Opinion
3:20-cr-26-BJD-LLL
11-06-2023
UNITED STATES OF AMERICA v. SAMUEL ARTHUR THOMPSON
Laura Cofer Taylor, Assistant United States Attorney Brenna Falzetta, Assistant United States Attorney Mai Tran, Assistant United States Attorney Christopher Eric Roper, Esquire (standby counsel) Samuel Arthur Thompson, pro se defendant.
Laura Cofer Taylor, Assistant United States Attorney
Brenna Falzetta, Assistant United States Attorney
Mai Tran, Assistant United States Attorney
Christopher Eric Roper, Esquire (standby counsel)
Samuel Arthur Thompson, pro se defendant.
REPORT AND RECOMMENDATION
LAURA LOTHMAN LAMBERT United States Magistrate Judge.
A grand jury has charged Samuel Arthur Thompson in a ten-count indictment for violations related to: the possession and receipt of visual depictions of minors engaged in sexually explicit conduct while previously being convicted of Second Degree Sodomy; the use or employment of minors to engage in sexually explicit conduct for the purpose of producing a visual depiction of that conduct while previously being convicted of Second Degree Sodomy; the failure to provide information required under the Sex Offender Registration and Notification Act; the knowing causation of transmissions of a program, information, code, and command causing damage without authorization to protected computers; and the possession of a firearm after previously being convicted of a crime punishable by imprisonment for a term exceeding one year. Doc. 178.Defendant, proceeding pro se, filed a motion requesting: 1) an evidentiary hearing pursuant to Franks v. Delaware, 438 U.S. 154 (1978) to challenge the validity of a search warrant for his residence issued on July 11, 2019; and 2) suppression of “all evidence, equipment, documentation, and information obtained and seized” as a result of that search warrant. Doc. 132 at 1. The government filed a response in opposition, doc. 149, and both parties filed supplemental briefs with leave of Court, docs. 154, 158.
This constitutes the operative indictment, filed February 22, 2023.
In Franks, the Supreme Court held that “[W]here [a] defendant makes a substantial preliminary showing that a false statement knowingly and intentionally, or with reckless disregard for the truth, was included by the affiant in the warrant affidavit, and if the allegedly false statement is necessary to the finding of probable cause, the Fourth Amendment requires that a hearing be held at the defendant's request. In the event that at that hearing the allegation of perjury or reckless disregard is established by the defendant by a preponderance of the evidence, and, with the affidavit's false material set to one side, the affidavit's remaining content is insufficient to establish probable cause, the search warrant must be voided and the fruits of the search excluded to the same extent as if probable cause was lacking on the face of the affidavit.” Id. at 155-56.
The Court held an evidentiary hearing on defendant's motion on March 2, 2023, March 3, 2023, and June 15, 2023. See clerk's minutes, docs. 185, 208; transcripts, docs. 184, 194, 209. Defendant's motion to suppress has been referred for the issuance of a report and recommendation regarding an appropriate resolution, see doc. 132.
The Court continued the hearing because an issue arose during the proceeding that necessitated additional briefing from the parties. Doc. 182. Following the resolution of that matter, the hearing concluded on June 15, 2023. Doc. 204.
I. Procedural History
On February 12, 2020, a grand jury charged defendant in a six-count indictment, doc. 7. At defendant's request, the Court appointed him counsel, doc. 10.
He was initially represented by the Federal Defender's Office, and then by Mr. Christopher Eric Roper after the Federal Defender's Office moved to withdraw, docs. 32, 33. Defendant's indictment was superseded on April 7, 2021, doc. 39, and defendant then requested to represent himself, doc. 50. Around this time, the government also moved for a competency evaluation of defendant, which the Court granted, doc. 64; defendant was found competent to proceed on February 4, 2022, doc. 96. After defendant was found competent to proceed, the Court held a Faretta hearing and ultimately permitted defendant to proceed pro se; the Court also appointed Mr. Roper to serve as standby counsel. Doc. 99. On October 3, 2022, Defendant filed his motion to suppress and for a Franks hearing, doc. 132. On February 22, 2023, a grand jury returned the second superseding, operative indictment, doc. 178.
Faretta v. California, 422 U.S. 806 (1975).
II. Background and Evidentiary Hearing
Defendant challenges a search warrant that was issued on July 11, 2019, and executed on his personal residence, located at 113 Marsh Island Circle, St. Augustine, 32095. Doc. 208-2, govt.'s ex. 1 (Application for Search Warrant). The search warrant alleges that defendant violated 18 U.S.C. § 1030, by intentionally accessed a protected computer or computer network without authorization. Id. at 2. The affidavit supporting the warrant application was authored by Special Agent Frank Norris (SA Norris) of the Federal Bureau of Investigation (FBI) and states as follows. On December 10, 2018, SA Norris, Special Agent JulianCarl Slaughter (SA Slaughter) and task force officer Roger Prendergast interviewed Michael Webb (Webb), Vice President of Information Technology for the Jacksonville Jaguars. Id. at 5. The interview was precipitated by the FBI's receipt of a complaint from the Jaguars stating that defendant, a former contractor for the Jaguars, had gained unauthorized access to a secure computer network located within the Jaguars' facility. Id. at 6. Defendant was a contract employee with the Jaguars from April 1, 2017, to February 23, 2018, and served as the video production engineer and control room equipment consultant for the video board system at the Jaguars' stadium. Id. Webb claimed that defendant failed to inform the Jaguars that he was a convicted sex offender when hired; SA Norris independently confirmed defendant's conviction. Id. at 6-7.
The first time an exhibit is cited, it will include the exhibit number; however, subsequent citations will include only the document number assigned by the Court's electronic filing system (CM/ECF). All citations to exhibits with multiple pages will follow the pagination assigned by CM/ECF.
The following is a synopsis of facts in the affidavit, intended to provide background and context for the warrant at issue. As discussed throughout this report and recommendation, defendant takes issue with many of the facts as recited in the affidavit.
The Jacksonville Jaguars is a football team with the National Football League. In his affidavit, SA Norris refers to the Jaguars as the “victim company.” Doc. 208-2 at 5. For the sake of clarity, I refer to the team throughout as the “Jaguars.”
While a contract employee, defendant was authorized to use remote access software called TeamViewer to access the devices that control the Jaguars' video board network. Id. at 7. With TeamViewer, defendant could access the video board system from any location with any internet-enabled device that had a compatible operating system. Id. On December 3, 2018, the Jaguars internally investigated a series of video monitor network incidents in which the video boards experienced brief outages from their standard operating design. Id. at 8. These outages occurred during Jaguars' “events” on September 16, 2018, November 18, 2018, and December 2, 2018. Id. The Jaguars determined that the outages during each of the incidents resulted in an inability of the video board system operators to display the desired content. Id. at 8-9. The technical term for this event is a “denial-of-service” attack. Id. at 9. During their investigation, the Jaguars determined that the outage on December 2, 2018, occurred due to a command that was sent by an unknown or “rogue” device. Id. The rogue device was determined to be Abekas Mira workstation “MIRA9120” that had been decommissioned from service and replaced with a new one. Id. Unbeknownst to the Jaguars, the MIRA9120 had been moved to a server rack adjacent to the server rack that housed the active Abekas Mira servers in the video board server room. Id. In its decommissioned state, the MIRA9120 had no connections to any video system; it had only a power cable and network cable connected to it. Id.
The “events” in the affidavit are presumably Jaguars home games that occurred in September, November, and December 2018.
The MIRA9120 is referred to as a “rogue device” in the affidavit for the search warrant at issue, doc. 208-2; however, for the sake of consistency, I refer to it as the “MIRA9120” throughout this report and recommendation.
The Jaguars examined the MIRA9120 and determined that TeamViewer software was installed and active. Id. at 10. The TeamViewer's default connection log, however, had been disabled by the user who installed the program on the MIRA9120; this made any connections used by the TeamViewer software on the MIRA9120 untraceable. Id. On or about December 3, 2018, Jaguars' technology staff disconnected the MIRA9120 from the video board network and re-enabled the TeamViewer logging feature to discover any unauthorized connections to the MIRA9120 during an upcoming event scheduled for December 16, 2018. Id.
The Jaguars then provided the FBI with the results of its internal investigation, which revealed that on February 23, 2018-defendant's last day at work with the Jaguars-a user logged onto TeamViewer and downloaded the TeamViewer software onto the MIRA9120. Id. at 10-11. Five minutes later, someone with the username “Sam7” logged onto TeamViewer and connected with username “MIRA9120.” Id. at 11. Ten minutes later, a user logged onto “rossvideo.com” and downloaded the “Dashboard” software, a free software program designed for facility control and monitoring of devices in a network. Id. Nineteen minutes later, a user with ID number 11649557 logged onto Dropbox.com to download a file named “CarboniteLoadSave.grid” from the “JagSaveForLater” folder; it was later determined defendant was the owner of that account number. Id. On December 16, 2018, the date of another scheduled Jaguars event, the MIRA9120 TeamViewer log file, now enabled, revealed that a user logged onto TeamViewer and connected with it; it was later determined that the same TeamViewer account number logged onto the MIRA9120 station a total of five times, the last session using an IP address that was later linked to defendant's residence. Id. at 11-13. SA Norris additionally learned that the TeamViewer account “Sam7” had fourteen sessions with the MIRA9120 account, with the last access to the “Sam7” account starting on November 18, 2018, using an iPhone and the IP address linked to defendant's residence. Id. at 12-13. Further, Dropbox account number 11649557, which as noted above is registered to defendant, was accessed on January 29, 2019, using the IP address linked to defendant's residence. Id. at 12-13. SA Norris further determined that the same Dropbox account was accessed to download the “CarboniteLoadSave.grid” file to the MIRA9120 on February 23, 2018. Id. at 13.
Defendant's first name is Samuel and his colleagues have referred to him as “Sam.” See docs. 132-7 at 2 (anonymous letter regarding defendant); 208-16, govt's ex. 15, at 7 (text messages in which defendant is referred to as “Sam.”).
In sum, SA Norris states in his affidavit that the MIRA9120 was used to conduct denial of service attacks on the Jaguars' video board network during scheduled events. Id. Further, the MIRA9120 was accessed by a TeamViewer account on defendant's last day of work using an IP address that was later linked with him; on the same day, files from defendant's Dropbox account were accessed and downloaded onto the MIRA9120. Id. The MIRA9120 was then the source of several attacks carried out on the Jaguars' network during scheduled events, and on December 16, 2018, the MIRA9120 was accessed by a TeamViewer account using the IP address linked to defendant's residence. Id. at 13-14.
At the evidentiary hearing on defendant's' motion to suppress and for a Franks hearing, doc. 132, the government presented the testimony of SA Norris. Doc. 185. The government also submitted 17 exhibits:
1. The application for the warrant to search defendant's residence dated July 11, 2019 (govt.'s ex. 1);
2. A “guardian report” dated December 10, 2018, supporting the facts in the search warrant affidavit (govt.'s ex. 2);
3. An incident response report from the Jacksonville Jaguars dated December 3, 2018 (govt.'s ex. 3);
4. A contract between defendant and the Jacksonville Jaguars dated April 1, 2017 (govt.'s ex. 4);
5. Composite photos of servers in Jacksonville Jaguars server room taken December 3, 2019 (govt.'s composite ex. 5);
6. Email correspondence between SA Norris, Webb, Michael Potts, Jason Dean and SA Slaughter dated January 14-16, 2019 (govt.'s ex. 6);
7. Email correspondence between Webb and SA Norris dated January 1618, 2019 (govt.'s ex. 7);
8. Records from TeamViewer regarding account ID 938826091 (govt.'s ex. 8);
9. Records from Dropbox, Inc. regarding account ID 11649557 (govt.'s ex. 9);
10.Records from TeamViewer regarding account IDs 1118559964 and 625675632 (govt.'s ex. 10);
11. Records from Comcast regarding IP address 67.190.234.123 (govt.'s ex. 11);
12. Photos of the search warrant left at defendant's residence (govt.'s composite ex. 12);
13. Records from ASM Global regarding defendant (govt.'s ex. 13);
14. Email correspondence between Webb and SA Norris dated December 23, 2020 (govt.'s ex. 14);
15. Text messages between defendant and Megha Parekh (govt.'s ex. 15);
16. Text messages between defendant and Larry Rosen (govt.'s ex. 16); and
17. Text messages between defendant and Jason Brimhall (govt.'s ex. 17).
These were received into evidence with no objection from defendant. Docs. 185; 208 through 208-18.
Defendant had the opportunity to cross examine SA Norris, testified on his own behalf, docs. 184, 185, and submitted four exhibits:
1. Email correspondence between defendant, Keith Van Der Leest, Jason Morill, Larry Rosen, and Hussain Naqi dated February 5-6, 2015 (defense ex. 1);
2. Text messages dated February 21-24, 2018 (defense ex. 2);
3. Letter to defendant from Ms. Parekh, the Jaguars' chief legal officer, dated April 16, 2019 (defense ex. 3); and
4. The warrant at issue and its attachments (defense composite ex. 4).
These were received into evidence with no objection from the government. Docs. 185; 208, 208-19 through 208-24.
Below, I reference only the evidence submitted at the hearing that is relevant to the various arguments.
I have reviewed each of the documents submitted into evidence, even if not cited in my analysis.
III. Analysis
As outlined above, defendant makes two arguments in his motion. First, defendant claims the search warrant is invalid under the principles outlined in Franks v. Delaware, 438 U.S. 154 (1978), because it contains false statements and material omissions. Second, defendant challenges the general validity of the warrant and its execution, including arguments that: the warrant lacked probable cause, was overbroad, and not sufficiently particularized; the search exceeded the scope of the warrant; and the warrant was unreasonably executed because the agents failed to knock and announce themselves, refused to show defendant the warrant at the outset, left a copy of the warrant with defendant that had no attachments, and excluded defendant from the home while conducting the search. I will address each argument in turn.
1. Arguments Related to Franks v. Delaware
The Fourth Amendment of the U.S. Constitution provides, “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, nut upon probable cause[.]” “Probable cause to support a search warrant exists when the totality of the circumstances allows the conclusion that ‘there is a fair probability that contraband or evidence of a crime will be found in a particular place.'” United States v. Kapordelis, 569 F.3d 1291, 1310 (11th Cir. 2009) (quoting Illinois v. Gates, 462 U.S. 213, 238 (1983); United States v. Brundidge, 170 F.3d 1350, 1352 (11th Cir. 1999)). “Where a warrant to search a residence is sought, the affidavit must supply the authorizing magistrate [judge] with a reasonable basis for concluding that [a defendant] might keep evidence of his crimes at his home, i.e., a safe yet accessible place.” Id. (internal quotations and citation omitted).
Affidavits supporting arrest warrants are presumptively valid. Id. at 1309 (citing Franks, 438 U.S. at 171). “[T]o be entitled to an evidentiary hearing on a motion to suppress based on alleged misrepresentations or omissions in a search warrant affidavit, a defendant must make a substantial preliminary showing that the affiant made false statements, either intentionally or with reckless disregard for the truth, pointing specifically to the portions of the affidavit claimed to be false, and that the false statements were necessary to the finding of probable cause. Id. “The reasoning in Franks also applies to information omitted from warrant affidavits.” Madiwale v. Savaiko, 117 F.3d 1321, 1326 (11th Cir. 1997). However, “even intentional or reckless omissions will invalidate a warrant only if inclusion of the omitted facts would have prevented a finding of probable cause.” Kapordelis, 569 F.3d at 1309 (alteration omitted) (quoting Madiwale, 117 F.3d at 1327). The Eleventh Circuit further clarified “the substantiality requirement is not lightly met” and
[t]o mandate an evidentiary hearing, the challenger's attack must be more than conclusory and must be supported by more than a mere desire to cross-examine. There must be allegations of deliberate falsehood or of reckless disregard for the truth, and those allegations must be accompanied by an offer of proof. They should point out specifically the portion of the warrant affidavit that is claimed to be false; and they should be accompanied by a statement of supporting reasons. Affidavits or sworn or otherwise reliable statements of witnesses should be furnished, or their absence satisfactorily explained.United States v. Arbolaez, 450 F.3d 1283, 1294 (11th Cir. 2006) (citation omitted).
As noted above, defendant moves for a Franks hearing and to suppress all evidence seized as a result of the arrest warrant, doc. 132. The Court set an evidentiary hearing to address the suppression motion and to give defendant an opportunity to make the requisite showing that he is entitled to a full Franks hearing. See docs. 164 (notice of hearing), s-176 at 2 (“The question of whether defendant has made the requisite showing that he is entitled to a Franks hearing has not yet been decided; it will be examined at the forthcoming evidentiary hearing.”); 194 at 10, lines 13-25; at 12, lines 3-5 (explaining that defendant had not yet made a satisfactory showing that he was entitled to a Franks hearing). In consideration of defendant's pro se status, the Court permitted him leeway at the evidentiary hearing to make the substantial preliminary showing that he was entitled to a full Franks hearing. Below, I address defendant's arguments related to the Franks issue.
A. Defendant's Relationship with SMG
As the first basis for his Franks request, Defendant argues that SA Norris omitted from his affidavit the fact that the City of Jacksonville (City), and not the Jaguars, owns the subject network and servers at issue. Doc. 132 at 9-10. Defendant further urges that he maintained authorized access to the network and servers through his continued relationship with the City via his contract work with SMG Jacksonville Sports and Entertainment (SMG). Id. Relatedly, defendant claims SA Norris falsely stated in his affidavit that it was the Jaguars that owned the facility and controlled access to the network and servers, when it was actually the City who owned the facility and determined who was given access. Id.; see also doc. 209 at 45-46 (defendant's closing argument). The specific sentence defendant challenges in the affidavit reads: “The interview was conducted as a result of FBI Jacksonville's receipt of a complaint from the VICTIM COMPANY [Jacksonville Jaguars] that THOMPSON, a former contractor for the VICTIM COMPANY, had been accessing a secure computer network located within the VICTIM COMPANY's facility.” Doc. 209 at 46 (citing doc. 208-2 ¶ 6).
During his closing argument, defendant relied on a portion of his crossexamination with SA Norris in which SA Norris testified that, to his knowledge, the City owned the facility. Id. at 47 (citing doc. 194 at 125-26). In further support of his argument, defendant points to a contract between himself and the Jaguars that states, in relevant part,
[p]ursuant to the Stadium lease agreement between [the Jaguars], the City, and Bold Events, LLC . . . the City authorized [the Jaguars] and Bold Events to oversee the construction of and receive the exclusive right to occupy, manage, and operate, a covered football field (the “Covered Flex Field”) and amphitheater currently known as Daily's Place (the “Amphitheater,” and, together with the covered Flex Field and Stadium, the “Facility”), respectively.Doc. 132 at 9-10 (citing doc. 208-5, govt.'s ex. 4, at 2). Finally, defendant cites to an FBI guardian report, or incident summary, authored by SA Slaughter, which states that “THOMPSON did have authority to access the [Jacksonville Jaguars] networks once he was terminated.” Doc. 132 at 10 (citing doc. 208-3, govt.'s ex. 2, at 3). Defendant claims the alleged omission and misrepresentation are material because they establish he was, in fact, authorized to access the servers during the time period at issue. Id. at 9-10.
At the hearing, SA Norris testified that based on information he received from Jaguars' personnel, his affidavit stated defendant's last day of employment with the Jaguars was February 23, 2018, and that as of that date, defendant no longer had any access to the Jaguars' secure computer network. Doc. 194 at 31-32. Further, SA Norris testified that the contract provision cited above gave the Jaguars the “exclusive rights” to occupy, manage, and operate the football field. Id. at 35. Regarding the sentence in the guardian report authored by SA Slaughter, SA Norris indicated that it contained a typo and should have read that “Thompson did not have authority to access the Jacksonville Jaguars network once he was terminated.” Id. at 27 (emphasis added).
I find SA Norris's testimony on these issues to be credible. Initially, I do not interpret SA Norris's statement in the affidavit to assert that the Jaguars owned the facility at issue; rather, SA Norris states defendant was alleged to have accessed a network within the Jaguars' facility. See doc. 208-2 ¶ 6. Further, the statement is not negated by SA Slaughter's guardian report. After reviewing the context of the sentence, it appears likely the sentence was a typo, as the report would not make sense if defendant had maintained access to the network. See doc. 208-3. And SA Norris reasonably relied on the Jaguars' representations regarding defendant's access to the network at issue; defendant presents no evidence that SA Norris was in possession of information to the contrary at the time he authored the warrant. Finally, even if SA Norris specified in the affidavit that the City was the true owner of the facility, this information does not negatively impact a probable cause finding.
B. The Anonymous Letter
Defendant next argues that SA Norris omitted from his affidavit that an anonymous letter addressed to senior Jaguars staff disclosing defendant's prior conviction as a sexual offender prompted the Jaguars' decision not to renew his contract. This, he claims, shows that Jaguar employees “had animosity toward [him].” Doc. 132 at 10-11 (citing doc. 132-7). Defendant asserts this letter may have influenced the “magistrate[ ] [judge's] determination of probable cause in weighing the credibility of evidence provided to the agent.” Id. at 11. At the hearing, SA Norris testified that, according to Webb, defendant failed to inform the Jaguars that he was a convicted sex offender at the time he was hired, doc. 194 at 37; in his affidavit, SA Norris stated the Jaguars “chose not to renew [defendant's] contract after learning he had not disclosed his past criminal record.” Doc. 208-2 ¶ 7. SA Norris also independently verified that defendant was a registered sex offender. Id. at 7; see also doc. 194 at 39. SA Norris further testified that he was aware in December 2018 that the Jaguars received an anonymous letter regarding defendant's past conviction; at that time, he had requested a copy of the letter, but had not yet received it. Doc. 194 at 37-38. SA Norris did not receive a copy of the letter until December 3, 2020. Id. at 38 (citing doc. 208-15, govt.'s ex. 14, at 2-3).
Initially, I note that SA Norris was unaware of the contents of the anonymous letter at the time he authored the affidavit supporting the warrant in July 2019, as he did not receive a copy of the letter until December 2020. Thus, I do not find that SA Norris's failure to discuss the letter in his affidavit was the result of an intentional or reckless omission, particularly considering that he independently verified defendant's criminal history. Further, even if this information was intentionally omitted or omitted with a reckless disregard for the accuracy of the warrant, defendant failed to make any showing that it was material to the probable cause in the warrant. See Madiwale, 117 F.3d at 1327 (“Omissions that are not reckless, but are instead . . . insignificant and immaterial, will not invalidate a warrant.” (citation omitted)).
C. Jaguars' Disclosure of Reason for Defendant's Termination
Defendant next claims SA Norris omitted from his affidavit that “the Jaguars did not disclose to [defendant that] they were aware he was a registered sex offender and did not disclose to [defendant that] this was the reason his contract was not being renewed.” Doc. 132 at 11. Because of this, defendant claims “[t]he magistrate [judge] did not know [defendant] believed he was leaving on good terms with the Jaguars, and that future engagement with the organization was possible.” Id. Defendant does not explain how this would have been material to the probable cause finding. See id.
At the hearing, SA Norris testified that although Jaguars personnel relayed to him the reason for terminating defendant, he was not aware prior to authoring the affidavit “what conversations took place between [defendant] and the Jaguars regarding him not being renewed or not having his contract being renewed.” Doc. 194 at 40. Based on this, I find defendant failed to make the requisite showing that SA Norris omitted this information intentionally or with a reckless disregard for the truth; further, the information is immaterial to the establishment of probable cause in the affidavit.
D. Defendant's Last Day of Employment
Defendant claims that SA Norris falsely stated in the affidavit that his last day of employment with the Jaguars was February 23, 2018, and any access after that date would not have been authorized. Doc. 132 at 12-13. In support, defendant notes that his contract with the Jaguars actually expired about a month later, on March 31, 2018. Id. at 12 (citing doc. 208-5 at 2); see also doc. 209 at 49-53 (defendant's closing argument).
At the hearing, SA Norris testified that Jaguars personnel chose not to renew defendant's contract and notified him of this in January 2018. Doc. 194 at 29-30. The Jaguars further relayed to SA Norris that defendant's last day physically in the stadium was “on or about” February 23, 2018, but they did not give him a definite end date. Id. SA Norris acknowledged that his affidavit stated “[a]s of February 23, 2018, [defendant] was no longer employed by the [Jaguars];” however, he testified that if he were to write the affidavit again, he would say “on or about” February 23, 2018. Id. at 31-32 (citing doc. 208-2 ¶ 6). Jaguars personnel further relayed to SA Norris that defendant did not have access to the video boards after his employment was terminated. Id. at 32. Regarding defendant's contract with the Jaguars, SA Norris testified that it was effective until March 31, 2018 “unless earlier terminated.” Id. at 35 (citing doc. 208-5 at 2). During defendant's cross-examination of SA Norris, the following exchange took place:
Q [defendant]. So did the Jaguars ever provide you a document that would be evidence to support that the term -- the contract termination clause was triggered?
A [SA Norris]. No, they did not.Id. at 224-25. Defendant claims this is further evidence that SA Norris's affidavit falsified the last date of his employment. Defendant also relies on the following statement from SA Slaughter's guardian report: “[Defendant] is currently employed in some capacity with the City of Jacksonville and/or SMG [as] a contractor for computer networks for the City of Jacksonville.” Doc. 209 at 55 (citing doc. 208-3 at 3).
SA Slaughter did not testify at the hearing.
Given that SA Norris relied on information provided from Jaguars personnel about the last date of defendant's employment, I find defendant has failed to make the preliminary showing of any falsehoods, either intentionally or with reckless disregard for the truth. Further, the evidence defendant relies on is not inconsistent with SA Norris's statements in the affidavit, based on the information he had at the time. For instance, although it is true that the agreement states defendant would be contracted with the Jaguars until March 31, 2018, it also states that it could be terminated earlier; the information provided to SA Norris indicates the Jaguars terminated the relationship early upon becoming aware of defendant's criminal record. Moreover, even assuming, arguendo, that defendant's employment relationship with the Jaguars was not terminated until March 31, 2018, it is immaterial to the probable cause finding, given that the intrusions occurred in September, November, and December of 2018.
E. Defendant's Employment with the City of Jacksonville in February 2018
Defendant next claims that SA Norris omitted from the affidavit that on February 23, 2018, he “was employed by [the City of Jacksonville], preparing for the City hosted annual Monster Truck Jam stadium event.” Doc. 132 at 13. Defendant asserts that all of the activities listed in the affidavit that took place on that February 23, 2018, would have been in accordance with his normal duties preparing for a show at the stadium. Id. at 14. In support, defendant provides text messages between himself, and various members of Jaguars personnel dated between February 21, 2018, and February 24, 2018. Id.; docs. 132-8; 184 at 19-22; 208-21, defense ex. 2.
As noted above, SA Norris testified that Jaguars personnel told him defendant's last day of employment was on or about February 23, 2018, and that-as of that date- defendant no longer had access to the network at issue. Doc. 194 at 31-32. Further, defendant acknowledges the text messages he uses to support his position were obtained in a “Cellebrite forensic extraction report from [his] phone,” presumably the phone seized by agents during the execution of the search warrant; thus, defendant provides no evidence that SA Norris had knowledge of the messages at the time he authored he affidavit. Doc. 209 at 51.
Defendant again fails to make any showing that SA Norris's statements regarding his last day employment were made intentionally or with a reckless disregard for the truth. Finally, even if defendant's last day of employment was February 24, 2018 (the date of the last text message he relies on) or March 31, 2018 (the end date of his contract), the allegedly false statement is immaterial to the probable cause contained in the affidavit because, again, the network intrusions occurred in September, November, and December of 2018. See docs. 208-2 ¶ 9 (affidavit listing dates of intrusions); 208-5 at 2 (contract with end date of March 31, 2018 “unless earlier terminated”); 208-21 (text messages entered into evidence by defendant).
F. Termination of Defendant's TeamViewer Account
Defendant claims SA Norris made a false statement in the affidavit when he said that “[defendant's] TeamViewer account was not terminated when his contract was ended with the [Jaguars].” Doc. 132 at 15 (citing doc. 208-2 ¶ 8). Defendant asserts this statement is misleading because the TeamViewer account is his personal account and is thus not subject to termination by the Jaguars. Id. I find defendant makes no showing to indicate the statement at issue is false, either intentionally, or with a reckless disregard for the truth, and provides no evidence to support his assertion. Moreover, the statement regarding TeamViewer is immaterial to the overall probable cause contained in the affidavit because, even if defendant retained lawful access to his personal TeamViewer account, this does not mean he was authorized to use it to access the network at issue.
G. Jaguars' Ability to Replicate Intrusions
Defendant next takes issue with a statement in SA Norris's affidavit regarding the Jaguars' ability to replicate the intrusions, which reads as follows: “[a]t no point before or after the suspected problems being fixed were the operators or engineers for the [Jaguars] able to replicate the issue causing the incidents.” Id. (citing doc. 208-2 ¶ 9b). Defendant claims this statement is false, pointing to an email from January 2019 where Jason Dean, Senior Manager of Technology and Events with the Jaguars, explains to SA Norris the steps the organization had taken to successfully replicate the incident. Id. (citing doc. 208-7, govt.'s ex. 6, at 2-3).
At the hearing, SA Norris testified that he obtained the replication information from the Jaguars' December 3, 2018 internal investigation report and that it characterized the state of the Jaguars' internal investigation at that time. Docs. 194 at 43-44 (citing doc. 208-4, govt.'s ex. 3, at 3). Defendant fails to make the preliminary showing that SA Norris's statement regarding the Jaguars' ability to replicate the incident was made with an intentional or reckless disregard for the truth, given that SA Norris relied on information provided by the Jaguars. Further, and fatal to defendant's position, is that he fails to even articulate, much less establish, that the inclusion of this statement regarding the Jaguars' ability to replicate the intrusion had any bearing whatsoever on the overall probable cause in the warrant.
H. The TeamViewer Software
Defendant next claims SA Norris's statement that the “TeamViewer software previously had been removed from all of the devices in the network by the [Jaguars'] IT staff” was misleading because it omitted the fact that SA Norris received an email from Jaguars employee Michael Potts indicating that TeamViewer had been removed from all known devices after February 25, 2018, subsequent to when defendant allegedly installed it on February 23, 2018. Doc. 132 at 15-16 (citing doc. 208-2 ¶ 9f). In support of his argument, defendant relies on the email, dated January 2019, where Potts wrote-in response to Norris's general question about removal of TeamViewer software from the videoboard network-that “[w]e went through and removed TeamViewer from all known systems after February 25th. I can't find an exact date at the moment.” Id. (citing doc. 132-9 at 3).
Initially, the statement in SA Norris's affidavit that defendant takes issue with is not inconsistent with the information in the email exchange. First, in Potts's email, which defendant did not question SA Norris about at the evidentiary hearing, Potts writes about the software being removed from “systems” and not “devices,” so it is unclear exactly what was being removed. Doc. 132-9 at 3. Second, SA Norris did not indicate in his affidavit any specific date that TeamViewer was removed from the MIRA9120. See doc. 208-2 at 10. Next, SA Norris testified at the hearing that the Jaguars re-engaged TeamViewer's logging capabilities for an event in December 2018, establishing that TeamViewer was, in fact, installed on the MIRA9120 subsequent to February 2018. Doc. 194 at 52-53.
And perhaps most compellingly, there was other evidence presented at that hearing regarding the Jaguars' use of TeamViewer on the MIRA9120 and how the organization used it to gain information about the origin of the intrusions. See id.; see also id. at 216-17 (SA Norris testified that, on February 23, 2018, the “Sam7” account, which belonged to defendant, was logged into the MIRA9120 around the time that the logging feature on TeamViewer was disabled). Although SA Norris testified about the TeamViewer logging function being used to assist the Jaguars in identifying the person causing the unauthorized intrusions, there is no testimony-beyond the discussion mentioned above-that further contextualizes Potts's email in any significant way. Thus, I do not find SA Norris's statement in the affidavit inconsistent with information in the email. And even if the information from Potts' email was included in the affidavit, it would not have impacted the probable cause determination given the other information linking defendant to the unauthorized intrusions. See Kapordelis, 569 F.3d at 1309.
I. Denial of Service Attack
Defendant also takes issue with SA Norris' characterization of the intrusions as “denial-of-service” attacks, arguing that “[i]n no conceivable way could this be construed as a denial-of-service attack.” Doc. 132 at 16-17 (citing doc. 208-2 ¶ 9b). Although somewhat unclear, it appears defendant believes the intrusions should have been characterized in some other way. See id. Defendant does not explain why the specific characterization of the intrusion is material to the probable cause determination. See id.; docs. 154, 209 at 68-71. As discussed in detail below, I find the facts articulated in SA Norris's affidavit sufficiently establish probable cause that a violation of 18 U.S.C. § 1030 occurred, regardless of the specific terms used to label the intrusion. The fact that defendant would characterize the intrusions using different terminology has no bearing on the probable cause contained in the affidavit.
J. The MIRA9120 Server
Last, defendant claims SA Norris falsely stated in the affidavit that:
Unbeknownst to the [Jaguars], the rogue device had been moved to a server rack adjacent to the server rack housing the active Abekas Mira servers in the facility's video board
server room (referred to as the “Rack Room”). In its decommissioned state, MIRA9120 had no connections to any video system and only had a power cable and network cable connected to it.Doc. 132 at 17 (citing doc. 208-2 ¶ 9d). In support, defendant claims that the MIRA9120 is a backup Abekas Mira server, which does not have any connections with the video systems because it would replace one of the six active Abekas Mira servers in the event of a failure. Id. Defendant provides no evidence or documentation to support his assertion and no argument regarding how this would have been material to the probable cause finding. See id.
At the hearing, SA Norris testified that Jaguars personnel reported to him that a rogue device (the MIRA9120) had been moved to a server rack adjacent to the rack holding the active server. Doc. 194 at 44. That information was further supported by SA Norris's personal viewing of the server room in December 2018. Id. at 44-48. Although defendant may characterize the MIRA9120 server in a different way, he fails to make a substantial preliminary showing that SA Norris made a false statement or with acted with a reckless disregard for the truth. Moreover, I find defendant's different characterization of the server at issue is immaterial to the probable cause contained in the affidavit.
In sum, I find that, even after having the opportunity to question SA Norris about the statements at issue, and testifying on his own behalf about the positioning of the MIRA9120, defendant fails to make the requisite preliminary showing that SA Norris made any intentional or reckless misrepresentations or omissions in his warrant, given that he reasonably relied on the information available to him at the time, and given to him directly by the Jaguars, as well as his own observations from the investigation. See United States v. Whyte, 928 F.3d 1317, 1333 (11th Cir. 2019) (“Omissions made negligently or because of an innocent mistake are insufficient to warrant suppression of the evidence.” (citation omitted)). Moreover, even assuming defendant made the necessary showing to establish the first prong of Franks, he is still not entitled to a full evidentiary hearing because the alleged misrepresentations and omissions he takes issue with are not material to the probable cause finding. Kapordelis, 569 F.3d at 1309. Stated differently, even if all of the arguments that defendant makes are true and each of the ten statements above were omitted entirely from the affidavit, or if the affidavit was supplemented with the additional information defendant relies on, probable cause would still exist for issuance of the search warrant.
2. Arguments Related to the Warrant and its Execution
Separate and apart from the Franks issue, defendant makes several arguments regarding the validity of the warrant and its execution. I address each below.
A. Overbreadth and Particularity
Defendant claims that the warrant “lacked particularity and was overbroad because it failed to sufficiently specify and limit the evidence sought.” Doc. 132 at 19. Defendant argues that although there were only three brief intrusions into the Jaguars' network in September, November, and December of 2018, the warrant allowed for “the unrestricted seizure of all forms of electronic systems and data without regard to the type of information sought and without any limitation on the timeframe relevant to the charge under investigation.” Id. Thus, I construe defendant's argument as asserting the warrant should have been limited to devices capable of using the TeamViewer software and evidence related to the specific dates at issue. See id.; doc. 209 at 67-68 (defendant's closing argument).
The warrant authorized a search of defendant's residence, and the search and seizure of “computers and electronic storage media” in the home, as well as other items outlined in Attachment B. Doc. 208-2 at 30-34. At the hearing, SA Norris testified that TeamViewer log files “is a simple text file that could be put on any number of” the devices listed in the definition of “computer hardware” outlined in the warrant. Doc. 194 at 171-73 (citing doc. 208-2 ¶ 17e). Although defendant makes only general arguments in his motion, doc. 132, he asked SA Norris about some specific items that law enforcement was authorized to search and seize, including keyboards and video display monitors. Doc. 194 at 174. In response, SA Norris testified that computer keyboards and video display monitors could reveal DNA evidence regarding who used related computers. Id. at 174-75. Defendant then asked SA Norris about the potential evidentiary value of “routers, modems, and network equipment used to connect computers to the Internet” listed in Attachment B. Id. at 180 (referencing doc. 208-2 at 31). In response, SA Norris stated the following:
routers sometimes have MAC addresses associated with them from devices that are used to connect. So in this case, since the IP address that was found in the . . . Comcast subpoena was from [defendant's] home address, therefore, any devices - - if we needed to actually take that connection a step further and prove what devices were actually
connected to [defendant's] router, we would have that information.Id.
SA Norris further explained that it would be “logical to say that if there was a computer in [defendant's] house connected to the modem that we found a TeamViewer log on, that that computer therefore connected to TeamViewer through that router, that modem.” Id. at 181. Defendant asked about the inclusion of “evidence of software that would allow others to control [a computer or storage medium whose seizure is otherwise authorized by the warrant], such as viruses, Trojan horses, and other forms of malicious software” in the warrant. Id. at 183 (referencing doc. 208-2 at 31-32). SA Noris responded that those items may be relevant as software that may have been used on the MIRA9120 device that the FBI was not initially aware of. Id.
Regarding particularity, the Fourth Amendment requires that a search warrant must “particularly describ[e] the place to be searched, and the person or things to be seized.” U.S. Const. amend. IV. “A warrant is sufficient where it describes ‘the place to be searched with sufficient particularity to direct the searcher, to confine his examination to the place described, and to advise those being searched of his authority.'” United States v. Aguirre, 368 Fed.Appx. 979, 987 (11th Cir. 2010) (per curiam) (quoting United States v. Burke, 784 F.2d 1090, 1092 (11th Cir. 1986)). “The particularity requirement allows a practical margin of flexibility, depending on the type of property to be seized, and ‘a description of property will be acceptable if it is as specific as the circumstances and nature of activity under investigation permit.'” Id. at 987-88 (quoting United States v. Wuagneux, 683 F.2d 1343, 1349 (11th Cir. 1982)).
Initially, I find SA Norris's affidavit provides probable cause to establish that a device within defendant's residence was used to conduct the intrusions at issue. See doc. 208-2. Attachment A specifies that defendant's residence was to be searched, and Attachment B provides that any “computers and electronic storage media” may be seized and searched for specific pieces of evidence or information which relate to the activity under investigation. Id. at 31-33.
Upon review, I find the items listed in Attachment B are sufficiently particular and relevant to the facts as outlined in the affidavit. The only items defendant challenges with any specificity are explained through SA Norris's testimony outlined above. The warrant is sufficiently particular in that it clearly states what is sought and is sufficiently limited by the probable cause on which the warrant is based. See Wuagneux, 683 F.2d at 1348 (“A description is sufficiently particular when it enables the searcher to reasonably ascertain and identify the things authorized to be seized.”); see also United States v. Conrad, no. 3:12-cr-134-J-34TEM, 2013 WL 4028273, at *8 (M.D. Fla. Aug. 7, 2013) (“Federal courts applying a reasonableness analysis on a case-by-case basis ‘have rejected most particularity challenges to warrants authorizing the seizure and search of entire personal or business computers' . . . . in recognition of the unique challenges posed by computer searches.” (quoting United States v. Richards, 659 F.3d 527, 539 (6th Cir. 2011))).
And because the information contained in the computers and electronic storage media that law enforcement was authorized to search and seize is sufficiently limited to evidence that is relevant to the probable cause underlying the warrant, the absence of a specific limitation regarding timeframe does not render it invalid. See United States v. Brooks, no. 3:13-cr-58-J-34JRK, 2014 WL 292194, at *12 (M.D. Fla. Jan. 27, 2014) (finding the search warrant at issue did not lack particularity with regard to the computer-related items because it “limited the search to computer equipment, digital storage devices, and accessories that could contain contraband and evidence linked to the child pornography offenses specified in the warrant.” (citation omitted)).
B. Scope of the Warrant
Defendant complains that an agent “took [his] unlocked cell phone from his hand while he was talking to his wife,” and argues that a search warrant does not “give police permission to search persons present at the site of the search,” and that the search performed exceeded the scope of the warrant. Doc. 132 at 19-20.
It is undisputed that defendant's cell phone was a “computer [or] electronic storage media” that was authorized to be seized under the warrant. See id. at 19-20; doc. 208-2 at 31. Nor does defendant challenge the assertion that the phone was in plain view in his residence. Rather, he appears to argue the phone was seized during a search of his person, as opposed to the residence, and was thus impermissible. See doc. 132 at 20. The testimony presented at the hearing, however, was that the phone, which was in plain view at the time, was seized from defendant's hand while he was making a call; defendant offers no facts to establish that his person was searched or that he was patted down during the execution of the warrant to locate the phone. Doc. 194 at 76. Thus, there are no facts to indicate the phone was seized as a result of a search of defendant's person.
Although defendant testified he was initially patted down to “mak[e] sure that I didn't have anything on me,” this is not what ultimately led to the seizure of the phone. Doc. 184 at 15. Rather, defendant testified the phone was taken after that the pat-down, while he was talking to his wife. Id. at 16.
In support of his argument, defendant relies upon Ybarra v. Illinois, 444 U.S. 85 (1979). In Ybarra, the Supreme Court held that the search of a customer who was in a bar during a search pursuant to a warrant was unlawful because “a person's mere propinquity to others independently suspected of criminal activity does not, without more, give rise to probable cause to search that person.” Id. at 91. Here, in contrast, no search of defendant's person occurred as it relates to the phone. Rather, the device was authorized to be seized pursuant to the warrant and was visible in his hand at the time of the warrant's execution. Defendant provides no authority to invalidate the warrant on the facts presented here.
C. Execution of the Warrant
Defendant next asserts that the execution of the warrant was constitutionally impermissible. First, he argues that agents failed to comply with the “knock and announce” rule. Doc. 132 at 20. At the hearing, SA Norris, who was present during the execution of the warrant, testified that SA Slaughter “knocked on the door and announced our presence” prior to entering the residence. Doc. 194 at 71-72. More specifically, he testified that SA Slaughter raised his voice and announced “FBI.
Search warrant.” Id. at 72. After that, SA Norris testified that defendant's son answered the door; the agents entered and saw defendant. Id. First, I find the testimony of SA Norris credible with regard to the entry procedure that was used. Even taking defendant's assertion as true, however, defendant provides no authority to support that a failure to knock and announce requires suppression. Doc. 132 at 20. See Hudson v. Michigan, 547 U.S. 586, 594 (2006) (suppression of evidence not required when police officers violate “knock and announce” rule.).
Defendant next argues the warrant is invalid because agents refused to show the warrant to him and instead demanded that he call his wife to have their minor son removed from the home during its execution. Doc. 132 at 20. Again, defendant provides no authority for the assertion that any resulting evidence should be suppressed on this basis. See id. While it is understandable that defendant was distressed with the FBI entering his home to execute a search warrant, particularly in the presence of his child, this feeling is not a basis for suppression.
Regarding this issue, SA Norris testified that, upon entering the home, the FBI's priority was to secure the residence, and the people in the home, to account for the safety of all persons and to prevent the destruction of evidence. Doc. 194 at 72-73. SA Norris testified that defendant requested a copy of the warrant “sometime in the beginning of . . . the search” as they were waiting for defendant's wife to pick up their son. Id. at 73-74. SA Norris delayed telling defendant why they were at his home initially “to secure everyone in the residence” and to ensure defendant's son would not be present during the search. Id. at 74. After defendant's wife picked up their child, defendant was provided a copy of the search warrant, along with Attachments A and B, at some point prior to the FBI leaving defendant's home that day. Id. at 76. The government entered a photo into evidence of the search warrant left on defendant's table, doc. 208-13, govt.'s ex. 12; SA Norris acknowledged on cross-examination that the photo does not conclusively show whether Attachments A and B were provided to defendant. Doc. 194 at 207.
SA Norris indicated that the search warrant, but not the affidavit, were provided to defendant. Doc. 194 at 75. According to SA Norris, as it is not the FBI's policy to provide a search warrant affidavit during an ongoing investigation. Id.
Initially, I find SA Norris's testimony on these issues to be credible. But even taking defendant's assertions as true, he provides no authority to establish the warrant should be invalidated because the FBI requested his minor son be removed prior to the search, or because he was not provided a copy of the warrant prior to the search. See United States v. Grubbs, 547 U.S. 90, 98-99 (2006) (neither the Fourth Amendment nor Federal Rule of Criminal Procedure 41 requires that an executing officer must present a property owner with a copy of a warrant before conducting a search). Moreover, even assuming, arguendo, that defendant was only provided a copy of the warrant, without the attachments, he provides no authority to suppress the resulting evidence on that basis alone.
Defendant also claims he should not have been excluded from his home while the search occurred, but again, provides no authority for suppression of evidence on that basis. Doc. 132 at 21. In considering his argument, I find it was reasonable for defendant to be excluded during the search for the reasons given by SA Norris, and that suppression is not warranted. See United States v. Correa, 347 Fed.Appx. 541, 545 (11th Cir. 2009) (per curiam) (“Because the occupants were aware of the investigation, the agents were entitled to secure the houses to prevent the destruction of evidence.” (citing United States v. Young, 909 F.2d 442, 446 (11th Cir. 1990)).
D. The Warrant Contained Sufficient Probable Cause
Defendant claims the warrant failed to demonstrate probable cause for a violation of 18 U.S.C. §§ 1030(a)(2)(C) or 1030(a)(5)(C). Doc. 132 at 5-8. Specifically, defendant asserts the warrant 1) did not establish probable cause that any information was obtained from a protected computer, as required by § 1030(a)(2)(C); and 2) did not establish that any “damage and loss” was caused, as required by § 1030(a)(5)(C). Defendant's arguments are without merit.
Defendant argues generally that the facts alleged in the affidavit do not establish that he “obtain[ed] information” from a protected computer, as required by section 1030(a)(2)(C). Doc. 132 at 8; see also doc. 208-2 at 5. But he is incorrect; “obtains information” includes the mere viewing of data. See Eleventh Circuit Pattern Jury Instruction O42.2 Annotations and Comments (“The Senate Judiciary Committee emphasized that ‘obtains information' in this context includes mere observation of the data.”). Thus, I find the warrant sufficiently outlines probable cause for a violation of section 1030(a)(2)(C), because defendant is alleged to have accessed a protected computer and viewed information from it on multiple occasions. See doc. 208-2 (warrant affidavit).
Regarding section 1030(a)(5)(C), defendant claims there are no facts to indicate that any damage and/or loss occurred because of the intrusions. Doc. 132 at 8; see also doc. 208-2 at 5. However, section 1030 defines “damage” as “any impairment to the integrity or availability of data, a program, a system, or information” and “loss” as “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.” 18 U.S.C. § 1030(e)(8),(11). In his affidavit, SA Norris states that the Jaguars' video boards “experienced an outage from their standard operating design” on three occasions and that, as a result, had to conduct an internal investigation into the incident. Doc. 208-2 ¶ 9a. Thus, under the proper definitions, the warrant sufficiently outlined probable cause for a violation of section 1030(a)(5)(C).
For the reasons outlined above, I find: 1) that defendant failed to make the substantial preliminary showing required for a full Franks hearing; and 2) that his motion to suppress should be denied.
The Court's analysis is limited to a finding of probable cause for purposes of the warrant and its execution. Nothing in this Order prevents defendant from raising these issues at trial.
Conclusion
For these reasons, I respectfully recommend that Defendant's Motion to Suppress and Request for a Franks Hearing, doc. 132, be denied.
Notice to the Parties
The party has fourteen days from the date the party is served a copy of this report to file written objections to this report's proposed findings and recommendations or to seek an extension of the fourteen-day deadline to file written objections. 28 U.S.C. § 636(b)(1)(C). A party's failure to serve and file written objections waives that party's right to challenge on appeal any unobjected-to factual finding or legal conclusion the district judge adopts from the Report and Recommendation. See 11th Cir. R. 3-1; 28 U.S.C. § 636(b)(1).
Honorable Brian J. Davis, United States District Judge.