hearing to suppress all physical and testimonial evidence. (Doc. # 29). Defendant was subsequently arraigned on a superseding indictment, which added four additional counts of receipt of child pornography. (Docs. # 35 and 31). The United States filed its response to Defendant's Motion to Suppress soon after. (Doc. # 38). Defendant having replied (Doc. # 40), this matter is ripe for the Court's review.
II. ANALYSIS
A. Defendant has not made the substantial preliminary showing to warrant a Franks Hearing.
1. Franks Hearing Standard
In Franks v. Delaware, 438 U.S. 154 (1978), the Supreme Court held that when a defendant "makes a substantial preliminary showing that a false statement knowingly and intentionally, or with reckless disregard for the truth, was included by the affiant in the warrant affidavit," and that the "allegedly false statement is necessary to the finding of probably clause, the Fourth Amendment requires that a hearing be held at the defendant's request." Franks, 438 U.S. at 155-56.
Affidavits in support of search warrants enjoy a "presumption of validity." Id. at 171. Defendant therefore has a "heavy burden" to meet in making a substantial preliminary showing of an intentional or knowing falsehood in an affidavit requesting a search warrant. United States v. Bennett, 905 F.2d 931, 934 (6th Cir. 1990). A defendant's allegations must be "more than conclusory and must be supported by more than a mere desire to cross examine," and "[a]llegations of negligence or innocent mistake are insufficient." Franks, 438 U.S. at 171. Rather, a defendant must furnish "allegations of deliberate falsehood or of reckless disregard for the truth," and "point out specifically the portion of the warrant affidavit that is claimed to be false," "accompanied by an offer of proof," including documentation by "[a]ffidavits or sworn or otherwise reliable statements of witnesses." Id.
Generally, Franks does not apply to "the omission of disputed facts," except "in the very rare case where the defendant makes a strong preliminary showing that the affiant with an intention to mislead excluded critical information from the affidavit." Mays v. City of Dayton, 134 F.3d 809, 816 (6th Cir. 1998). Thus, "[a]lthough material omissions are not immune from inquiry under Franks ... an affidavit which omits potentially exculpatory information is less likely to present a question of impermissible official conduct than one which affirmative includes false information." United States v. Atkin, 107 F.3d 1213, 1217 (6th Cir. 1997) (citing United States v. Martin, 920 f.2d 393, 398 (6th Cir. 1990)). "This is so because an allegation of omission 'potentially opens officers to endless conjecture about investigative leads, fragments of information, or other matter that might, if included, have redounded to defendant's benefit.'" Id.
2. Defendant has failed to make a substantial preliminary showing that Detective Buhts intended to mislead the issuing Judge.
Defendant's arguments amount to an allegation that several small gaps of information in the affidavit created one large omission, which must have been deliberate and done with the intent to mislead. (Doc. # 29). The alleged gaps are as follows: (1) the affidavit does not indicate who actually viewed the child sexual exploitation images downloaded from the .238 and .43 Addresses, to confirm that they constituted child pornography; (2) Detective Buhts did not appear to download any files through a direct connection to the .119 Address, as he did for the .43 and .238 Addresses; (3) no facts in the affidavit connect the .119 Address to the .43 and .238 Addresses; and (4) that no facts connect any of the IP addresses to Defendant. Id. at 5-6. Defendant asserts that the absence of these facts, in conjunction with Detective Buhts's decision to omit the GUID associated with the .119 Address, show that Detective Buhts "purposely omitted information" that might have led the Magistrate Judge to determine that the .119 Address was not connected to the .43 and .238 Addresses. Id. at 7-8. Defendant also briefly argues, with no supporting citation, that the affidavit does not contain sufficient descriptions of the child sexual exploitation images downloaded by Detective Buhts. Id. at 8-9.
This argument is discussed in Part C of the Court's analysis.
Defendant's argument is unavailing. Looking at the evidence broadly, Time Warner Cable traced the physical location of the hitherto-missing modem associated with the .43 Address and determined that the same modem was thereafter connected to the .119 Address. (Doc. # 37 at 9). More particularly, Detective Buhts downloaded child pornography from the .43 and .238 Addresses, associated with a single GUID. Id. at 8-9. Time Warner Cable noticed that one of its modems, associated with the .43 Address, had been stolen. Id. at 9. Upon finding the modem, Time Warner Cable determined that the same modem—previously associated with the .43 Address—was associated with the .119 Address, which had been tracked offering to share notable files likely containing child pornography. Id. at 9-10. The modem was physically traced to the residence of a Time Warner Cable employee, who had access to the testing site where the modem was supposed to be physically located. Id. Thus, Defendant's argument that there were no facts connecting the .238 and .43 Addresses to the .119 Address is belied by the record.
Second, Defendant has not met his burden of showing, by "[a]ffidavits or sworn or otherwise reliable statements of witnesses," Franks, 438 U.S. at 171, that Detective Buhts had the intent to mislead the Judge, and therefore excluded critical information from his affidavit. See Mays, 124 F. 3d at 816. Defendant argues that Detective Buhts's decision to not include the GUID associated with the .119 Address was a deliberate decision to omit information that might lead the Judge to deny the request for a search warrant. (Doc. # 29 at 7-8). In support, Defendant offers the affidavit of Doctor Marcus K. Rogers. (Doc. # 29-1). Doctor Rogers was employed by counsel for Defendant as a computer-forensics expert, and offers three conclusions: (1) that Detective Buhts's affidavit does not establish or show connections between the .119 Address and the .43 and .238 Addresses; (2) that the investigative protocol used by Detective Buhts while investigating the .43 and .238 Addresses was not the same as that used investigating the .119 Address; and (3) that the "affidavit tendered to [the Judge] is incomplete and/or misleading." Id. at 2-5.
Although Doctor Rogers may be a computer-forensics expert, his opinions focus on the affidavit's compliance with the Fourth Amendment—a matter reserved for the Court. Therefore, his opinion that the entire affidavit is "incomplete and/or misleading" is of little to no value.
Doctor Rogers's affidavit suffers from the same, if not greater, factual gaps that Defendant alleges are found in Detective Buhts's affidavit. And, although the Court declines to consider Doctor Rogers's opinion evidence regarding the Fourth Amendment probable-cause requirements and investigative-search procedures, the Court notes that Doctor Rogers's affidavit itself does not conclude that Detective Buhts's intended to mislead the Judge—only that the affidavit might be "incomplete," and not necessarily "misleading." (Doc. # 29-1 at 5). Doctor Rogers's affidavit is the sole evidence that Defendant offers to support his allegations of Detective Buhts's intention to mislead. Defendant has failed to make a substantial preliminary showing that Detective Buhts omitted information from the affidavit with the intent to mislead the Magistrate, and his request for a Franks hearing is denied.
B. Suppression of the evidence is not warranted.
1. Fourth Amendment Standard
The Fourth Amendment provides that the "right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated." U.S. Const. amend. IV. A search by the United States or its agent may implicate the Fourth Amendment in two ways. First, a search occurs when the government "physically occupie[s] private property for the purpose of obtaining information." United States v. Jones, 565 U.S. 400, 404-05 (2012). Second, a search occurs when "the government violates a subjective expectation of privacy that society recognizes as reasonable." Kyllo v. United States, 533 U.S. 27, 33 (2001) (citing Katz v. United States, 389 U.S. 347, 361 (1967) (Harlan, J., concurring)). For the latter, a defendant's expectation of privacy must be one that society is willing to recognize as legitimate. United States v. Jacobsen, 466 U.S. 109, 122 (1984) ("The concept of an interest in privacy that society is prepared to recognize as reasonable is, but its very nature, critically different from the mere expectation, however well justified, that certain facts will not come to the attention of the authorities."). "The burden of establishing a prima facie case of an unlawful search and seizure is on the movant." United States v. Wickizer, 633 F.2d 900, 901 (6th Cir. 1980)
2. Defendant did not have a reasonable expectation of privacy in the stolen modem , and the temporary cessation of Internet connectivity was not a seizure.
Although not raised in his initial Motion to Suppress (Doc. # 29), Defendant argues in his Reply that Time Warner Cable was acting as an agent of the United States in its search to find its own missing modem, and that its actions to find the missing modem therefore constituted an unconstitutional search and seizure, in violation of the Fourth Amendment. (Doc. # 40 at 7-8). Both of these arguments fail.
To show that Time Warner Cable acted as an agent of the United States for purposes of the Fourth Amendment, Defendant must show: (1) that the United States knew of or acquiesced to Time Warner Cable's search; and (2) the intent of Time Warner Cable while engaging in the search was not "entirely independent of the government's intent to collect evidence for use in a criminal prosecution." United States v. Bowers, 594 F.3d 522, 525-26 (6th Cir. 2010) (quoting United States v. Hardin, 539 F.3d 404, 418 (6th Cir. 2008)). But, before the Court analyzes whether Time Warner Cable was acting as the United States' agent, it will first determine whether a search or seizure in derogation of Defendant's Fourth Amendment rights occurred.
Despite Defendant's statements, there is no evidence suggesting that Time Warner Cable "physically occupied" Defendant's "private property for the purpose of obtaining information." Jones, 565 U.S. at 404-05. Defendant suggests that Time Warner Cable determined the physical location of the stolen location as follows:
The affiant in the warrant never fully describes how TWC links an IP address to a particular street address. The affidavit fails to state whether TWC went onto Mr. Shank's [sic] property, or accomplished the task remotely. Based upon the above statement it is presumed that TWC entered Mr. Shank's [sic] property because there is no other way to determine his address but-for going onto his property to pull the service drop line. To determine Mr. Shank's [sic] residential address, TWC underwent a process of one TWC employee on a computer at the office communicating with one or two people in the field. This involves a step-by-step process of watching pings and pulling wires.(Doc. # 40 at 3). Although imaginative, Defendant's description of the process by which Time Warner Cable physically located the stolen modem is entirely different from the actual procedures undertaken by Time Warner Cable, as shown in the affidavit:
I arranged with our Technical Operations teams to track the location of the modem through the cable plant. Out (Our) diagnostic tools report the node location from which the modem is responding. From this point we physically disconnect certain parts of the plant while running a continuous ping to the modem. If the pings are dropped or time out then that indicates the modem is located in a part of the plant service[d] by the leg that was disconnected. This process was repeated until we eventually pulled the service line leading to an individual address.(Doc. # 37 at 9) (emphasis added). As indicated in the affidavit, the entire procedure took place at Time Warner Cable's cable plant. Thus, no search by physical occupation of Defendant's property occurred.
Defendant's Fourth Amendment claim therefore depends upon his reasonable expectation of privacy. A defendant has no legitimate expectation of privacy in items that he has stolen, or the contents therein. United States v. Hensel, 672 F.2d 578, 579 (6th Cir. 1982); see also United States v. Caymen, 404 F.3d 1196 (9th Cir. 2005) (holding that the defendant had no legitimate expectation of privacy in the contents of a computer hard drive that he had obtained through fraud). Defendant had no legitimate expectation of privacy against a search for the modem that Defendant had removed from the test facility and taken to his own residence. Defendant's argument is akin to another defendant seeking to suppress a warrant issued after the owner of a stolen iPhone, using the "find my phone" function, tracks his or her phone to the defendant's residence. Neither this hypothetical defendant, nor the Defendant in this case, has any reasonable expectation that they should be able to conceal a stolen electronic device from the true owner's signaling of that device to find its physical location.
Finally, Defendant argues that Time Warner Cable "seized" all of his "telephone, internet, and cable tv data" when they temporarily interrupted the flow of information as part of their ping-based search. (Doc. # 40 at 4). According to Defendant, the "continuous ping discussed in the affidavit to the search warrant is to a proprietary IP on a private network and is not open to the public." Id. at 8. Again, Defendant has no legitimate expectation of privacy in the contents of the stolen modem. Hensel, 672 F. 2d at 579. Moreover, there is a substantial difference between temporarily blocking the outbound pathway of Defendant's data stream, and actually seizing and observing the contents of that data. Here, Defendant has failed to provide any facts, case law, or persuasive argument suggesting that Time Warner Cable seized the contents of his data by temporarily ceasing service in an effort to determine the physical location of its own stolen modem.
Although the Court is unable to find case law directly discussing Defendant's arguments, two appellate court decisions, from the Sixth and Third Circuit, provide analogous support for the Court's determination. In United States v. Skinner, 690 F.3d 772 (6th Cir. 2012), the defendant moved to suppress the data emanating from the defendant's cell phone, which the government used to track his location by continuously pinging the cell phone from nearby cell-phone towers. The Sixth Circuit affirmed the lower court's denial of the defendant's motion, holding that the defendant "did not have a reasonable expectation of privacy in the data emanating from his cell phone that showed its location." Skinner, 690 F.3d at 775. In United States v. Stanley, 753 F.3d 114 (3rd 2014), the defendant moved to suppress evidence gathered by the government using a software called "Moocherhunter," a "mobile tracking software" that can be "used by anyone with a laptop computer and a directional antenna" to locate the physical location of a known device by "measure[ing] the signal strength of the radio waves emitted" from the device." Stanley, 753 F.3d at 116. The Third Circuit affirmed the lower court's denial of the defendant's motion, holding that the Moocherhunter "revealed only the path of the signal establishing the connection. It revealed nothing about the content of the data carried by the signal." Id. at 122. The defendant had no legitimate expectation of privacy in such signals, "deliberately projected outside of his home." Id. at 119. Similarly here, Defendant had no legitimate expectation of privacy in the signals emanating from his residence that Time Warner Cable used to track and locate its stolen modem, especially as they revealed only the source of the signals and nothing about the contents of the data carried by the signals. And a temporary block of the signals, to help locate the stolen modem, is not a seizure of the contents of Defendant's data.
Because Defendant has not shown that Time Warner Cable physically occupied his property, that he had a legitimate expectation of privacy in the stolen modem, or that Time Warner Cable effected a seizure of the contents of his internet exchanges, even if the Court were to find that Time Warner Cable was acting as an agent of the United States, Defendant can prove no Fourth Amendment violation. Therefore, Defendant's Motion to Suppress on these grounds is denied.
C. The descriptions of child sexual exploitation images were sufficient to create probable cause.
Lastly, Defendant argues that Detective Buhts included insufficient descriptions of the images downloaded from the .43 and .238 Addresses. In United States v. Meeks, 290 F. App'x 896 (6th Cir. 2008), the Sixth Circuit upheld the lower court's denial of a defendant's challenge to a search warrant on, among other grounds, the allegation that the affidavit for the search warrant did not contain anything that fell "within the definition of child pornography." Meeks, 290 F. App'x at 902. Just as in this case, the defendant in Meeks did "not cite to any cases in support of his argument." Id.
The Court in Meeks looked to 18 U.S.C. § 2256 for the definitions of "minor" (a person under the age of eighteen), and "sexually explicit conduct," which included "lascivious exhibition of the genitals or pubic area of any person." Id. (citing 18 U.S.C. 2256(1) and (2)(A)(v)). The Court then found that the description of the images—a prepubescent girl "wearing only an oversized, fishnet blouse thereby exposing her lower body, and a "prepubescent female wearing oversized underwear" in poses one would not "expect a young girl to be in"—to be suggestive of child pornography and sufficient to establish probable cause. Id. at 902-03. The Court compares such descriptions to those found in the Detective Buhts's affidavit, which provides, for one such description: "The child in this image file is lying on her back, naked; with her legs spread apart lewdly displaying her genitals to the camera. The child's breasts are also exposed to the camera. The child appears to be under the age of 15." (Doc. # 37 at 8). Having made the comparison, the Court finds that Defendant's argument is meritless. Defendant has failed to convince the Court that suppression of any evidence is warranted, and his Motion to Suppress the images is denied.
The Court has chosen the least-graphic of the three descriptions of the child sexual exploitation images in the affidavit. The other two are equally suggestive of child pornography. (Doc. # 37 at 8-9). --------
III. CONCLUSION
For the reasons stated herein, IT IS ORDERED as follows:
1. Defendant John Schank's Motion for a Franks Hearing to Suppress All Physical Evidence and Testimonial Evidence (Doc. # 29) be, and is hereby denied;
2. The time period between April 6, 2018 and the date of this Order, totaling sixty-six (66) days, is "excludable time" pursuant to 18 U.S.C. 3161(h)(1)(D) ; and
3. This matter is scheduled for a Status Conference on June 15, 2018 at 1:00 p.m. in Covington. The Defendant shall be present for the conference.
This 11th day of June, 2018.
Signed By:
David L . Bunning
United States District Judge