Opinion
Case No. 2:20-cr-122-JLB-NPM
2021-07-06
UNITED STATES of America v. Marquise THOMAS
Yolande G. Viacava, US Attorney's Office, Ft Myers, FL, James A. Muench, US Attorney's Office, Tampa, FL, for United States of America. James Lappan, Public Defender, Federal Public Defender's Office, Ft Myers, FL, for Marquise Thomas.
Yolande G. Viacava, US Attorney's Office, Ft Myers, FL, James A. Muench, US Attorney's Office, Tampa, FL, for United States of America.
James Lappan, Public Defender, Federal Public Defender's Office, Ft Myers, FL, for Marquise Thomas.
ORDER
NICHOLAS P. MIZELL, UNITED STATES MAGISTRATE JUDGE
Based on the contents of laptops and other electronic devices seized from his home pursuant to a search warrant, defendant Marquise Thomas is charged in a one-count indictment with possession of child pornography. (Doc. 1). Probable cause for the warrant to search his residence was based on law enforcement's use of peer-to-peer (P2P) file-sharing software that, in conjunction with information obtained from other sources, associated Thomas's residential address with electronic devices from which illicit images could be downloaded by the public over the internet.
Because Thomas is not charged with distributing child pornography based on the file-sharing activities identified by the P2P software, the Government does not intend to use at trial the information that supplied probable cause for the seizure of his devices. Instead, the Government intends to prosecute Thomas based only on an examination of the seized devices. (Doc. 33, p. 5). Nevertheless, to see if he can develop any arguments to challenge the search warrant that authorized the seizure, Thomas seeks discovery about the P2P software that contributed to a magistrate judge's finding of probable cause for the search. For the reasons explained below, Thomas's Motion to Compel (Doc. 29) is denied.
I. BACKGROUND
The Search Warrant and Indictment
The application for the search warrant was supported by an affidavit from FBI agent Donald Woelke, whose duties include the investigation of online exploitation of children and, in particular, the possession and transmission of child pornography. As explained in agent Woelke's affidavit (Woelke Aff., ¶¶ 15-20), individuals use P2P file sharing to share files over the internet. P2P file-sharing programs are publicly available for download. Once installed, users may designate a shared folder on their device from which other P2P users may freely download files, and users search for files in other P2P users’ shared folders by using file names or keywords. Multiple files may be downloaded simultaneously, and a single file may be downloaded by retrieving parts of it from multiple devices. While users may freely download files from other P2P users, they may not upload files to other users’ devices without the recipient's knowledge and active participation.
The use of these programs creates a variety of P2P networks. While BitTorrent may be the most well known, there are many others—such as eDonkey, KAD, Ares, KaZaA, DirectConnect, Gnutella, LimeWire and Frostwire—and a P2P program may facilitate the sharing of files with one or more P2P networks. See generally United States v. Maurek , 131 F. Supp. 3d 1258, 1259, 1264 (W.D. Okla. 2015) ("Maurek II "); United States v. Alva , No. 2:14-cr-00023-RCJ-NJK, 2017 WL 6820149, *1 (D. Nev. Dec. 15, 2017) ; United States v. Feldman , No. 13-CR-155, 2015 WL 248006, *3 (E.D. Wis. Jan. 19, 2015). Instead of relying on a single server to provide an entire file directly to everyone who might want to download it, which can increase bandwidth costs and cause slow download speeds, P2P users can download portions of the file from numerous other P2P users simultaneously, reducing bandwidth demands and resulting in faster downloads. See generally United States v. Gonzales , No. CR-17-01311-001-PHX-DGC, 2019 WL 669813, *1 (D. Ariz. Feb. 19, 2019) ("Gonzalez I "); United States v. Hoeffener , No. 4:16CR00374 JAR/PLC, 2017 WL 3676141, *5-7 (E.D. Mo. Aug. 25, 2017) ("Hoeffener I "); United States v. Maurek , No. CR-15-129-D, 2015 WL 12915605, *1 (W.D. Okla. Aug. 31, 2015) ("Maurek I ").
This order cites two opinions from each of three criminal actions: Gonzalez , Maurek , and Hoeffener . In chronological order, the district court opinions from Gonzalez and Maurek , and the district and circuit court opinions from Hoeffener , are short cited as Gonzalez I and Gonzalez II , etc.
Devices connected to the internet are assigned an internet protocol (IP) address by an internet service provider (ISP), such as Comcast or CenturyLink, which makes it possible for data to be transferred between devices. As Woelke testified and Thomas concedes, the IP addresses associated with the devices making files available for download are publicly available to other P2P users.
In November 2018, Woelke investigated the sharing of child pornography on a public P2P network. Using a P2P program created for use by law enforcement, Woelke identified IP address 73.28.248.125 as making files available for download by users of the public network. He reviewed the file names and browsed the thumbnail images, which appeared to depict child pornography, and between November 10 and 24, he downloaded several hundred child pornography files from this IP address. A publicly available database disclosed that this IP address was associated with Comcast. In response to a subpoena, Comcast advised that from November 10 to 24, it had assigned this IP address to devices in Thomas's residence pursuant to a subscription agreement with him. Furthermore, the investigation determined that between July 17, 2018, and August 20, 2018, a Homeland Security agent had downloaded multiple child pornography files from IP address 71.208.48.1, and, in response to a subpoena, CenturyLink had reported this IP address as assigned during the relevant time period to devices in Thomas's residence pursuant to a subscription agreement with him.
Based on this information, as well as indications that Thomas continued to live in the residence reported by Comcast and CenturyLink, the warrant was issued on January 23, 2019. Executing the warrant the next day, Woelke's task force seized laptops, a cellphone, and other devices capable of storing electronic child pornography files. Based on a forensic examination of the laptops and cellphone seized from the house, Thomas was charged by indictment on October 7, 2020, with possession of child pornography. (Doc. 33, p. 5).
The Parties’ Disclosures and Discovery Requests
Pursuant to the Pretrial Criminal Scheduling Order (Doc. 13) and Federal Rule of Criminal Procedure 16, and by letter dated October 23, 2020, the Government disclosed to defense counsel that, among other things, he was free to inspect the items that will be used by the Government in its case-in-chief—such as the laptops and cellphone seized from Thomas's residence. (Doc. 20-1). One would naturally expect any challenge to the search warrant to start with such an examination. For instance, might there be indications that the devices were never connected to a P2P network? Or might there be indications that specific files referenced in the search warrant application were never present on any of the seized devices? A reliable finding of this sort might raise legitimate questions about the search warrant application worthy of further inquiry.
But instead, without reference to any examination of the devices or any expert opinions, defense counsel—in a November 24, 2020 letter to the prosecution—advanced his apparently personal musings about how the law enforcement software might not work the way Woelke had explained in his search warrant application. (Doc. 29-1). Opening his query with "I simply don't understand how federal agents" downloaded child pornography from Thomas's devices, defense counsel nevertheless claimed to "know" that the law enforcement software "secured information unavailable to any civilian." (Doc. 29-1, pp. 1, 5). This "information," as defense counsel would have it, comes in two forms: (1) the law enforcement software somehow associates an IP address with a specific geographic location (such as someone's house); and (2) it is capable of restricting its download of all data for a particular file from a single source. (Doc. 29-1, p. 3). From these two predicates, defense counsel leaps to the conclusion that the law enforcement software may be a form of malware that "compromises an area for which there is a reasonable expectation of privacy" (an apparent reference to areas of a device not shared with other P2P users, such as nonshared folders). (Doc. 29-1, p. 5).
Defense counsel seems to completely overlook Woelke's explanation in the search warrant application that the subject IP addresses were associated to Thomas's residence as a result of Comcast's and CenturyLink's subpoena responses, and that a publicly available database associates IP addresses with the ISP that assigns them; nowhere did Woelke claim that the law enforcement software was capable of making this association on its own. Moreover, defense counsel concedes that public users of the P2P network can identify the IP address of the device making files available for downloaded. (Doc. 29-1, pp. 3-4).
To ostensibly dispel his professed suspicion that the law enforcement software may have somehow accessed areas of Thomas's devices that were not available to public users of the P2P network, defense counsel requested the production of, among other things: (1) the name of the "law enforcement version P2P program" used by Woelke; (2) disclosure of whether the user manual for this "law enforcement version P2P program" is available to the public; (3) disclosure of whether the source code for this "law enforcement version P2P program" is available to the public; (4) the name of the program used by the unidentified DHS agent; (5) disclosure of whether the user manual for that program is available to the public; and (6) disclosure of whether the source code for that program is available to the public. (Doc. 29-1, p. 6).
The Motion to Compel
With no additional disclosure or production by the Government in response to this discovery request, Thomas filed the instant motion to compel disclosure of the six items mentioned above and, if not publicly available, production of the user manuals and source code for the program(s) utilized by Woelke and the DHS agent. (Doc. 29). But as with the disclosure request, the motion is not supported by any findings gleaned from an examination of the devices or any expert opinion testimony. Rather, it rests on admittedly uninformed and speculative conjecture that the law enforcement software "tagged the defendant's computer: that is, installed an investigative tool to create an identifier that tracks the defendant's computer." (Doc. 29, p. 18). This, in turn, is based on the suspicion ("Mr. Thomas suspects") that the law enforcement software enables federal agents to do "much more to Mr. Thomas [than] any private citizen could do." (Doc. 29, p. 14).
See Doc. 29, pp. 12 ("complete mystery"), 16 ("can only guess"), 18 ("don't know if this is true"), 22 ("no idea"), 25 ("no idea").
But this appears to make little if any sense because the defense concedes that files contained within shared P2P folders are available to all P2P users (Doc. 29, pp. 14-15), that public "trackers" in the P2P network identify all devices in the network sharing the files or parts of them (Doc. 29, p. 15), and public P2P users can identify the IP address of the device from which they download any data (Doc. 29-1, pp. 3-4). Further, it strains credulity to say that a law enforcement P2P user does "much more" to the host of a publicly shared file by downloading a copy of all of it when any other user is free to download a copy of any part or parts of it.
Nevertheless, the motion argues that the discovery should be compelled so Thomas can assess whether he might have a basis to attack the search warrant application for lack of probable cause, for improperly developed probable cause, or for containing an intentionally or recklessly false statement that was necessary to the probable cause finding. (Doc. 29, p. 9). And the motion argues that the discovery may be relevant and material to presenting a defense at trial and to challenging any evidence the Government might offer related to the law enforcement P2P software. (Doc. 29, pp. 9, 22-25).
In response, the Government sheds some more light on the differences between the law enforcement P2P software and the way publicly available P2P programs often work. While the public versions generally acquire and then reassemble fragments of the same file present in the shared folders of multiple devices, the law enforcement version downloads the entire file from a single device. (Doc. 33, p. 3). The law enforcement software logs the IP address of the device from which the file was downloaded, and it does not share files with other users of P2P networks. (Doc. 33, p. 3). But as the Government contends, none of this is material to Thomas's defense because he is charged with possession of child pornography based on the forensic examination of his computers and cellphone subsequent to their seizure from his home, and not distribution of child pornography due to his file-sharing activities over a P2P network. (Doc. 33, pp. 5-6). Thus, the Government does not intend to introduce any evidence about the file-sharing activities, such as the information it obtained by using the law enforcement P2P software. (Doc. 33, p. 5).
Moreover, the Government points out that no P2P user has a reasonable expectation of privacy in either the files made available to other P2P users or the IP address of the device making them available. (Doc. 33, pp. 3, 6). With the subject devices and everything gathered from them available for inspection—and none of Thomas's arguments for discovery arising from any such inspection—the Government contends that the motion to compel is nothing more than a "speculative fishing expedition." (Doc. 33, pp. 4, 6). Pointedly, the Government argues "the evidence in this case reflects the software performing precisely as designed since child pornography was downloaded from the defendant's computer and the defendant was found in possession of child pornography subsequent to the search warrant. Further, the defendant's admissions to agents substantiate his possession of child pornography and his use of a peer-to-peer file sharing program to search for and collect child pornography." (Doc. 33, p. 12). In sum, the Government asserts that Thomas has failed to provide an adequate basis for the Court to compel discovery concerning the grounds provided by FBI agent Woelke for the search warrant.
Replying to the Government's response, Thomas holds fast to his entirely unsupported contention that the law enforcement P2P software links IP addresses to specific geographic locations—even though Woelke's affidavit in support of the search warrant application explains otherwise. (Doc. 39, pp. 3, 6). From there, he continues to speculate that the law enforcement software might "trespass" by installing malware on a P2P user's computer, or it might access areas not made available to other P2P users. (Doc. 39, pp. 3-5). Retreating from his opening memorandum, Thomas makes clear that his request for discovery is entirely concerned with a potential attack on the search warrant rather than mounting a defense at trial. (Doc. 39, p. 13 ("... Mr. Thomas believes the salient issue is not the type of prosecution but the type of investigation.")). But turning a blind eye to the countless ways a forensic examination of his seized devices could dispel or corroborate his professed suspicions, Thomas argues that production of the user manuals and source code for the law enforcement program(s) should be compelled despite the absence of any substantiation for his purported concerns.
II. ANALYSIS
The Scope of Rule 16
"Our starting point is Rule 16(a) of the Federal Rules of Criminal Procedure, which spells out the materials the prosecution must produce on the defendant's request." United States v. Jordan , 316 F.3d 1215, 1249 (11th Cir. 2003). The rule provides in pertinent part:
(E) Documents and Objects. Upon a defendant's request, the government
must permit the defendant to inspect and to copy or photograph books, papers, documents, data, photographs, tangible objects, buildings or places, or copies or portions of any of these items, if the item is within the government's possession, custody, or control and:
(i) the item is material to preparing the defense;
(ii) the government intends to use the item in its case-in-chief at trial; or
(iii) the item was obtained from or belongs to the defendant.
Subsection (iii) is not at issue because the Government has made all items seized from Thomas available for inspection. Nor is subsection (ii) at issue because the Government does not intend to offer any testimony or other evidence at trial about the law enforcement P2P program(s) or any information about the subject devices gathered by any such program. So, to fall within the scope of Rule 16 discovery, the requested items must be "material to preparing the defense." Fed. R. Crim. P. 16(a)(1)(E)(i).
In the context of Rule 16, "the defense" means "the defendant's response to the Government's case in chief," or in other words, "a defense on the merits to the criminal charge itself." United States v. Armstrong , 517 U.S. 456, 462, 116 S.Ct. 1480, 134 L.Ed.2d 687 (1996). Thus, Rule 16 requires the disclosure of items material to raising a "shield" to the criminal charge and not to advancing any "sword" that challenges the conduct of the Government's investigation or prosecution. Id. See also United States v. Thompson , 758 F. App'x 398, 405 (6th Cir. 2018) ( Rule 16(a)(1)(E) applies only to items that might refute the Government's arguments that the defendant committed the crime charged) (citing United States v. Semrau , 693 F.3d 510, 529 (6th Cir. 2012) ); United States v. Brinson , 208 F. App'x 420, 423 (6th Cir. 2006) ( Rule 16 "was not meant to extend to issues not impacting the defendant's culpability"); United States v. Rashed , 234 F.3d 1280, 1285 (D.C. Cir. 2000) (reasoning that Rule 16 enables attempts to refute the Government's case-in-chief and does not enable attempts to establish an independent constitutional bar to the prosecution).
Armstrong references the then-existing Rule 16(a)(1)(C), which is now codified as Rule 16(a)(1)(E). This restyling of the rule did not change its substance.
The Government seeks a conviction for possession (and not distribution) of child pornography based only on the post-seizure forensic examination of the devices that were in Thomas's residence and not the pre-seizure identification and download of items from his devices by the law enforcement P2P program(s). (Doc. 33, p. 5). Thomas is likewise entitled to forensically examine the devices seized from him; instead, he advances an unsubstantiated claim that an inspection of the source code and user manuals for the law enforcement P2P program(s) would be "material to his defense." (Doc. 29, pp. 10-11).
The investigative software utilized by the Government provided probable cause to search Thomas's home and seize devices found in it, but it has nothing to do with whether he knowingly possessed the devices. There is no suggestion that the Government uploaded any child pornography to the subject devices, and the Government has confirmed that Thomas will not be confronted with anything about the law enforcement P2P software at trial. In sum, even if the software was capable of associating an IP address with a specific residence, or it only downloaded fragments of illicit photos or videos from an IP address associated with Thomas, there would still be no Rule 16 disclosure obligation because none of this would pertain to any defense concerning Thomas's alleged possession of the incriminating devices. See Hoeffener I , 2017 WL 3676141 at *13 (denying motion to compel source code, software, and manuals related to law enforcement's P2P investigation because "nothing in the ... receipt-of-child-pornography charge reveal[ed] that the charge [was] based, to any extent, on materials downloaded from Defendant's computer while [the FBI] used [a P2P program]"), aff'd , 950 F.3d 1037 (8th Cir. 2020) ; Maurek I , 2015 WL 12915605 at *3 (denying motion to compel production and inspection of law enforcement P2P software because the defendant—charged with receipt, distribution and possession of child pornography—did not identify "any specific defense to the charges against him that the [program] could help him develop").
Thus, while Thomas asserts that the production of the source code and user manuals could possibly lead to his mounting a challenge at trial concerning the reliability of the law enforcement P2P program(s), he will have no occasion to do so.
Further, even if the possession-of-child-pornography charge arose from the evidence gathered by the law enforcement P2P program(s), the disclosure and production of their source code and user manuals would remain unwarranted because Thomas has failed to substantiate how this would be "material" to his defense. A conclusory argument that the requested item is material to the defense "will not suffice." United States v. Jordan , 316 F.3d 1215, 1250 (11th Cir. 2003). And the defendant must show more than "some abstract logical relationship to the issues in the case." Id. "Materiality must be shown by more than mere speculation or conjecture." United States v. Hoeffener , 950 F.3d 1037, 1043 (8th Cir. 2020) (" Hoeffener II ").
For example, in Gonzalez I , 2019 WL 669813 at *2, two defendants—Anthony Gonzalez and Aaron Ordonez—were charged with both distributing and possessing child pornography. The distribution counts were based on video files downloaded by a law enforcement P2P program, and the possession counts were based on an examination of devices seized from their homes. While they did not request production of the source code, Gonzalez and Ordonez sought production of an installable copy of the program (and Gonzalez also sought production of the user and training manuals).
Gonzalez argued that the requested production was material to his defense because the distribution charges were based on files purportedly downloaded by the law enforcement P2P program, and—as evidenced by an affidavit from his expert—these files were not found on the device seized from his home. Furthermore, his expert testified that her examination of the subject device revealed no evidence that Gonzalez had ever downloaded the files on which the distribution charges were based. Id. at *4-5. Gonzalez had done more than "simply request access to the software and argue that it [was] material to his defense." Id. at *5. "He [had] presented evidence that [called] into question the government's version of events." Id. So the court granted him access to the program to investigate its reliability and prepare to cross-examine the FBI's P2P investigator at trial. Id. at *6.
On the other hand, Ordonez did not present "any evidence in support of [his] materiality argument" or any "case-specific expert evidence to support [his] motion to compel." Id. The court therefore found that Ordonez "failed to make a threshold showing of materiality under Rule 16(a)(1)(E)(i)." Id. at *7 (citing United States v. Pirosko , 787 F.3d 358, 366 (6th Cir. 2015) (finding the mere allegation of unanswered questions about the government's software insufficient to show materiality)).
Just like Ordonez and opposite from Gonzalez, Thomas offers no case-specific facts or expert opinions and instead grounds his materiality arguments on ill-informed conjecture and speculation. Thus, it would be improper to compel the disclosure of the program's source code or user manual under Rule 16 because Thomas makes no threshold showing of their materiality to his defense. See also Maurek I , 2015 WL 12915605 at *3 (denying motion to compel inspection of law enforcement P2P program in distribution-of-child-pornography case—even though defendant argued, just as Thomas does here, that production would allow for expert analysis of the software—because the defendant failed "to present [the] Court with any specific facts which would tend to show how production and/or inspection of the [program] would enable him to significantly alter the quantum of proof in his favor") (internal quotation and citation omitted).
For the same reason, similar motions to compel fall short even when supported by an expert declaration. See Hoeffener I , 2017 WL 3676141 at *13 (denying motion to compel items related to law enforcement P2P program because defendant's expert declaration "failed to elucidate how the requested information would assist Defendant's response to the Government's case-in-chief," or enable an effective cross-examination of the investigator).
Discovery Related to a Potential Attack on the Search Warrant
Rule 16 " ‘is intended to prescribe the minimum amount of discovery to which the parties are entitled,’ and leaves intact a court's ‘discretion’ to grant or deny the ‘broader’ discovery requests of a criminal defendant." United States v. Jordan , 316 F.3d 1215, 1249 n. 69 (11th Cir. 2003) (quoting Notes of Advisory Committee on 1974 Amendments to Federal Rule of Criminal Procedure 16 ). But much like the materiality standard for Rule 16(a)(1)(E)(i), a defendant is not entitled to broader discovery without first presenting facts that call into doubt the propriety of the case advanced against him.
For example, to warrant an inquiry into the veracity of an officer's affidavit in support of a search warrant application, the defendant's "attack must be more than conclusory and must be supported by more than a mere desire to cross-examine." Franks v. Delaware , 438 U.S. 154, 171, 98 S.Ct. 2674, 57 L.Ed.2d 667 (1978). Rather, the defendant must make "a substantial preliminary showing that a false statement knowingly and intentionally, or with reckless disregard for the truth, was included by the affiant in the warrant affidavit, and [that] the allegedly false statement [was] necessary to the finding of probable cause." Id. at 155-156, 98 S.Ct. 2674 ; see also id. at 170, 98 S.Ct. 2674 ("The requirement of a substantial showing would suffice to prevent misuse of a veracity hearing for purposes of discovery or obstruction.").
"There is, of course, a presumption of validity with respect to the affidavit supporting the search warrant." Id. at 171, 98 S.Ct. 2674. And "searches pursuant to a warrant will rarely require any deep inquiry into reasonableness, for a warrant issued by a magistrate normally suffices to establish that a law enforcement officer has acted in good faith in conducting the search." United States v. Leon , 468 U.S. 897, 922, 104 S.Ct. 3405, 82 L.Ed.2d 677 (1984) (internal quotations and citations omitted).
Moreover, there is no reasonable expectation of privacy in the spaces of hard drives and other electronic storage devices made available to the public via a P2P network, or in the IP address or other information made available to other P2P users. See United States v. Palmer , No. 2:15-cr-1-FtM-38DNF, 2015 WL 4139069, *12 (M.D. Fla. July 8, 2015) ; Maurek II , 131 F. Supp. 3d at 1262-1263 ; see generally Katz v. United States , 389 U.S. 347, 351, 88 S.Ct. 507, 19 L.Ed.2d 576 (1967) ("What a person knowingly exposes to the public, even in his own home or office, is not a subject of Fourth Amendment protection"). The case law is replete with findings that law enforcement P2P programs comply with the Fourth Amendment because they gather information that a P2P user shares with public users of the network.
As the Eleventh Circuit discussed in United States v. Norman , 448 F. App'x 895, 897 (2011) :
... even if Norman held a subjectively reasonable expectation of privacy in the shared files on his computer, this expectation was not objectively reasonable. As the record shows, Norman's computer contained a peer-to-peer file-sharing program—which Norman himself used—that allowed other public users of such software to access the shared files on his computer. Moreover, Norman's argument that law enforcement used "unique" software that was not available to the general public, and his reliance on Kyllo v. United States , 533 U.S. 27, 121 S. Ct. 2038, 150 L. Ed. 2d 94 (2001), are misplaced because, as noted, he had placed the contents of the folder the police searched into the public domain, thereby negating any reasonable expectation of privacy in the folder. In Kyllo , law enforcement used a thermal imager to scan the home of a suspected marijuana grower to determine whether his home was emitting heat consistent with the use of high-intensity lamps for growing marijuana. 533 U.S. at 29–30, 121 S. Ct. 2038. The Supreme Court held that when the government uses a device, in that case a sense-enhancing thermal imager, which was not in general public use, to obtain information about the interior of a home that could not otherwise have been obtained without physical intrusion, the surveillance constitutes a search. Id. at 34, 40, 121 S. Ct. 2038. However, unlike in Kyllo , the contents of the shared folder on Norman's computer were knowable to law enforcement without physical intrusion to Norman's house because this information was also available to members of the public. Accordingly, Norman did not suffer a Fourth Amendment violation, and thus, the district court did not err in denying his motion to suppress.
In fact, by defense counsel's estimation, the law enforcement P2P software used by FBI agent Woelke in this case was a program called "Torrential Downpour" (Doc. 29-1, p. 2 n. 1), and following a series of tests conducted by an expert for the defense in Gonzalez , it was found that Torrential Downpour does not distribute files or data to other devices on the P2P network, does not connect to other IP addresses when attempting to download data from a target device, and that it never downloads a file that the P2P user had previously removed from the shared folder or deleted. United States v. Gonzalez , No. CR-17-01311-001-PHX-DGC, 2020 WL 5210821 at *5-10 (D. Ariz. Sept. 1, 2020) (" Gonzalez II "). In sum, the defendant's experts "confirmed in each instance what the government has represented about Torrential Downpour—that it does not somehow enter non-shared space to download files." Id. at *7. See also Hoeffener I , 2017 WL 3676141 at *6 (stating that an independent company validated Torrential Downpour).
Thomas offers no evidence suggesting either a potential Fourth Amendment violation or any intentional or reckless falsehood. For instance, Thomas does not offer: any evidence that files reportedly downloaded from the devices do not exist on them or did not exist on them during the relevant time; any evidence that the law enforcement P2P program(s) might have uploaded anything to Thomas's devices; or any evidence that the subject devices never participated in any P2P network or were otherwise incapable of sharing information with P2P users. Thomas's speculation that the law enforcement P2P program(s) utilized by investigators during the pre-warrant investigation may have somehow acted as a form of malware or hacked into unshared spaces of his devices is simply not enough to unlock the door to discovery. See Hoeffener II , 950 F.3d at 1044 (affirming denial of motion to compel source code and manuals related to law enforcement P2P program because the defendant—charged with receipt and possession of child pornography—offered "mere speculation that the software program could possibly access non-public areas of his computer or that there was a possibility that it malfunctioned"); Pirosko , 787 F.3d at 365-366 (reasoning that allowing the defendant—charged with receiving and distributing child pornography—access to the law enforcement P2P program without his first providing "any evidence of error would ... pointlessly drag out the course of litigation"); Feldman , 2015 WL 248006 at *5 (denying motion to compel based on the same suspicions that Thomas advances here—that the law enforcement P2P program might install a "tag" on the defendant's computer or infiltrate its private spaces—despite these suspicions being advanced under oath by an expert witness).
Notably, a forensic examination can determine if a file was deleted after it was downloaded by a law enforcement P2P program and before the execution of a search warrant to seize the device. See United States v. Owens , No. 18-CR-157, 2019 WL 6896144, *4 (E.D. Wis. Dec. 18, 2019).
In United States v. Jones , 565 U.S. 400, 407, 132 S.Ct. 945, 181 L.Ed.2d 911 (2012), the Supreme Court held that notwithstanding the absence of an expectation of privacy, the physical installation of a GPS tracking device on an automobile constitutes a Fourth Amendment search because it involves a "physical intrusion of a constitutionally protected area in order to obtain information." Speculating that the law enforcement P2P program might upload or install something on a P2P user's computer, Thomas alludes that this might run afoul of the holding in Jones . (Doc. 29, pp. 13-14; Doc. 39, pp. 4-5). But as the majority cautioned in Jones : "It is important to be clear about what occurred in this case: The Government physically occupied private property for the purpose of obtaining information." Id. at 404, 132 S.Ct. 945. And as it further reasoned: "Situations involving merely the transmission of electronic signals without trespass would remain subject to Katz [reasonable-expectation-of-privacy] analysis." Id. at 411, 132 S.Ct. 945 (emphasis in original). Even if the law would support a finding that uploading data to a computer on a P2P network constitutes a physical occupation of private property, the mere suspicion by Thomas that this could have happened here does not justify any discovery.
Moreover, the grounds that underlie Thomas's conjecture are either wrong or not worthy of any further guesswork. First, Thomas advances a variety of suppositions based on the apparent misbelief that the law enforcement P2P program(s) can associate an IP address with a particular residence. (Doc. 29, p. 18; Doc. 29-1, p. 3). But Woelke's affidavit made no such suggestion. Instead, the affidavit explained that a publicly available database associates IP addresses with internet service providers, and that responses to subpoenas served on Comcast and CenturyLink connected the subject IP addresses to Thomas and his residence. (Woelke Aff. ¶¶ 25, 27).
Cases discussing the use of law enforcement P2P programs in child pornography investigations often observe that investigators associate IP addresses with residences by serving internet service providers with subpoenas. See , e.g. , United States v. Chiaradio , 684 F.3d 265, 271 (1st Cir. 2012) ("After serving a subpoena on the ISP, Agent Cecchini traced the IP address to a residence in Westerly, Rhode Island ....").
Thomas also appears to be mistaken about how law enforcement's ability to download an entire file over a P2P network from a single device is somehow different from what other P2P users can do. As the court found in Hoeffener I , 2017 WL 3676141 at *8 : "The BitTorrent network also supports single source downloads. A non-law enforcement user of the BitTorrent network may obtain such downloads by using an IP filter to filter activity into the user's computer so that only one IP address can communicate with the user's computer." See also Maurek II , 131 F. Supp. 3d at 1261 (noting that a developer of Torrential Downpour testified that its "direct connection capabilities were no different from other commercially available versions of BitTorrent and it (Torrential Downpour) had no rate of error").
Besides, even if only fragments of files known to depict child pornography were downloaded from Thomas's devices, or if Woelke had not progressed beyond reviewing the list of files available for download and viewing their thumbnail sketches, the affidavit still would have provided probable cause to search the devices in Thomas's home for items related to the crimes of possessing and distributing child pornography. See Feldman , 2015 WL 248006 at *4 (courts have routinely found no direct download is required to establish probable cause, and digital fingerprints related to illicit material may suffice). In fact, at least one of the file names contained "pthc" (Woelke Aff. ¶ 24), which "is a common search term used for ‘pre-teen hard core.’ " United States v. Carroll , No. 3:15-CR-00012-TCB, 2015 WL 8491011, *2 (N.D.).
"Courts reviewing the legitimacy of search warrants should not interpret supporting affidavits in a hypertechnical manner; rather, a realistic and commonsense approach should be employed ...." United States v. Miller , 24 F.3d 1357, 1361 (11th Cir. 1994). In this case, the names of the files (which also included "girl bate" and "rape") combined with Woelke's averment that he had viewed the thumbnail sketches and determined, based on his training and experience, that they depicted child pornography sufficiently showed "a fair probability that contraband or evidence of a crime" would be found at Thomas's residence. See Carroll , 2015 WL 8491011 at *3, aff'd , 886 F.3d 1347 (11th Cir. 2018) (quoting Miller , 24 F.3d at 1361) (quoting Illinois v. Gates , 462 U.S. 213, 238, 103 S.Ct. 2317, 76 L.Ed.2d 527 (1983) ).
Contrary to any suggestion by Thomas otherwise, Daubert -like scrutiny into the reliability of law enforcement P2P programs at the search warrant stage is unnecessary and inappropriate. The Federal Rules of Evidence do not apply to proceedings surrounding the issuance of a search warrant, and "probable cause does not require scientific certainty." Maurek II , 131 F. Supp. 3d at 1265 (internal quotation and citation omitted).
Finally, the Government also resists Thomas's motion to compel on the grounds of privilege. (Doc. 33, pp. 9-14). But since Thomas has not demonstrated any entitlement to the requested information, the Court need not determine whether the law enforcement privilege applies.
III. CONCLUSION
Thomas presents no non-speculative basis for holding a hearing, either to explore the legality of the Government's pre-warrant investigation or the veracity of the search warrant affidavit. His arguments overlook the facts, ignore the nature of the charge and the Government's case-in-chief, and fall short of providing any basis for the requested discovery. The Government continues to afford Thomas and any expert he might retain the opportunity to forensically examine the seized devices. (Doc. 33, pp. 4-5). Thomas simply has the wrong point of origin in mind for his fishing expedition. The motion to compel (Doc. 29) is DENIED .
ORDERED in Fort Myers, Florida on July 6, 2021.