Opinion
CRIMINAL ACTION No. 1:11-CR-373-CAP-ECS
06-27-2013
UNITED STATES OF AMERICA v. CARL SKOW
REPORT AND RECOMMENDATION OF THE MAGISTRATE JUDGE
I.
Introduction
This matter is before the Court on Defendant's motion to suppress, which was the subject of a report and recommendation issued September 11, 2012, recommending that the motion be denied, or, alternatively, remanded for a hearing on the applicability of the plain view doctrine. [Doc. 59 at 24]. Judge Pannell received the report and recommendation "with approval," but remanded October 1, 2012, for a further hearing on the applicability of the plain view doctrine. [Doc. 64].
Pursuant to the remand, I set this matter for an evidentiary hearing on Friday, December 7, 2012, but the hearing was continued, by joint motion, on November 30, 2012. [Doc. 68]. The hearing was then rescheduled and conducted on January 23, 2013. Evidence was taken and a briefing schedule was established. [Doc. 69]. The transcript was filed thereafter, [Doc. 71], and Defendant's Supplemental Brief was filed on February 27, 2013. [Doc. 74]. The government filed a motion to reopen the record on March 8, 2013, [Doc. 75], and a response to Defendant's brief on March 13, 2013. [Doc. 76]. Defendant opposed reopening the record. [Doc. 77]. At first, I granted the government's motion and set yet another hearing, [Doc. 79], but, after another motion to continue the hearing was filed by Defendant, [Doc. 80], I reconsidered the motion to reopen, denied the motion, and allowed Defendant until May 20, 2013, to file his reply to the government's response. [Doc. 81]. Defendant's reply was filed May 29, 2013, without objection. [Doc. 83]. The motion, at long last, is now ready for a decision.
II.
The Issue
The issue remanded to me for further hearing is limited to one issue only: whether, under the plain view doctrine, during the search of Defendant's computer undertaken pursuant to a warrant, the officers were lawfully in a place where the incriminating or evidentiary character of the images of child pornography would have been "immediately apparent," assuming that the officers were not authorized by probable cause under the warrant to search for child pornography. See Horton v. California, 496 U.S. 128, 136, 110 S. Ct. 2301, 2307-08 (1990). If so, the seizure of this evidence, or contraband, would be justified under the plain view doctrine. With this limited issue firmly in mind, I will summarize the evidence presented at the supplemental evidentiary hearing conducted on January 23, 2013. For a full discussion of the probable cause and Franks issues, see my Report and Recommendation at 6-7, 18-19, 23-24 [Doc. 59].
III.
The Supplemental Evidence
Three witnesses testified at the hearing: two for the government and one for the Defendant. [T. 2]. All three witnesses were stipulated to be expert witnesses in computer forensic analysis. [T. 4]. The government's witnesses also possessed first-hand knowledge regarding how the warrant was obtained, how it was executed, and how the computers and related devices were searched. Defendant's witness was an expert in computer forensics who had examined the seized computers and devices and arrived at certain opinions regarding what would have been evident on the computer when it was searched and whether it was necessary or appropriate for the agents to have inspected the computer in the manner they did. All of this testimony consumed 145 pages of direct, cross, and redirect examination by counsel. See generally [Doc. 71]. A. Agent Ted Schlatre
Reference to the transcript of the suppression hearing, [Doc. 71], will be made as follows: "[T. (Page)]."
Ted Schlatre is a special agent with Homeland Security-ICE. It was stipulated that he was an expert in computer forensics and had experience and background in child exploitation cases. [T. 4, 7]. He described the process used by agents in examining computers seized pursuant to search warrants. He identified two types of software used to search computers — Encase and Forensic Tool Kit. [T. 9]. The examiner first creates an "image" of the hard drive from which the software can analyze the files, folders, and file paths on the original computer. [T. 10]. It could take several months to complete a full forensic examination of a computer after an image is made. [T. 14].
As noted, the first step for the examining officer is to make the "image" of the computer from which a working copy can be made that is loaded into Encase. The software analyzes the computer by obtaining a digital signature, or fingerprint, of the computer and each document or file in it known as a "hash value." [T. 14-15]. Having hash values of files allows the examiner to go straight to a certain file if he knows what he is looking for. [T. 16-17]. As long as the file does not change, the hash value will not change. [T. 17]. Known hash values of child pornography can be used to discover whether the same known files exist on a particular computer. [T. 17-18]. But any alteration of a file will change the hash value. [T. 19].
Ultimately, the examiner will have to look at all the files to know for sure what is in them. [T. 20]. Certain file extensions indicate pictures. One such extension is "jpeg." A user can change these extensions. [T. 21]. The Encase software can analyze whether a file extension does not match the file signature, indicating a change. [Id.]. But the software does not show the examiner substantively what is on an image, a document, or a video. [T. 22]. The examiner can also look for correspondence like e-mail, and at browsing history to see what websites have been visited. [T. 23]. A computer may also be searched with search terms, or "keywords." [T. 24, 32].
Officers also can conduct a forensic preview without actually imaging the hard drive. [T. 26]. This can be done in cases on the scene to look for pictures, or if there is something in particular the agent is looking for, he can go right to it. [Id.]. It does not take the place of a full investigation. [Id.].
Schlatre was the affiant on the search warrant. [T. 27-28]. He testified about how agents, generally speaking, would go about searching for the evidence or items listed in the warrant. Looking at the warrant, Attachment B, paragraph 3(a), Schlatre testified that they were looking for evidence on the computer of who owned the computer, which could include resumes, photos of the owner, or other similar identifying information. [T. 29]. He would also look for Skype or instant messaging, and also for photographs that would indicate ownership of the computer. [Id.]. To find photos of the owner, the examiner would need to look at all the photographs on the computer. [T. 30].
In addition, under the warrant, the agents were looking for evidence of purchase of a copy of any "Rosetta Stone" language courses or materials. [T. 31]. To look for this evidence, agents would use a keyword search. [T. 31-32]. Alternatively, agents could look for a logo for Rosetta Stone or a picture of the packaging indicating that someone went to a website for it. [T. 32]. Examiners would look in different places in the computer for any such evidence. [Id.].
The warrant also authorized a search for evidence of the purchase of a girl's bicycle as a means of transportation for a teenage girl. [T. 32-33]. An examiner could do a keyword search for "bicycle," for brands of bicycles or could also go through all the pictures on the computer to see if there were pictures of girls' bicycles. [T. 33]. Insofar as the warrant authorized search for "[a]ny evidence of preparation for the arrival of a 14-year-old female, including[,] but not limited to, girl's clothing, beds, toys, games," [Doc. 55-1 at 5], the agent would do word searches for these items and also look for pictures of toys and games, any pictures that would indicate or suggest that someone was looking to furnish a girl's bedroom, buy female clothing, or buy toys for a girl. [T. 33-34].
The warrant also authorized a search for certain photographs of minor girls provided by the undercover agent to Defendant. [T. 34]. Again, the agent testified that the examiner could be expected to do a keyword search for the particular e-mail account that the pictures were sent to. [T. 35]. He would also look in the internet cache or in slack space, but ultimately would have to look at all the pictures on the computer to find them. [Id.].
On cross examination, Agent Schlatre testified that his search methodology — what he would have done — would not have differed if he was not authorized under the warrant to look for child pornography. [T. 37]. In this case, however, all of the actual forensic analysis on Defendant's computer was done by Agent Richardson, not by him. [T. 45]. Agent Schlatre also stated on several occasions that the inclusion of child pornography in the search warrant was based on his belief that Defendant was interested in obtaining a minor for sex and that, in his experience and training, "people who are interested in children for sex tend to collect, trade, possess, share, download, or upload child pornography." [T. 37]; see also [T. 52, 55]. He stated that "if you have sexual interest in children and that's your sexual interest . . . it's reasonable to believe you had — based on experience and based on prior cases and studies — that people who have a sexual interest in children also collect child pornography." [T. 37]. B. Agent Michael Richardson
Agent Michael Richardson was the forensic agent on the scene for execution of the warrant. [T. 57]. His responsibility was to check all the electronic media and do a preview of the electronic media on site. [Id.]. He did a preview in this case. [T. 57-58]. He focused on one computer in particular, an "ASUS Thermaltake." [T. 58]. It had three internal hard drives. [T. 59]. They were also two other computers at the residence that did not appear to be operational. [Id.].
If he had attempted to preview each and every piece of media, including hashing each item, it would have taken four days, maybe five days, to preview. [T. 60]. In this case, he used a product called "Encase Portable." [T. 60-61]. He did a preview and he looked for images of child pornography, among other things. [T. 61]. After performing several operations on the computer and hard drives over a two-hour period, he received a manageable "bucket of images" to look at. [T. 62]. He immediately noticed images of child pornography. [Id.]. There was no question when he saw those images that they were in fact child pornography. [T. 62-63]. At that point he just shut the preview down because they were seizing the computers anyway: "We packed up all the evidence and returned to the South Atlanta office to my lab." [T. 63].
Back at the lab, he also used another version of Encase software. [T. 66]. His practice was to go straight to images. [Id.]. That is where he starts. [T. 66-67]. He looked at what amounted to a "bucket of images." [T. 67]. He was also looking for images of "Mariena," a 14-year-old girl whose name he had been given. [Id.]. Scrolling through the images he ultimately found images of Mariena. [T. 68]. Those images were later "hashed" and found to be the same images sent by the undercover agent to the Defendant. [Id.].
Richardson also tried to find evidence of usership of the computer. [T. 69-70]. He looked at the registry files, e-mails, e-mail addresses, browsing history. [T. 70]. He could not remember if he saw images of Defendant on the computer or not. [Id.]. However, "Carl" was shown as the registered user. [T. 71]. He also found evidence of Rosetta Stone through a keyword search which took him directly to it. [T. 72-73]. With regard to the girls' bicycles, he did image searching first and then a keyword search. [T. 73]. He did not find anything. [Id.]. With regard to evidence of "preparation for the arrival of a 14-year-old female," he went through images to see if there were any images of any of these items. [T. 73-74]. He also did keyword searches and again checked the Internet history and found no evidence of those items either. [T. 74].
Agent Richardson was looking for child pornography when he did his searches. [T. 75]. He believed that he needed to go through all of the images on the computer even if hash values were known for some of the pictures:
[T]here may be images that are not known to law enforcement at that time. There may be images that the defendant just made. There may be some images of interest that maybe aren't child pornography, but are still related to the case. So I still have to go through each and every image and determine if it has any relevance to the case or not.[Id.].
Agent Richardson was looking for child pornography because he believed the warrant authorized him to do that. [T. 80]. At the time of his initial preview on site, he did not have hash values for the pictures of the girls that were known to exist. [T. 83-84]. He found images of child pornography soon after he started scrolling through the pictures. [T. 84]. Agent Richardson contended that eventually he would have to have gone through all images, regardless of what he found initially:
So long as covered in the warrant, I'm going to check all things that could be checked . . . . If it's not in the warrant, then I stop immediately, and they're going to have to get another warrant for that item. But as long as it's covered in the warrant I'm going to search for everything I can.[T. 85].
With Encase Portable the date range for any searches cannot be limited. [T. 88]. Back at the office, it is possible to do a date range limited search. [T. 89]. The word search for "Rosetta Stone" and "bicycle" were done back at the lab. [T. 92]. Basically, all Agent Richardson found on site was child pornography. [T. 94]. He testified that if he had worked only on the one computer, it would have taken a month to a month and a half to examine the computer. [T. 94-95].
He testified that if he had just been looking for photographs of Mariena when he searched under the search warrant he would not have done anything differently. [T. 96]. He would still have scrolled through all the images. [Id.]. And with regard to Rosetta Stone, the bicycle, the children's clothing, the evidence of usership, he would have scrolled through all the images. [Id.]. C. Defendant's Expert Jim Persinger
Mr. Persinger is a computer forensics consultant hired by the Defendant. He went to the office of Homeland Security to review the Defendant's computer. [T. 101]. He was provided with certain pictures and he determined those file names had hash values associated with the pictures. [T. 101-02]. His approach was to start with the hash values. [T. 102-03]. He would search the file name and then the hash value. [Id.]. In his opinion, that was the narrowest way to find the documents and the quickest way. [T. 103]. He also did a keyword search for "Mariena." [T. 104]. He used a function called Gallery Viewer. [T. 105-06]. Gallery Viewer turned up images of the pictures in question. [T. 106]. It did not turn up any child pornography. [Id.]. He found the term "Rosetta." [T. 107].
Like Agent Richardson, Mr. Persinger was looking at an image of the hard drive when he did his searches. [T. 109]. As did Richardson, he "hashed" the entire hard drive. [T. 111]. Then he was able to try to find matches. [Id.]. He knew there were three pictures in particular that he was looking for. [T. 112]. He was able to find them with the file information. [Id.]. The hash value will disclose every location that the picture was in. [T. 113]. It will also tell him if the file has been renamed. [Id.].
His first line of attack would have been to run file names to find what he's looking for. [T. 114]. As a last resort, if all other methods fail, then he would sit there "for tedious hours" and scroll with the mouse. [T. 115]. If he were looking for child porn, he would also look for it by file name. [Id.]. He stated that there were about five words that would "come up" related to child porn. He would look for those file names to find child porn. [T. 116-17]. This would find very specific child porn. [Id.].
During his review, Mr. Persinger did not find any child pornography. [T. 121]. In his opinion, someone who found child pornography on this computer had to be zeroing in and looking particularly for child pornography, not looking for Rosetta Stone, or references to a girl's bicycle, or the five particular photographs. [Id.]. He was asked to perform particular tasks. To find the three to five pictures and references to Rosetta Stone, he focused on two hard drives. [T. 123]. He was not asked to look for references to bicycles or evidence of shopping for children's clothing or toys. [T. 132]. He said that if he had been asked to look for information regarding a girl's bicycle or women's clothes he would have said the search was too broad. [T. 132-33]. He agreed that once he found what he thought was a picture, ultimately he would have to open the picture and look at it to be sure it was what he was looking for. [T. 136].
He was shown the last page of Defendant's Exhibit 1, page 17, an exhibit created by him. [Id.]. In particular, his attention was called to a file labeled as follows, in part: "Guatemala 9yo fucked in car with sound.mpg.lnk." [Id.]. That file was found on Defendant's computer on a hard drive. [Id.]. In fact, he found this in the course of his examination. [T. 137-138]. He admitted that if he was looking for evidence of a defendant's preparation to bring a young Guatemalan girl into his home for sex he would search "Guatemala." [T. 138]. If he did that, this file would come up. [Id.]. He could then play the video and determine whether, as the title suggests, it showed a 9-year-old Guatemalan girl being raped. [T. 139]. He admitted that if he had gone as far as to find this link he would have had reason to believe that the link was pornographic in nature and involved a child. [T. 140].
IV.
Discussion
A. Was the Child Pornography in Plain View?
The essence of Defendant's argument is that the agents engaged in a more comprehensive and intrusive search of Defendant's computer and hard drives than was authorized by the warrant, taking into consideration that the application lacked probable cause to search for child pornography. Relying on his expert, Defendant contends that a properly limited search using hash values and keywords would have immediately disclosed the pictures of the young girls given to Defendant by the undercover officer, any reference to a girl named "Mariena," any reference to Rosetta Stone language courses, and any indicators of ownership of the computer, without ever placing the examining agents in a place where they would have seen child pornography. [Doc. 74 at 10]. A more targeted search, in other words, was constitutionally required, according to Defendant. [Id. at 12]. Furthermore, Defendant contends that a limitation of the search to evidence received or created after June 3, 2011, would likewise have assured that no child pornography would have been seen. [Id. at 13-14].
The "plain view" doctrine permits a warrantless seizure where (1) an officer is lawfully located in the place from which the seized object could be plainly viewed and must have a lawful right of access to the object itself; and (2) the incriminating character of the item is immediately apparent. Horton v. California, 496 U.S. 128, 136-37, 110 S. Ct. 2301, 2308 (1990); United States v. Smith, 459 F.3d 1276, 1290 (11th Cir. 2006). "The plain view doctrine allows police officers to seize any contraband in plain view if the officers have a right of access to the place where the contraband is located." United States v. Rodgers, 924 F.2d 219, 221 (11th Cir. 1991).
In this case, Defendant argues in effect that the officers were not authorized to look at all the photographs on the computer to determine if any of them constituted evidence of any of the charged offenses for which search and seizure was authorized in the warrant. Defendant takes issue with the agents' search protocol in this regard. But even though Defendant is correct that it would have been possible to target narrowly the girl photographs, and the references to Rosetta Stone and Mariena, without necessarily having ventured into a place on the computer where child pornography could have been discovered, Defendants argument fails as it is applied to other categories of information authorized to be searched for and seized in the warrant.
The warrant authorized search for any evidence of the purchase of a bicycle; in addition, the warrant authorized search for any evidence of preparation for and arrival of a 14-year-old female, probably from Guatemala, whose arrival was anticipated by Defendant as a result of his dealings with the undercover officer. I simply cannot conclude that it was unreasonable for Agent Richardson to have looked through his "bucket of images" seeking such evidence. Indeed, even Defendant's expert was required to concede that if he had been looking for evidence of preparations to receive a Guatemalan girl into his home, and he ran a key search using the term "Guatemala," he himself would have retrieved the file described above and would have recognized it as a link to child pornography. See Def's Exh. 1 at 17, [T. 137-40].
While the Court is mindful of proper limitations that should be applied to searches of computers under warrants, and agrees that a warrant to search a computer for specific evidence is not a carte blanche to rummage throughout the depths of the hard drives, nor all its registries and caches and slack space, the essential watchword of the Fourth Amendment is reasonableness. And in this case, I cannot say that it was unreasonable for Agent Richardson, in previewing the file, to have compiled a manageable "bucket" of photographic images from which to make an initial pass at evidence authorized to be searched for and seized under the warrant.
As far as a date limitation is concerned, Defendant is correct that the search of the computer for evidence of the charged offense might have been limited to a time frame post-dating the undercover operation leading to Defendant's arrest. If this limitation had been applied, Defendant contends that no child porn would have been discovered. Defendant presented no evidence, however, to support this statement. And, given that the preview software used on the scene by Agent Richardson lacked the capability of date limitation, see [T. 88], it was not unreasonable for the agent to have reviewed the images on site without applying such a limitation.
As for the more comprehensive search performed back at the lab, I do not find any unreasonable conduct in the agents looking at the list of files and at least cursorily opening those that appeared to be evidentiary or contraband.
When a warrant authorizes the seizure of documents, 'an officer acting pursuant to such a warrant is entitled to examine any document he discovers,' in order to 'to perceive the relevance of the documents to the crime.' United States v. Slocum, 708 F.2d 587, 604 (11th Cir. 1983). Moreover, '[i]n searches for papers, it is certain that some innocuous documents will be examined, at least cursorily, in order to determine whether they are, in fact, among those papers authorized to be seized.' Andresen v. Maryland, 427 U.S. 463, 482 n.11, 96 S. Ct. 2737, 2749 n.11 (1976).United States v. Miranda, 325 F. App'x 858, 860 (11th Cir. 2009).
Whether or not it would have been reasonable to have looked through all the jpegs and other photographic image files just to find the pictures of the girls, or a reference to Rosetta Stone, it was certainly reasonable for the agent to look through Defendant's photographs for evidence of Defendants ownership, possession and control of the computer and its hard drives, and it was reasonable to look for any evidence of Defendant's planning and preparations for the coming of this Guatemalan girl he believed the undercover officer was going to deliver to him. And, as Agent Richardson testified, as soon as he started looking through the images on Defendant's computer, he came very quickly in the process upon child pornography.
The fact that Agent Richardson was looking for child pornography does not render his search unconstitutional. At the time he made his search, he was possessed of a search warrant that, on its face, authorized him to search for child pornography. The issue is not whether he was looking for child pornography. The issue is whether the search warrant authorized the agent to look through the photographs in making the searches he had probable cause to make, and whether, in so carrying out this authorized mandate, the agent came into a place where photographs would have been in plain view whose incriminating character as child pornography would have been "immediately apparent." I answer these questions, "Yes." I thus conclude on this issue that the requirements of the plain view doctrine were met in this case with regard to Agent Richardson's discovery of child pornography on Defendant's computer and its associated hard drives. B. The Good Faith Exception to the Exclusionary Rule.
Defendant did not assert that the incriminating nature of the pictures seized as child pornography was not immediately apparent. Defendant's sole argument was, in effect, that the government exceeded the scope of what was authorized in searching through the pictures.
In my prior report and recommendation to the district judge in this case, I concluded that even though I believed the warrant was lacking in probable cause to support a search for child pornography, there was no basis for concluding that the officers did not act in good faith reliance upon a facially valid warrant in executing the search of Defendant's computers. Stated another way, it was not unreasonable for the officers to believe that the warrant signed by Magistrate Judge Walker was valid — based upon probable cause — and that the warrant authorized them to search for child pornography. Indeed, despite the case law finding lack of probable cause in similar circumstances, I do not find it unreasonable for the officers to have believed, based upon their experience, even "intuitively," as one Court put it, that persons who seek to have sex with minors and are sexually attracted to minors are likely to have looked at and downloaded child pornography onto their computers. Accordingly, under United States v. Leon, 468 U.S. 897, 922, 104 S. Ct. 3405, 3420 (1984), the evidence of child pornography seized in this case need not be suppressed, because the agents obtained the evidence based on objective, good faith reliance upon an initially valid warrant, even though it was later found to lack probable cause in certain respects.
United States v. Colbert, 605 F.3d 573, 578 (8th Cir. 2010) ("There is an intuitive relationship between acts such as child molestation or enticement and possession of child pornography."). --------
V.
Conclusion
It is my conclusion that the officers were lawfully located in the place from which the evidence of child pornography could be plainly viewed and that the incriminating character of the material was immediately apparent. Smith, 459 F.3d at 1290; see also Miranda, 325 F. App'x at 860 ("The child pornography files were intermingled with counterfeiting files, so they were in plain view. Once the officer saw child pornography on Miranda's hard drives, its incriminating character was immediately apparent, so the officer could seize the files."); United States v. Williams, 592 F.3d 511, 523 (4th Cir. 2010) ("[W]e conclude that the sheer amount of information contained on a computer does not distinguish the authorized search of the computer from an analogous search of a file cabinet containing a large number of documents."); United States v. Wong, 334 F.3d 831, 838 (9th Cir. 2003) (child porn validly seized in plain view under search warrant for evidence of murder). The plain view doctrine therefore validates the seizure of the evidence of child pornography. Alternatively, the good faith exception to the exclusionary rule also applies to validate the search and seizure in this case.
Accordingly, the motion to suppress should be DENIED.
In addition, it appearing that there are no further pretrial or discovery matters to bring before the undersigned, it is therefore ORDERED that this case be and is hereby CERTIFIED as ready for trial.
SO REPORTED AND RECOMMENDED, this 27th day of June, 2013.
s/ E . Clayton Scofield
E. Clayton Scofield III
UNITED STATES MAGISTRATE JUDGE